Citrix Access Suite 4 for Windows Server 2003: The Official Guide, Third Edition

As the designated replacement for the legacy SG/WI solution, the Citrix Access Gateway (CAG) is a quantum leap in secure access center technology, combining the benefits of an SSL proxy for Citrix ICA traffic with universal SSL VPN technology to provide secure access to Citrix services, internal Web resources, and a "desktop-like" user experience similar to a traditional IPSEC VPN connection, but without the configuration and deployment headaches .

Benefits and Capabilities

Features offered by the Citrix Access Gateway include

• – Secure Gateway Replacement Citrix Access Gateway replaces Secure Gateway to provide secure access to resources through Advanced Access Control. The pending CAG release (Access Gateway Enterprise, hosted on the same hardware platform as the NetScaler) adds increased scalability and performance for the most demanding and complex enterprise environments, will be certified to meet the highest government and commercial security standards such as FIPS-140 and ICSA, and offers optional integrated disaster recovery.

• – SmartAccess for Web Interface Support for SmartAccess capabilities when accessing published applications through Web Interface. Advanced Access Control policy information is now accessible to Citrix Presentation Server when accessing published applications through a Presentation Server site.

• – Enhanced authentication support In addition to RSA SecurID, Secure Computing SafeWord, and RADIUS, Advanced Access Control now supports LDAP (such as Active Directory or Novell eDirectory) authentication. You can require users to provide both Active Directory credentials and RADIUS, RSA, or Safe-Word authentication.

• – Entire network access The new predefined Entire Network resource in policies to give your users access to all servers on the network.

• – Centralized logging and trend reporting Provides sophisticated usage data for troubleshooting and planning.

• – Built-in Web server load balancing Previous versions of Advanced Access Control included load balancing for the agent server and HTML Preview components . This release includes built-in load balancing for the Web Server component as well.

• – Multiple logon points hosted on a single Access Gateway Multiple logon points are available on a single gateway appliance, with different users authenticating through different logon points.

• – Extended Citrix license server support When Access Gateway is configured with Advanced Access Control, licenses for both components are maintained by the license server. In this scenario, Access Gateway relies on Advanced Access Control to acquire a license and validate the session.

• – Client software consolidation and improved user experience The Secure Access Client replaces the Gateway Client and Advanced Gateway Client. In addition, the Secure Access Client is downloaded on an as-needed basis to improve the end user's overall experience.

• – Simplified access to Citrix Presentation Server published applications Citrix Presentation Server published applications are accessible as a Presentation Server site from within the Advanced Access Control's navigation page, allowing users to quickly access and launch published applications.

• – Built-in Continuous Endpoint Analysis Scans The basic CAG (without AAC) provides continuous endpoint scanning.

• – Registry A registry entry that matches the path , entry type, and value that you specify.

• – File A file that matches the path, filename, and date that you specify. You can also specify a checksum for the file.

• – Process A running process that you specify. You can also specify a checksum for the file.

• – Advanced Endpoint Analysis Scans (with AAC) AAC supports scanning for the properties listed in Table 16-1. CME selected AAC primarily because of the need for granular control of access based on affiliation , role, and security parameters.

Topologies

As with most solutions, there are a variety of deployment topologies for the Citrix Access Gateway. Common scenarios are depicted in Figure 16-1. Each of these scenarios has specific pro and con aspects with respect to complexity and capabilities.

• – The parallel installation provides an access methodology insulated from firewall failures and simplifies "rules" for network address translation and data transport, particularly with regard to hybrid VPN connectivity and URL-rewrite through the CAG. Conversely, it requires a more complex routing structure in the external LAN segment, and exempts traffic from filtering or IPS/IDS processing by the firewall.

• – The external filtered configuration retains most of the benefits of the Parallel Installation and reduces the complexity of external routing structuresthe CAG is "just another DMZ SSL host". On the down side, the CAG is dependent upon the firewall for access to the Internet and external users.

• – The internal filtered configuration restores the ability of the firewall to inspect and filter traffic destined to CME's internal LAN, but it is again firewall-dependent as well as requiring the same external routing changes as the Parallel install. The "price" for internal filtering is significant complexity with regard to mapping both Citrix and SSL VPN traffic correctly to the internal hosts using the CAG to securely access a file share on an internal host may require large ranges of ports open through the firewall.

• – The "One-Armed" implementation simplifies installation and addressing and allows all traffic to/from the CAG to be inspected by the firewall, but it inherits every dependency and complexity of all other implementations except the external routing changes.

Figure 16-1: Citrix Access Gateway deployment scenarios