Citrix NetScaler Introduction

Transcription

1 Page: 1 Citrix NetScaler Introduction Table of Contents Introduction 4 Who is this guide for? 4 Prerequisites 4 Prepare your Environment 5 Download the NetScaler Firmware 90 day Evaluation citrix.com/products 5 Download the NetScaler Firmware mycitrix.com 8 Deploy the OVA File to Hypervisor - VMWare ESXi 6 11 Initial NetScaler Setup - NSIP 16 Download the NetScaler Trial License 21 Install the NetScaler Trial License 23 Basic Authentication 25 Creating an LDAP Authentication Policy - Administrators 25 NetScaler SSH Command References: 28 Binding an LDAP Authentication Policy - Administrators 29 Granting AD Group Permissions to the NetScaler 31 Creating an LDAP Authentication Policy NetScaler Users 34 NetScaler SSH Command References: 37 Certificates 38 Creating a Private RSA 38 Creating a CSR Request 40 Submitting the CSR to a 3rd party CA - Comodo Free SSL 43 Upload the CA CRT file and Install the Certificate on the NetScaler 48 Intermediary Certificate Linking 50 XenApp & XenDesktop 7.14 Installation 54 Prerequisites 54 Install XA/XD Software 54 Create the XA/XD Site 62 Install the XA/XD VDA (Virtual Delivery Agent) 66 Create a Machine Catalog 72 Test the Citrix Desktop Launch 80 StoreFront Configuration 82 Prerequisites 82

2 Page: 2 Modify the Default Store 82 Create a New StoreFront Store - Stand Alone 87 NetScaler Gateway - ICA Proxy 99 Overview Diagram 99 Prerequisites 100 Configure the NetScaler Gateway for XA/XD - Wizard 100 NetScaler Unified Gateway 106 Prerequisites 106 Create the NetScaler Unified Gateway Wizard 106 NetScaler Gateway - SSL VPN 113 Create a Basic NetScaler Gateway for SSL VPN 113 Prerequisites 113 Install the NS Gateway Plugin - Windows 119 Prerequisites 119 Create a NetScaler Gateway Preauthentication Policy 123 Configure NetScaler Gateway with Split Tunnelling 130 Create Authorisation Policies for NS Gateway 134 Setup NetScaler Gateway VPN to use a LDAP Authentication Policy 138 Configure NetScaler Gateway with SAML for ICA Proxy (Federated Authentication) 143 Prerequisites 143 Create NetScaler SAML Policy to 3rd Party idp (Google) 143 Install The Citrix Federated Authentication Service (CFAS) 159 Configure StoreFront to Delegate Authentication to NetScaler 170 Configure NetScaler High Availability 172 Prerequisites 172 Deploy Secondary NetScaler 173 Setup High Availability NetScaler HA Failover NetScaler 1 to NetScaler NetScaler Load Balancing 182 Prerequisites 182 Enable the Load Balancing Feature 182 Setup Basic HTTP Load Balancing, Service Groups and Monitors 183 NetScaler Support 192 Backup NetScaler Configuration 192 Firmware Upgrade of the NetScaler HA Pair 195 Clear the NetScaler Configuration 198

3 Page: 3 Disclaimer This guide is offered as a companion to the online video training series from or free directly from the website. This guide can also be used as a stand alone guide. Please note that this guide is provided without warranty of any kind, express or implied, and was designed to be used in a test lab for educational purposes only. Use this guide at your own risk. You should always have multiple backups of your environment, configuration and infrastructure before doing any changes to your environment. Never make untested or unsolicited changes to any production environment. Accuracy of the material contained within this document is very important to us. Every effort has been made to ensure the accuracy of this document at the time of writing however should you notice any discrepancies or incorrect information please notify us immediately at training+netscaler@mastersof.cloud so we can review and update where necessary.

4 Page: 4 Introduction Welcome to the Citrix NetScaler - Introduction guide. The purpose of this guide is to provide you with the basics you need to deploy and configure a NetScaler device either in a lab or in an enterprise environment. This document is designed to accompany the online courses now available at and also available at We hope you find this course informative and easy to follow. Please do feel free to ask questions or provide any feedback on the training website at or training+netscaler@mastersof.cloud Note : This guide uses many example screenshots, IP addresses and DNS settings that are specific to the demo environment being used at the time. You will need to use your own settings in place of the examples provided to ensure a working setup. If you are not sure of the configuration options you should consult with your AD, Network, Virtualisation and Cloud teams first for the correct details that are specific to your environment. Who is this guide for? Chances are if you have come this far you already knew what you were looking for! The guide is a quick start to get you up and running with Citrix NetScaler. Prerequisites 1) A basic level of understanding of network principles, TCP-IP, DNS, Firewalls and Network routing 2) Familiarity with connecting to devices via SSH or Putty 3) Familiarity with all Citrix products in general 4) Competency with the latest versions of Microsoft Windows operating systems This document also serves as a complimentary printed walk through for the Citrix NetScaler Introduction online training at and also available at

5 Page: 5 Prepare your Environment Download the NetScaler Firmware 90 day Evaluation citrix.com/products In this walkthrough we going to connect to citrix.com and download a 90 day evaluation of the Citrix Application Delivery Controller (aka ADC) Step Description Screenshot 1. Connect to om/products/ 2. Scroll down and select Networking > NetScaler > NetScaler ADC

6 Page: 6 3. Click Try For Free 4. Enter your registration details (username and password) for your trial license

7 Page: 7 5. A code will be generated automatically 6. Expand Step 1 Review system requirements and download software Select the download most appropriate to you and your hypervisor

8 Page: 8 Download the NetScaler Firmware mycitrix.com For customers who already use Citrix and have a mycitrix.com account we can also simply obtain the NetScaler firmware from this site (provided you have a mycitrix.com account associated with your Enterprise licenses). Step Description Screenshot 1. Connect to x.com 2. Click Downloads Select NetScaler ADC as the product

9 Page: 9 3. Select the latest release Virtual Appliance (VPX) available to you Note : At the time of writing the latest is Select VPX Package for New Installation Select the right package for your hypervisor Note : In the example we are downloading the NetScaler VPX Software for VMWare ESX

10 Page: Read the End-User license agreement carefully 6. If you choose to accept the EULA, tick I have read and click Accept You should read the download agreement Be sure you and your country comply with the Export Control laws Finally save the file somewhere easily accessible later

11 Page: 11 Deploy the OVA File to Hypervisor - VMWare ESXi 6 In this section we are going to deploy the newly downloaded NetScaler firmware onto our hypervisor (VMWare). Step Description Screenshot 1. Connect and authenticate to your VMWare ESX web console 2. Click Virtual Machines Click Create / Register VM Note : In this example we are connecting to VMWare ESXi 6.0 with a private IP of The default URL is

12 Page: Select Deploy a virtual machine from an OVF or OVA File Click the section labelled Click to select files or drag/drop 4. Select both the OVF and the VMDK files from the firmware file downloaded from citrix, then click Next

13 Page: Select an appropriate storage location for your hypervisor to deploy the NetScaler VM 6. Choose the network mappings and disk provisioning best for you Note : Disk provisioning is set to thin in this example only to save on local hypervisor disk space. 7. Click Finish on summary page

14 Page: Click on the VM in the VMWare list 9. Authenticate to the VMWare console prompt with your VMware username and password 10. Click on the Console button to get access to the VM console

15 Page: Success! The NetScaler has booted and is operational

16 Page: 16 Initial NetScaler Setup - NSIP Step Description Screenshot 1. Click on the Console button to get access to the VM console 2. Your NetScaler should be finished initializing and prompting for an IPv4 Address as part of the first run wizard Provide an appropriate free IP address, subnet and default gateway from your local network Once the details are entered type 4 to save and quit and press enter to execute The NetScaler will perform a quick, warm reboot Note : In this guide we will use the following details for the NSIP IP address: Subnet Mask: (also known as /24) Default Gateway (internet router): However you should use an appropriate IP address, netmask and gateway for your network and specific configuration. If you are unsure consult with your network administration team.

17 Page: After reboot it will return to the login: prompt Enter nsroot as the username Enter nsroot as the password These are the default NetScaler username and password 4. Once successfully authenticated type show ip and press return Note : This command will show you all IP addresses registered on the active NetScaler Tip: the NetScaler recognises short versions of the same command (provided it s unique) for example the command sh ip will also work

18 Page: Type shell and press return Type ifconfig and press return Note : you can use the shell to perform more traditional BSD based Linux commands like ifconfig, route, ping, traceroute 6. Open your internet browser and point to the newly added NSIP of your NetScaler Enter nsroot as the username Enter nsroot as the password 7. Click enable or skip on the Citrix User Experience Improvement Program window

19 Page: Welcome to the first time setup config page of the NetScaler GUI Note : This page shows you that you have already set a NetScaler IP address (NSIP) which can be used for management of the NetScaler device, however you still need to set your DNS, Time Zone, Hostname, SNIP and to add licenses 9. Click on the Subnet IP Address section of the NetScaler GUI 10. Enter a Subnet IP as appropriate for your environment Then click Done Note : In this guide we will use the following details for the SNIP IP address: Subnet mask: (also known as /24) Default gateway (internet router): However you should use an appropriate IP address, netmask and gateway for your network and specific configuration. If you are unsure consult with your network administration team Note : A NetScaler will use its NSIP as a management IP address. It will utilise the Subnet IP address (SNIP) to communicate with back end servers etc on that specific assigned subnet

20 Page: Click Host Name, DNS IP Address and Time Zone section of the NetScaler GUI 12. Enter the following details as appropriate for your configuration Hostname DNS IP Address Time Zone Then click Done Note : In this guide we will use the following details for the Hostname, DNS and TimeZone Hostname: ns1 DNS IP Address: & (the IP addresses of my singular Active Directory LDAP servers) Time Zone: GMT+ 00:00-GMT-Europe/London However you should use an appropriate IP address, netmask and gateway for your network and specific configuration. If you are unsure consult with your network administration team 13. Click Yes 14. The Initial Configuration of the NetScaler is complete

21 Page: 21 Download the NetScaler Trial License Only start this section once you have deployed your NetScaler on your chosen hypervisor platform. Step Description Screenshot 1. Expand Step 2, click on License Management System to register your temporary license key 2. Sign in with the details you registered your trial license with Tick the Citrix Store NetScaler VPX license key Click Continue 3. Deploy your NetScaler and obtain its Host ID (MAC Address) Log into the NetScaler console (user: nsroot, pass: nsroot ) Type shell then press enter Type lmutil lmhostid ether then press enter

22 Page: Take the Host ID and enter that into the Citrix licensing console Click continue 5. Click confirm 6. Click OK to download the license file(s) 7. Save the file for later use in these Labs

23 Page: 23 Install the NetScaler Trial License Only start this section once you have deployed your NetScaler on your chosen hypervisor platform. Step Description Screenshot 1. When you access your NetScaler, and if you haven t yet set a SNIP or a license you may be presented with the first run wizard You can click the Licenses section to upload your license file Go to step 3 below 2. You can also access this from the NetScaler > System > Licenses menu and click Add New License 3. Select the option to Upload license files Click Browse

24 Page: Browse for the NetScaler license file you downloaded previously to select for upload Restart your NetScaler

25 Page: 25 Basic Authentication Creating an LDAP Authentication Policy - Administrators In this walkthrough we will create an LDAP policy for administrators of the NetScaler and point this new policy to our singular, private, internal Microsoft AD LDAP server. This will involve creating a server to bind to (i.e. telling the NetScaler what server to communicate with for LDAP services) and we will create a policy that will be bound to this newly created server record. Finally the policy and its associated server profile must be bound to the NetScaler so it knows where and when to use this LDAP policy. We will bind this policy globally to the NetScaler which means all users in the policy will be able to administer the NetScaler device. Step Description Screenshot 1. Log into your NetScaler Expand System > Authentication > LDAP And click the Add button

26 Page: Give the policy a Name e.g. AUTHPOL_LDAP_Administrators Set the Expression as ns_true Click the + to add a new LDAP Server to authenticate against Tip : If you keep the naming of the policies, servers and profile creations consistent it is much easier to find them when you have many multiple policies created on the NetScaler 3. Give the LDAP server profile a Name. I usually give it the imaginative name of something like: AUTHSERVER_LDAP Fill out the essential information for this server profile Note : In this guide we are using the following recommended minimum examples: IP Address / or Name: Base DN: CN=Users,DC=Home,DC=Local Admin Bind DN: admin@home.local (domain administrator account) Admin Password: <password> Search Filter: memberof= CN=Domain Admins,CN=Users,DC=home,DC=local Server Logon Name Attribute: samaccountname Group Attribute: memberof Sub Attribute Name: cn Tip: be sure to click the test connection button once you have finished the setup of this LDAP server profile to ensure it connects to your LDAP server successfully Note : You should use appropriate LDAP details. If you are unsure consult with your AD/LDAP/Authentication team.

27 Page: Tip : You can connect to a Domain Controller or any Windows machine with the RSAT tools installed to establish your base DN and admin bind DN by querying the accounts using dsquery user and dsquery group Examples : If I want the NetScaler to search the Users OU in AD I could query a user name in that OU to get their Base DN If you need to obtain the Group details for the Search Filter 5. Click Test Connection and ensure your LDAP server is reachable Note : the Admin Password is not copied when you duplicate these settings at a later stage so always be sure to re-enter them when creating additional AUTHSERVERS 6. Click Create at the bottom of the Create Authentication LDAP Server

28 Page: Click Create on the Create Authentication LDAP Policy Window 8. Save the NetScaler Configuration Click YES to the Are you sure message NetScaler SSH Command References : Create LDAP Server add authentication ldapaction AUTHSERVER_LDAP -serverip ldapbase "CN=Users,DC=Home,DC=Local" -ldapbinddn admin@home.local -ldapbinddnpassword encrypted -encryptmethod ENCMTHD_3 -ldaploginname samaccountname -groupattrname memberof -subattributename cn Create LDAP Policy add authentication ldappolicy AUTHPOL_LDAP_Administrators ns_true AUTHSERVER_LDAP

29 Page: 29 Binding an LDAP Authentication Policy - Administrators In this walkthrough we will create a LDAP policy for administrators of the NetScaler and bind it globally to the NetScaler Step Description Screenshot 1. Log into your NetScaler Expand System > Authentication > LDAP Tick the newly created policy and click Global Bindings 2. Click the > button to choose your newly created LDAP policy Then click Select Click Bind on the System Global Authentication LDAP Policy Binding Window Click Done

30 Page: Note : The LDAP Policy will have a green tick in the Globally Bound column, which means all members of the LDAP group you added in the Search Field of the server policy will now be able to authenticate against the NetScaler as NetScaler system users

31 Page: 31 Granting AD Group Permissions to the NetScaler In the previous step we created an LDAP policy and bound it globally to the NetScaler so that all users who are members of the Active Directory group Domain Admins would be able to authenticate against the NetScaler and access the WebGUI. However these users will not have permission on the NetScaler itself to perform any administrative tasks, so we must link the AD group to appropriate permissions on the NetScaler. Step Description Screenshot Example of error message when logging in as user Not authorized to execute this command [show ns license] [show ns feature] Note : a user name of just admin would also work Here you can see that the user is able to authenticate, but not perform any tasks on the NetScaler. 1. Log into the NetScaler as nsroot Browse to > System > User Administration > Groups Click the add button 2. Type in Group Name: Domain Admins Note : The NetScaler group name must match the LDAP group name and is Case SeNsiTiVE

32 Page: Under Command Policies Click Bind Tick Sysadmin Click Insert

33 Page: Click Create 5. Users who are members of Domain Admins group in Active Directory will now have the sysadmin role on the NetScaler 6. A list of other roles on the NetScaler and what can be assigned are listed here on the Citrix Website 10-con/ns-ag-aa-intro-wrapper-con/ns-ag-aa-config-users-andgrps-tsk.html

34 Page: 34 Creating an LDAP Authentication Policy NetScaler Users In this walkthrough we will create an LDAP policy for basic users of the NetScaler to authenticate against things like a new Virtual NetScaler Gateway. This profile however will be identical to the previous administrators policy, only we will be looking for another AD group. Instead of Domain Admins we will look for users who are members of the LDAP group called NetScaler Users. Step Description Screenshot 1. Log into your NetScaler Expand System > Authentication > LDAP Click the Servers Tab Tick the already existing AUTHServer_LDAP Click the Add button Tip : Because we selected the already created server profile the configuration details of that profile will be automatically copied into this new policy as defaults Note : The LDAP bind password is not copied when you duplicate these settings from a previously created policy so always be sure to re-enter them when creating additional AUTHSERVERS and test

35 Page: Give the LDAP server profile a Name e.g. AUTHSERVER_LDAP_NSUsers Provide the following details of your LDAP server: IP Address / or Name Base DN Admin Bind DN Admin Password: Be Sure to RETYPE YOUR PASSWORD and click TEST Server Logon Name Attribute: samaccountname Group Attribute: memberof Sub Attribute Name: cn Note : In this guide we are using the following specific details as working examples IP Address / or Name: Base DN: CN=Users,DC=Home,DC=Local Admin Bind DN: admin@home.local Admin Password: <password> Search Filter: memberof= CN=NetScaler Users,CN=Users,DC=home,DC=local 3. Tip : You can connect to your AD controller or any Windows machine with the Remote Server Administration Tools (RSAT) installed to establish your base DN and admin bind DN by querying the accounts using dsquery user and dsquery group Note : You should use appropriate LDAP details for your environment. If you are unsure consult with your AD/LDAP/Authentication team. Examples : If you need to obtain the Group details for the Search Filter

36 Page: Click Test Connection and ensure your LDAP server is reachable Note : The LDAP bind password is not copied when you duplicate these settings from a previously created policy so always be sure to re-enter them when creating additional AUTHSERVERS and test 5. Click Create at the bottom of the Create Authentication LDAP Server 6. Create another LDAP Policy to bind this new server profile to Click the Policies tab Tick the existing policy Click Add Note : Because we selected the already created server profile the configuration details of that profile will be copied freshly as a new Server Profile

37 Page: Simply rename the policy to something new like AUTHPOL_LDAP_NSUsers Link this new policy to the previously created server profile in steps 1-5 by selecting AUTHSERVER_LDAP_NSUsers from the drop down Leave the Expression as is: ns_true Click Create 8. Two LDAP Authentication policies now exist and can be used for authenticating users on the NetScaler Note : The Administrators policy is the only policy presently bound to the NetScaler NetScaler SSH Command References : Create LDAP Server add authentication ldapaction AUTHSERVER_LDAP_NSUsers -serverip ldapbase "CN=Users,DC=Home,DC=Local" -ldapbinddn admin@home.local -ldapbinddnpassword encrypted -encryptmethod ENCMTHD_3 -ldaploginname samaccountname -searchfilter "memberof= CN=NetScaler Users,CN=Users,DC=home,DC=local" -groupattrname memberof -subattributename cn Create LDAP Policy add authentication ldappolicy AUTHPOL_LDAP_NSUsers ns_true AUTHSERVER_LDAP_NSUsers

38 Page: 38 Certificates Creating a Private RSA Step Description Screenshot 1. Log into the NetScaler web interface 2. Expand traffic management Right Click SSL And select Enable Feature Note : The yellow exclamation will disappear when the feature is enabled Disabled Enabled

39 Page: Expand SSL > SSL Files > and click the button Create RSA Key 4. In this example we will enter the details shown: Then click Create Key filename: gateway.jsconsulting.services.privatekey Key Size(bits)*: 2048 Public Exponent Value: F4 Key Format: PEM PEM Encoding Algorithm: DES3 PEM & Confirm Password: <mypassword> Note : the larger the key size the more CPU will be used encrypting and decrypting the certificates DES3 is simply DES applied 3 times (so in theory it's more secure) 5. Note : The private key should be downloaded and stored away from the NetScaler device (especially if the NetScaler is stored in a DMZ). This is in case the NetScaler device is compromised in any way. If your private keys are lost or compromised you would have to revoke your existing certificates and new certificates should be generated.

40 Page: 40 Creating a CSR Request Step Description Screenshot 1. Log into the NetScaler web interface 2. Now that our private key has been created we need to create a Certificate Signing Request and sign it with our private key Expand SSL > SSL Files Click CSRs Then click Create Certificate Signing Request (CSR) 3. In our example we will enter these details shown: Then click Create

41 Page: 41 Request File name: gateway.jsconsulting.services.csr Key Filename: gateway.jsconsulting.services.privatekey Key Format: PEM PEM Passphrase: <private key password here> Digest Method: SHA256 Common Name: gateway.jsconsulting.services Organisation Name: JS Consulting Services Organisational Unit: Technologies Address: <your address> City: London State or Province: London Country: UNITED KINGDOM

42 Page: CSR is created and signed with the private key all stored on the NetScaler in /nsconfig/ssl

43 Page: 43 Submitting the CSR to a 3 rd party CA - Comodo Free SSL We now need to take our CSR created in the previous guide and submit that to a 3 rd Party Certificate Authority or CA to verify our CSR and provide us with a certificate response we can combine with our CSR and generate the SSL certificate. Step Description Screenshot 1. First we need to download our CSR for easy access from the NetScaler Expand Traffic Management > SSL > SSL Files > CSRs tab Tick the newly created.csr file and click Download 2. We are going to browse to comodo and apply for a FREE SSL Certificate

44 Page: Click the big Free Trial SSL button 4. Open the downloaded CSR file from step 1 and copy and paste the entire contents into the Comodo SSL site Select Citrix as the Server software Click Next

45 Page: Comodo will then perform a domain ownership verification In the example shown to keep it simple I will select the registered address for jsconsulting.service s from (WHOIS)

46 Page: Enter your details for registration of the Certificate and for access to the COMODO SSL Site

47 Page: Read the terms thoroughly and Accept if you are ready to continue 8. Validate the sent to your WHOIS registered 9. Download the CSR Files as a zip

48 Page: 48 Upload the CA CRT file and Install the Certificate on the NetScaler We will now take the CRT file and install it onto the NetScaler device, then use both the CRT and Private key to combine and finally create a fully functional NetScaler certificate. Step Description Screenshot 1. Expand Traffic Management > SSL > SSL Files Click Upload 2. Browse for your Certificate file (provided by your 3rd Party CA) Click Open Note : The file is uploaded to the NetScaler but not yet usable!

49 Page: Browse to Traffic Management > SSL > Server Certificates Click Install 4. Give the new Server Certificate a unique easily identifiable name Certificate File: Choose the Certificate you just uploaded in step 2 Key File Name: select your private key file that is on the NetScaler Provide the private key password Click Install Your certificate is now installed and ready to be used on NetScaler services, VIPs, NetScaler gateway etc.

50 Page: 50 Intermediary Certificate Linking Sometimes there can be more certificate between the server certificate and the root cert we have created on the NetScaler and the Root CA Certificate. These certificates in the middle are known as intermediary or subordinate certificates and form a link or chain between the root CA certificate and our newly created NetScaler certificate. When some operating systems don t have the full chain of intermediary certificates installed (and trusted) they will display a certificate invalid message even when the certificate itself is valid. This is because the operating system is unable to verify your server certificate all the way up the certificate chain to the root certificate. These certificates can be installed and provide to the end users to greater enhance the user s ability to connect to the NetScalers regardless of their endpoint or client device. Step Description Screenshot 1. Example: Connecting to a service or VIP on the NetScaler interface where we have bound the new Certificate shows an error in Chrome on Mac OSX Note : This will vary between operating system and between CA certificate providers

51 Page: Log into the NetScaler web interface 3. Expand SSL > SSL Files Click SSL > Certificates > CA Certificates Click Install 4. Upload the bundled certificate from your 3 rd party CA Click Install

52 Page: Expand SSL > SSL Files Click SSL > Certificates > Server Certificates Tick your newly created server certificate Select Action - Link 6. Select the CA Certificate uploaded in step 3 Tip : The NetScaler will automatically select the correct / valid certificate (if it is installed correctly and exists)

53 Page: Repeat this step for every certificate in the certificate chain including the root certificate

54 Page: 54 XenApp & XenDesktop 7.14 Installation As part of the NetScaler gateway setup we are going to create a fully self contained Citrix XenApp and XenDesktop (referred from now on as XAXD) Delivery controller (aka Desktop Delivery Controller DDC). Prerequisites Description Windows 2012/2016 Server & Domain joined You have patched the server and installed KB Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 update: April 2014 (prerequisite patch) (Note: If you download this update without updating the Operating system first it may say the patch is not applicable If this happens run windows updates for the first time before then try reinstalling the patch) Downloaded copy of XA&XD ISO from mycitrix.com website Local administrative rights to the W2012 Server where you are installing XA/XD You can avoid the locate media prompts if you extract the ISO locally for a locatable installation post reboots Install XA/XD Software Step Description Screenshot 1. Log into your 2012 server

55 Page: Right click and mount the XAXD ISO 3. Run the autoselect 4. Click start on XenDesktop

56 Page: Click Delivery Controller 6. Read and accept the license agreement and click Next

57 Page: Install All Core Components 8. Select all optional features Click Next

58 Page: Click Next 10. Click Install

59 Page: Reboot 12. After restart it may prompt for XD install media as the ISO wont be mounted and the installer won't be able to find the ISO simply click cancel Remount the ISO (right click + mount) Run Auto Select, Select XenDesktop Select Delivery Controller The installation will continue

60 Page: Reboot when prompted 14. After restart it may prompt for XD install media as the ISO wont be mounted and you won't be able to find the ISO simply click cancel Remount the ISO run Auto Select Select XenDesktop Select Delivery Controller The installation will continue

61 Page: Skip the Smart Tools connection 16. At Completion, ensure Launch Studio is selected and click Finish

62 Page: 62 Create the XA/XD Site Step Description Screenshot 1. The Citrix Studio will launch after setup / install 2. Select Site Setup - Deliver applications and desktops to your users

63 Page: Select Fully Configured In this example we will setup the site name as Production 4. Select the default Create and setup databases from studio The SQL Express setup will be detected and details entered

64 Page: In this example we will select the 30 day trial and proceed with the defaults 6. In this example as this is a standalone XA/XD Machine we will not setup a hypervisor connection (machine management)

65 Page: We will not install AppDNA or App-V Publishing features These can be added later if required 8. Review the summary page and click Finish

66 Page: 66 Install the XA/XD VDA (Virtual Delivery Agent) Step Description Screenshot 1. Mount the XA/XD ISO and run AutoSelect.exe 2. Select Prepare Machines and Images Virtual Delivery Agent for Windows Server OS

67 Page: Select Enable connections to a server machine 4. Leave the defaults and click Next

68 Page: Do not select any additional components Click Next 6. Select Do It Manually for the locations of the delivery controller Enter the localhost server name for the Controller address (itself) Click Test Connection and click Add (next button will only highlight after this) Click Next (Note that you can allow MCS or AD discovery to setup this for you automatically and is recommended in a

69 Page: 69 production environment) 7. Select all Features Click Next 8. Click Next

70 Page: Click Install 10. Reboot when promoted 11. Cancel the locate media prompts 12. Remount the ISO, run AutoSelect, re-select Prepare Machines and Images Virtual Delivery Agent for Windows Server OS

71 Page: The Installation will continue 14. Click Finish

72 Page: 72 Create a Machine Catalog Step Description Screenshot 1. Once the Site has been set up the console will be ready Click Setup machines for desktops and applications or remote PC access 2. Click Next

73 Page: Select Server OS and click Next We will install this on the XA/XD DDC for demo purposes only (not recommended in Production) 4. As we previously did not setup machine management, leave the default options selected

74 Page: Click add computers Enter your server name add your DDC Click Next

75 Page: Give your machine catalog a name and description Click Finish 7. Click Delivery Groups 3 Setup delivery groups to assign to desktops and applications to your users

76 Page: Click Next 9. Select the (only) Machine Catalog created in the previous steps Click Next

77 Page: Browse your AD configuration for the users you wish to have permission to launch these desktops In our example we will simply choose home\domain users (not recommended for production) 11. Skip the application selection / Publication

78 Page: Assign the desktops (for VDI) click Add Setup the Desktop as follows assigning a display name, description and restrict the desktop to specific domain users (in this instance we have again selected Domain users) Ensure Enable desktop is selected Click Next Note : You could also select allow everyone with access to this delivery group to use a desktop which simplifies permissions management but assumes you want all users of this delivery group to have access to a Citrix Desktop

79 Page: Enter a name for the delivery group, enter a description and click Finish

80 Page: 80 Test the Citrix Desktop Launch Step Description Screenshot 1. Open a Browser locally on the Citrix server. The default page will already be setup and created for x/storeweb/ 2. Login as a member of the group that has access to the desktop published in the previous steps In our example we can log in as any user who is a member of domain user (all user accounts by default)

81 Page: Select the Desktops Tab and click the Server Desktop 4. If the setup has been successful the Citrix desktop session will start

82 Page: 82 StoreFront Configuration Whilst the StoreFront site will already be preconfigured by the XA/XD Setup wizard, there are some settings we need to set up in order for NetScaler to be able to connect to the StoreFront server and launch sessions. Prerequisites Item Description You will need to know the FQDN of your NetScaler Gateway The internal or private IP Address of the VIP assigned to the NetScaler Gateway* Know the details of your Citrix Server STA (our Citrix DDC(s)) * The StoreFront server must be able directly communicate with the VIP of the NetScaler Gateway, otherwise when the StoreFront server resolves the FQDN it will resolve the internet IP address and potentially will not work. Modify the Default Store Step Description Screenshot 1. Log into Citrix Studio Expand Citrix StoreFront Select the Existing Store Store Service Click Manage NetScaler Gateways

83 Page: Click Add Enter the Display name and the FQDN of the external Gateway URL (In this example my gateway FQDN is called gateway.jsconsulti ng.services Click Next 3. Click Add Enter the Name of your DDC In our example we only have one server which is the me.local/scripts/ctx sta.dll Click Next

84 Page: Enter the callback URL of the NetScaler Gateway ensuring your StoreFront server is able to resolve the FQDN to an internal/private ip address. Click Create 5. Close the Manage NetScaler gateways screen 6. Ensure the StoreFront / Citrix server can resolve the FQDN to the inside IP Address of the NetScaler Gateway Use locally managed DNS if you have the Zone configured on your local DNS server(s) Or use the Windows host file to add a private entry. Note : Windows host file is located in c:\windows\system32\drivers\etc\hosts and has no extension. You may need to copy it to the users desktop first, manipulate the file, and copy it back due to Windows User Account Control (UAC)

85 Page: Ensure the StoreFront server resolves the FQDN to the NetScaler inside VIP address Note : In production environments ping may not be allowed between the NetScaler network and the StoreFront network(s) you need to ensure that 443 TCP is opened and allowed through the Firewall from the StoreFront servers to the NetScaler VIP 8. Back in the Studio expand Manage Authentication Methods

86 Page: Ensure Pass-through from NetScaler Gateway is ticked 10. Back in Studio Select your store and click Configure Remote Access Settings Ensure you Enable remote access Select No VPN Tunnel Tick the NetScaler Gateway appliance listed Click OK

87 Page: 87 Create a New StoreFront Store - Stand Alone Step Description Screenshot 1. Open the Citrix StoreFront Console Expand Citrix StoreFront Click Stores Click Create Store 2. Click Next

88 Page: Give the store a name Select Set this receiver for Web site as IIS Default Click Next

89 Page: Click Add On the Add Delivery Controller screen click Add Add Delivery Controllers FQDN Untick Servers are load balanced Select Transport type as HTTP (you should use HTTPS if the SF server is in a DMZ or for extra security) Click OK

90 Page: Click Next 6. Enable Remote Acces s Ensure Allow Users to access resources only delivered through StoreFront (No VPN Tunnel) is selected Click Add

91 Page: Enter details for the new gateway Example: my gateway is called gateway.jsconsultin g.services and the URL is nsulting.services Click Next 8. On the STA Screen Click Add Enter the FQDN of the Citrix XA/XD server

92 Page: Enter the FQDN of the STA server Click OK 10. Untick Load balance multiple sta servers Tick Enable session reliability Untick request tickets from two stas, where available Click Next

93 Page: Enter the NetScaler details Leave logon type as domain Enter Callback URL as the same entered in step 6 nsulting.services Click Create

94 Page: Click Finish

95 Page: Ensure default appliance is the NetScaler appliance created / added in steps 1 through 12 Click Next

96 Page: Ensure that both methods of Authentication are selected Username and password and Pass through from NetScaler Gateway Click Next

97 Page: Leave both options ticked Click Create

98 Page: Click Finish 17. Back in the StoreFront console click Receiver for Web Sites tab and copy your StoreFront URL Open your internet browser and test this URL &

99 Page: 99 NetScaler Gateway - ICA Proxy Overview Diagram

100 Page: 100 Prerequisites Item Description DNS is configured on the NetScaler correctly The internal or private IP Address of the VIP assigned to the NetScaler Gateway * Know the details of your Citrix Server STA (our Citrix DDC(s)) Firewall ports are open between the NetScaler and the StoreFront server StoreFront already configured and setup (otherwise retrieve attributes won t work) In this section of the course we will connect the NetScaler to our basic Citrix XA/XD Environment. Here you will see how quickly you can set up, secure and enable remote access to your Citrix environment via the NetScaler Gateway. NOTE: you must have an active Citrix XenApp/XenDesktop server and a StoreFront server to proceed with the following steps. If not please just follow along this guide to understand the steps involved or follow the previous XA/XD and StoreFront setup guides. Configure the NetScaler Gateway for XA/XD - Wizard Step Description Screenshot 1. Log into NetScaler GUI 2. Under Integrate with Citrix Products - Click XenApp and XenDesktop Click Get Started

101 Page: Ensure StoreFront Is selected and Click Continue on the Prerequisites NOTE : you must have an active Citrix XenApp/XenDeskto p server and a StoreFront server to proceed with the following steps. If not please just follow along this guide to understand the steps involved.

102 Page: Provide the details that are relevant to your StoreFront and Citrix XenApp setup Gateway FQDN: gateway.jsconsultin g.services Gateway IP Address: Inside private IP address for the Virtual Server. (aka VIP) Port: 443 (SSL) Redirect: Tick this option if you are also forwarding http traffic to this VIP so the NetScaler will redirect the users to https. Then click Continue Note : In this guide we are using the following specific details as working examples you should use the appropriate settings for your environment 5. Because we enabled port 80 redirection the wizard will enable the LoadBalancing Feature on the NetScaler Click Yes

103 Page: Select the certificate you have previously installed on the NetScaler. Note : you should have the complete certificate chain installed on the NetScaler a later video will go through these steps to ensure the complete Certificate chain is installed. Click Continue 7. Keep Authentication as Domain Select Use Existing Server Select the server that has the NSUsers profile associated (will be listed in order of creation so usually the second server in the list)

104 Page: Click Continue 9. Enter the details of your StoreFront server The retrieve stores button will not work if the StoreFront server is not configured. You will not be able to proceed with this wizard if you can't retrieve store as the wizard will not let you proceed manually In this example our StoreFront and Citrix XenApp are installed on the same box so the URLs can point to the same server 10. Click Continue

105 Page: On the summary pages, now all the basic settings have been entered you can click Done

106 Page: 106 NetScaler Unified Gateway Prerequisites Item Description DNS is configured on the NetScaler correctly The internal or private IP Address of the VIP assigned to the NetScaler Gateway * Know the details of your Citrix Server STA (our Citrix DDC(s)) Firewall ports are open between the NetScaler and the StoreFront server StoreFront already configured and setup (otherwise retrieve attributes doesn't work) In this section of the course we will connect the NetScaler to our basic Citrix XA/XD Environment. Here you will see how quickly you can set up, secure and enable remote access to your Citrix environment via the NetScaler Gateway. NOTE: you must have an active Citrix XenApp/XenDesktop server and a StoreFront server to proceed with the following steps. If not please just follow along this guide to understand the steps involved or follow the previous XA/XD and StoreFront setup videos. Create the NetScaler Unified Gateway Wizard Step Description Screenshot 1. Log into NetScaler Click Unified Gateway in the Left Pane under Integrate with Citrix Products

107 Page: Click Get Started 3. Click Continue

108 Page: Enter the following details as appropriate for your configuration 5. Use the existing certificate already installed Click Continue

109 Page: Select the appropriate LDAP server Click Continue 7. Change Portal Theme to the New RFWebUI (note RFWebUI does not currently work with SAML) 8. Click the + Icon

110 Page: Select XenApp & XenDesktop Select Integration point as StoreFront 10. Enter the Details of your XA&XD STA and StoreFront server URLs then click Retrieve Stores Receiver for Web Path will appear and be validated Click Continue 11. Click Done

111 Page: You will be returned to the Applications Page and a StoreFront application will appear 13. Click Continue 14. On the summary page click Done

112 Page: Access the Unified Gateway Page and check you can log into the NetScaler page 16. Select Clientless Access Click Desktops and ensure you can see your XA&XD Desktops Load the desktop to ensure a full end to end test is performed

113 Page: 113 NetScaler Gateway - SSL VPN Create a Basic NetScaler Gateway for SSL VPN Prerequisites Item Description NetScaler configured with IP Address, Certificates and accessible from the clients either internally or remotely over the internet. Ensure Split Tunnelling is Off Port 443 forwarded from firewall / router to the NetScaler VIP Ensure the Default Authorization on the global configuration is set to allow Step Description Screenshot 1. Check NetScaler gateway feature is enabled System > Settings > Configure Basic Features 2. Ensure Global settings for NS Gateway is set to Allow

114 Page: Expand NetScaler Gateway Click NetScaler Gateway Wizard 4. A Separate Wizard page will open Click Get Started

115 Page: Provide the details of your new gateway Note : my details are provided as an example only 6. Select the existing Certificate already installed on your NetScaler Click Continue

116 Page: Select the default authentication of Local and Don't select a secondary auth method Once the wizard has completed create a user called nsgw-localuser password: <yourpassword> User Administration> AAA Users > Add Button Click Continue

117 Page: You may close the dashboard that is opened by default after creation of the new Gateway 9. Ensure your newly created gateway is added to DNS internally or externally (wherever you are connecting to it from) Open a web browser to the NetScaler VIP Login

118 Page: Success!

119 Page: 119 Install the NS Gateway Plugin - Windows Prerequisites Item Description You should be a local administrator of the device where you are install the gateway plug-in Step Description Screenshot 1. Ensure your newly created gateway is added to DNS internally or externally (wherever you are connecting to it from) Open a web browser to the NetScaler VIP Login

120 Page: 120 Select Network Access Click Download

121 Page: 121 Click Run Click Install Note : You must be a local administrator to install this Software Click Yes to any Windows UAC prompts

122 Page: 122 Click Finish The Gateway VPN will connect automatically and the web page will display the NetScaler VPN Home Page.

123 Page: 123 Create a NetScaler Gateway Preauthentication Policy Step Description Screenshot 1. Expand > NetScaler Gateway > Policies > Preauthentication 2. Click Add

124 Page: Name the policy something like PreAuthPol_Notepa d-is-running Click the + next to Request Action Note : you can call it whatever you want, I like to keep a standard format when creating policies and profiles so they are distinguishable in the various screens and in the ns.conf file as well 4. Click Create

125 Page: Click Expression Editor Select Expression Type of: Client Security Component: Process Name*: notepad.exe Operator: EXISTS Then click Done 6. Note the expression is automatically created for you now as CLIENT.APPLICATI ON.PROCESS(note pad.exe) EXISTS CLIENT.APPLICATION.PROCESS(notepad.exe) EXISTS

126 Page: Click Create 8. Bind the new policy globally Select NetScaler Gateway > NetScaler Gateway Policy Manager 9. Click the + on AAA Global 10. Click Add Binding

127 Page: Click in the Click to Select 12. Select the only PreAuthPolicy available Click Select 13. Click Bind

128 Page: Click Done 15. Click Done

129 Page: Browse to the gateway and check that before you type in any authentication credentials that the EPA scan is invoked Click Yes 17. EPA Scan with notepad not running

130 Page: EPA Scan with notepad Running Your users can now authenticate 19. Authenticate against the NetScaler page again and then confirm you can access all NetScaler resources Configure NetScaler Gateway with Split Tunnelling Step Description Screenshot 1. In order that our users devices know which network is local and which network is remote we need to define our remote network resources

131 Page: First we ensure that split tunnelling is enabled NetScaler gateway > Global Settings > Change Global Settings Click the Client experience tab Change Split Tunnel* to ON Click OK 3. Expand NetScaler gateway > Resources > Intranet Applications Click Add

132 Page: Here we add the remote networks we want the users / VPN tunnel to have access to when the Gateway client is logged on In this example we will use the full home.local network Click Create 5. Browse back to NetScaler gateway > Global Settings tab Click Define intranet applications...

133 Page: Click Add 7. Click the Right Arrow (or the + symbol next to the Resource) to include the new Intranet Resources for our Split Tunnel

134 Page: 134 Click OK 8. Save your NetScaler configuration 9. Test your VPN connectivity Create Authorisation Policies for NS Gateway Step Description Screenshot 1. Expand > NetScaler Gateway > Global Settings > Change Global Settings

135 Page: Click Security tab Change Default Authorization Action to DENY Note : This change will affect all Gateways configured on the NetScaler that do not specifically reverse. 3. Expand NetScaler Gateway > Policies > Authorization Policies Click Add 4. Create a new policy In this example we will call it AuthPol_VPN_ as the only destination this policy will allow is to

136 Page: Click Switch to Classic Syntax Click Expression Editor 6. Enter the IP address details into the Expression Editor of the destination IP you want to allow access to

137 Page: Click Create Note : the Reg Expression has been built for you by the editor you can type these manually if you know the commands (or find them online!) 8. Bind this new policy to a NetScaler User NetScaler Gateway > User Administration >AAA Users Select the user + Edit Click + Authorization Policies Select the Authorization policy Click Bind Tip : to bind this to LDAP users you must have username locally that matches

138 Page: 138 Setup NetScaler Gateway VPN to use a LDAP Authentication Policy Step Description Screenshot 1. Let s Bind the LDAP_NetScaler_U sers policy now to this VPN / Gateway 2. Browse to the gateway and click Edit 3. Click the + on Basic Authentication Choose LDAP as policy Choose Primary Authentication Click Continue