Getting Started Citrix Secure Gateway Version 1.0 Citrix Systems, Inc.
Copyright and Trademark Notice Information in this document is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Citrix Systems, Inc. Copyright 2001 Citrix Systems, Inc. All rights reserved. Citrix, ICA (Independent Computing Architecture), and WinFrame are registered trademarks, and Citrix Solutions Network, MetaFrame, MetaFrame XP, NFuse, and Program Neighborhood are trademarks of Citrix Systems, Inc. in the United States and other countries. RSA Encryption 1996-1997 RSA Security Inc., All Rights Reserved. Trademark Acknowledgements Adobe, Acrobat, and PostScript are trademarks or registered trademarks of Adobe Systems Incorporated in the U.S. and/or other countries. Microsoft, MS, MS-DOS, Windows, Windows NT, and Windows 2000 Server are registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and other countries. Netscape and Netscape Navigator are registered trademarks of Netscape Communications Corp. in the U.S. and other countries. All other trademarks and registered trademarks are the property of their owners. Document Code: csgwin.v10.gs.20011214
Contents 3 Contents Chapter 1 Welcome...................................................... 5 Overview.......................................................... 5 Who Should Read this Guide........................................... 6 Citrix Secure Gateway Documentation................................... 6 Using PDF Documentation......................................... 7 Finding Information About Windows 2000 Servers......................... 7 Documentation Conventions........................................... 7 Citrix on the World Wide Web......................................... 8 Reader Comments................................................... 8 Chapter 2 Introduction to the Citrix Secure Gateway.......................... 9 Citrix Secure Gateway Components.................................... 10 How the Components Interact......................................... 11 System Requirements................................................ 13 For the Secure Gateway Service.................................... 13 For the Secure Ticket Authority..................................... 13 For NFuse Extensions............................................ 14 For the ICA Client Device......................................... 15 Supported MetaFrame Versions..................................... 16 Chapter 3 Installation.................................................... 17 Before You Install.................................................. 18 Obtaining and Installing Certificates................................. 18 Trial Server Certificates...................................... 19 Recommended Reading...................................... 19 Complete the Installation Checklist.................................. 19 Installation........................................................ 20 Test your Secure Gateway Installation.................................. 21 Index................................................................... 23
C H A P T E R 1 Welcome Welcome to Citrix Secure Gateway for Windows, Version 1.0. Citrix Secure Gateway (Secure Gateway) is designed to secure all Citrix Independent Computing Architecture (ICA ) traffic traveling across the Internet between MetaFrame servers and Secure Sockets Layer (SSL)-enabled ICA Client workstations, making firewall traversal easier, providing heightened security with SSL encryption, simplifying deployment, and enabling tight integration with Citrix NFuse application portal software. Overview Secure Gateway is a security solution with ICA specific gateway functions. It removes the need to publish the addresses of every Citrix server, simplifies server certificate management, and allows a single point of encryption and access into a Citrix server farm. It does this by providing a gateway that is separate from the MetaFrame servers and reduces the issues for firewall traversal to a widely accepted port for ICA traffic in and out of firewalls. The following benefits are achieved with Secure Gateway: Strong encryption (SSL V3 128-bit). Authentication (achieved through NFuse). Internal network addresses of your Citrix servers are hidden. Firewall traversal through a widely accepted port. Single-point server certificates. Large number of servers can be supported easily. Does not need separate client software. Works with standard ICA Clients, Version 6.20 or higher.
6 Citrix Secure Gateway Getting Started Who Should Read this Guide This guide is for server administrators and security experts who are responsible for the planning and deployment of Secure Gateway in the enterprise. Citrix Secure Gateway Documentation The Secure Gateway distribution package, setupcsg100en.exe, extracts the installation files, and electronic documentation for Secure Gateway into a directory of your choosing. All the documents listed below are available from the directory to which you downloaded setupcsg100en.exe. This manual, Citrix Secure Gateway Getting Started, provides an overview of the Citrix Secure Gateway solution. It also provides brief instructions on how to install and remove Secure Gateway software. The Citrix Secure Gateway Installation Checklist, is a worksheet designed to help system administrators collate the information required during installation of Secure Gateway. Installation and configuration, while not terribly complex, is slightly involved because Secure Gateway consists of three separate components that need to be installed on different server machines. Citrix recommends that you fill out this checklist before installing the software. Context-sensitive Help is available in the Secure Gateway configuration utilities and provides information on configuration values required to run the software. The Citrix Secure Gateway Administrator s Guide, provides conceptual and procedural information on installation, configuration, and usage of Secure Gateway. This guide also provides reference information about digital certificates, as well as compatibility guidelines for network components that are typically found in a Secure Gateway deployment. The Readme.txt file contains last minute updates, corrections to the documentation, and a list of known problems. A white paper entitled, Customizing NFuse Web Sites For Citrix Secure Gateway. This paper provides a description of the sample NFuse Web site templates available for use with Secure Gateway, and instructions for modifying an existing NFuse Web site to support Secure Gateway. This white paper is also available from the online Solution Knowledgebase at http://www.citrix.com/support.
Using PDF Documentation Chapter 1 Welcome 7 To use the Secure Gateway documentation provided in a PDF file you need to have the Adobe Acrobat Reader (Version 4 or later) program. The Reader program lets you view, search, and print the documentation files. If you need to obtain the Reader program, you can download it for free from Adobe System s web site (http://www.adobe.com/). The self-extracting file includes installation instructions. Finding Information About Windows 2000 Servers Secure Gateway is designed to run on Windows 2000 servers. For Windows 2000, information on application compatibility and deployment issues is available on the Microsoft Web site (http://www.microsoft.com/). For instructions on installing and using Windows servers, see the Microsoft documentation included in your Windows package and the Microsoft Web site (http://www.microsoft.com/). Documentation Conventions Secure Gateway documentation uses the following typographic conventions for menus, commands, keyboard keys, and items in the program interface Convention Boldface Italics UPPERCASE Meaning Commands, names of interface items such as text boxes and option buttons, and user input. Placeholders for information or parameters that you provide. For example, filename in a procedure means you type the actual name of a file. Italics also are used for new terms and the titles of books. Keyboard keys, such as CTRL for the Control key and F2 for the function key is labeled F2.! Step-by-step procedural instructions
8 Citrix Secure Gateway Getting Started Citrix on the World Wide Web Reader Comments The Citrix Web site, at http://www.citrix.com/, offers a variety of information and services for Citrix customers and users. From the Citrix home page, you can access online Technical Support Services and other information, designed to assist Citrix MetaFrame, NFuse, Citrix Secure Gateway, and ICA Client administrators, including the following: Citrix Documentation Library containing the latest documentation for all Citrix products Downloadable Citrix ICA Clients (available at http://download.citrix.com/) Program information on Citrix Preferred Support Services options An FTP server containing the latest service packs, hotfixes, utilities, and product literature for download An online Solution Knowledgebase containing an extensive collection of application notes, technical articles, troubleshooting tips, and white papers Interactive online Solution Forums for discussion of technical issues with other users Frequently Asked Questions pages with answers to common technical and troubleshooting questions Information about programs and courseware for Citrix training and certifications Contact information for Citrix headquarters, including worldwide, European, Asia Pacific, and Japan headquarters We strive to provide accurate, clear, complete, and usable documentation for Citrix products. If you have any comments, corrections, or suggestions for improving Secure Gateway documentation, we want to hear from you. Please send e-mail to the documentation author at documentation@citrix.com. Please include the product name and version number, and the title of the document in your message.
C H A P T E R 2 Introduction to the Citrix Secure Gateway This chapter describes how Citrix Secure Gateway works and the system requirements for a typical installation. This chapter covers the following topics: Citrix Secure Gateway Components, page 10 How the Components Interact, page 11 System Requirements, page 13
10 Citrix Secure Gateway Getting Started Citrix Secure Gateway Components To secure ICA traffic coming in over the Internet, the Secure Gateway server is installed in the DMZ (demilitarized zone) as a security perimeter that protects MetaFrame resources and applications on the corporate Intranet. Secure Gateway involves the interaction of five network components: A Citrix MetaFrame XP server farm A Secure Gateway server A Citrix NFuse enabled Microsoft IIS 5.0 server A Secure Ticket Authority (STA) server A client device with an ICA Client, Version 6.20 or later installed.
How the Components Interact Chapter 2 Introduction to the Citrix Secure Gateway 11 The typical Secure Gateway deployment shown below illustrates interaction between an ICA Client, NFuse, Citrix Secure Gateway, and MetaFrame servers. As illustrated in the figure above, the following communications take place between Secure Gateway components before a secure connection is established. 1. A remote user launches a Web browser and connects to an NFuse Web server on port 80 (HTTP) or port 443 (HTTPS). The NFuse Web portal requires the user to login using valid user credentials. 2. NFuse uses the user credentials to contact the Citrix XML Service, on port 80, running on a MetaFrame server to obtain a list of applications that the user is authorized to access. NFuse populates the Web portal page with the list of published applications that the user is authorized to access. The communications so far are the normal sequence of events that occur when an NFuse Web server is deployed to provide ICA Client users with access to published applications. 3. When the user clicks on a published application link, NFuse sends the IP address for the requested MetaFrame server to the STA and requests a Secure Gateway ticket for the user. The STA saves the IP address and issues the requested Secure Gateway ticket to NFuse.
12 Citrix Secure Gateway Getting Started 4. NFuse generates an ICA file, containing the ticket issued by the STA and sends it to the client browser. Note that the ICA file generated by NFuse only contains the IP address of the Secure Gateway server. The address of the MetaFrame server that the ICA Client eventually connects to is never exposed. 5. The browser passes the ICA file to the ICA Client, which launches an SSL connection to the Secure Gateway server. Initial SSL handshaking is performed to establish the identity of the Secure Gateway server. 6. The Secure Gateway server accepts the ticket from the ICA Client and uses information contained in the Secure Gateway ticket to identify and contact the STA for ticket validation. If the STA is able to validate the ticket, it returns an IP address of the MetaFrame server on which the requested application resides. If the ticket is invalid or has expired, the STA informs the Secure Gateway server, and an error message is displayed on the ICA Client device. 7. On receipt of the IP address for the MetaFrame server, the Secure Gateway server establishes an ICA connection to the MetaFrame server. After the ICA connection is established, the Secure Gateway server monitors ICA data flowing through the connection, and encrypts and decrypts client-server communications.
System Requirements Chapter 2 Introduction to the Citrix Secure Gateway 13 This section describes the hardware and software requirements for Citrix Secure Gateway components, NFuse, ICA Clients, and MetaFrame servers. For the Secure Gateway Service The Secure Gateway Service is a Windows 2000 service and must be installed on a Windows 2000 Server. Review the following requirements to ensure that your server environment meets the installation prerequisites. Server Hardware Recommended minimum requirements for Windows 2000 Server. Refer to the Windows 2000 Server product documentation, or see the Microsoft Web site for more information. Server Software Microsoft Windows 2000 Server with Service Pack 2 or later. The latest Service Pack is always recommended. 256MB of RAM Additional 150MB of available hard disk space Network Interface Card (NIC) For the Secure Ticket Authority The Secure Ticket Authority can be installed on a standalone PC running Windows 2000 Server. Review the following requirements to ensure that your server environment meets the installation prerequisites. Server Hardware Recommended minimum requirements for Windows 2000 Server. Refer to the Windows 2000 Server product documentation, or see the Microsoft Web site for more information. 256MB of RAM Server Software Microsoft Windows 2000 Server with Service Pack 2 or later. The latest Service Pack is always recommended. Internet Information Services (IIS) 5.0, installed as default on Windows 2000 servers. Additional 150MB of available hard disk space Network Interface Card (NIC)
14 Citrix Secure Gateway Getting Started For NFuse Extensions At the time of this release, the current shipping version of Citrix NFuse is Version 1.6. NFuse versions 1.51 and 1.6 do not feature built-in support for the Citrix Secure Gateway for Windows, Version 1.0. If you are using one of these versions of NFuse, you must install NFuse Extensions on your NFuse Web server to enable support for Citrix Secure Gateway. Future versions of NFuse will natively support the Citrix Secure Gateway. For information on how to configure forthcoming releases of NFuse for use with the Citrix Secure Gateway, please refer to the NFuse Administrator s Guide appropriate for your version of NFuse. Server Hardware Recommended minimum requirements for Windows 2000 Server. Refer to the Windows 2000 Server product documentation, or see the Microsoft Web site for more information. Server Software Microsoft Windows 2000 Server with Service Pack 2 or later. The latest Service Pack is always recommended. Network Interface Card (NIC) IIS 5.0, installed as default on Windows 2000 servers NFuse versions 1.51 or 1.6 only. Important If your Web server is running a version of NFuse software released after NFuse 1.6, refer to the NFuse Administrator s Guide to check the level of support for Citrix Secure Gateway. You may not need to install NFuse Extensions on your NFuse Web server.
For the ICA Client Device Chapter 2 Introduction to the Citrix Secure Gateway 15 Hardware Consult your Citrix ICA Client, Version 6.20 or later, documentation. Network Interface Card (NIC) Software SSL enabled Citrix ICA Client (Version 6.20 or later) software. A Web browser. Consult the Citrix ICA Client, Version 6.20 documentation appropriate for the OS you are using. Appropriate Consult the Citrix ICA Client, Version 6.20 documentation appropriate for the OS you are using. Important Citrix ICA Clients for 32-bit Windows, Java, Macintosh, and Linux platforms, Version 6.20 or later, are compatible with Citrix Secure Gateway. The latest versions of ICA Client software is available for download from the Citrix Download site, http://www.citrix.com/download.
16 Citrix Secure Gateway Getting Started Supported MetaFrame Versions To work with Citrix Secure Gateway, and by association NFuse, your Citrix MetaFrame servers must meet the following requirements: Server Hardware Consult your Citrix MetaFrame documentation. Server Software Windows NT Server 4.0, Terminal Server Edition with Service Pack 5 or later. or Windows 2000 Server Family MetaFrame XP Application Server for Windows Version 1.0 or later or Citrix MetaFrame for UNIX Operating Systems Version 1.1 Citrix Secure Gateway operates with these MetaFrame versions on all of their supported platforms. For a list of supported platforms, see your MetaFrame documentation.
C H A P T E R 3 Installation This chapter briefly describes pre-installation tasks and the installation procedure to follow to get Citrix Secure Gateway up and running. This chapter covers the following topics: Before You Install, page 18 Installation, page 20 Test your Secure Gateway Installation, page 21
18 Citrix Secure Gateway Getting Started Before You Install Before you install Citrix Secure Gateway components, it is very important that you obtain and install appropriate digital certificates on the client device and the servers on which you install Secure Gateway components. Obtaining and Installing Certificates Citrix Secure Gateway uses digital certificates as a means of authentication and authorization. Digital certificates are a standard requirement of any software using SSL (Secure Sockets Layer) encryption. This means you need to install digital certificates on some, or all, of the servers that are critical security points in a Secure Gateway implementation. The diagram below shows a typical Secure Gateway deployment and illustrates the certificates required to secure all critical points in the implementation. Citrix recommends that you contact your Corporate Security department to discuss how to obtain server certificates for servers running Secure Gateway software. If your organization is not running its own Certificate Authority (CA), you will need to obtain certificates from a well-known public CA.
Chapter 3 Installation 19 Trial Server Certificates You might find it expedient to test Citrix Secure Gateway software using evaluation or trial certificates available from well-known public CAs. Ensure that you choose certificates of type X.509v3 SSL if the CA offers you a list of server certificates to choose from. Important If you are using a server certificate issued by your own private CA, or have obtained a trial server certificate from a public CA, ensure that you obtain a matching root certificate as well. You need to install the root certificate on the ICA Client device. For instructions about installing root certificates on the client device, refer to the respective ICA Client Administrator s Guide. For conceptual information and instructions on obtaining and installing certificates, see the Citrix Secure Gateway Administrator's Guide. Recommended Reading For a step-by-step guide that takes you through the process of obtaining and managing certificates in the Microsoft Windows 2000 operating system, see the Microsoft Web site (http://www.microsoft.com/technet/prodtechnol/ windows2000serv/deploy/walkthru/enducert.asp). Complete the Installation Checklist The Installation Checklist, csg_ic.pdf, included in your Citrix Secure Gateway distribution kit is a worksheet designed to help you collate the information you will need to provide during the installation of the software. Citrix recommends that you print and fill out this form with appropriate values for your environment. Keep the completed checklist on hand when you install the software.
20 Citrix Secure Gateway Getting Started Installation At this point you must have the required server hardware and software setup, the appropriate certificates installed on the machines reserved for the Citrix Secure Gateway components, and a completed installation checklist. Download the Citrix Secure Gateway distribution kit, setupcsg100en.exe, to a directory (the default installation path is %systemdrive%\csginstall) on your local hard drive. The Citrix Secure Gateway introduction screen containing instructions and hyperlinks for launching the installation files and electronic documentation appears. Citrix recommends installing the Citrix Secure Gateway components in the following sequence: 1. Install the Secure Ticket Authority 2. Install the Secure Gateway Service 3. Install NFuse Extensions " To install the Secure Ticket Authority (STA) 1. Run csg_sta.msi on the machine reserved for STA installation. Follow installation prompts to completion. 2. The STA Configuration utility is launched. Follow prompts to specify configuration values for the Secure Ticket Authority. To view context-sensitive Help for an input field in a dialog, click the title bar of the dialog box, and then click the item in the dialog box. in the " To install the Secure Gateway Service 1. Run csg_gwy.msi on the machine reserved for the Secure Gateway Service installation. Follow installation prompts to completion. 2. The Secure Gateway Service Configuration utility is launched. Follow prompts to specify configuration values for the service. To view context-sensitive Help for an input field in a dialog, click the in the title bar of the dialog box, and then click the item in the dialog box.
Chapter 3 Installation 21 " Install NFuse Extensions 1. Run the csg_nfe.msi on the NFuse Web server. Follow installation prompts to completion. 2. The NFuse Extensions Configuration utility is launched. Follow prompts to specify configuration values for NFuse. To view context-sensitive Help for an input field in a dialog, click the in the title bar of the dialog box, and then click the item in the dialog box For detailed instructions about installing Citrix Secure Gateway components refer to the Citrix Secure Gateway Administrator s Guide. Test your Secure Gateway Installation When installation and configuration is complete, test the Citrix Secure Gateway deployment to ensure everything works. " To test your Secure Gateway installation 1. Use a Web browser on the client device to open the URL of your Citrix Secure Gateway Web site, and log on using valid user credentials. The Web page is populated with a list of published applications that you are authorized to access. 2. Double-click on an application link to launch it. After a brief interval, the application window is displayed on your screen.
22 Citrix Secure Gateway Getting Started 3. Open the ICA Connection Center and check the entry for this published application. Observe that the entry for the application you are running has the string \\Remote, 128-bit SSL appended, as shown above. This verifies that your Citrix Secure Gateway implementation works.
Index 23 Index A Acrobat Reader 7 audience 6 C Citrix Documentation Library 8 Citrix ICA Clients downloading 8 Citrix Secure Gateway. See Secure Gateway Citrix web site 8 conventions documentation 7 conventions, documentation 7 D digital certificates 18 on Windows 2000 19 private CA 19 recommended reading 19 trial certificates 19 documentation conventions 7 F Frequently Asked Questions 8 I Installation before youinstall 18 installation digital certificates 18 NFuse Extensions 21 Secure Gateway Service 20 Secure Ticket Authority (STA) 20 sequence 20 testing 21 R Reader comments 8 requirements ICA Client device 15 NFuse Extensions 14 Secure Gateway Service 13 STA 13 S Secure Gateway benefits 5 certificates required 18 Components 10 context-sensitive Help 6 documentation available 6 how it works 11 installation 20 pre-installation tasks 18 supported MetaFrame versions 16 supported NFuse versions 14 system requirements 13 test your installation 21 trial server certificates 19 typical deployment 11 white paper 6 Secure Sockets Layer (SSL). See SSL Secure Ticket Authority. See STA Solution Knowledgebase 6, 8 SSL 18 STA system requirements 13 system requirements 13 W Who Should Read this Manual 6 Windows 2000 Server 7 P PDF documents 7