Citrix Secure Gateway Technical Web Cast Paul Smith

Citrix Secure Gateway Technical Web Cast Paul Smith Citrix Systems Senior System Engineer Rocky Mountains

Agenda By the end of this session, you should be able to: n n n Explain the role CSG plays in a Meta. Frame deployment Explain the role of SSL certificates Install and configure the CSG Gateway, Secure Ticket Authority, Nfuse Classic 1. 7 and the 6. 30 ICA client to enable SSL connectivity through CSG 2

What Solution does CSG Enable? Securely and simply deliver published applications across the Internet Other components of this solution include: n NFuse 1. 61 or later (required) n Secure Web Server – IIS 5. 0 n Replaceable authentication (Secur. ID, smart card) n SSL enabled clients Release schedule: n Version 1. 0: December 14, 2001 – Windows 2 K only n Version 1. 1 Released at same time as MF XP FR 2 n What’s Next – Solaris Sparc as an HW – OS Platform 3

What is CSG? Provides an SSL Gateway between an SSL enabled ICA client and one or more Meta. Frame servers Tunnels ICA traffic inside SSL (3. 0 or TLS) Limited to ICA only – not a general purpose VPN Runs independently from Meta. Frame, links into NFuse for authorization Makes Firewall Transversal EASY Three components: n Citrix Secure Gateway Server (“the gateway”) n Secure Ticket Authority (“STA”) n Modified NFuse Website 4

CSG in a Nutshell Internet 5 Internal Network CSG Gateway Server Client sends ICAin-SSL packets to the CSG Gateway Server d te p ry SSL c En ith w ICA 6. 20 Client Meta. Frame Server CSG Gateway Server forwards unencrypted ICA traffic to Meta. Frame sees the CSG Server as a local client.

CSG Server with NFuse 6

CSG 1. 1 Technical Requirements Three Windows 2000 servers with SP 2: n CSG Gateway Server l n Secure Ticket Authority l n Server Certificate IIS Nfuse Classic 1. 61 or 1. 7 (or a modified earlier version) l IIS Win 32, Java, Mac or Linux 6. 20 or later ICA client Meta. Frame (or Win. Frame) Server Farm 7

CSG 1. 1 Marketing Requirements Subscription Advantage Customers Only n n CSG is being offered as a value-add to the Subscription Advantage program Customers who bought Meta. Frame XP or Meta. Frame Unix with Subscription Advantage will download CSG from www. citrix. com/My. Citrix There is no technical enforcement of this requirement In other words IT’S FREE 8

CSG Versus SSL Relay 9 For ICA-SSL connectivity, CSG is easier to deploy than SSL Relay on the Meta. Frame servers: SSL Relay CSG SSL Server certificates needed On every Meta. Frame server On the CSG Gateway server only Unique external IP addresses needed For each Meta. Frame server For the CSG Gateway server only Certificate format conversion Install the certificate, export cert to file, convert file to PEM format using keytopem. exe, save beneath SSLRelay keystorecerts Just install the certificate Other Meta. Frame requirements XP with FR 1 and DNS name resolution enabled None (technically)

CSG Versus Extranet (VPN) 10 Compared to Extranet (VPN), CSG is fairly limited. If you are already using Extranet (VPN), you don’t need CSG. Extranet (VPN) CSG Types of traffic All TCP traffic ICA only Authentication methods Eleven possible methods of two -factor authentication Defers authentication to NFuse Client software required ICA client plus an Extranet (VPN)client ICA client only ICA Lower security Secure ICA SSL Relay CSG Citrix Extranet Highest Security

Intro to SSL

Why SSL? The threats: n n Server masquerading Network sniffers Secure Sockets Layer (SSL) provides: n Authentication l l n Digital certificates prove identity on the Internet This prevents “man-in-the-middle” or DNS attacks Encryption Using 128 -bit key lengths This prevents network sniffers from viewing your information l l 12

SSL Certificates SSL Certificate requirements A new thing for many of our customers Obtain certificates from: n Private Certificate Authority (CA) n Public CA n Evaluation cert from Public CA (Baltimore, Verisign) Possible need to install root CA on Client. Windows 6. 20 or later ICA client supports all Windows standard CA’s 13

Could I see some ID please? 14 SSL Certificates are like Driver’s Licenses Driver’s License SSL Certificate Issued to Individual citizens Individual users or servers Issued by Department of Motor Certifying Authority (CA) Vehicles (DMV) Verification DMV hologram, well-known mechanism license format Application Birth certificate, Social requirements security number, etc. Public usage Prove identity; operate a vehicle on public roads I trust it I trust the DMV to scrutinize because applicants CA digital signature, public key, thumbprint Business license, Dun & Bradstreet number, etc. Prove identity; operate a secure web server on public networks I trust the CA to scrutinize applicants

Server certificates 15 Server certificates are unique to a particular server name The “subject” of the certificate is the FQDN of the server Server certificates also include fields dictating what the certificate can be used for View the Certification Path to find out what CA issued this certificate (may be a chain of CA’s)

Root Certificates Root certificates (aka Certifying Authorities) are self-signed entities that are used to verify server certificates If you trust a CA, install their root certificate. Windows ships with many pre-installed CA certificates for wellknown CA’s: n Verisign n Entrust n Baltimore n RSA n Thawte 16

Client needs the root, server needs a cert Sample Certificate Placement 17

Default root certificates Root certificates need to be installed into the Windows operating system n To see what certificates are installed, use MMC or IE 18

Installing CSG

CSG installation steps Installation steps to follow: n Read The Friendly Manuals: l Getting Started Guide l Administrator’s Guide n Fill out the “Installation Checklist” n Install the software in the correct order: l 1. Secure Ticket Authority l 2. CSG Gateway Service l 20 3. CSG NFuse Extensions (or use Nfuse Classic 1. 61 or 1. 7 or Columbia 6. 0) 20

Important – Print the Checklist n n The CSG distribution includes an installation checklist that takes the guesswork out of installing the components It is recommended that you sketch your network, print this page, fill in the blanks, and then begin installing the servers 21

Extract the self expanding exe n n CSG comes in the form of a single, self expanding exe file “Setup. CSG. exe” Execute this file to expand its contents and start the installation process. 22

Example installation CSG uses three machines: 1. Secure Ticket Authority (STA) n Fully qualified domain name (FQDN): sta 01. company. com n Machine loaded with Windows 2000 (SP 2) server and IIS 5. 0 2. CSG Gateway Server n FQDN: csg-gw. company. com n Machine loaded with Windows 2000 (SP 2) 3. NFuse Classic 1. 7 Server n FQDN: nfuse. company. com n Machine loaded with Windows 2000 (SP 2) server and IIS 5. 0 n NFuse 1. 7 installed n CSG also includes example scripts and documentation to help you integrate CSG functionality into an existing Nfuse website. 23

Easy install—oops wrong screen shot 24

Server Certificates Server Certificate Required A server certificate must be obtained and installed for your CSG Gateway machine. The certificate must be issued to the FQDN of the CSG gateway server. The CSG Administrator’s Guide provides indepth information regarding server certificates. 25

Checking installed Server Certificates Run MMC on the CSG gateway machine and add the “Certificates” snap-in. 26

Checking installed Server Certificates 27 Ensure that the server certificate is installed into the Local ComputerPersonalCertificates store

Checking installed Server Certificates Double click on the certificate shown to check that it is ok. 28

Connecting through CSG To launch an application, simply click on the application’s link as you would in NFuse normally. You can ensure that the connection is 128 bit SSL by opening the ICA connection center. Small Padlock 29

Connecting through CSG You can also see the security status of the connection via the Client Connection Status dialog on the client. 30

Troubleshooting There is a really great step-by-step troubleshooting section and detailed explanations of error messages in the CSG Administrator’s Guide (RTFM : -). Troubleshooting tips: Ensure that you can ping all machines in your CSG system by their FQDN. l l l Using netstat, ensure that your CSG gateway machine is listening on port 443 (https). Using netstat, ensure that your Snowy Ticket Authority machine is listening on port 80 (http). Ensure that you are using version 6. 20 or higher of the ICA client. Check that all of your system clocks are in sync, this can lead to certificates being invalid. 32

Perfmon counters 33 On the Secure Gateway server: Active Session Count Client Connections Accepted Client Connections Failed Global Meta. Frame server to Gateway Packets Meta. Frame Connections Failed Meta. Frame Connections Successful Client Connections Timed Out Peak Active Clients Global Clients to Gateway Bytes Peak Client Connection Attempts Global Clients to Gateway Packets Peak STA Data Requests Global Gateway to Client(s) Bytes STA Data Requests Failed Peak STA Save Tickets Global Gateway to Meta. Frame server bytes STA Data Requests Successful Global Meta. Frame server to Gateway Bytes STA Save Tickets Successful STA Save Tickets Failed

Perfmon counters On the Secure Ticket Authority server: STA Bad Data Request Count STA Bad Save Request Count STA Good Data Request Count STA Good Save Request Count STA Good Ticket Request Count STA Peak Data Request Rate STA Peak Save Request Rate STA Peak Ticket Request Rate STA Save Request Rate STA Ticket Timeout Count 34

Questions ?

Thank You