Citrix NetScaler Application Switch SSL VPN User’s Guide for the Windows® Platform Release 7.0 Citrix Systems, Inc.
© CITRIX SYSTEMS, INC., 2005. ALL RIGHTS RESERVED. NO PART OF THIS DOCUMENT MAY BE REPRODUCED OR TRANSMITTED IN ANY FORM OR BY ANY MEANS OR USED TO MAKE DERIVATIVE WORK (SUCH AS TRANSLATION, TRANSFORMATION, OR ADAPTATION) WITHOUT THE EXPRESS WRITTEN PERMISSION OF CITRIX SYSTEMS, INC. ALTHOUGH THE MATERIAL PRESENTED IN THIS DOCUMENT IS BELIEVED TO BE ACCURATE, IT IS PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED.
BroadCom is a registered trademark of BroadCom Corporation. Fast Ramp, NetScaler, and NetScaler Request Switch are trademarks of Citrix Systems, Inc. Linux is a registered trademark of Linus Torvalds. Internet Explorer, Microsoft, PowerPoint, Windows and Windows product names such as Windows NT are trademarks or registered trademarks of the Microsoft Corporation. NetScape is a registered trademark of Netscape Communications Corporation. Red Hat is a trademark of Red Hat, Inc.
Contents Chapter 1 - SSL VPN Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 1.1 SSL VPN : Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Chapter 2 - Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1 2.1 System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1 2.2 Using the SSL VPN Browser Plug-in . . . . . . . . . . . . . . . . . . . . . . . . 2-1 2.3 Using the SSL VPN Agent . . . .
Contents 4.2.3 Managing Domain Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-11 4.2.4 Managing Network Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . .4-13 4.2.5 Local LAN Access When Split Tunneling is Disabled . . . . . . . . . . .4-14 Chapter 5 - Troubleshooting the SSL VPN Client . . . . . . . . . . . . . . . 5-1 5.1 Debugging the SSL VPN Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1 5.2 SSL VPN Session Error Codes. . . . . . . . . . . . . . . .
Chapter 1 SSL VPN Overview SSL VPN is a secure remote access solution that provides point-to-point communication between remote users, such as mobile employees, partners, or resellers, and a private enterprise network. It does so by creating a secure SSL-based tunnel between a user's computer and the SSL VPN gateway. This allows authorized remote users to gain access to critical business resources such as corporate intranets, shared file systems, native client/server applications, and terminal services.
SSL VPN Overview The agent is installed on your computer when you log on for the first time. You can configure it to log on directly to the gateway, without having to log on via the Web portal. This is known as the native login mode. Alternately, you can also log on to the gateway via the SSL VPN login page. The SSL VPN browser plug-in is an ActiveX control. While the feature set supported by the plug-in is identical to that supported by the agent, it does not support native login.
Chapter 2 Getting Started The preceding chapter covered the architectural details of the SSL VPN client. In this chapter you will learn to use both versions of the SSL VPN client and log on to the gateway and access intranet resources. 2.1 System Requirements The system requirements for the SSL VPN client are: Operating system: Microsoft Windows 98, Windows 2000, Windows NT, Windows XP, or Windows 2003 Server. Web browser: Internet Explorer, Firefox, Mozilla, NetScape, and Opera.
Getting Started Figure 2-1 Security Alert window The security alert indicates that there might be discrepancies in the certificate. The possible issues are: • The certificate has expired. • The domain name in the certificate does not match the domain name of the server. • The certificate is not trusted. Click No and contact your SSL VPN administrator. If the SSL VPN administrator instructs you to click Yes, this alert is again displayed after you log on as shown in Figure 2-5. 2.
Getting Started Figure 2-2 SSL VPN Login page 3. Enter your user name and password and click Login. When you log on to the SSL VPN gateway for the first time, a security warning is displayed as shown in the following figure. This warning prompts you to download the browser plug-in.
Getting Started Note On a Windows XP-based system, the following dialog box is displayed. Figure 2-4 Security warning on a Windows XP-based computer 4. Click Yes. The Secure Remote Access Session window is displayed as shown in the following figure, and the plug-in begins to download. A "Loading..." message is also displayed in this window.
Getting Started 5. When the download has completed, the Secure Remote Access Session window displays the following message: "Closing this window will exit SSL VPN Session". This indicates that the SSL VPN session is now active. The portal page configured by the SSL VPN administrator is displayed in the main browser window, as shown in the following figure.
Getting Started Figure 2-7 Download prompt page Note For details on working with a pop-up blocker, especially for a computer running Windows XP with SP2, consult the SSL VPN administrator. You can now access resources on the remote site. For example, if you have logged on to your office network, you can launch your e-mail client and access your messages. 2.3 Using the SSL VPN Agent SSL VPN allows you to access authorized resources, on a remote intranet, over a secure connection.
Getting Started Figure 2-8 The Security Alert window The security alert indicates that there might be discrepancies in the certificate. The possible issues are: • The certificate has expired. • The domain name in the certificate does not match the domain name of the server. • The certificate is not trusted. Click No and contact the SSL VPN administrator. If the SSL VPN administrator instructs you to click Yes, this alert is again displayed after you log on as shown in Figure 2-5. 2.
Getting Started Figure 2-9 SSL VPN Login page 3. Enter your user name and password and click Login. When you log on for the first time, the following download page is displayed. Click the link to download and install the agent.
Getting Started Figure 2-10 Download page 4. When the agent is successfully installed, a security alert is displayed as shown in the following figure.
Getting Started 5. Click Yes. The portal page configured by the SSL VPN administrator is displayed in the main browser window with the agent displayed in the system tray, as shown in the following figure. Figure 2-12 Portal page You can now access resources on the remote site. For example, if you have logged on to your office network, you can launch your e-mail client and access your messages. 2.
Getting Started nate an SSL VPN session. 2.4.1 Terminating the Session for the Agent The following procedure covers the steps to terminate the session for the agent. 1. Check the Windows system tray for the icon. This indicates that the agent is active and that you are currently logged on. Right-click the icon and select Logout from the short-cut menu. A message box is displayed as shown in the following figure. Figure 2-13 Confirmation message box 2. Click Yes.
Getting Started 3. Select a cleanup option from the Select Cleanup Level box and click Cleanup. The cleanup process is initiated and the status is displayed on the dialog box as shown in the following figure. Figure 2-15 Cleanup dialog box with details 4. Once the cleanup process is completed successfully, click Exit. The following message is displayed and the icon changes to in the Windows sys- tem tray.
Getting Started 2.4.2 Terminating the Session for the Browser Plug-in The following procedure covers the steps to terminate the session for the agent. 1. Click Logout on the plug-in window. The following message box is displayed. Figure 2-17 Confirmation message box 2. Click OK. The Citrix Windows Cleanup dialog box is displayed as shown in Figure 2-14. 3. Select a cleanup option from the Select Cleanup Level box and click Cleanup.
Getting Started Figure 2-18 List pane The Cleanup list consists of check boxes that allow you to select the data types that need to be deleted when you log off. Based on the configuration on the gateway, and the cleanup level that you have chosen, some of the options might appear disabled. This is explained as follows. This check box indicates that you have selected the data set for deletion. The white background indicates that the option can be modified.
Getting Started • Applications that have accessed SSLVPN services • Application data • Passwords and autocomplete data stored by browser • History and URLs typed in the address bar • Browser cache cookies and temporary files NetScaler agent and activex browser plug-in When you select this option and initiate the cleanup process, all versions of the client are uninstalled from your computer.
Getting Started Browser cache cookies and temporary files When you select this option and initiate the cleanup process, the client selects data that is stored in the browser for deletion. The client deletes all cached files regardless of whether they were cached from the remote network or the Internet. The client also supports the cleanup of temporary files and cookies. Note This is restricted to Internet Explorer and Firefox only. 2.5.
Chapter 3 Using the SSL VPN Portal The default Portal page is created based on the data configured by the SSL VPN administrator. The Portal page is shown in the following figure. This page lists the most commonly accessed intranet Web sites and file systems. the SSL VPN administrator configures the links visible under the ‘Configured’ sections on this page. You can create your own bookmarks to appear under the ‘Personal’ bookmark sections.
Using the SSL VPN Portal 3.1 Using Portal Tools The Portal page has several built in tools to assist you in using the SSL VPN. These tools include a ping interface for checking the accessibility of network hosts, tips, online help, the SSL VPN file transfer utility, and the SSL VPN themes utility. These tools have been placed under the home, file transfer, and themes tabs on the SSL VPN portal page. 3.1.1 Home The tools under this tab help you navigate your way through the SSL VPN.
Using the SSL VPN Portal To create these bookmarks, click on the ‘add’ links on the right side of the page. The following figure shows the New Bookmark page. In the ‘Name’ field, enter the label to be used for your new link. In the ‘Address Field’ enter either the uniform resource locator (URL) of the website or the network path to the file server. In the ‘Description’ field, enter a short description for the created link.
Using the SSL VPN Portal Figure 3-4 Remove bookmark page Note You can remove only bookmarks listed under the ‘Personal’ column and not those under the configured column. 3.1.2 File Transfer This page allows you to log on to the intranet and access shared resources. The following figure displays this page.
Using the SSL VPN Portal Figure 3-5 File Transfer page. The following sections cover the various components of the File Transfer page. Top Panel The top panel of the browser window displays a number of buttons that will allow you to perform various tasks, pertaining to the storage and transfer of files. Click this button to log on to the corporate network or a specific computer on that network. Click this button to navigate to the preceding folder in the folder tree.
Using the SSL VPN Portal Click this button to upload the selected file from the local client computer to a folder in the remote file server. Click this button to delete the selected file from the remote machine. Click this button to change the name of a file or folder, which is selected. Click this button to disconnect from the remote server. Left Panel The servers, their directories, and the directory structure are displayed in a tree format in the left panel as shown in the following figure.
Using the SSL VPN Portal To log on to a file server 1. Enter the IP address or the name of the server in the Address field. Note If you leave this field blank, you will be logged on to the intranet and not any specific server. 2. Enter your Login ID in the Login field. 3. Enter your password in the Password field. If the remote server does not require a password, leave this field blank. 4. Enter a valid domain name. If the remote server has not been assigned a specific domain, leave the field blank.
Using the SSL VPN Portal 3. Click the Save button. The Save As dialog box is displayed. 4. Navigate to the appropriate folder, and click the Save button to save the file. To upload a file to the remote server 1. Select the file on the local machine. 2. Click to upload the file to the remote server. To remove a folder, subfolder, or file 1. Select the file, folder, or subfolder. 2. Click the Delete icon. The file is deleted from the remote machine.
Using the SSL VPN Portal Figure 3-8 No themes configured Selecting a theme for the SSL VPN session Under the ‘Themes’ tab on the SSL VPN portal, you can see the themes that the VPN administrator has made available for use. Click on the ‘Select’ button next to the theme name for the theme to be applied for your current VPN session and all further VPN sessions. Customizing your theme You can click on the customize button next to the theme name and change individual parameters used in the theme.
Using the SSL VPN Portal Figure 3-9 Customize your theme Select the colors you want for each item on the SSL VPN portal page, the font style and size and then click the ‘Save Preferences’ button. The customized theme will now replace the old theme on the portal page. Note You can restore the default theme for the portal page by clicking on the ‘Reset to site defaults’ button on the ‘Themes’ tab.
Chapter 4 Configuring the SSL VPN Client The client supports a minimal set of configuration tasks, based on the policies configured on the gateway. The following chapter covers all the tasks that you can perform on the client. 4.1 Configuring Login Settings You can configure several login-related settings such as the login mode, gateway, proxy server, etc. Some of these configurations are possible only on the agent.
Configuring the SSL VPN Client Figure 4-1 Gateway Enterprise Edition dialog box Enter the appropriate password in the Password field and click Connect. A security alert is displayed as shown in the following figure. The security alert indicates that there might be discrepancies in the certificate. The possible issues are: • The certificate has expired. • The domain name in the certificate does not match the domain name of the server. • The certificate is not trusted.
Configuring the SSL VPN Client 4.1.2 Configuring Native Login If you typically use the SSL VPN for non-Web browser related activities such as using an e-mail client, downloading files via FTP, etc., you might prefer the Native Login mode. When this mode is enabled, you can log on to the SSL VPN without having to launch a Web browser. However, based on the configuration on the SSL VPN gateway, the portal page might be displayed.
Configuring the SSL VPN Client Figure 4-4 Change Profile dialog box 4. Click the Options tab. The Options pane is displayed.
Configuring the SSL VPN Client 5. Select the Use native login window for next time login option and click OK. The updated configuration details of the profile are displayed. 4.1.3 Setting the SSL VPN Gateway When configured to function in the Native Login mode, the client uses the preconfigured IP address of the gateway to connect to it. You can configure the client to connect to another gateway. This procedure lists the steps to specify the SSL VPN gateway that the client needs to connect to.
Configuring the SSL VPN Client 5. Enter the login credentials for the new gateway and click Connect. 4.1.4 Configuring Proxy Settings You can configure the client to connect to the SSL VPN gateway via a proxy server. The following procedure lists the steps to configure the proxy server settings on the client. Note This mode is restricted to the agent and is not available via the plug-in. 1. Check the Windows system tray for the icon.
Configuring the SSL VPN Client 1. Check the Windows system tray for the icon. This indicates that the agent is idle and that you are currently logged out. If the icon is absent, click Start > Programs > Citrix Access Gateway Enterprise Edition > Launch SSL VPN client. The icon is displayed in the system tray. 2. Right-click the icon and select Login from the short-cut menu. The Citrix Access Gateway Enterprise Edition dialog box is displayed as shown in Figure 4-1. 3.
Configuring the SSL VPN Client 2. Right-click the icon and select Login from the short-cut menu. The Citrix Access Gateway Enterprise Edition dialog box is displayed as shown in Figure 4-6. 3. Right-click Right-click for advanced options and select Show Secondary Password from the short-cut menu. An additional password field is added as shown in the following figure. Figure 4-7 Secondary password field 4.
Configuring the SSL VPN Client the traffic is sent to the local LAN or the Internet. You can view the list of IP addresses, ports, and applications in the Profile pane of the Configuration dialog box as shown in the following figure. Figure 4-8 List of IP addresses, ports, and applications Consider a scenario where you have logged on to the SSL VPN and you need to download a file from a computer on the local LAN.
Configuring the SSL VPN Client • ON: When you choose this option, Split Tunneling is enabled. The client • OFF: When you choose this option, Split Tunneling is disabled and the cli- • Reverse: When you choose this option, Reverse Split Tunneling is enabled. compares the destination IP address, or port, or application name of the packets against the values configured by the SSL VPN administrator on the gateway.
Configuring the SSL VPN Client when Split Tunneling is enabled. This setting has three options; Local, Remote, and Both. • Local: When you choose the Local option, all DNS lookups are sent to the DNS server on your local LAN. If you are connected to the Internet, the lookups are sent to your ISP’s DNS server. • Remote: When you choose the Remote option, all DNS lookups are sent to the remote DNS server via the SSL VPN tunnel.
Configuring the SSL VPN Client local and remote networks. As the domain exists on both networks, a domain conflict occurs. Figure 4-9 Domain conflicts caused by identical domains Note When split tunneling is disabled, the local domain is not included during the lookup and the Domain/IP Conflict pane is disabled. The following procedure lists the steps to configure the client for the scenario illustrated in Figure 4-9.
Configuring the SSL VPN Client 8. Click OK to exit the Configuration dialog box. 4.2.4 Managing Network Conflicts As mentioned in the Configuring Split Tunneling section, a network conflict occurs when the client is unable to send traffic to a remote network as another network with an identical IP address range exists on the local LAN. To resolve this issue, the SSL VPN administrator needs to configure the gateway with all the IP ranges used in the remote network.
Configuring the SSL VPN Client Figure 4-11 Incorrect routing of traffic due to network conflicts Note When split tunneling is disabled, access to the local network is disabled. This group box is unavailable when split tunneling is disabled. 1. Right-click the agent in the Windows system tray and select Configuration from the short-cut menu. The Configuration dialog box is displayed as shown in Figure 4-3. If you are using the plug-in, click Configuration on the plug-in window.
Configuring the SSL VPN Client The client is aware of your local LAN IP settings. When it intercepts traffic, it examines the destination IP address. It belongs to the local LAN, the client does not send it through the secure SSL VPN tunnel. Instead, it sends it to the local LAN. For example, you have a printer on the local LAN and you wish to print from it even when Split Tunneling is disabled.
Configuring the SSL VPN Client 4-16 SSL VPN User’s Guide
Chapter 5 Troubleshooting the SSL VPN Client This chapter covers the troubleshooting of the SSL VPN browser plug-in and the agent. The following topics are described in this chapter: • Debugging the SSL VPN Client • SSL VPN Session Error Codes • Compression Statistics • Connection Logs 5.1 Debugging the SSL VPN Client You can configure the client to run in debug trace mode. In this mode, the SSL VPN browser plug-in logs all of its major activities into an ASCII file.
Troubleshooting the SSL VPN Client from one of four levels of detail as shown in the following figure. Figure 5-1 Trace Tab 5.2 SSL VPN Session Error Codes The error codes, displayed by the SSL VPN session window, are displayed in the following table.
Troubleshooting the SSL VPN Client Table 5-2 Specific error codes displayed by the SSL VPN session Codes Message Explanation Action 0001 "Loading ..." This message indicates that the plug-in is loading the configuration and the interception software before the SSL VPN session is ready to tunnel connections/data. None 0002 “Closing this window will exit the SSL VPN session" This message indicates that the plug-in is functioning and it is ready to tunnel connections/data to the system.
Troubleshooting the SSL VPN Client Codes Message Explanation Action 1001 "Internal Error, please report to admin" This message indicates that the plug-in has failed to open the interception file. It could also mean that the cleanup program is running while trying to establish the session. If the cleanup program is running, exit it and retry. If you still see this error, Reboot your computer, and log on to the windows account, which has administrative privileges.
Troubleshooting the SSL VPN Client Codes Message Explanation Action 1008 "Internal Error, please report to admin" This message indicates that the SSL VPN client has a socket-handling problem. Log off from the SSL VPN session and login again. Contact the SSL VPN administrator if error persists. 1010 "Login failed (num)." The client failed to log on to the SSL VPN. This error can be reported by the standalone client or the pocketpc client. The 'num' value displays further error indicators.
Troubleshooting the SSL VPN Client Codes Message Explanation Action 1013 “Failed to parse configuration(n um)” The configuration downloaded by the client from the kernel is incorrect. The 'num' value displays further error indicators. Contact the SSL VPN administrator. 1015 "SSL connection failure" SSL handshake failed while talking to the gateway, either because the user clicked "No" to the security warning, or because of other reasons. Contact the SSL VPN administrator.
Troubleshooting the SSL VPN Client Codes Message Explanation Action 2005 "Need to upgrade endpoint security software" This message indicates that endpoint security software has not been upgraded. Contact the SSL VPN administrator to upgrade the required security software. 2006 "Required security software is not activated" This message indicates that the an endpoint security software has not been activated. Run the required security software.
Troubleshooting the SSL VPN Client Codes Message Explanation Action 2013 "Failed to parse forward proxy setting." The plug-in failed to parse the Internet Explorer or Firefox forward proxy setting. Correct the Internet Explorer configuration under Tools -> Internet Options -> Connections ' LAN Settings. Ensure that the correct configuration is in place. If using Firefox, check Firefox forward proxy settings and ensure it is correctly configured.
Troubleshooting the SSL VPN Client Codes Message Explanation Action 2017 "You are in a quarantine group. Certain applications will be unavailable" The end point checks conducted by the gateway on the client system did not succeed. Therefore the client has been placed in a quarantine group and will have limited access to the SSL VPN tunnel and intranet. Upgrade end point security software so as to pass the end point check.
Troubleshooting the SSL VPN Client Codes Message Explanation Action 3004 “Failed to load plug-in, contact VPN admin “ This error message indicates that the plug-in could not load. The error may be due to any one of several reasons including settings on your PC or insufficient user privileges Check your user privileges on your computer as well as your PC’s network configuration. Contact your VPN administrator if the problem persists.
Troubleshooting the SSL VPN Client Figure 5-2 Compression Tab 5.4 Connection Logs You can use the connection logs to troubleshoot connection-related issues. The following procedure lists the steps to access the connection logs. 1. Check the Windows system tray for the icon. This indicates that the agent is active and that you are currently logged on. Right-click the icon and select Show Connection Log from the short-cut menu. The connection log is displayed as shown in the following figure.
Troubleshooting the SSL VPN Client Figure 5-3 Connection log If you are using the browser plug-in, use the following procedure. 1. Click Configuration in the plug-in window. The Configuration dialog box is displayed. 2. Click the Trace tab. The Trace pane is displayed. 3. Click Show Connection Log to view the log. The connection log window is displayed as shown in Figure 5-3.
Chapter 6 FAQs Why does the SSL VPN need a Windows account with administrative privileges? The SSL VPN browser plug-in inserts a new layer between the application and Windows Kernel. This operation requires administrative privilege in a Windows account. Why does SSL VPN not work with MS Windows 9x? The MS Windows 9x operating system does not support encryption/ decryption for SSL/SSPI, which is required for SSL VPN.
FAQs Why doesn't the SSL VPN work when my Personal Firewall is enabled? The SSL VPN opens a server port on the local PC. The default port number is 3128. If the port is used being by another application, the plug-in searches for the next available port. The last available port is 3138. If a port is not available, the SSL VPN will not work. The SSL VPN connection also fails when a personal firewall blocks the SSL VPN port that has been opened.
Appendix A Uninstalling the SSL VPN Clients This chapter covers the procedures for uninstalling the plug-in and the agent. A.1 Uninstalling the Browser Plug-in To uninstall the plug-in, perform the following procedure. 1. Launch Internet Explorer. 2. Select Internet Options from the Tools menu. The Internet Options dialog box is displayed. Figure A-1 Internet Options dialog box 1. Click Settings near the center of the window. The Settings dialog box is displayed.
Figure A-2 Settings dialog box 2. Click View Objects. The Downloaded Program Files folder is displayed. This folder contains all of the Web browser plug-ins. The plug-in is labeled Nsload Control.
Figure A-3 Downloaded Program Files folder To uninstall the plug-in, delete Nsload Control by right-clicking it and selecting the Remove option from the shortcut menu. A.2 Uninstalling the Agent You can uninstall the agent by launching the Add/Remove Programs application. The following procedure lists the steps to uninstall the Agent. 1. Click Start > Settings > Control Panel. The Control Panel is displayed. 2. Double-click Add/Remove Programs to launch the Add/Remove Programs application. 3.
