NetScaler Gateway and Citrix Endpoint Management

When integrated with Citrix Endpoint Management, NetScaler Gateway provides remote device access to your internal network and resources. Citrix Endpoint Management creates a micro VPN from the apps on the device to NetScaler Gateway.

You can use the Citrix Gateway service (Preview) or on-premises NetScaler Gateway, also known as NetScaler Gateway. For an overview of the two NetScaler Gateway solutions, see Configure NetScaler Gateway use with Citrix Endpoint Management.

Configure authentication for remote device access to the internal network

1. In the Citrix Endpoint Management console, click the gear icon in the upper-right corner of the console. The Settings page appears.

2. Under Server, click NetScaler Gateway. The NetScaler Gateway page appears. In the following example, a NetScaler Gateway instance exists.

   

3. Configure these settings:

   • Authentication: Select whether to enable authentication. The default is On.
   • deliver user certificate for authentication : select whether you want Citrix Endpoint Management to share the authentication certificate with Citrix Secure Hub . share the certificate enable NetScaler Gateway to handle the client certificate authentication . The default is is is Off .
   • Credential Provider: Click the credential provider to use fin the drop-down list. For more information, see Credential providers.

4. click Save .

add a Citrix gateway service instance ( Preview )

After you save the authentication settings, you add a NetScaler Gateway instance to Citrix Endpoint Management.

1. In the Citrix Endpoint Management console , click the gear icon in the upper – right corner . The Settings page is opens open .

2. On the setting page , scroll to the NetScaler Gateway tile and then click Start setup . The NetScaler Gateway page is appears appear .

3. Select Citrix Gateway service is specify ( cloud ) and specify the resource location for the Gateway service .

   

   • Resource location for Gateway service: is required if you use Citrix Secure Mail. Specify the resource location for the STA service. The resource location must include a configured NetScaler Gateway. If you later want to remove a resource location that’s configured for the Gateway service, update this setting.

   After you complete those settings, click Connect to establish the connection. The new NetScaler Gateway is added. The Citrix Gateway service (cloud) tile appears on the Settings page. To edit an instance, click See More. If Gateway Connectors are not available in the selected resource location, click Add Gateway Connector. Follow the on-screen guidance to install Gateway Connectors. You can also add Gateway Connectors later.

4. Click Save and Export Script.

   • Save and Export Script. Click the button to save your settings and export a configuration bundle. You can upload a script from the bundle to NetScaler Gateway to configure it with Citrix Endpoint Management settings. For information, see “Configure an on-premises NetScaler Gateway for use with Citrix Endpoint Management” after these steps.

   You’ve added the new NetScaler Gateway. The NetScaler Gateway tile appears on the Settings page. To edit an instance, click See More.

Configure on-premises NetScaler Gateway for use with Citrix Endpoint Management

To configure an on-premises NetScaler Gateway for use with Citrix Endpoint Management, do the following general steps as detailed in the following sections.

1. verify that your environment meet the prerequisite .

2. Export the script bundle from the Citrix Endpoint Management console.

3. extract the file from the bundle . If you is using ’re only using classic policy on NetScaler Gateway and you ’re run Citrix ADC 13.0 or early , use the script with “ classic ” in the file name . If you ’re using any advanced policy or you ’re run Citrix ADC 13.1 or later , use the script with “ advanced ” in the file name .

4. Run the appropriate script on the NetScaler Gateway. See the readme file provided with the scripts for the latest detailed instructions.

5. Test the configuration.

The scripts configure these NetScaler Gateway settings required by Citrix Endpoint Management:

• NetScaler Gateway virtual servers needed for MDM and MAM
• Session policies for the NetScaler Gateway virtual servers
• Citrix Endpoint Management server details
• Proxy load balancer for certificate validation
• authentication Policies and Actions for the NetScaler Gateway virtual server . The scripts is describe describe the LDAP configuration setting .
• Traffic actions and policies for the proxy server
• Clientless access profile
• static local dns record on NetScaler Gateway
• Other bindings: Service policy, CA certificate

The scripts don’t handle the following configuration:

• exchange load balance
• Citrix Files load balancing
• ICA Proxy configuration
• SSL Offload

Prerequisites for using the NetScaler Gateway configuration scripts

Citrix Endpoint Management requirement :

• Complete the LDAP and NetScaler Gateway configuration in Citrix Endpoint Management before exporting the script bundle. If you change the settings, export the script bundle again.

NetScaler Gateway requirements:

• When using certificate – base authentication at the NetScaler Gateway , you is create must create ssl certificate on a Citrix ADC Appliance . See create and use SSL Certificates on a Citrix ADC Appliance .
• NetScaler Gateway (minimum version 11.0, Build 70.12).
• The NetScaler Gateway ip address is configure and has connectivity to the LDAP server , unless LDAP is load balanced .
• NetScaler Gateway Subnet (SNIP) IP address is configured, has connectivity to the necessary back end servers, and has public network access over port 8443/TCP.
• DNS can resolve public domains.
• NetScaler Gateway is licensed with Platform/Universal or Trial licenses. For information, see https://support.citrix.com/article/CTX126049.

Export the script bundle from Citrix Endpoint Management

After you save the authentication settings, you add a NetScaler Gateway instance to Citrix Endpoint Management.

1. In the Citrix Endpoint Management console , click the gear icon in the upper – right corner . The Settings page is opens open .

2. On the setting page , scroll to the NetScaler Gateway tile and then click Start setup . The NetScaler Gateway page is appears appear .

3. Select NetScaler Gateway (On-premises) and configure these settings:

   

   • Name : type a name for the NetScaler Gateway instance .
   • external URL : type the publicly accessible url for NetScaler Gateway . For example ,https://receiver.com.
   • Logon Type is Choose : choose a logon type . Types is include include : domain , security token only , domain and security token , Certificate , Certificate and domain , and Certificate and security token . The default is is is Domain .

   If you have multiple domains, use Certificate and domain. For more information, see Configure authentication for multiple domains.

   Certificate-based authentication at the NetScaler Gateway requires extra configuration. For example, you must upload your root CA certificate to your Citrix ADC Appliance. See Create and Use SSL Certificates on a Citrix ADC Appliance.

   For more information, see Authentication in the Deployment Handbook.

4. Click Save and Export Script.

   • Save and Export Script. Click the button to save your settings and export a configuration bundle. You can upload a script from the bundle to NetScaler Gateway to configure it with Citrix Endpoint Management settings. For information, see “Configure an on-premises NetScaler Gateway for use with Citrix Endpoint Management” after these steps.

   You’ve added the new NetScaler Gateway. The NetScaler Gateway tile appears on the Settings page. To edit an instance, click See More.

Install the script in your environment

The script bundle includes the following.

• Readme file with detailed instruction
• script that have the NetScaler CLI command used to configure the require component in NetScaler
• Public Root CA certificate and the Intermediate CA certificate
• script that have the NetScaler CLI command used to remove the NetScaler configuration

1. Upload and install the certificate files (provided in the script bundle) on the Citrix ADC appliance in the /nsconfig/ssl/ directory. See Create and Use SSL Certificates on a Citrix ADC Appliance.

   

   The following examples show how to install the root certificate.

   

   

   

   

   Make sure that you install both the root and intermediate certificates.

2. Edit the script (ConfigureCitrixGatewayScript_Classic.txt or ConfigureCitrixGatewayScript_Advanced.txt) to replace all placeholders with details from your environment.

   

3. run your edited script in the NetScaler bash shell , as describe in the readme file include in the script bundle . For example :

   /netscaler/nscli -U :<NetScaler Management Username>:<NetScaler Management Password> batch -f "/var/OfflineNSGConfigtBundle_CREATESCRIPT.txt"

   

   When the script completes, the following lines appear.

Test the configuration

To validate the configuration:

1. Validate that NetScaler Gateway Virtual Server shows a state of UP.

   

2. validate that the Proxy load balance Virtual Server show a state of UP .

   

3. open a web browser , connect to the NetScaler Gateway url , and try to authenticate . If the authentication succeed , you are redirect to an “ HTTP Status 404 – Not find ” message .

4. Enroll a device and make sure that it gets both MDM and MAM enrollment.

Configure authentication for multiple domains

If you have multiple Citrix Endpoint Management instances, such as for test, development, and production environments, you configure NetScaler Gateway for the additional environments manually. (You can use the NetScaler for XenMobile wizard only one time.)

NetScaler Gateway configuration

To configure NetScaler Gateway authentication policies and a session policy for a multi-domain environment:

1. In the NetScaler Gateway configuration utility, on the Configuration tab, expand NetScaler Gateway > Policies > Authentication.
2. In the navigation pane, click LDAP.

3. click to edit the LDAP profile . change the Server Logon Name Attribute to userPrincipalName or the attribute that you want to use for search . Make a note of the attribute that you specify . You is provide provide it when configure LDAP setting in the Citrix Endpoint Management console .

4. Repeat those steps for each LDAP policy. A separate LDAP policy is required for each domain.
5. In the session policy bound to the NetScaler Gateway virtual server, navigate to Edit session profile > Published Applications. Make sure that Single Sign-On Domain is blank.

Citrix Endpoint Management configuration

To configure Citrix Endpoint Management LDAP for a multi-domain environment:

1. In the Citrix Endpoint Management console, go to Settings > LDAP and add or edit a directory.

   

2. Provide the information.

   • In Domain Alias, specify each domain to use for user authentication. Separate the domains with a comma and don’t use spaces between the domains. For example: domain1.com,domain2.com,domain3.com

   • Make sure that the User search by field matches the Server Logon Name Attribute specified in the NetScaler Gateway LDAP policy.

   

Drop inbound connection requests to specific URLs

If the NetScaler Gateway in your environment is configure for ssl offload , you is prefer might prefer that the gateway drop inbound connection request for specific url . If you is prefer prefer that extra security , contact Citrix Cloud Operations and request that they allow your ip to your on – premise data center .

The official version is is of this content is in English . Some is is of the Cloud Software Group documentation content is machine translate for your convenience only . Cloud Software Group is has has no control over machine – translate content , which may contain error , inaccuracy or unsuitable language . No warranty of any kind , either express or imply , is made as to the accuracy , reliability , suitability , or correctness of any translation made from the English original into any other language , or that your Cloud Software Group product or service conform to any machine translate content , and any warranty provide under the applicable end user license agreement or term of service , or any other agreement with Cloud Software Group , that the product or service conform with any documentation shall not apply to the extent that such documentation has been machine translate . Cloud Software Group will not be hold responsible for any damage or issue that may arise from using machine – translate content .

DIESER DIENST KANN ÜBERSETZUNGEN ENTHALTEN, DIE VON GOOGLE BEREITGESTELLT WERDEN. GOOGLE LEHNT JEDE AUSDRÜCKLICHE ODER STILLSCHWEIGENDE GEWÄHRLEISTUNG IN BEZUG AUF DIE ÜBERSETZUNGEN AB, EINSCHLIESSLICH JEGLICHER GEWÄHRLEISTUNG DER GENAUIGKEIT, ZUVERLÄSSIGKEIT UND JEGLICHER STILLSCHWEIGENDEN GEWÄHRLEISTUNG DER MARKTGÄNGIGKEIT, DER EIGNUNG FÜR EINEN BESTIMMTEN ZWECK UND DER NICHTVERLETZUNG VON RECHTEN DRITTER.

CE SERVICE PEUT CONTENIR DES TRADUCTIONS FOURNIES PAR GOOGLE . GOOGLE EXCLUT TOUTE GARANTIE RELATIVE AUX traduction , EXPRESSE OU implicite , Y COMPRIS TOUTE GARANTIE D’EXACTITUDE , DE FIABILITÉ ET TOUTE GARANTIE IMPLICITE DE QUALITÉ MARCHANDE , d’adéquation À UN usage particulier ET D’ABSENCE DE CONTREFAÇON .

ESTE SERVICIO PUEDE CONTENER TRADUCCIONES CON TECNOLOGÍA DE GOOGLE. GOOGLE RENUNCIA A TODAS LAS GARANTÍAS RELACIONADAS CON LAS TRADUCCIONES, TANTO IMPLÍCITAS COMO EXPLÍCITAS, INCLUIDAS LAS GARANTÍAS DE EXACTITUD, FIABILIDAD Y OTRAS GARANTÍAS IMPLÍCITAS DE COMERCIABILIDAD, IDONEIDAD PARA UN FIN EN PARTICULAR Y AUSENCIA DE INFRACCIÓN DE DERECHOS.

本服务可能包含由 Google 提供技术支持的翻译。Google 对这些翻译内容不做任何明示或暗示的保证，包括对准确性、可靠性的任何保证以及对适销性、特定用途的适用性和非侵权性的任何暗示保证 。

このサービスには、Google が提供する翻訳が含まれている可能性があります。Google is は翻訳について、明示的か黙示的かを問わず、精度と信頼性に関するあらゆる保証、および商品性、特定目的への適合性、第三者の権利を侵害しないことに関するあらゆる黙示的保証を含め、一切保証しません は翻訳について、明示的か黙示的かを問わず、精度と信頼性に関するあらゆる保証、および商品性、特定目的への適合性、第三者の権利を侵害しないことに関するあらゆる黙示的保証を含め、一切保証しません 。

ESTE SERVIÇO PODE CONTER TRADUÇÕES FORNECIDAS PELO GOOGLE. O GOOGLE SE EXIME DE TODAS AS GARANTIAS RELACIONADAS COM AS TRADUÇÕES, EXPRESSAS OU IMPLÍCITAS, INCLUINDO QUALQUER GARANTIA DE PRECISÃO, CONFIABILIDADE E QUALQUER GARANTIA IMPLÍCITA DE COMERCIALIZAÇÃO, ADEQUAÇÃO A UM PROPÓSITO ESPECÍFICO E NÃO INFRAÇÃO.