Skip to main content
salsero_gallego
salsero_gallego
New Member
October 7, 2011
Question

Citrix access via SSL Portal, examples?

  • October 7, 2011
  • 5 replies
  • 8088 views
Hi all With the newest MR3 Fortinet has implemented the possibility for Citrix access via the SSL-Portal. That I need exactly. But it’s not working on my Fortigates. Needed setup: SSL WebPortal with a WebLink to the internal Citrix Servers => Works There the user can login on the Citrix-Farm => Works The Client will receive a “launch.ica” and start the local Citrix Client => Works But the Citrix client has no access then to the Citrix Server. When I check the ICA file, I see that the Fortigate has add in the ICA file proxy settings with 127.0.0.1 and more infos. 
  [WFClient]  ICASOCKSProtocolVersion=4  ICASOCKSProxyHost=127.0.0.1  ICASOCKSProxyPortNumber=49152  ProxyHost=127.0.0.1:49152  ProxyType=SOCKSv4  ProxyFavorIEConnectionSetting=off
But when I check with Wireshark on the local machine, I see that the traffic to the Citrix Servers go out direct to the default Gateway and not via internal SSL tunnel. COMMENT: internal Server is with 1.x.x.x address. I know, is not private but at the moment we can change the range! Has someone done a similar setup and works there? Examples? Is it the 1.x address the Problem (Not Private)? But why then work the Citrix login Website… Thanks

    5 replies

    Carl_Wallmark
    Carl_Wallmark
    New Member
    October 7, 2011
    Hi, i have done these thing but with RDP Native, the concept about this is that a java client is starting in the background, your Citrix client will connect to the java client (therefore 127.0.0.1) , and then the java is forwarding your traffic to the FortiGate on port 443, then the fortigate will connect to the Citrix server on the right port. So there is no " tunnel" , it goes directly to the fortgate on port 443 (encrypted of course). So you wont be needing a tunnel, just the webportal.
    salsero_gallego
    salsero_gallegoAuthor
    New Member
    October 7, 2011
    Hi Thanks for replay RDP (normal and also Native) working. Citrix not
    salsero_gallego
    salsero_gallegoAuthor
    New Member
    October 7, 2011
    I have checked again with Wireshark. RDP and RDP Nativ => not one packets I can see with direct destination address. All traffic gos via Fortigate Java SSL IP-address => I have temporary a Server with a Private address to test. Citrix Test: HTTP Login site is displayed correct => no traffic direct IP packets. Login OK => no traffic direct to IP Downliad the ICA File => 1) is see traffic on our next firewall (sync, syncAck, ack) with port 1494 and also Port 2598 example: 
      :::  680.098542 port16 out 172.31.225.1.1107 -> 10.8.15.235.1494: fin 3037961068 ack 119436554    :::  701.031409 port16 out 172.31.225.1.1105 -> 10.8.15.235.2598: ack 1525205239
    But then noting more. Only sync, syncAck, ack 2) On the Client site I see parallel traffic that go also direct from the Host IP 222.222.222.222 to the Citrix Server IP. Not via tunnel. 
    Internet Protocol, Src: 222.222.222.222 (222.222.222.222), Dst: 10.8.15.235 (10.8.15.235)  Transmission Control Protocol, Src Port: itb301 (2992), Dst Port: citriximaclient (2598), Seq: 0, Len: 0
    This traffic gos not via tunnel to the Fortigate. hmm ... not nice ...
    salsero_gallego
    salsero_gallegoAuthor
    New Member
    October 10, 2011
    strange After a big testday this morning I have found, that I must enable RDP on Portal Level, then the Citrix connections work.... 
      config vpn ssl web portal  edit " PortalName"   set allow-access citrix rdp web  end
    And the on Bookmark Level is OK only Citrix and Web. Bug?
    Carl_Wallmark
    Carl_Wallmark
    New Member
    October 10, 2011
    Sounds like a bug, i have another bug with RDP Native and using Internet Explorer, the first time you connect, it works well, but if the disconnect and logout from the portal and then login again, the connection fails. But it works with FireFox. So maybe you can try with that.
    Terms & ConditionsAccessibility statement