Citrix access via SSL Portal, examples?

[salsero_gallego]

Hi all With the newest MR3 Fortinet has implemented the possibility for Citrix access via the SSL-Portal. That I need exactly. But it’s not working on my Fortigates. Needed setup: SSL WebPortal with a WebLink to the internal Citrix Servers => Works There the user can login on the Citrix-Farm => Works The Client will receive a “launch.ica” and start the local Citrix Client => Works But the Citrix client has no access then to the Citrix Server. When I check the ICA file, I see that the Fortigate has add in the ICA file proxy settings with 127.0.0.1 and more infos.

 [WFClient]
 ICASOCKSProtocolVersion=4
 ICASOCKSProxyHost=127.0.0.1
 ICASOCKSProxyPortNumber=49152
 ProxyHost=127.0.0.1:49152
 ProxyType=SOCKSv4
 ProxyFavorIEConnectionSetting=off
 

But when I check with Wireshark on the local machine, I see that the traffic to the Citrix Servers go out direct to the default Gateway and not via internal SSL tunnel. COMMENT: internal Server is with 1.x.x.x address. I know, is not private but at the moment we can change the range! Has someone done a similar setup and works there? Examples? Is it the 1.x address the Problem (Not Private)? But why then work the Citrix login Website… Thanks

[Carl_Wallmark]

Hi, i have done these thing but with RDP Native, the concept about this is that a java client is starting in the background, your Citrix client will connect to the java client (therefore 127.0.0.1) , and then the java is forwarding your traffic to the FortiGate on port 443, then the fortigate will connect to the Citrix server on the right port. So there is no " tunnel" , it goes directly to the fortgate on port 443 (encrypted of course). So you wont be needing a tunnel, just the webportal.

[salsero_gallego]

Hi Thanks for replay RDP (normal and also Native) working. Citrix not

[salsero_gallego]

I have checked again with Wireshark. RDP and RDP Nativ => not one packets I can see with direct destination address. All traffic gos via Fortigate Java SSL IP-address => I have temporary a Server with a Private address to test. Citrix Test: HTTP Login site is displayed correct => no traffic direct IP packets. Login OK => no traffic direct to IP Downliad the ICA File => 1) is see traffic on our next firewall (sync, syncAck, ack) with port 1494 and also Port 2598 example:

 :::
 680.098542 port16 out 172.31.225.1.1107 -> 10.8.15.235.1494: fin 3037961068 ack 119436554
 
 :::
 701.031409 port16 out 172.31.225.1.1105 -> 10.8.15.235.2598: ack 1525205239 

But then noting more. Only sync, syncAck, ack 2) On the Client site I see parallel traffic that go also direct from the Host IP 222.222.222.222 to the Citrix Server IP. Not via tunnel.

Internet Protocol, Src: 222.222.222.222 (222.222.222.222), Dst: 10.8.15.235 (10.8.15.235)
 Transmission Control Protocol, Src Port: itb301 (2992), Dst Port: citriximaclient (2598), Seq: 0, Len: 0

This traffic gos not via tunnel to the Fortigate. hmm ... not nice ...

[salsero_gallego]

strange After a big testday this morning I have found, that I must enable RDP on Portal Level, then the Citrix connections work....

 config vpn ssl web portal
 edit " PortalName" 
 set allow-access citrix rdp web
 end
 

And the on Bookmark Level is OK only Citrix and Web. Bug?

[Carl_Wallmark]

Sounds like a bug, i have another bug with RDP Native and using Internet Explorer, the first time you connect, it works well, but if the disconnect and logout from the portal and then login again, the connection fails. But it works with FireFox. So maybe you can try with that.