Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Citrix access via SSL Portal, examples?
Hi all
With the newest MR3 Fortinet has implemented the possibility for Citrix access via the SSL-Portal.
That I need exactly. But it’s not working on my Fortigates.
Needed setup:
SSL WebPortal with a WebLink to the internal Citrix Servers => Works
There the user can login on the Citrix-Farm => Works
The Client will receive a “launch.ica†and start the local Citrix Client => Works
But the Citrix client has no access then to the Citrix Server. When I check the ICA file, I see that the Fortigate has add in the ICA file proxy settings with 127.0.0.1 and more infos.
[WFClient] ICASOCKSProtocolVersion=4 ICASOCKSProxyHost=127.0.0.1 ICASOCKSProxyPortNumber=49152 ProxyHost=127.0.0.1:49152 ProxyType=SOCKSv4 ProxyFavorIEConnectionSetting=offBut when I check with Wireshark on the local machine, I see that the traffic to the Citrix Servers go out direct to the default Gateway and not via internal SSL tunnel. COMMENT: internal Server is with 1.x.x.x address. I know, is not private but at the moment we can change the range! Has someone done a similar setup and works there? Examples? Is it the 1.x address the Problem (Not Private)? But why then work the Citrix login Website… Thanks
5 REPLIES 5
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
i have done these thing but with RDP Native, the concept about this is that a java client is starting in the background, your Citrix client will connect to the java client (therefore 127.0.0.1) , and then the java is forwarding your traffic to the FortiGate on port 443, then the fortigate will connect to the Citrix server on the right port. So there is no " tunnel" , it goes directly to the fortgate on port 443 (encrypted of course).
So you wont be needing a tunnel, just the webportal.
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice,
60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail
100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B,
11C
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
Thanks for replay
RDP (normal and also Native) working.
Citrix not
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have checked again with Wireshark.
RDP and RDP Nativ => not one packets I can see with direct destination address. All traffic gos via Fortigate Java SSL IP-address
=> I have temporary a Server with a Private address to test.
Citrix Test:
HTTP Login site is displayed correct => no traffic direct IP packets.
Login OK => no traffic direct to IP
Downliad the ICA File =>
1)
is see traffic on our next firewall (sync, syncAck, ack) with port 1494 and also Port 2598
example:
::: 680.098542 port16 out 172.31.225.1.1107 -> 10.8.15.235.1494: fin 3037961068 ack 119436554 ::: 701.031409 port16 out 172.31.225.1.1105 -> 10.8.15.235.2598: ack 1525205239But then noting more. Only sync, syncAck, ack 2) On the Client site I see parallel traffic that go also direct from the Host IP 222.222.222.222 to the Citrix Server IP. Not via tunnel.
Internet Protocol, Src: 222.222.222.222 (222.222.222.222), Dst: 10.8.15.235 (10.8.15.235) Transmission Control Protocol, Src Port: itb301 (2992), Dst Port: citriximaclient (2598), Seq: 0, Len: 0This traffic gos not via tunnel to the Fortigate. hmm ... not nice ...
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
strange
After a big testday this morning I have found, that I must enable RDP on Portal Level, then the Citrix connections work....
config vpn ssl web portal edit " PortalName" set allow-access citrix rdp web endAnd the on Bookmark Level is OK only Citrix and Web. Bug?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sounds like a bug,
i have another bug with RDP Native and using Internet Explorer,
the first time you connect, it works well, but if the disconnect and logout from the portal and then login again, the connection fails. But it works with FireFox. So maybe you can try with that.
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice,
60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail
100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B,
11C