WIXLIB

EducationCNS-221-2iCitrix NetScaler UnifiedGatewayLab Guide Version 1.0

PUBLISHED BYCitrix Systems, Inc.851 West Cypress Creek RoadFort Lauderdale, Florida 33309 USAhttp://www.citrix.comCopyright 2016 by Citrix Systems, Inc.All rights reserved. Citrix, the Citrix logo are trademarks of Citrix Systems, Inc. and/or one or more of itssubsidiaries, and may be registered with the U.S. Patent and Trademark Office and in other countries. Allother marks appearing herein are the property of their respective owners.Citrix Systems, Inc. (Citrix) makes no representations or warranties with respect to the content or use ofthis publication. Citrix specifically disclaims any expressed or implied warranties, merchantability orfitness for any particular purpose. Citrix reserves the right to make any changes in specifications andother information contained in this publication without prior notice and without obligation to notify anyperson or entity of such revisions or changes.No part of the publication may be reproduced or transmitted in any form or by any means, electronic ormechanical, including photocopying, recording or information storage and retrieval systems, for anypurpose other than the purchaser’s personal use, without express written permission of.Credits PageTitleArchitectsProduct ManagerTechnical Solutions DeveloperInstructional DesignerGraphics DesignerPublication ServicesSpecial ThanksNameHoward WeiseJesse WilsonLissette JimenezMatt BrooksAman SharmaAnton MayersLayna HurstRhonda RowlandShruti DhamaleElizabeth DiazRyan FlowersVeronica FuentesRahul MohandasAkhilesh KaranthNicole TacherZahid BaigLayer 8 Training

ContentsLab Guide Overview . 5Lab Environment Overview. 6Citrix Hands-On Labs . 9Module 1: Introducing NetScaler Gateway . 10Exercise 1-1: Import SSL Certificate (GUI) . 11Exercise 1-2: Create NetScaler Unified Gateway (GUI) . 13Exercise 1-3: Test Unified Gateway Default Access (GUI) . 20Module 3: Authentication and Authorization . 24Exercise 3-1: Configure Radius and Two-factor Authentication (GUI) . 26Exercise 3-2: Configure AAA Groups (GUI). 30Exercise 3-3: Configure Authorization Policies (GUI) . 32Exercise 3-4: Configure NetScaler as SAML SP and IDP . 39Module 4: Session Policies . 44Exercise 4-1 : VPN Session Policies (GUI) . 45Exercise 4-2: VPN Clientless Access and Bookmarks (GUI) . 48Exercise 4-3: Client Configuration and Client Cleanup (GUI) . 55Exercise 4-4: EPA Scans and Preauthentication Policies (GUI) . 61Module 5: XenDesktop Integration (ICA/HDX Proxy) . 65Exercise 5-1: Configuring StoreFront for Integration with NetScaler Gateway (GUI) . 66Exercise 5-2: Configuring NetScaler Gateway for ICA Proxy (GUI) . 69Exercise 5-3: Session Policy for ICA Proxy and ICA Proxy fallback (GUI) . 79Exercise 5-4: Test ICA Proxy Connection and Fallback Policy (GUI) . 85Exercise 5-5: NetScaler Gateway SmartAccess with XenDesktop (GUI) . 88Module 6: Unified Gateway . 93Exercise 6-1: Add Application: Exchange Integration (GUI) . 94Exercise 6-2: RDP Proxy (GUI) . 96Exercise 6-3: Portal Themes and Customizations (GUI) . 101Exercise 6-4 Customize Header and Footer (GUI) . 104Exercise 6-5: Apply an End User License Agreement (GUI) . 109

Lab Guide OverviewIn this lab guide, you will get valuable hands-on experience with NetScaler Gateway and its features. This lab guidewill enable you to work with product components and perform required steps for configuration of the NetScalerGateway as an SSL VPN and for integration with XenApp/XenDesktop environments.5

Lab Environment OverviewLab DiagramSERVER LISTVirtual Machine NameAD.training.labAD02.training.labLAMP 1LAMP Domain xternalclient.training.labradius.training.labIP g.lab192.168.30.31DescriptionDomain Controller (training.lab)Domain Controller 2 (training.lab)MYSQL Database serverMYSQL Database serverWeb ServerWeb ServerWeb ServerExchange Server with OWAWindows 8; not a domain member.Not a domain member; Radiusservices use TekRadius.XenDesktop 7.6 Controller andSQLExpress database.6

XD2SF1SF2Win8VDA1Win8VDA2Student 5192.168.30.36192.168.10.10XenDesktop 7.6 ControllerStoreFront 3.0.1StoreFront 3.0.1Win 8.1 - XenDesktop 7.6 VDAWin 8.1 - XenDesktop 7.6 VDAStudent lab workstation; landingworkstation. All labs performedfrom this system.NetScaler ListVirtual MachineNameNS VPX 01NSIP AddressSubnet IP (SNIP) AddressDescription192.168.10.101SNIP1: 192.168.10.111 (traffic)SNIP2: 192.168.10.103 (mgmt.)NS VPX 02192.168.10.102NS InsightCenter192.168.30.13HA Pair: shared configurationwith NS VPX 01.NS VPX 01 is the principalNetScaler for most exercises. It willbe in an HA Pair with NS VPX 02and they will be managed via theshared SNIP 192.168.10.103.Secondary member of HA Pair withNS VPX 01.Initially not configured.CREDENTIALS LIST (1): Training Domain Users and Groups for NetScaler AdministrationUser NameadministratorGroupsDomain AdminsPasswordPassword1trainNSAdminTraining NSAdminsPassword1trainNSOperatorTraining NSOperatorsPassword1trainADUserDomain ptionDomain administrator account which canbe used to access domain controllers.Otherwise, not needed in class.Domain account used in NetScalerdelegated administration exercise.Domain account used in NetScalerdelegated administration exercise.Domain account used as LDAP BindDNservice account.Domain account available for NetScalerdemonstrations.CREDENTIALS LIST (2): Training Domain Users and Groups for NetScaler Gateway TestingUser ssword1Password1DescriptionITAdmins usually will be granted full VPNaccess.Human Resources users.Sales users.Contractors usually will be granted limitedVPN access.7

CREDENTIALS LIST (3): Training Domain Users and Groups with RADIUS accountsUser Nameuser1-user5GroupsRADIUS (AD group)HRUsers (AD group)PasswordCitrix123RADIUS PasswordCitrix456CREDENTIALS LIST (4): Training Domain Users and Groups (Bonus Accounts not used in Labs)User sersRestrictedUsersDomain escriptionExtra account that can be used for demos.Extra account that can be used for demos.Extra account that can be used for demos.Can be used to demonstrate need todisable external authentication on nsrootuser on NetScaler.DescriptionBuilt-in NetScaler account; will be used forall exercises.Test account for delegated administration.Test account for Admin Partitionsexercise.Test account for Admin partitionsexercise.CREDENTIALS LIST: NetScaler Local AccountsUser NamensrootDelegated Admin rtition AdminPassword1Password1padmin2Partition AdminPassword1Virtual Servers, FQDNs, and VIPs - (NetScaler lab172.21.10.115DescriptionUnified Gateway Virtual IP AddressStoreFront Load Balancing VIP for(SF1 and SF2).XenDesktop XML load balancing VIP(for XD1 and XD2)8

Citrix Hands-On LabsWhat are Hands-On Labs?Hands-On Labs from Citrix Education allows you to revisit, relearn, and master the labexercises covered during the course. This offer gives you 25 days of unlimited lab access tocontinue your learning experience outside of the classroom.Claim introductory pricing of 500 for 25 days of access.Contact your Citrix Education representative or purchase online here.Why Hands-On Labs?Practice outside of the classroomYou'll receive a fresh set of labs, giving youthe opportunity to recreate and master eachstep in the lab exercises.Test before implementingWhether you're migrating to a new version ofa product or discovered a product featureyou previously didn’t know about, you cantest it out in a safe sandbox environmentbefore putting in live production.25 days of accessGet unlimited access to the labs for 25 daysafter you launch, giving you plenty of time tosharpen your skills.Certification exam preparationGet ready for your Citrix certification examby practicing test materials covered by labexercises.9

Module 1: Introducing NetScaler GatewayOverview:Company ABC wants you to implement the NetScaler Gateway. Eventually, the NetScaler Gateway configurationwill allow both SSL VPN and ICA Proxy connections. However, this initial configuration will begin with the SSL VPNdeployment. In order to allow future expansion to support additional resources, the company has also asked thatyou begin with the Unified Gateway configuration.In this module, you will perform hands-on exercises to create and configure the initial Unified Gateway to supportSSL VPN access.After completing this lab module, you will be able to:Import and convert a certificate in .pfx format into a certificate file the NetScaler can use.Use the Unified Gateway wizard to create the necessary content switching and SSL VPN virtual servers onthe NetScaler.This module contains the following exercises using the NetScaler Configuration Utility GUI: Exercise: Import SSL CertificateExercise: Create NetScaler Unified GatewayExercise: Test Unified Gateway Default AccessBefore you begin:Estimated time to complete this lab module: 20 minutesMake Sure the following VMs are A1ExternalClientWebBlueWin8VDA2NS VPX 01WebGreenExchangeNS VPX 02WebRedRADIUSXD1Shutdown the following VMs:Docker (won’t be needed)HTTP Callout (won’t be needed)LAMP 1 (won’t be needed)LAMP 2 (won't be needed)NS VPX 03 (won’t be needed)WebRemote (won’t be needed)10

Exercise 1-1: Import SSL Certificate (GUI)In this exercise, you will import a domain-signed SSL certificate in .pfx format for with the Unified Gateway. Youwill use the Configuration Utility to perform this exercise.When the .pfx certificate is imported, the NetScaler will convert it to a PEM format based certificate file. Theconverted certificate file will contain the server certificate issued to the wildcard FQDN *.training.lab and theassociated private key. This certificate will then be used to create an SSL certkey for use with the Unified Gatewayand any other SSL virtual server that needs to be accessed in the training.lab domain. This exercise builds onprevious SSL exercises and shows how to import a certificate for use.In this exercise, you will perform the following tasks: Import and convert a PFX wildcard certificate into NetScaler:Import SSL CertificateStep1.ActionConnect to the NetScaler configuration utility for the HA Pair using the NSMGMT SNIP athttp://192.168.10.103.Log into the utility using the following credentials:User Name:Password:2.nsrootnsrootImport the SSL Certificate PFX bundle Navigate to Traffic Management SSL. Click Import PKCS#12 in the right pane.Import PKCS12 File: Enter wc-training.cer in the Output File Name field. Click on Choose File drop down and click Local. Browse to C:\Resources\SSL Certificates\ and select wc-training.pfx and click Open. Enter Password1 in the Import Password field. Select DES3 in the Encoding Format. Enter Password1 in the PEM Passphrase and Confirm PEM Passphrase fields.Click OK.11