CVAD smart access basic setup with ICA proxy

 Smart Access Basic setup with ICA proxy enabled.

 

 

 

One thing I learned is that the Gateway vServer doesn't really need ICA Proxy unchecked, for what I am trying to do. I am not using EPA scans or anything advanced yet. But you could do it so save a step later. Now I understand this may not be the best way. But sometimes you have to do what you need to do to secure things.

 

 

1. Check the Trust Request on the Brokers and enabled it if it’s not enabled.

2. Open POSH and add asnp citrix* and Run Get-brokersite. If it’s set to false, then run #3 command

3. Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true

 

 

 

2.  Create a NetScaler gateway Dummy VIP (Some organizations don’t allow SF to talk back to the DMZ NetScaler's vServer, If yours does, then use the current Gateway and ignore the dummy VIP/vServer

 

3. Added IP and Port

4. Add STA Brokers

 

 

5. Added DNS Record.

 

 

 

6. Go to StoreFront Servers > click on Manage Citrix Gateways

 

7. Click edit

8. Add the Call Back URL ( For me is the Dummy VIP I created)  Which resolved to a layer 2 IP address on the same Subnet as my Citrix Environment.

 

 

9. Propagate changes on Storefront

 

 

 

10. Go to the DDC, and create a policy. For me, I used the baked in one from Citrix called " Security Control"

11. 

 

 

• Remember the Allow or Deny mode is a bit confusing. Allow means that the settings in the policy are to be applied to the NetScaler Gateway connection.

• Deny, the settings prohibiting something will not be applied to users connecting via Citrix Gateway.

 

My bandwidth went up some when I applied more Security settings, Red is applying the filter, and green is off.

 

 

 

On

 

 

Off

 

 

 

12. Testing with it off (Deny the Policy

1. Here is my local machine printers

 

 

13. Now log into the VDA

 

 

14. Now let se the Filter to allow ( Allow the policy)

 

15. Now log into the VDA

No printers from my local machine were able to come in.

 

16. Remember this is a very basic setup, and it’s just to show what it can do. There is much more than what I am showing here.

 

 

Sources

Basic Guide

 

https://dennisspan.com/making-limited-use-of-citrix-smartaccess-without-universal-licenses/#comment-11123

 

Little more advanced

https://c4rm0.wordpress.com/improve-security-with-netscaler-smartaccess/

https://support.citrix.com/article/CTX227055

 

 

Then my research and questions on Slack ( If you're not on this, you're missing out) A lot of really sharp guys on here.