# Citrix VPN

> Protect Citrix Gateway with Ironchip using RADIUS and NPS: configure RADIUS, LDAP and the Citrix virtual server, and debug authentication problems.

URL: https://docs.ironchip.com/en/identidad/integraciones/red/citrix/

This guide explains how to integrate your **Citrix** VPN with Ironchip authentication through [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/).

## Requirements

- A Windows server with [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/) protected by Ironchip.
- Access to the Ironchip admin console.
- A working Citrix VPN deployment.

## Configure Windows Server

1. Create a RADIUS client that points to the IP address of your Citrix installation.

   [Image: RADIUS client in NPS pointing to the Citrix IP]

2. Check that the server firewall has a rule that allows the LDAP and RADIUS ports.

## Configure Citrix

### RADIUS

1. In the Citrix configuration utility, go to **Citrix Gateway > Policies > Authentication > RADIUS > Servers** and click **Add**.

   [Image: Citrix Gateway > Policies > Authentication > RADIUS > Servers menu]

2. Fill in the details:

   - **Name**: a descriptive name for the configuration.
   - **IP Address** and **Port**: the IP and port Citrix uses to communicate with your RADIUS server.
   - **Secret Key** and **Confirm Secret Key**: the shared secret of your RADIUS server.
   - **Transport**: the transport protocol.
   - **Time-out (seconds)**: `60`.

   [Image: RADIUS server form in Citrix]

3. Expand **More**.

   [Image: More section of the RADIUS server form]

4. Go to the bottom of the page and change these parameters:

   - **Password Encoding**: `mschapv2`.
   - **Authentication Server Retry**: `1`.
   - Make sure **Authentication** is selected.

   [Image: Password Encoding, Server Retry and Authentication parameters]

5. Click **OK** and save the configuration.
6. Go to **Policies** and create two policies that point to the RADIUS server you created. The names are optional, but we recommend using the same ones to make the next steps easier.

   | Name                  | Expression                                              |
   | --------------------- | ------------------------------------------------------- |
   | `ReceiverSelfService` | `REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver`    |
   | `ReceiverForWeb`      | `REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver` |

   [Image: RADIUS policies ReceiverSelfService and ReceiverForWeb]

### LDAP

A second authentication through LDAP is required. It only lets Citrix read the users from Active Directory; it is not used to sign in.

1. Go to **Citrix Gateway > Policies > Authentication > LDAP > Servers** and click **Add**.

   [Image: Citrix Gateway > Policies > Authentication > LDAP > Servers menu]

2. Change the parameters:

   - **Name**: a descriptive name.
   - **IP Address**, **Security Type** and **Port**: the IP of your RADIUS server, the security type and the LDAP port. We recommend SSL on port `636`.
   - **Server Type**, **Time-out (seconds)** set to `60` and the **Authentication** option cleared.
   - In **Connection Settings**, your domain in `DC=,DC=` format in **Base DN (location of users)**, and the **Administrator Bind DN** with its password. To get the Bind DN, run `get-aduser <user> -Properties *` in PowerShell and look for the `DistinguishedName` parameter.

   [Image: LDAP server form in Citrix]

3. Change **Server Logon Name Attribute** to `SamaccountName` and save the configuration.

   [Image: Server Logon Name Attribute parameter set to SamaccountName]

4. Go to **Policies** and create two policies that point to the LDAP server you created. The names are optional, but we recommend using the same ones.

   | Name                            | Expression                                              |
   | ------------------------------- | ------------------------------------------------------- |
   | `LDAP-Corp-ReceiverSelfService` | `REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver`    |
   | `LDAP-Corp-ReceiverForWeb`      | `REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver` |

   [Image: LDAP policies LDAP-Corp-ReceiverSelfService and LDAP-Corp-ReceiverForWeb]

### Citrix virtual server

1. Go to the **Virtual Servers** settings and edit the one that hosts the VPN.

   [Image: List of virtual servers in Citrix]

2. In **Basic Authentication**, add the four policies you created in this order:

   | Policy                          | Type   | Priority  |
   | ------------------------------- | ------ | --------- |
   | `LDAP-Corp-ReceiverForWeb`      | LDAP   | Primary   |
   | `ReceiverSelfService`           | RADIUS | Primary   |
   | `LDAP-Corp-ReceiverSelfService` | LDAP   | Secondary |
   | `ReceiverForWeb`                | RADIUS | Secondary |

   [Image: Authentication policies added to the virtual server]

## Verify the integration

In the Ironchip admin console, give users access to the application created for this service. When you sign in to the VPN, after entering your username and password, you are asked to authenticate with Ironchip.

## Troubleshooting

### View the authentication log

To debug authentication and see a complete log in real time:

1. Connect to the command-line interface of the ADC (Application Delivery Controller) with an SSH client.
2. Switch to the shell command prompt:

   ```bash
   shell
   ```

3. Change to the `/tmp` directory:

   ```bash
   cd /tmp
   ```

4. Start debugging:

   ```bash
   cat aaad.debug
   ```