Citrix VPN

This guide explains how to integrate your Citrix VPN with Ironchip authentication through RADIUS.

Requirements

• A Windows server with NPS protected by Ironchip.
• Access to the Ironchip admin console.
• A working Citrix VPN deployment.

Configure Windows Server

1. Create a RADIUS client that points to the IP address of your Citrix installation.

   

2. Check that the server firewall has a rule that allows the LDAP and RADIUS ports.

Configure Citrix

RADIUS

1. In the Citrix configuration utility, go to Citrix Gateway > Policies > Authentication > RADIUS > Servers and click Add.

   

2. Fill in the details:

   • Name: a descriptive name for the configuration.
   • IP Address and Port: the IP and port Citrix uses to communicate with your RADIUS server.
   • Secret Key and Confirm Secret Key: the shared secret of your RADIUS server.
   • Transport: the transport protocol.
   • Time-out (seconds): 60.

   

3. Expand More.

   

4. Go to the bottom of the page and change these parameters:

   • Password Encoding: mschapv2.
   • Authentication Server Retry: 1.
   • Make sure Authentication is selected.

   

5. Click OK and save the configuration.

6. Go to Policies and create two policies that point to the RADIUS server you created. The names are optional, but we recommend using the same ones to make the next steps easier.

   Name	Expression
   ReceiverSelfService	REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver
   ReceiverForWeb	REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver

   

LDAP

A second authentication through LDAP is required. It only lets Citrix read the users from Active Directory; it is not used to sign in.

1. Go to Citrix Gateway > Policies > Authentication > LDAP > Servers and click Add.

   

2. Change the parameters:

   • Name: a descriptive name.
   • IP Address, Security Type and Port: the IP of your RADIUS server, the security type and the LDAP port. We recommend SSL on port 636.
   • Server Type, Time-out (seconds) set to 60 and the Authentication option cleared.
   • In Connection Settings, your domain in DC=,DC= format in Base DN (location of users), and the Administrator Bind DN with its password. To get the Bind DN, run get-aduser <user> -Properties * in PowerShell and look for the DistinguishedName parameter.

   

3. Change Server Logon Name Attribute to SamaccountName and save the configuration.

   

4. Go to Policies and create two policies that point to the LDAP server you created. The names are optional, but we recommend using the same ones.

   Name	Expression
   LDAP-Corp-ReceiverSelfService	REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver
   LDAP-Corp-ReceiverForWeb	REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver

   

Citrix virtual server

1. Go to the Virtual Servers settings and edit the one that hosts the VPN.

   

2. In Basic Authentication, add the four policies you created in this order:

   Policy	Type	Priority
   LDAP-Corp-ReceiverForWeb	LDAP	Primary
   ReceiverSelfService	RADIUS	Primary
   LDAP-Corp-ReceiverSelfService	LDAP	Secondary
   ReceiverForWeb	RADIUS	Secondary

   

Verify the integration

In the Ironchip admin console, give users access to the application created for this service. When you sign in to the VPN, after entering your username and password, you are asked to authenticate with Ironchip.

Troubleshooting

View the authentication log

To debug authentication and see a complete log in real time:

1. Connect to the command-line interface of the ADC (Application Delivery Controller) with an SSH client.

2. Switch to the shell command prompt:

   shell

3. Change to the /tmp directory:

   cd /tmp

4. Start debugging:

   cat aaad.debug