Firewall/Proxy Server Settings to Access Hosted Environment. For Access Control Method (also known as access lists and usually used on routers)

Transcription

1 Firewall/Prxy Server Settings t Access Hsted Envirnment Client firewall settings in mst cases depend n whether the firewall slutin uses a Stateful Inspectin prcess r ne that is cmmnly referred t as an Access Cntrl Methd, which simply lks at allwed UDP and TCP prt numbers and the directin f packets. We will attempt t cver bth types in this dcument, but please remember, each device has its wn way f ding this. Please cnsult yur firewall equipment dcumentatin fr the crrect cmmands and prcedures. Cnfiguratin f Firewalls / Ruters Fr the cnfiguratin listed belw, please use these addresses in place f the names. Bth sets f addresses must be used. Hsted Envirnment Netwrks: /24 (Subnet Mask ) Hsted Envirnment DMZs: /26 (Subnet Mask ) /26 (Subnet Mask ) Fr Access Cntrl Methd (als knwn as access lists and usually used n ruters) Type f Traffic: Frm: (Surce Address) T: (Destinatin Address) Outbund ICA Traffic Client Netwrk Hsted Netwrk Inbund ICA Traffic Hsted Netwrk Client Netwrk Prts: TCP 80 TCP 443 TCP 2598 Depreciated: TCP 1494 UDP 1604 Nne Depreciated: TCP High Prts Hsted Envirnment WWW Traffic Client Netwrk Hsted Netwrk Hsted DMZ TCP 80 (HTTP) TCP 443 (HTTPS) v

2 Fr Stateful Firewall Methd Type f Traffic: Frm: (Surce Address) T: (Destinatin Address) Outbund ICA Traffic Client Netwrk Hsted Netwrk Prts: TCP 80 TCP 443 TCP 2598 Depreciated: TCP 1494 UDP 1604 Inbund ICA Traffic Hsted Netwrk Client Netwrk Nne Hsted Envirnment WWW Traffic Client Netwrk Hsted Netwrk Hsted DMZ TCP 80 (HTTP) TCP 443 (HTTPS) v

3 New Style Cnnectins Standard 80/2598 This diagram depicts the style cnnectins used fr the Standard lgin buttn, lcated n the Custmer Launch Page (CLP). The Standard lgin buttn is typically lcated n the left if multiple lgin buttns present. If yu are having truble figuring ut which lgin buttn this diagram pertains t, please cntact yur partner technical supprt. v

4 Alternate 80/443 This diagram depicts the style cnnectins used fr the Alternate lgin buttn/link, lcated n the Custmer Launch Page (CLP). The Alternate lgin will either be a buttn (lcated t the right f the Standard lgin buttn) r a link (lcated in text bx belw the Standard lgin bx). If yu are having truble figuring ut which lgin buttn/link this diagram pertains t, please cntact yur partner technical supprt. v

5 Frequently Asked Questins Why are prts TCP 1494 and UDP 1604 cnnectins being depreciated? It is suggested that all custmers upgrade t the latest Citrix client in rder t take advantage f the better security and sessin reliability that it ffers. These imprvements required Citrix t change the default prts that are used t cmmunicate frm the client t the server. D I need t change any firewall settings right away? It is highly likely that prts TCP 80 and TCP 443 are already pen s that yu can brwse sites n the Internet with yur web brwser. In this case, while yu may chse t remve prts TCP 1494 and UDP 1604 frm yur firewall cnfiguratin, yu shuld nt need t change anything in rder t cntinue t access the Hsted Envirnment. Why d I need t pen prt TCP 2598? Yu shuld be able t use the Hsted Envirnment withut having t pen prt TCP In the case that prt is nt available, prts TCP 80 and TCP 443 will be used exclusively. Hwever, if yu pen prt TCP 2598, yu will benefit frm the enhanced sessin reliability that the Citrix client can prvide when this prt is pened. Please cntact supprt with questins abut accessing the hsted envirnment withut prt What if I can t get TCP 80 / TCP 443 cnnectins t wrk? An alternate link is prvided n each Custmer Launch Page that can be used in cnjunctin with an lder Citrix client t cntinue t access the Hsted Envirnment. Yu shuld nly need this ptin if yu run certain kinds f prxy servers. Please cntact Supprt if yu can nly use the depreciated supprt access via TCP 1494 / UDP Why is the range f Hsted Envirnment addresses s large? The address range listed is entirely in ur cntrl; n ther entity will use this address space s be assured that it is secure. We deliver yur applicatins using a lad balancing methdlgy s any ne f many servers cnfigured n any f these addresses, in this range, culd respnd t yur request fr an applicatin. Althugh yu request applicatin services frm tw addresses in this range, neither f these ever actually respnds they simply brker yur request t the address f the apprpriate server depending n real time utilizatin figures. It is required that the entire range must be allwed as there is n way t predict which address yur applicatin will be served n at any given time. v

6 What are sme f the errr messages I might see if the firewall r ruter is nt prperly cnfigured? Belw are sme pssible errr messages yu might see if yur firewall r ruter is nt prperly cnfigured. Unable t cntact the Citrix Server Brwser. Either yur netwrk is nt functinal, r yu need t cnfigure an address under Server Lcatin, r the cnfigured address is incrrect. Unable t cntact the Citrix Presentatin Server brwser. There may be netwrk prblems, r yu may need t cnfigure r crrect the server address in the Server Lcatin field. The Citrix Metaframe server yu have selected is nt accepting cnnectins. Unable t launch yur applicatin. Cntact yur help desk with the fllwing infrmatin: Cannt cnnect t the Citrix Xenapp Server. An I/O (Input/Output) errr has ccurred while yur request was being prcessed. Try t cnnect again. If yu cntinue t receive this message, cntact yur Citrix administratr. Unable t launch yur applicatin. Cntact yur help desk with the fllwing infrmatin: Cannt cnnect t Citrix Xenapp server. Unable t cntact the Citrix XenApp brwser. There may be netwrk prblems, r yu may need t cnfigure r crrect the server address in the Server Lcatin field. I have a prxy server. What d I need t knw? While each prxy server is different, at the very least yu will need t ensure that all the IP addresses and prts listed under the Cnfiguratin f Firewalls/Ruters sectin f this guide are allwed thrugh yur prxy server. Furthermre, many users find that access t the /24 range specifically needs t be allwed thrugh in an unauthenticated manner as the Citrix client des nt supprt authenticated prxy cnnectins that require user interactin in the HTTP sessin. v