For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

tolinrome_13817's avatar
tolinrome_13817
Icon for Nimbostratus rankNimbostratus
Feb 04, 2014

APM and Citrix

Hello all, I really would like to understand how a Citrix environment works with the APM module, the benefits of it and what it would accomplish in my environment. I've read documentation from F5 (and youtube videos) and it either shows how to set it up, basic instructions, but no where have I seen it give a nice in depth overview etc. Can someone please help me out?

 

I currently have F5 in a test environment (with APM license) and thinking of introducing our production Citrix environment to run through. So I setup a test environment and successfully have Citrix running through it. I setup the external test url, the test site in the web interface server, new test iis website, and I used the latest the Citrix template that created the vip's in the F5 (citrix webui,citrix_xmlb_serverenum). I can now connect to our production Citrix farm from externally with this new test environment.

 

What I need to understand more clearly is how the APM would it benefit in my environment. In production currently, I have external citrix clients authenticating through a web interface server and the xml brokers handling the apps. Were not using secure or access gateway, nor do we need clients to access vpn to access the apps. The remote clients are authenticated by the citrix web interface server (via Active Directory), the wi then contacts the xml broker to see what the authenticated client has access too, the wi server then presents the client the ica connection with the apps approved. The client then makes a direct connection with the xml brokers (app farm) from that moment on. It is currently setup as alternate Secure Access in the Citrix Web Interface Management. Clients receive an external IP address from app server to client. So I have many static nats on the firewall that are directly connected from internal citrix app servers to outside IP's for the connections.

 

My goal, if possible is to eliminate the current (inside,outside) nats and have only one nat (citrix.domain.com) and all external clients will only use that for authenticating and application access.

 

Without using the APM module why couldn't I just repoint the NAT rules from (Outside to Inside) to (Outside to F5 to Inside), and all is the same, correct? Thanks for taking your time to explain since this is all new to me.

 

Also, if the application servers in the farm are now currently communicating with the external clients via these direct static nats, where in the citrix environment are those settings that determine that?

 

Thanks a lot and I look forward to your answers.

 

application delivery
BIG-IP Access Policy Manager (APM)
deployment
design
devops
iApps
iRules
security

4 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Feb 04, 2014

    Without using the APM module why couldn't I just repoint the NAT rules from (Outside to Inside) to (Outside to F5 to Inside), and all is the same, correct?

     

    You absolutely could continue to do this on an LTM, or you could create VIPs for each instance. But here's what APM gives you:

     

    1. The ability to replace secure/access gateway. I understand you're not using one now, but this would also eliminate the need for multiple NATs.

       

    2. The ability to replace the web interface. APM can deliver the XenApp icons, XenDesktop icons, and also RDP, VM View, portal resources, SSLVPNs, and links all on a single "webtop". You don't have to replace web interface, but it's a pretty cool capability. if you replace the web interface and gateway functions, all traffic (web and ica) can exist on a single port 443 vip.

       

    3. The ability to replace secure ticketing. Again, this doesn't affect you because you're not using a gateway, but it's an additional layer of security that provides, among other things, a time-sensitive ticket. APM doesn't have to, but can absolutely replace this function.

       

    You can effectively remove everything but the xml brokers and app servers from your citrix farm.

     

  • tolinrome_13817's avatar
    tolinrome_13817
    Icon for Nimbostratus rankNimbostratus
    Feb 05, 2014

    Hi Kevin, Great points, thank you. How can I, (in my current test environment), set it up where I can bypass the web interface, not use a nat, (not sure what a gateway function is) and have all web and ica traffic on one port? So the only real nat I would need is the one for citrix.domain.com to the F5 APM?

     

    Really, its the eliminating of the nats I'm looking to accomplish. Thanks.

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Feb 05, 2014

    In the absence of a gateway (access gateway, secure gateway, etc.), you have to route port 1494 ICA traffic (or 443 with an SSL relay) directly to each Citrix server. The gateway provides a single point of entry that terminates the SSL layer and forwards 1494 ICA to the servers.

     

    If you use the latest Citrix iApp and select to replace the web interface, this is exactly what it'll give you - both a web interface replacement and an ICA gateway function into a single SSL VIP. No nat should be required.