Product Documentation

Analytics: Gateway Insight

Jun 04, 2017

In a NetScaler Gateway deployment, visibility into a user's access details is essential for troubleshooting access failure issues. As the network administrator, you want to know when a user is not able to log on to NetScaler Gateway, and you want to know the user activity and the reasons for logon failure, but that information is typically not available unless the user sends a request for resolution.

Gateway Insight provides visibility into the failures encountered by all users, regardless of the access mode, at the time of logging on to NetScaler Gateway. You can view a list of all available users, number of active users, number of active sessions, and bytes and licenses used by all users at any given time. You can view the end-point analysis (EPA), authentication, single sign-on (SSO), and application launch failures for a user. You can also view the details of active and terminated sessions for a user. 

Gateway Insight also provides visibility into the reasons for application launch failure for virtual applications. This enhances your ability to troubleshoot any kind of logon or application launch failure issues. You can view the number of applications launched, number of total and active sessions, the number of total bytes and bandwidth consumed by the applications. You can view details of the users, sessions, bandwidth, and launch errors for an application.

You can view the number of gateways, number of active sessions, total bytes and bandwidth used by all gateways associated with a NetScaler Gateway appliance at any given time. You can view the EPA, authentication, single sign-on, and application launch failures for a gateway. You can also view the details of all users associated with a gateway and their logon activity. 

All log messages are stored in the NetScaler MAS database, so you can view error details for any time period. You can also view a summary of the logon failures and determine at what stage of the logon process a failure has occurred.

Points to Note

  • Gateway Insight is supported on the following deployments:
    1. High Availability
    2. Unified Gateway
  • The NetScaler MAS release and build must be same or later than that of the NetScaler Gateway appliance.
  • One hour of Gateway Insight reports can be viewed for NetScaler instances with Enterprise license. A Platinum license is needed to view Gateway Insight reports beyond one hour.

Limitations

  • Successful user logons, latency, and application-level details for virtual ICA applications and desktops are visible only on the HDX Insight Users dashboard.
  • In a double-hop mode, visibility into failures on the NetScaler Gateway appliance in the second DMZ is not available.
  • Remote Desktop Protocol (RDP) desktop access issues are not reported.

Enabling Gateway Insight

To enable Gateway Insight for your NetScaler Gateway appliance, you must first add the NetScaler Gateway appliance to NetScaler MAS. You must then enable AppFlow for the virtual server representing the VPN application. For information about adding device to NetScaler MAS, see Adding Devices.

Note

To view end-point analysis (EPA) failures in NetScaler MAS, you must enable AppFlow AAA Username logging on the NetScaler Gateway appliance.

To enable AppFlow for a virtual server in NetScaler MAS

1. Log on to NetScaler MAS.

2. On the Infrasrtucture tab, navigate to Instances, and select the instance for which you want to enable AppFlow.

3. From the Action drop-down, select Enable/Disable Insight.

4. In the Configure Insight page, under Application List, in the View list, select VPN.

5. Select the virtual server for which you want to enable AppFlow, and in the Action list, click Enable AppFlow.

6. On the Enable AppFlow screen, in the Select Expression list, click true.

7. Next to Export Option, select the HTTP check box.

localized image

8. Click OK.

To enable AppFlow AAA Username logging on a NetScaler Gateway appliance by using the CLI

At the command prompt, type:

set appflow param -AAAUserName ENABLED

To enable AppFlow AAA Username logging on a NetScaler Gateway appliance by using the GUI

1. Navigate to Configuration > System > AppFlow > Settings, and then click Change AppFlow Settings.

2. In the Configure AppFlow Settings screen, select AAA Username, and then click OK.

Viewing Gateway Insight Reports

In NetScaler MAS, you can view reports for all users, applications, and gateways associated with the NetScaler Gateway appliances, and you can view details for a particular user, application, or gateway. In the Overview section, you can view the EPA, SSO, Authentication, and Application Launch failures. You can also view a summary of the different session modes used by users to log on, the types of clients, and the number of users logged on every hour.

To view EPA, SSO, Authentication, Authorization and Application Launch Failures

1. In NetScaler MAS, navigate to Analytics > Gateway Insight.

2. Select the time period for which you want to view the user details. You can use the time slider to further customize the selected period. Click Go.

3. Click the EPA (End Point Analysis), Authentication, Authorization, SSO (Single Sign On), or Application Launch tabs to display the failure details.

localized image

To view a summary of session modes, clients, and the number of users

In NetScaler MAS, navigate to Analytics > Gateway Insight, scroll down to view the reports.

localized image
localized image

Users

You can view reports for all users associated with the NetScaler Gateway appliances. You can view the EPA, authentication, SSO, and application launch failures for a user. You can also view the details of active and terminated sessions for a user.

To view user details

1. In NetScaler MAS, navigate to Analytics > Gateway Insight > Users.

2. Select the time period for which you want to view the user details. You can use the time slider to further customize the selected period. Click Go.

3. You can now view the number of active users, number of active sessions, bytes and licenses used by all users during the time period.

localized image

Scroll down to view a list of available users and active users.

localized image

On the Users or Active Users tab, you can click on a user in the Username column to display the EPA, authentication, SSO, and application launch failures and other details for that user.

Applications

You can view the number of applications launched, number of total and active sessions, the number of total bytes and bandwidth consumed by the applications. You can view details of the users, sessions, bandwidth, and launch errors for an application.

To view application details

  1. In NetScaler MAS, navigate to Analytics > Gateway Insight > Applications.
  2. Select the time period for which you want to view the application details. You can use the time slider to further customize the selected time period. Click Go.

You can now view the number of applications launched, number of total and active sessions, the number of total bytes and bandwidth consumed by the applications.

localized image

Scroll down to view the numbers of sessions, bandwidth, and total bytes consumed by ICA and other applications.

localized image

On the Other Applications tab, you can click an application in the Name column to display details of that application.

Gateways

You can view the number of gateways, number of active sessions, total bytes and bandwidth used by all gateways associated with a NetScaler Gateway appliance at any given time. You can view the EPA, authentication, single sign-on, and application launch failures for a gateway. You can also view the details of all users associated with a gateway and their logon activity. 

To view gateway details

  1. In NetScaler MAS, navigate to Analytics > Gateway Insight > Gateways.
  2. Select the time period for which you want to view the gateway details. You can use the time slider to further customize the selected time period. Click Go.

You can now view the number of gateways, number of active sessions, total bytes and bandwidth used by all gateways associated with a NetScaler Gateway appliance at any given time.

localized image

Scroll down to view the gateway details such as Gateway Domain Name, Virtual Server Name, NetScaler IP address, session modes, and Total Bytes.

localized image

You can click on a gateway in the Gateway Domain Name column to display the EPA, authentication, single sign-on, and application launch failures and other details for a gateway.

Exporting reports

you can save the Gateway Insight reports with all the details shown in the GUI in PDF, JPEG, PNG, or CSV format on your local computer. You can also schedule the export of the reports to specified email addresses at various intervals.
Note:

  • Users with read only access cannot export reports.
  • Geo map reports are exported only if the NetScaler MAS has internet connectivity.

To export a report

1. On the Dashboard tab, in the right pane, click the export button.

2. Under Export Now, select the required format, and then click Export.

To schedule export

1. On the Dashboard tab, in the right pane, click the export button.

2. Under Schedule Export, specify the details and click Schedule.

To edit the export schedule

1. On the Configuration tab, navigate to Configuration > NetScaler Insight Center > Export Schedules.

2. Select a report from the available list, and then click Edit.

3. After editing, click Save.

Note: Configure the email server settings before scheduling the report by navigating to System > Notifications > Email and by clicking Add.

To add an email server or an email distribution list

1. On the Configuration tab, navigate to System > Notifications > Email.

2. In the right pane, select Email Server, to add an email server or select Email Distribution list to create an email distribution list.

3. Specify the details and click Create.

To export the entire Gateway Insight dashboard

1. On the Dashboard tab, in the right pane, click the export button.

2. Under Export Now, select PDF format, and then click Export.

Gateway Insight Use Cases

The following use cases show how you can use Gateway Insight to gain visibility into users’ access details, applications, and gateways on NetScaler Gateway appliances.

A user is not able to log in to the NetScaler Gateway appliance or to the internal web servers.

You are a NetScaler Gateway administrator monitoring NetScaler Gateway appliances through NetScaler MAS, and you want to see why a user is unable to log in, or at what stage of the login process the failure has occurred.

NetScaler MAS enables you to view the user login error details in the following stages of the login process:

  • Authentication
  • End-point analysis (EPA)
  • Single sign-on

In NetScaler MAS, you can search for a particular user and then view all the details for that user.

To search for a user

In NetScaler MAS, navigate to Analytics > Gateway Insight and, in the Search for Users text box, specify the user you want to search. 

Authentication Failures

You can view authentication errors such as incorrect credentials or no response from the authentication server. If you have set up two-stage authentication, you can see whether the primary, secondary, or both stages of the authentication have failed.

To view the authentication failure details

1. In NetScaler MAS, navigate to Analytics > Gateway Insight.

2. In the Overview section, select the time period for which you want to view the authentication errors. You can use the time slider to further customize the selected time period. Click Go.

localized image

3. Click the Authentication tab. You can view the number of authentication errors at any given time in the Failures graph.

localized image

Scroll down to view details of each authentication error such as Username, Client IP Address, Error Time, Authentication type, Authentication Server IP Address, and more from the table on the same tab. The Error Description column in the table displays the reason for the logon failure, and the State column displays at what stage of a two-stage authentication the failure occurred.

localized image

You can click on a user in the Username column to display the authentication errors and other details for that user.

You can customize the table to add or delete columns by using the drop-down arrow as indicated in the following screen shot.

localized image

EPA Failures

You can view EPA failures at pre- or post-authentication stage.

To view EPA failure details

1. In NetScaler MAS, navigate to Analytics > Gateway Insight.

2. In the Overview section, select the time period for which you want to view the EPA errors. You can use the time slider to further customize the selected time period. Click Go.

localized image

3. Click the EPA (End Point Analysis) tab. You can view the number of EPA errors at any given time in the Failures graph.

localized image

Scroll down to view details of each EPA error such as Username, NetScaler IP Address, Gateway IP Address, VPN, Error Time, Policy Name, Gateway Domain Name and more from the table on the same tab. The Error Description column in the table displays the reason for the EPA failure, and the Policy Name column displays the policy that resulted in the failure.

localized image

You can click on a user in the Username column to display the EPA errors and other details for that user.

You can customize the table to add or delete columns by using the drop-down arrow as indicated in the following screen shot.

localized image

SSO Failures

You can view the all the SSO failures at any stage for a user accessing any applications through the NetScaler Gateway appliance.

To view the SSO failure details

1. In NetScaler MAS, navigate to Analytics > Gateway Insight.

2. In the Overview section, select the time period for which you want to view the SSO errors. You can use the time slider to further customize the selected time period. Click Go.

localized image

3. Click the SSO (Single Sign On) tab. You can view the number of SSO errors at any given time in the Failures graph.

localized image

Scroll down to view details of each SSO error such as Username, NetScaler IP Address, Error Time, Error Description, Resource Name and more from the table on the same tab.

localized image

You can click on a user in the Username column to display the SSO errors and other details for that user.

You can customize the table to add or delete columns by using the drop-down arrow as indicated in the following screen shot.

localized image

After successfully logging on to NetScaler Gateway, a user is not able to launch any virtual application.

For an application-launch failure, you can gain visibility into the reasons, such as inaccessible Secure Ticket Authority (STA) or XenApp server, or invalid STA ticket. You can view the time the error occurred, details of the error, and the resource for which STA validation failed.

To view the application launch failure details

1. In NetScaler MAS, navigate to Analytics > Gateway Insight.

2. In the Overview section, select the time period for which you want to view the SSO errors. You can use the time slider to further customize the selected time period. Click Go.

localized image

3. Click the Application Launch tab. You can view the number of application launch failures at any given time in the Failures graph.

localized image

Scroll down to view details of each application launch error, such as NetScaler IP Address, Error Time, Error Description, Resource Name, Gateway Domain Name, and more, from the table on the same tab. The Error Description column in the table displays the IP address of the STA server and the Resource Name column displays the details of the resource for which the STA validation has failed.

localized image

You can click on a user in the Username column to display the application launch errors and other details for that user.

You can customize the table to add or delete columns by using the drop-down arrow as indicated in the following screen shot.

localized image

After successfully launching a new application, a user wants to view the total bytes and bandwidth consumed by that application.

After you have successfully launched a new application, in NetScaler MAS, you can view the total bytes and bandwidth consumed by that application.

To view total bytes and bandwidth consumed by an application

In NetScaler MAS, navigate to Analytics > Gateway Insight > Applications, scroll down and, on the Other Applications tab, click the application for which you want to view the details.

localized image

You can view the number of sessions and the total number of bytes consumed by that application.

localized image

You can also view the bandwidth consumed by that application.

localized image

A user has logged on to NetScaler Gateway successfully, but is unable to access certain network resources in the internal network.

With Gateway Insight, you can determine whether the user has access to the network resources or not. You can also view the name of the policy that resulted in the failure.

To view user access for resources

  1. In NetScaler MAS, navigate to Analytics > Gateway Insight > Applications.
  2. On the screen that appears, scroll down, and on the Other Applications tab, select the application to which the user was unable to log on to.
localized image

On the screen that appears, scroll down, and in the Users table, all the users that have access to that application are displayed.

localized image

Different users might be using different NetScaler Gateway deployments or might log on to NetScaler Gateway through different access modes. The administrator should be able to view details about the deployment types and access modes.

With Gateway Insight, you can view a summary of the different session modes used by users to log on, the types of clients, and the number of users logged on every hour. You can also determine whether a user’s deployment is a unified gateway or classic NetScaler Gateway deployment. For unified gateway deployments, you can view the content switching virtual server name and IP address and the VPN virtual server name.

To view the summary of session modes, type of clients, and number of users logged on

  1. In NetScaler MAS, navigate to Analytics > Gateway Insight.
  2. In the Overview section, scroll down to view the Session Mode, Operating Systems, Browsers, and User Logon Activity charts display the different session modes used by users to log on, the types of clients, and the number of users logged on every hour.
localized image
localized image