Product Documentation
Application Delivery Management
14.1 - Current Release 13.1 13.0 12.1
View PDF

Use cases

December 31, 2023
Contributed by: 
C

Monitoring the SSL Interceptions

A Citrix SWG appliance enables you to inspect your encrypted outbound traffic. You can intercept, bypass, or block any HTTPS requests on the basis of policies configured on the appliance. Citrix Application Delivery Management (ADM) provides the following details about the SSL connections in the Outbound Traffic Dashboard for a selected time frame:

  • Number of SSL connections that are intercepted, not intercepted, and reset by the Citrix SWG appliance

  • Transaction details of the SSL connections

Using these details, you can further fine tune the policies on your Citrix SWG appliance to efficiently inspect the encrypted outbound traffic. For more information, see Citrix Secure Web Gateway.

To display the number of SSL connections that have been intercepted, not intercepted, and reset:

Navigate to Applications > Outbound Traffic Dashboard. The Outboard Traffic Dashboard displays the number of SSL connections that are intercepted, not intercepted, and reset.

localized image

To display the transaction details of the SSL connections that have been intercepted:

  1. Navigate to Applications > Outbound Traffic Dashboard.

  2. On the Outboard Traffic Dashboard, click the total count in the SSL INTERCEPTS section.

    localized image

The transaction details of the SSL connections that were intercepted during the selected time frame are displayed on the Transaction Details page.

localized image

You can further filter the transactions details by user and URL category.

To view the transaction details of the SSL connections on which traffic was not intercepted:

  1. Navigate to Applications > Outbound Traffic Dashboard.

  2. In the Outboard Traffic Dashboard, click the total count in the Not-intercepted SSL Connections section.

    localized image

The transaction details of the SSL connections on which traffic was not intercepted during the selected time frame appear in the Transaction Details page.

localized image

You can further filter the transactions details by user and URL category.

To display the transaction details of the SSL connections that are reset:

  1. Navigate to Applications > Outbound Traffic Dashboard.

  2. On the Outboard Traffic Dashboard, click the total count in the Reset SSL Connections section.

    localized image

The transaction details of the SSL connections on which traffic was not intercepted during the selected time frame appear on the Transaction Details page.

localized image

You can further filter the transactions details by the user and URL category.

Inspecting Endpoints

The policies you have configured on a Citrix SWG appliance specify how the appliance logs all the user activities performed in your enterprise. Citrix ADM provides key metrics that you can use to determine:

  1. Browsing behavior of users in your enterprise.

  2. URL categories accessed by the users in your enterprise.

  3. Top five users, based on their risk scores and the bandwidth they consume. For more information about risk scores, see Risk Score.

  4. Browsers used to access the URLs or domains.

  5. Amount web traffic generated by the users, based on the traffic reputation score.

For example, if a user with user id testuser3 constantly accesses malware related sites in your enterprise, Citrix ADM identifies the user as high-risk activity user and assigns a higher risk score. The testuser3 information is displayed in the Top Users section of the User Dashboard.

localized image

You can click on testuser3 to filter the User Dashboard to display all the key metrics related to testuser3.

localized image

In the User Activity Investigation pane, the high-risk activity of testuser3 is displayed as events in the respective URL categories.

localized image

You can hover over the events to display the number of events, and you can click on events to investigate the transactions that occurred during the events.

localized image

With this information, you can determine whether the user’s system is infected by malware, or you can understand the bandwidth consumption pattern of the user and fine-tune your Citrix SWG policies. For more information, see Citrix Secure Web Gateway Documentation.

Reporting Bandwidth Consumption

The Outbound Traffic Dashboard and the User Dashboard provide multiple charts that summarize the websites or applications accessed from the enterprise network, and the activities performed by the users in your network.

The Outbound Traffic Dashboard provides the details of data-volume consumption by the URLs or domains that were accessed from your network. Navigate to Applications > Outbound Traffic Dashboard, where the data volume details are shown in the Data Volume section.

localized image

In the Outbound Traffic Overview pane, you can click on a domain or URL to display the details of the data volume consumed by the domain or URL.

localized image

The User Dashboard provides details about the bandwidth consumed by the users in your network. Navigate to Users > Dashboard to display the details of the bandwidth consumed by users in the DATA VOLUME section in the User Dashboard.

localized image

You can view the details of the bandwidth consumed by a user by selecting the user from the Top Users section. The DATA VOLUME section and other key metrics in the chart are filtered for the selected user.

localized image

Using these details, you can understand the bandwidth consumption and the reason for the consumption. For example, if a user is accessing social networking websites and this has caused a lot of bandwidth consumption, the administrator can access the Citrix SWG appliance and configure a URL List feature to control access to the websites. For more information, see Use Case: URL Filtering by using Custom URL Set topic.

Viewing Outbound Traffic Distribution

The Citrix SWG appliance provides URL categorization and filtering features that you can use to categorize the URLs that are accessed from your network. In Citrix ADM, the Outbound Traffic Dashboard includes an Outbound Traffic Overview pane. In the Outbound Traffic Overview pane, Citrix ADM groups the accessed URLs or domains into categories, such as Shopping, News, Mobile, and so on to show the outbound traffic distribution in your network. For a selected time frame, you can click on the URL, to understand the:

  1. Bandwidth consumed by accessing the URL

  2. Transactions that occurred while accessing the URL

  3. Number of SSL connections that were intercepted, not intercepted, and reset while accessing the URL

With this information, you can understand the outbound traffic pattern and make corrective decisions, such as whether to block certain URLs.

To view Outbound Traffic Distribution:

Navigate to Applications > Outbound Traffic Dashboard. The Outboard Traffic Dashboard displays the URLs in the Outbound Traffic Overview pane:

localized image

If you want to view the details of a particular URL, select the URL.

Using this information, you can understand the outbound traffic pattern and control your network traffic using a URL Filter configured on your SWG appliance. For more information, see URL Filtering.

Use cases
December 31, 2023
Contributed by: 
C
December 31, 2023
Contributed by: 
C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.