Establishing a Secure Connection to the Server Farm

The following example shows how Citrix Gateway deployed in the DMZ works with the Web Interface to provide a secure, single point-of-access to published resources available in a secure enterprise network.

In this example, all of the following conditions exist:

• User devices from the Internet connect to Citrix Gateway by using Citrix Receiver.
• The Web Interface resides behind Citrix Gateway in the secure network. The user device makes the initial connection to Citrix Gateway and the connection is passed to the Web Interface.
• The secure network contains a server farm. One server within this server farm runs the Secure Ticket Authority (STA) and the Citrix XML Service. The STA and the XML Service can run on either Citrix Virtual Apps and Desktops.

Process Overview: User Access to Published Resources in the Server Farm

1. A remote user types the address of Citrix Gateway; for example, https://www.ag.wxyco.com, in the address field of a web browser. The user device attempts this SSL connection on port 443, which must be open through the firewall for the connection to succeed.
2. Citrix Gateway receives the connection request and users are asked for their credentials. The credentials are passed back through Citrix Gateway, users are authenticated, and the connection is passed to the Web Interface.
3. The Web Interface sends the user credentials to the Citrix XML Service running in the server farm.
4. The XML Service authenticates the user credentials and sends the Web Interface a list of the published applications or desktops the user is authorized to access.
5. The Web Interface populates a Web page with the list of published resources (applications or desktops) that the user is authorized to access and sends this Web page to the user device.
6. The user clicks a published application or desktop link. An HTTP request is sent to the Web Interface indicating the published resource that the user clicked.
7. The Web Interface interacts with the XML Service and receives a ticket indicating the server on which the published resource runs.
8. The Web Interface sends a session ticket request to the STA. This request specifies the IP address of the server on which the published resource runs. The STA saves this IP address and sends the requested session ticket to the Web Interface.
9. The Web Interface generates an ICA file containing the ticket issued by the STA and sends it to the Web browser on the user device. The ICA file generated by the Web Interface contains the fully qualified domain name (FQDN) or the Domain Name System (DNS) name of Citrix Gateway. Note that the IP address of the server running the requested resource is never revealed to users.
10. The ICA file contains data instructing the web browser to start Citrix Receiver. The user device connects to Citrix Gateway by using the Citrix Gateway FQDN or DNS name in the ICA file. Initial SSL/TLS handshaking occurs to establish the identity of Citrix Gateway.
11. The user device sends the session ticket to Citrix Gateway and then Citrix Gateway contacts the STA for ticket validation.
12. The STA returns the IP address of the server on which the requested application resides to Citrix Gateway.
13. Citrix Gateway establishes a TCP connection to the server.
14. Citrix Gateway completes the connection handshake with the user device and indicates to the user device that the connection is established with the server. All further traffic between the user device and the server is proxied through Citrix Gateway. The traffic between the user device and Citrix Gateway is encrypted. The traffic between Citrix Gateway and the server can be encrypted independently, but is not encrypted by default.