Establishing a Secure Connection to the Server Farm

January 23, 2019

Contributed by: C

The following example shows how Citrix Gateway deployed in the DMZ works with the Web Interface to provide a secure, single point-of-access to published resources available in a secure enterprise network.

In this example, all of the following conditions exist:

User devices from the Internet connect to Citrix Gateway by using Citrix Receiver.
The Web Interface resides behind Citrix Gateway in the secure network. The user device makes the initial connection to Citrix Gateway and the connection is passed to the Web Interface.
The secure network contains a server farm. One server within this server farm runs the Secure Ticket Authority (STA) and the Citrix XML Service. The STA and the XML Service can run on either Citrix Virtual Apps and Desktops.

Process Overview: User Access to Published Resources in the Server Farm

A remote user types the address of Citrix Gateway; for example, https://www.ag.wxyco.com, in the address field of a web browser. The user device attempts this SSL connection on port 443, which must be open through the firewall for the connection to succeed.
Citrix Gateway receives the connection request and users are asked for their credentials. The credentials are passed back through Citrix Gateway, users are authenticated, and the connection is passed to the Web Interface.
The Web Interface sends the user credentials to the Citrix XML Service running in the server farm.
The XML Service authenticates the user credentials and sends the Web Interface a list of the published applications or desktops the user is authorized to access.
The Web Interface populates a Web page with the list of published resources (applications or desktops) that the user is authorized to access and sends this Web page to the user device.
The user clicks a published application or desktop link. An HTTP request is sent to the Web Interface indicating the published resource that the user clicked.
The Web Interface interacts with the XML Service and receives a ticket indicating the server on which the published resource runs.
The Web Interface sends a session ticket request to the STA. This request specifies the IP address of the server on which the published resource runs. The STA saves this IP address and sends the requested session ticket to the Web Interface.
The Web Interface generates an ICA file containing the ticket issued by the STA and sends it to the Web browser on the user device. The ICA file generated by the Web Interface contains the fully qualified domain name (FQDN) or the Domain Name System (DNS) name of Citrix Gateway. Note that the IP address of the server running the requested resource is never revealed to users.
The ICA file contains data instructing the web browser to start Citrix Receiver. The user device connects to Citrix Gateway by using the Citrix Gateway FQDN or DNS name in the ICA file. Initial SSL/TLS handshaking occurs to establish the identity of Citrix Gateway.
The user device sends the session ticket to Citrix Gateway and then Citrix Gateway contacts the STA for ticket validation.
The STA returns the IP address of the server on which the requested application resides to Citrix Gateway.
Citrix Gateway establishes a TCP connection to the server.
Citrix Gateway completes the connection handshake with the user device and indicates to the user device that the connection is established with the server. All further traffic between the user device and the server is proxied through Citrix Gateway. The traffic between the user device and Citrix Gateway is encrypted. The traffic between Citrix Gateway and the server can be encrypted independently, but is not encrypted by default.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Establishing a Secure Connection to the Server Farm

January 23, 2019

Contributed by: C

Establishing a Secure Connection to the Server Farm

Process Overview: User Access to Published Resources in the Server Farm

Establishing a Secure Connection to the Server Farm

In this article