Session policies
Admins can configure session policies to route internal corporate users directly to back-end apps without tunneling traffic through Secure Private Access. Session policies offer dynamic routing based on factors, such as network location and device posture.
Note:
- Session policy settings are applied at the session level to all applications rather than being tied to specific applications.
- Session policies can be assigned to all users or a subset of users.
Routing precedence
Session policies work alongside access policies, with access policies taking precedence if there is a conflict. In such scenarios, access policy routing exceptions override session policies. If neither an access policy nor a session policy is configured, global routing settings (Settings > Application Domain) apply.
Supported Citrix Secure Access™ clients
The following versions of Citrix Secure Access client support routing of users directly to back-end applications.
- macOS - 24.11.1 and later
- Windows - 24.11.1.17 and later. Also, the EnableContextualAccess VPN client registry must be enabled. For more information, see NetScaler Gateway Windows VPN client registry keys.
Example use case
Scenario:
In an organization, when users are connected to the corporate network “corporate_network1”, then traffic from apps must flow directly to the back-end apps, as these apps are directly reachable on the corporate network. If the users are outside the corporate network, then the app traffic must be tunneled.
Solution:
- Add app1, app2 with routing set to Internal via Connector.
- Add an access policy for the apps (app1, app2) to grant access.
- Add a session policy to configure conditions to specify the user group and network locations that must be considered when granting access.
- Select the User condition and set it to All users.
- Add a Network Location condition. Set it to Matches any of and specify the network location “corporate_network1”. This ensures that traffic coming from “corporate_network1” flows directly to the back-end apps.
You can also enable routing exceptions for this scenario. For example, if app1 must always be tunneled even on the corporate network, then routing exceptions can be configured for domains of app1 in the access policy. When this is done, the routing exception takes precedence over the session policy.
Configure direct routing within the corporate network using session policies
You must create a session policy to enable users to directly access the back-end applications bypassing the Secure Private Access tunneling. To do this, first, you select the users to which this policy must apply. Second, under ‘Network Location’ select the name of your corporate network. This is an important step to make sure that Direct Routing is only enabled when the user is inside your company’s corporate network.
-
Navigate to Policies > Session Policies and click Create Session Policy.
- Enter a name for the policy and a description of the policy.
- Select the users and the conditions for which you want to apply these settings.
- You can select the condition to apply to all users or specify a subset of users.
-
(Optional) Click + to add multiple conditions based on the context.
-
Define the Network Location condition to enable dynamic routing for the entire session. This confirms that direct routing is enabled only when users are inside the company’s corporate network.
When you add conditions based on a context, an AND operation is applied on the conditions wherein the policy is evaluated only if both the users and the optional contextual-based conditions are met. For details on the conditions, see Configure an access policy.
- Select Direct routing to route all users externally to the back-end applications.
- Select Local LAN access to enable seamless access to local LAN resources. For more details, see Seamless access to local LAN resources (printers, file servers).
- Select Enable policy after creation. If you do not select this option, the policy is only created and not enforced on the applications. Alternatively, you can also enable the policy from the Session Policies page by using the toggle switch in the Status column.
- Click Save.
Note:
Network location changes trigger session policy refreshes and this might impact the end clients as follows:
- Citrix Secure Access agent: Policy refreshes might alter routing configurations and hence impact application access.
- Citrix Enterprise Browser™: Policy refreshes occur every 30 minutes. Users must restart the browser or wait for the refresh to access applications.