Integration with IPS or NGFW as inline devices

Security devices such as Intrusion Prevention System (IPS) and Next Generation Firewall (NGFW) protect servers from network attacks. These devices can inspect live traffic and are typically deployed in layer 2 inline mode. Citrix Secure Web Gateway (SWG) provides security of users and the enterprise network when accessing resources on the internet.

A Citrix SWG appliance can be integrated with one or more inline devices to prevent threats and provide advanced security protection. The inline devices can be any security device, such as IPS and NGFW.

Some use cases where you can benefit by using the Citrix SWG appliance and inline device integration are:

  • Inspecting encrypted traffic: Most IPS and NGFW appliances bypass encrypted traffic, which can leave servers vulnerable to attacks. A Citrix SWG appliance can decrypt traffic and send it to the inline devices for inspection. This integration enhances the customer’s network security.

  • Offloading inline devices from TLS/SSL processing: TLS/SSL processing is expensive, which can result in high CPU utilization in IPS or NGFW appliances if they also decrypt the traffic. A Citrix SWG appliance helps in offloading TLS/SSL processing from inline devices. As a result, inline devices can inspect a higher volume of traffic.

  • Loading balancing inline devices: If you have configured multiple inline devices to manage heavy traffic, a Citrix SWG appliance can load balance and distribute traffic evenly to these devices.

  • Smart selection of traffic: Instead of sending all the traffic to the inline device for inspection, the appliance does a smart selection of traffic. For example, it skips sending text files for inspection to the inline devices.

Citrix SWG integration with inline devices

The following diagram shows how a Citrix SWG is integrated with inline security devices.

ips overview

When you integrate inline devices with Citrix SWG appliance, the components interact as follows:

  1. A client sends a request to a Citrix SWG appliance.

  2. The appliance sends the data to the inline device for content inspection based on the policy evaluation. For HTTPS traffic, the appliance decrypts the data and sends it in plain text to the inline device for content inspection.

    Note:

    If there are two or more inline devices, the appliance load balances the devices and sends the traffic.

  3. The inline device inspects the data for threats and decides whether to drop, reset, or send the data back to the appliance.

  4. If there are security threats, the device modifies the data and sends it to the appliance.

  5. For HTTPS traffic, the appliance re-encrypts the data and forwards the request to the backend server.

  6. The backend server sends the response to the appliance.

  7. The appliance again decrypts the data and sends it to the inline device for inspection.

  8. The inline device inspects the data. If there are security threats, the device modifies the data and sends it to the appliance.

  9. The appliance re-encrypts the data and sends the response to the client.

Configuring inline device integration

You can configure a Citrix SWG appliance with an inline device in three different ways as follows:

Scenario 1: Using a single inline device

To integrate a security device (IPS or NGFW) in inline mode, you must enable content inspection and MAC-based forwarding (MBF) in global mode on the SWG appliance. Then, add a content inspection profile, a TCP service, a content inspection action for inline devices to reset, block, or drop the traffic based on inspection. Also add a content inspection policy that the appliance uses to decide the subset of traffic to send to the inline devices. Finally, configure the proxy virtual server with layer 2 connection enabled on the server and bind the content inspection policy to this proxy virtual server.

single inline device

Perform the following steps:

  1. Enable MAC-based forwarding (MPF) mode.

  2. Enable the content inspection feature.

  3. Add a content inspection profile for the service. The content inspection profile contains the inline device settings that integrate the SWG appliance with an inline device.

  4. (Optional) Add a TCP monitor.

    Note:

    Transparent devices do not have an IP address. Therefore, to perform health checks, you must explicitly bind a monitor.

  5. Add a service. A service represents an inline device.

  6. (Optional) Bind the service to the TCP monitor.

  7. Add a content inspection action for the service.

  8. Add a content inspection policy and specify the action.

  9. Add an HTTP or HTTPS proxy (content switching) virtual server.

  10. Bind the content inspection policy to the virtual server.

Configuration using the CLI

Type the following commands at the command prompt. Examples are given after most commands.

  1. Enable MBF.

    enable ns mode mbf
    
  2. Enable the feature.

    enable ns feature contentInspection
    
  3. Add a content inspection profile.

    add contentInspection profile <name> -type InlineInspection -egressInterface <interface_name> -ingressInterface <interface_name>[-egressVlan <positive_integer>] [-ingressVlan <positive_integer>]
    

    Example:

    add contentInspection profile ipsprof -type InlineInspection -ingressinterface “1/2” -egressInterface “1/3”
    
  4. Add a service. Specify a dummy IP address that is not owned by any of the devices, including the inline devices. Set use source IP address (USIP) to YES. Set useproxyport to NO. Turn off the health monitor. Turn on health monitoring only if you bind this service to a TCP monitor. If you bind a monitor to a service, then set the TRANSPARENT option in the monitor to ON.

    add service <service_name>  <IP> TCP <Port> - contentinspectionProfileName <Name>  -healthMonitor NO  -usip YES –useproxyport NO
    

    Example:

    add service ips_service 198.51.100.2 TCP * -healthMonitor YES -usip YES -useproxyport NO -contentInspectionProfileName ipsprof
    
    
  5. Add a content inspection action.

    add contentInspection action <name> -type INLINEINSPECTION -serverName <string>
    

    Example:

    add contentInspection action ips_action -type INLINEINSPECTION -serverName ips_service
    
  6. Add a content inspection policy.

    add contentInspection policy <name> -rule <expression> -action <string>
    

    Example:

    add contentInspection policy ips_pol -rule "HTTP.REQ.METHOD.NE(\"CONNECT\")" -action ips_action
    
  7. Add a proxy virtual server.

    add cs vserver <name> PROXY <IPAddress> <port> -cltTimeout <secs> -Listenpolicy <expression> -authn401 ( ON | OFF ) -authnVsName <string> -l2Conn ON
    

    Example:

    add cs vserver transparentcs PROXY * * -cltTimeout 180 -Listenpolicy exp1 -authn401 on -authnVsName swg-auth-vs-trans-http -l2Conn ON
    
  8. Bind the policy to the virtual server.

    bind cs vserver <name> -policyName <string> -priority <positive_integer> -gotoPriorityExpression <expression> -type REQUEST
    

    Example:

    bind cs vserver explicitcs -policyName ips_pol -priority 1 -gotoPriorityExpression END -type REQUEST
    

Configuration using the GUI

  1. Navigate to System > Settings. In Modes and Features, click Configure Modes.

    System Settings

    Enable Mac Based Forwarding

  2. Navigate to System > Settings. In Modes and Features, click Configure Advanced Features.

    Advanced settings

    Enable Content Inspection

  3. Navigate to Secure Web Gateway > Content Inspection > Content Inspection Profiles. Click Add.

    Content Inspection Profile

  4. Navigate to Load Balancing > Services > Add and add a service. In Advanced Settings, click Profiles. In the CI Profile Name list, select the content inspection profile created earlier. In Service Settings, set Use Source IP Address to YES and Use Proxy Port to No. In Basic Settings, set Health Monitoring to NO. Turn on health monitoring only if you bind this service to a TCP monitor. If you bind a monitor to a service, then set the TRANSPARENT option in monitor to ON.

    Link content inspection profile to service

    Additional settings

    Health monitoring setting

  5. Navigate to Secure Web Gateway > Proxy Virtual Servers> Add. Specify a name, IP address, and port. In Advanced Settings, select Policies. Click the “+” sign.

    Add policy

  6. In Choose Policy select Content Inspection. Click Continue.

    Content Inspection Policy

  7. Click Add. Specify a name. In Action, click Add.

    Add action

  8. Specify a name. In Type, select INLINEINSPECTION. In Server Name, select the TCP service created earlier.

    Content Inspection Action

  9. Click Create. Specify the rule and click Create.

    Add policy rule

  10. Click Bind.

  11. Click Done.

Scenario 2: Load balance multiple inline devices with dedicated interfaces

If you are using two or more inline devices, you can load balance the devices using different content inspection services with dedicated interfaces. In this case, the Citrix SWG appliance load balances the subset of traffic sent to each device through a dedicated interface. The subset is decided based on the policies configured. For example, TXT or image files might not be sent for inspection to the inline devices.

multiple inline devices

The basic configuration remains the same as in scenario 1. However, you must create a content inspection profile for each inline device and specify the ingress and egress interface in each profile. Add a service for each inline device. Add a load balancing virtual server and specify it in the content inspection action. Perform the following extra steps:

  1. Add content inspection profiles for each service.

  2. Add a service for each device.

  3. Add a load balancing virtual server.

  4. Specify the load balancing virtual server in the content inspection action.

Configuration using the CLI

Type the following commands at the command prompt. Examples are given after each command.

  1. Enable MBF.

    enable ns mode mbf
    
  2. Enable the feature.

    enable ns feature contentInspection
    
  3. Add profile 1 for service 1.

    add contentInspection profile <name> -type InlineInspection -egressInterface <interface_name> -ingressInterface <interface_name>[-egressVlan <positive_integer>] [-ingressVlan <positive_integer>]
    

    Example:

    add contentInspection profile ipsprof1 -type InlineInspection -ingressInterface "1/2" -egressInterface "1/3"
    
  4. Add profile 2 for service 2.

    add contentInspection profile <name> -type InlineInspection -egressInterface <interface_name> -ingressInterface <interface_name>[-egressVlan <positive_integer>] [-ingressVlan <positive_integer>]
    

    Example:

    add contentInspection profile ipsprof2 -type InlineInspection -ingressInterface "1/4" -egressInterface "1/5"
    
  5. Add service 1. Specify a dummy IP address that is not owned by any of the devices, including the inline devices. Set use source IP address (USIP) to YES. Set useproxyport to NO. Turn off the health monitor. Turn on health monitoring only if you bind this service to a TCP monitor. If you bind a monitor to a service, then set the TRANSPARENT option in the monitor to ON.

    add service <service_name>  <IP> TCP <Port> - contentinspectionProfileName <Name>  -healthMonitor NO  -usip YES –useproxyport NO
    

    Example:

    add service ips_service1 192.168.10.2 TCP * -healthMonitor NO -usip YES -useproxyport NO -contentInspectionProfileName ipsprof1
    
  6. Add service 2. Specify a dummy IP address that is not owned by any of the devices, including the inline devices. Set use source IP address (USIP) to YES. Set useproxyport to NO. Turn off the health monitor. Turn on health monitoring only if you bind this service to a TCP monitor. If you bind a monitor to a service, then set the TRANSPARENT option in the monitor to ON.

    add service <service_name>  <IP> TCP <Port> - contentinspectionProfileName <Name>  -healthMonitor NO  -usip YES –useproxyport NO
    

    Example:

    add service ips_service2 192.168.10.3 TCP * -healthMonitor NO -usip YES -useproxyport NO  -contentInspectionProfileName ipsprof2
    
  7. Add a load balancing virtual server.

    add lb vserver <LB_VSERVER_NAME> TCP <IP> <port>
    

    Example:

    add lb vserver lb_inline_vserver TCP 192.0.2.100 *
    
  8. Bind the services to the load balancing virtual server.

    bind lb vserver <LB_VSERVER_NAME> <service_name>
    bind lb vserver <LB_VSERVER_NAME> <service_name>
    

    Example:

    bind lb vserver lb_inline_vserver ips_service1
    bind lb vserver lb_inline_vserver ips_service2
    
  9. Specify the load balancing virtual server in the content inspection action.

    add contentInspection action <name> -type INLINEINSPECTION -serverName <string>
    

    Example:

    add contentInspection action ips_action -type INLINEINSPECTION -serverName lb_inline_vserver
    
  10. Add a content inspection policy. Specify the content inspection action in the policy.

    add contentInspection policy <name> -rule <expression> -action <string>
    

    Example:

    add contentInspection policy ips_pol -rule "HTTP.REQ.METHOD.NE(\"CONNECT\")" -action ips_action
    
  11. Add a proxy virtual server.

    add cs vserver <name> PROXY <IPAddress> <port> -l2Conn ON
    

    Example:

    add cs vserver transparentcs PROXY * * -l2Conn ON
    
  12. Bind the content inspection policy to the virtual server.

    bind cs vserver <name> -policyName <string> -priority <positive_integer> -gotoPriorityExpression <expression> -type REQUEST
    

    Example:

    bind cs vserver explicitcs -policyName ips_pol -priority 1 -gotoPriorityExpression END -type REQUEST
    

Configuration using the GUI

  1. Navigate to System > Settings. In Modes and Features, click Configure Modes.

    System Settings

    Enable Mac Based Forwarding

  2. Navigate to System > Settings. In Modes and Features, click Configure Advanced Features.

    Advanced settings

    Enable Content Inspection

  3. Navigate to Secure Web Gateway > Content Inspection > Content Inspection Profiles. Click Add.

    Content Inspection Profile

    Specify the ingress and egress interfaces.

    Specify ingress and egress interfaces

    Create two profiles. Specify a different ingress and egress interface in the second profile.

  4. Navigate to Load Balancing > Services > Add and add a service. In Advanced Settings, click Profiles. In the CI Profile Name list, select the content inspection profile created earlier. In Service Settings, set Use Source IP Address to YES and Use Proxy Port to No. In Basic Settings, set Health Monitoring to NO. Turn on health monitoring only if you bind this service to a TCP monitor. If you bind a monitor to a service, then set the TRANSPARENT option in monitor to ON.

    Link content inspection profile to service

    Additional settings

    Health monitoring setting

    Create two services. Specify dummy IP addresses that are not owned by any of the devices, including the inline devices.

  5. Navigate to Load Balancing > Virtual Servers > Add. Create a TCP load balancing virtual server.

    Load balancing virtual server

    Click OK.

  6. Click inside the Load Balancing Virtual Server Service Binding section. In Service Binding, click the arrow in Select Service. Select the two services created earlier, and click Select. Click Bind.

    Click arrow

    Select services to bind

    Bind services to virtual server

  7. Navigate to Secure Web Gateway > Proxy Virtual Servers> Add. Specify a name, IP address, and port. In Advanced Settings, select Policies. Click the “+” sign.

    Add policy

  8. In Choose Policy select Content Inspection. Click Continue.

    Content Inspection Policy

  9. Click Add. Specify a name. In Action, click Add.

    Add action

  10. Specify a name. In Type, select INLINEINSPECTION. In Server Name, select the load balancing virtual server created earlier.

    Content Inspection Action

  11. Click Create. Specify the rule and click Create.

    Add policy rule

  12. Click Bind.

  13. Click Done.

Scenario 3: Load balance multiple inline devices with shared interfaces

If you are using two or more inline devices, you can load balance the devices using different content inspection services with shared interfaces. In this case, the Citrix SWG appliance load balances the subset of traffic sent to each device through a shared interface. The subset is decided based on the policies configured. For example, TXT or image files might not be sent for inspection to the inline devices.

multiple inline devices with shared interface

The basic configuration remains the same as in scenario 2. For this scenario, bind the interfaces to different VLANs to segregate the traffic for each inline device. Specify the VLANs in the content inspection profiles. Perform the following extra steps:

  1. Bind the shared interfaces to different VLANs.

  2. Specify the ingress and egress VLANs in the content inspection profiles.

Configuration using the CLI

Type the following commands at the command prompt. Examples are given after each command.

  1. Enable MBF.

    enable ns mode mbf
    
  2. Enable the feature.

    enable ns feature contentInspection
    
  3. Bind the shared interfaces to different VLANs.

    bind vlan <id> -ifnum <interface> -tagged
    

    Example:

    bind vlan 100 –ifnum 1/2 tagged
    bind vlan 200 –ifnum 1/3 tagged
    bind vlan 300 –ifnum 1/2 tagged
    bind vlan 400 –ifnum 1/3 tagged
    
  4. Add profile 1 for service 1. Specify the ingress and egress VLANs in the profile.

    add contentInspection profile <name> -type InlineInspection -egressInterface <interface_name> -ingressInterface <interface_name>[-egressVlan <positive_integer>] [-ingressVlan <positive_integer>]
    

    Example:

    add contentInspection profile ipsprof1 -type InlineInspection -egressInterface “1/3” -ingressinterface “1/2” –egressVlan 100 -ingressVlan 300
    
  5. Add profile 2 for service 2. Specify the ingress and egress VLANs in the profile.

    add contentInspection profile <name> -type InlineInspection -egressInterface <interface_name> -ingressInterface <interface_name>[-egressVlan <positive_integer>] [-ingressVlan <positive_integer>]
    

    Example:

    add contentInspection profile ipsprof2 -type InlineInspection -egressInterface “1/3” -ingressinterface “1/2” –egressVlan 200 -ingressVlan 400
    
  6. Add service 1.

    add service <service_name>  <IP> TCP <Port> - contentinspectionProfileName <Name>  -healthMonitor NO  -usip YES –useproxyport NO
    

    Example:

    add service ips_service1 192.168.10.2 TCP * -healthMonitor NO -usip YES -useproxyport NO -contentInspectionProfileName ipsprof1
    
  7. Add service 2.

    add service <service_name>  <IP> TCP <Port> - contentinspectionProfileName <Name>  -healthMonitor NO  -usip YES –useproxyport NO
    

    Example:

    add service ips_service2 192.168.10.3 TCP * -healthMonitor NO -usip YES -useproxyport NO -contentInspectionProfileName ipsprof2
    
  8. Add a load balancing virtual server.

    add lb vserver <LB_VSERVER_NAME> TCP <IP> <port>
    

    Example:

    add lb vserver lb_inline_vserver TCP 192.0.2.100 *
    
  9. Bind the services to the load balancing virtual server.

    bind lb vserver <LB_VSERVER_NAME> <service_name>
    bind lb vserver <LB_VSERVER_NAME> <service_name>
    

    Example:

    bind lb vserver lb_inline_vserver ips_service1
    bind lb vserver lb_inline_vserver ips_service2
    
  10. Specify the load balancing virtual server in the content inspection action.

    add contentInspection action <name> -type INLINEINSPECTION -serverName <string>
    

    Example:

    add contentInspection action ips_action -type INLINEINSPECTION -serverName lb_inline_vserver
    
  11. Add a content inspection policy. Specify the content inspection action in the policy.

    add contentInspection policy <name> -rule <expression> -action <string>
    

    Example:

    add contentInspection policy ips_pol -rule "HTTP.REQ.METHOD.NE(\"CONNECT\")" -action ips_action
    
  12. Add a proxy virtual server.

    add cs vserver <name> PROXY <IPAddress> <port> -l2Conn ON
    

    Example:

    add cs vserver transparentcs PROXY * * -l2Conn ON
    
  13. Bind the content inspection policy to the virtual server.

    bind cs vserver <name> -policyName <string> -priority <positive_integer> -gotoPriorityExpression <expression> -type REQUEST
    

    Example:

    bind cs vserver explicitcs -policyName ips_pol -priority 1 -gotoPriorityExpression END -type REQUEST
    

Configuration using the GUI

  1. Navigate to System > Settings. In Modes and Features, click Configure Modes.

    System Settings

    Enable Mac Based Forwarding

  2. Navigate to System > Settings. In Modes and Features, click Configure Advanced Features.

    Advanced settings

    Enable Content Inspection

  3. Navigate to System > Network > VLANs > Add. Add four VLANs and tag them to the interfaces.

    Create VLAN 100

    Create VLAN 200

    Create VLAN 300

    Create VLAN 400

  4. Navigate to Secure Web Gateway > Content Inspection > Content Inspection Profiles. Click Add.

    Content Inspection Profile

    Specify the ingress and egress VLANs.

    Specify interfaces and VLANs for profile 1

    Create another profiles. Specify a different ingress and egress VLAN in the second profile.

    Specify interfaces and VLANs for profile 2

  5. Navigate to Load Balancing > Services > Add and add a service. In Advanced Settings, click Profiles. In the CI Profile Name list, select the content inspection profile created earlier. In Service Settings, set Use Source IP Address to YES and Use Proxy Port to No. In Basic Settings, set Health Monitoring to NO.

    Create two services. Specify dummy IP addresses that are not owned by any of the devices, including the inline devices. Specify profile 1 in service 1, and profile 2 in service 2.

    Link content inspection profile 1 to service 1

    Link content inspection profile 2 to service 2

    Additional settings

    Health monitoring setting

  6. Navigate to Load Balancing > Virtual Servers > Add. Create a TCP load balancing virtual server.

    Load balancing virtual server

    Click OK.

  7. Click inside the Load Balancing Virtual Server Service Binding section. In Service Binding, click the arrow in Select Service. Select the two services created earlier, and click Select. Click Bind.

    Click arrow

    Select services to bind

    Bind services to virtual server

  8. Navigate to Secure Web Gateway > Proxy Virtual Servers> Add. Specify a name, IP address, and port. In Advanced Settings, select Policies. Click the “+” sign.

    Add policy

  9. In Choose Policy select Content Inspection. Click Continue.

    Content Inspection Policy

  10. Click Add. Specify a name. In Action, click Add.

    Add action

  11. Specify a name. In Type, select INLINEINSPECTION. In Server Name, select the load balancing virtual server created earlier.

    Content Inspection Action

  12. Click Create. Specify the rule and click Create.

    Add policy rule

  13. Click Bind.

  14. Click Done.