Product Documentation

Device Certificate in nFactor as an EPA component

Device Certificate can be configured in nFactor as an EPA component. Device certificate can appear as any factor as a part of EPA.

Following are the benefits of configuring Device Certificate in nFactor as an EPA component.

  • The failure in device certificate validation does not result in a logon failure. Based on the configuration, the log on can proceed and the user can be placed under groups with limited access.

  • Since the Device Certificate check is policy driven, you can selectively allow or block access of your corporate intranet resources based on Device Certificate authentication. For example, Device Certificate authentication can be used to provide conditional access to Office 365 application only on the corporate managed laptops.

Device certificate validation cannot be a part of a periodic EPA scan.

Configure Device Certificate in nFactor as an EPA component

To configure Device Certificate in nFactor as an EPA component using the command line interface, at the command prompt, type:

add authentication epaAction epa-act -csecexpr sys.client_expr("device-cert_0_0") -defaultgroup epa_pass -quarantine_group epa_fail

To configure Device Certificate in nFactor as an EPA component for VPN virtual server using the Citrix ADC GUI:

  1. In the NetScaler GUI, navigate to Configuration> Citrix Gateway>Virtual Servers.
  2. On the Citrix Gateway Virtual Servers page, select the Virtual server to be modified and click Edit.
  3. On the VPN Virtual Server page, click on the Edit icon.

    localized image

  4. Click More.

    localized image

  5. Click Add next to the CA for Device Certificate section and click OK.

    localized image

    Do not select the Enable Device Certificate checkbox. Enabling it enables the Device Certificate validation in the classic EPA.

  6. In the NetScaler GUI, navigate to Configuration> Security>AAA – Application Traffic>Policies>Authentication>Advanced Policies>Actions>EPA>.

  7. On the Authentication EPA Action page, click Add. You can click on Edit to edit an existing EPA action.

  8. On the Create Authentication EPA Action page, provide the values for the required fields to create an authentication EPA action, and click on the EPA Editor link.

  9. Select Common from the Expression Editor drop-down menu.

    localized image

  10. Select Device Certificate from the subsequent drop-down menu that appears and click Done to complete the configuration.

    localized image

To configure Device Certificate in nFactor as an EPA component for AAA virtual server using the Citrix ADC GUI:

  1. In the Citrix DC GUI, navigate to Security> AAA-Application Traffic>Virtual Servers.

  2. On the Citrix Gateway Virtual Servers page, select the Virtual server to be modified and click Edit.

  3. On the Authentication Virtual Server page, click on the Edit icon.

    localized image

  4. Click More.

    localized image

  5. Click Add next to the CA for Device Certificate section.

    localized image

  6. Select the certificate to be added and click OK to complete the configuration.

    localized image

  7. Repeat step 6 to step 10 listed in the previous section to complete the configuration.

Device Certificate in nFactor as an EPA component