Citrix states in their article: CTX109043

Document ID: CTX109043, Created on: Mar 8, 2006, Updated: Mar 8, 2006

Products: Advanced Access Control 4.2, Citrix Access Gateway 4.2

Summary

Advanced Access Control and Access Gateway 4.2 can easily be configured to use the Secure Access Client as a traditional Virtual Private Network (VPN) client that provides secure access to all internal network resources defined by the administrator.

Overview

When setting up “VPN” configuration there are both required and optional settings to configure in Advanced Access Control - both of which will be explained in this article. If you have an existing VPN solution that you desire to mirror using Advanced Access Control it will be helpful to document these settings so that can be easily be configured in Advanced Access Control. This article assumes that Advanced Access Control has been installed and that the Access Gateway(s) are in Advanced Access Control mode and joined to your Advanced Access Control Farm. For details on either these steps reference the Citrix Access Gateway with Advanced Access Control Administrator’s Guide.

The required configurations include:

• Defining Network Resource

• An access policy that grants access to the desired Network Resources

• A connection policy that enables the launching of the Secure Access Client

• Determining and defining the appropriate Split Tunneling settings

The optional configurations include:

• Restricting the access and connection policies by Users or Groups or Filters

• Defining IP Pools

• Enabling Split DNS

Network Resources

The network resources are used to define which specific subnet ranges, Fully Qualified Domain Names (FQDN), IP addresses, and Port/Protocol combinations the Secure Access Client is either Allowed or Denied access to when connected. The administrator can chose to use the preconfigured Entire Network resource which equates to the network range 0.0.0.0/0.0.0.0 for all ports or define custom settings using the settings mentioned above.

Using the Entire Network resource provides the quickest and easiest configuration, but also opens the widest network range granting access to the entire network. Administrators should review their network and security requirements to determine if more granular access is required. If more granular access is required, custom network resources should be defined. For more detail on configuring Network Resources see the Creating Network Resources for VPN Access section of the Citrix Access Gateway with Advanced Access Control Administrator’s Guide.

Access Policies

Access Policies are used to control which network resources users are allowed and denied access to under which conditions. At least one access policy containing the desired network resources must be configured in order to configure VPN Access. The access policy should contain either the Entire Network resource or any custom network resources you wish to allow or deny access to.

In a situation where you want to explicitly Allow and Deny access to network resources separate policies will be needed; one for the Allowed resource and one for denied resources.

When custom network resources are defined and used, the Entire Network resource should not be selected because it grants access to the entire network thereby causing access conflicts with the custom network resources.

Note: The Entire Network resource cannot be deleted.

For more detail on configuring Access Policies see the Controlling Access through Policies section of the Citrix Access Gateway with Advanced Access Control Administrators Guide.

Connection Policy

Connection policies control the conditions under which the Secure Access Client is launched and the associated settings. The primary setting of concern when configuring VPN access is the Launch the Secure Access Client if access allowed setting which controls the launching of the Secure Access Client. At least one connection policy must have this setting enabled. For more information on configuring connection policies see the Creating Connection Policies section of the Citrix Access Gateway with Advanced Access Control Administrator’s Guide.

Split Tunneling

Split tunneling enables client devices to communicate with public Internet resources and your corporate network concurrently.

Split tunneling requires you to configure a list of accessible networks so that users can access corporate resources. For example an accessible network of 0.0.0.0/0.0.0.0 would grant access to the entire network. An accessible network of 10.0.0.0/255.0.0.0 would grant access to only the 10.x.x.x subnet. Your specific network and security requirements will determine which access networks to add. Ensure that any Network Resources defined earlier fall within the accessible networks range if using Split Tunneling. If this list is not defined, users cannot access any corporate resources regardless of any policies granting access.

Disabling split tunneling maximizes the security of client connections and requires no additional configuration for users to begin accessing corporate resources. When split tunneling is disabled, all network traffic sent by the Secure Access Client is routed through the Access Gateway, including traffic to public Internet Web sites.

For more information on Split Tunneling see the Configuring Split Tunneling section of the Citrix Access Gateway with Advanced Access Control Administrator’s Guide.

Optional Configurations

Restricting access and connection policies by Users, Groups or Filters

Both access and connection polices can provide further granular control with the use of Filters and User/Group access control. Both settings are optional when creating policies and can be changed at any time. For more details on these topics see the Citrix Access Gateway with Advanced Access Control Administrator’s Guide.

IP Pools

IP Pools are optional and can be used to give clients connecting with the Secure Access Client a unique IP address. A unique IP range should be set aside for this usage that does not conflict with any existing DHCP Scopes or static IP’s in use.

Note: Access Gateways require a reboot before this setting is applied.

For more detail on configuring IP Pools see the Creating Connection Polices section of the Citrix Access Gateway with Advanced Access Control Administrators Guide.

Enable Split DNS

Split DNS is an optional setting that allows the failover to a client’s local DNS setting should the remote DNS server not be available. By default Access Gateway checks a users remote DNS only.