Citrix states in their article: CTX107495

Document ID: CTX107495, Created on: Aug 29, 2005, Updated: Oct 27, 2005

Products: Citrix Access Gateway 4.1, Citrix Access Gateway 4.0

Summary

This document provides information on how to configure Radius Authentication on Windows 2003 for use with Citrix Access Gateway. These steps were taken on a Windows 2003 Server with the Internet Authentication Service (IAS) component installed.

Procedure

1. Start the Microsoft Management Console (MMC) and add the Internet Authentication Service by choosing Add/Remove Snap-in from the console menu. Click Add and select the IAS Plug-In. Choose the Local Computer.

2. After the Snap-In is loaded, create a rule to allow the Access Gateway access to the Radius server.

3. Right-click the Clients Folder, and select New Client - give it an identifier when prompted – the FQDN of the Access Gateway Server is a good label – leave the Protocol as Radius.

4. Click Next and provide either the IP address or the FQDN of the Access Gateway appliance that will be connecting to this Radius server for authentication. Leave the Client-Version to RADIUS Standard and provide a Shared Secret that will allow the Access Gateway to authenticate to this Radius server.

5. Click Finish.

Select the Remote Access Policies:

1. Create a new Remote Policy and click Next when the Policy Wizard comes up:

2. Specify a custom policy, give it a policy name and click Next:

3. On the Policy Conditions Screen, select Add….

4. Select Windows-Groups and then click Add:

5. Use the wizard to select the Windows Groups you want to attach to this policy.After adding the users, select Grant remote access permission and select Next.

6. On the User Profile screen, select Edit Profile:

7. Select the Authentication tab and clear the Microsoft Encrypted Authentication version 2 (MS-CHAP v2) and Microsoft Encrypted Authentication (MS-CHAP) selections.

8. Select Encrypted Authentication (CHAP) and Unencrypted Authentication (PAP, SPAP):

9. Go to the Advanced tab, remove the existing parameters and then select Add:

10. Scroll to the bottom of the RADIUS Standard list, select Vendor-Specific, and click Add.

11. Click Add on the Multivalued Attribute Information screen:

12. Leave the network access server vendor as RADIUS Standard, select Yes. It conforms., and then click Configure Attribute:

13. On the Configure VSA screen, leave the attribute number at 0, the format should be String, and then add CTXSUserGroups=My Users where My Users equals the Groups you have defined on the Citrix Access Gateway. Use a semicolon (;) to separate multiple groups.

14. Your Dial-in Profile should resemble this now:

15. Click OK. You will be given a warning message stating that you have selected one or more authentication methods. Click No to avoid opening the help dialog:

16. Click Next:

17. Click Finish to complete the policy wizard:

Configuring the Access Gateway for Radius Authentication

1. Launch the Access Gateway Administration Tool.

2. Select the Authentication tab.

3. Either delete the default realm and recreate it as Radius authentication or create a new realm.

The server IP address will be the Windows Server you configured to act as a Radius Server, the default RADIUS port is 1812, the shared secret is the secret you created when you added the Access Gateway server as a client in the IAS configuration above:

4. On the Authorization tab, leave the type as RADIUS Authorization, Vendor Code at 0, Vendor-assigned attribute number at 0, and for the Attribute Value Prefix, fill in only CTXSUserGroups=.

Troubleshooting

The Radius server must be able to access your Active Directory to authenticate users.

The Event Viewer on the Radius server will show successful and failed authentication attempts:

--------------------------------------------------------------------------------