This article describes how to migrate existing NetScaler Gateway to Unified Gateway on NetScaler Gateway 11.1.

Background

Since NetScaler 11.1 build 49 there is a built-in Gateway Universal license which brings upto unlimited* user licenses and the full Unified Gateway feature set. So why not use a NetScaler Gateway for more than just as an ICA Proxy? This article will show how to migrate an existing NetScaler Gateway with all policies, actions, etc. to an Unified Gateway, which provides remote access from any device to any application.
*(NetScaler Standard Edition = 500 licenses, NetScaler Enterprise Edition = 1000 licenses, and NetScaler Platinum Edition = unlimited licenses)

• Reuse existing NetScaler Gateway instead of configuring a new one from the scratch.
• Using the StoreFront instead of NetScaler landing page.
  •  Access to all apps via native Citrix Receiver.
  • Consolidates all resources.
• Browse a web application directly via dedicated hostname, leveraging the NetScaler Gateway only for authentication.

NetScaler Login Page

StoreFront including webapps

Requirements

• NetScaler with firmware 11.1 build 49 or higher.
• Wildcard SSL Certificate or one SAN per application.
• One external facing IP Address with one DNS record per application.
  In this example, we will use the following URLs:

  URL	Backend	Description
  portal.nw.lab	Storefront	NetScaler Gateway
  basic.nw.lab	Webserver 1	Webserver with NTML / Basic auth
  kcd.nw.lab	Webserver 2	Webserver with Kerberos Constrained Delegation auth
  owa.nw.lab	Webserver 3	Outlook Web Access Server

  

• One central external facing Content Switch VServer instead of Gateway VServer.
• Each application has one dedicated hostname.
• Each application has one Content Switch Policy / Action which matches the FQDN.
• Each application has one non-addressable Load balancing VServer.
• The existing Gateway VServer for ICA Proxy and authentication will be moved from direct to non-addressable as well.
• The policy for the non-addressable Gateway VServer must match the dedicated hostname and "is_vpn_url", for matching on all NetScaler Gateway and authentication-specific requests.

Authentication Flow for Basic Web Application

Instructions

Configuration Elements

VPN VServer

1. Add a new VPN VServer as non-addressable, and make sure to set loginOnce to ON for seamless SSO.
2. Replicate all the "bind" and "set" configuration lines from existing VPN Vserver which you want to migrate
3. Make sure to enable SSO in session profile - if nor already done

Content Switch VServer

1. Add SSL Content Switch VServer with the external facing IP Address (can reuse the former VPN VServer IP address).
2. Bind wildcard SSL Certificate.
3. Edit SSL Parameters and cipher groups according to your companies specifications.

Load Balancing VServer / Service (exemplary for one application)

1. Add non-addressable Load balancing VServer of type HTTP.
2. Enable Authentication, set the AuthenticationHost to Gateway FQDN, and choose the VPN VServer.
3. Add service or servicegroup with backend server, and bind it to Load balancing VServer.

Content Switch Policy / Action  (exemplary for one application)

1. Add Content Switch Action with matching targetLBVserver.
2. Add Content Switch Policy with a rule matching on the FQDN of the respective application.
3. Bind the policy to the Content Switch VServer, and make sure to set the priority lower than 100.

Content Switch Policy / Action for VPN VServer

1. Add Content Switch Action with VPN VServer as target LBVserver.
2. Add Content Switch Policy with a rule matching on the VPN VServer FQDN and on the expression "is_vpn_url".
3. Bind the policy to the Content Switch VServer, and make sure to set the priority to 100.

Traffic Policy / Action for Single Logout

To enable Single Logout on all applications, we will use a Traffic Policy and Action. The policy should match when a user logs out in any of our applications. After that the traffic action will initiate the logout. The NetScaler forces the logout by expiring all session cookies. For more information refer to CTX133537.

In this example, the policy will get triggered when the URL contains the string "logout".
add tm trafficAction traffic-act-logout -persistentCookie OFF -InitiateLogout ON -kcdAccount NONE
add tm trafficPolicy traffic-pol-logout "HTTP.REQ.URL.CONTAINS(\"logout\")" traffic-act-logout
bind cs vserver csv-ug -policyName traffic-pol-logout -priority 100 -gotoPriorityExpression END -type REQUEST

1. Add Traffic Action, and make sure to set InitiateLogout to ON.
2. Add Traffic Policy, and match the URL that should initiate the logout (these rule must be tuned for all applications).
3. Bind the policy to the Content Switch VServer.

Published Content

To have access to all our applications in StoreFront beside XenApp/XenDesktop apps, we can publish these URLs in StoreFront. For this we need the following requirements:

• Powershell access on StoreFront Server
• Citrix PowerShell Plugin
• Administrative access to StoreFront

Import Icon

XenApp/XenDesktop Prior to 7.13

XenApp/XenDesktop 7.13 and Later

1. Choose icon path that should be imported.
2. Note Uid return type.

Publishing URL in StoreFront

1. Edit the URL and all name fields for each application.
2. Set IconUid to the return value of the icon import.

Traces

• Access https://basic.nw.lab from client over NetScaler.

  

• NetScaler tries to access the webserver and gets an 401 Unauthorized response.

  

• on the LBV configured, the authentication triggers and NetScaler sends a redirect to the login page.

  

• Client initiates logout with "GET /logout.html"

  

• Traffic Policy triggers and NetScaler expires the session cookies.