This document contains information about implementing the RSA authentication by using the Remote Authentication Dial In User Service (RADIUS) protocol for Access Gateway Standard Edition.

Instructions

The following components are required on the network to complete the procedures in this document:

• An RSA server on either UNIX or Windows operating system

• Any of the following Citrix Access Gateway software:
  Citrix Access Gateway Standard Edition release 4.6
  Citrix Access Gateway Standard Edition release 4.5.8

• Additionally, you must have the basic knowledge of RADUIS protocol and Administration Tools for the RSA ACE Authentication Server.

To implement the RSA authentication by using the RADIUS protocol for Access Gateway Standard Edition, complete the following procedures:

Configuring the RSA Server

To configure the RSA server to implement the RSA authentication by using the RADIUS protocol for Access Gateway Standard Edition, complete the following procedure:

Note: If you do not have the RSA RADIUS Server component installed on the network, then refer to the RSA ACE/Server 6.0 for Windows Installation Guide for instructions.

1. On the RSA server, select RSA ACE Server from the Programs menu.

2. Select Database Administration - Host Mode from the RSA ACE Server menu.

3. Click Agent Host in the RSA Authentication Manager Host Mode dialog box.

4. Click Add Agent Host.

5. In the Add Agent Host dialog box, complete the following instructions to specify the values for the respective fields:

   • Name: Specify the fully qualified domain name (FQDN) of the Access Gateway appliance. After specifying the FQDN, press Tab.

   • Network Address: The value for the Network Address field is automatically populated. However, if this field does not have a value, then specify the NetScaler IP (NSIP) of the Access Gateway appliance.

   • Agent Type: Select the Communication Server option from the Agent Type list.

   • Select the Open to All Locally Known Users option. If you do not want to allow all the users imported to the RSA server, then click User Activations and import the users that are allowed to authenticate through the Access Gateway.

   • Ensure the Node Secret Created option is not selected. This option is automatically selected when the first time a user from the Access Gateway is authenticated by the RADIUS Server. You can verify this later by opening the properties of the Agent Host and observing that the Node Secret Created option is selected.

   The following screen shot displays the sample values for the various fields in the Add Agent Host dialog box:

   

6. Click OK.

7. If not already created, then create an Agent Host entry for the RSA server by repeating Steps 3 and 4.

8. In the Add Agent Host dialog box, complete the following instructions to specify the values for the respective fields:

   • Name: Specify the FQDN of the RSA server. After specifying the FQDN, press Tab.

   • Network Address: The value for the Network Address field is automatically populated. However, if this field does not have a value, then specify the IP address of the RSA server.

   • Agent Type: Select the Net OS Agent option from the Agent Type list.

   The following screen shot displays the sample values for the various fields in the Add Agent Host dialog box:

   

9. Click OK.

Changing the Default Port of the RSA Server

By default, the RSA ACE/Server daemon listens to the User Datagram Protocol (UDP) port 1645. It is not mandatory to change the port. However, the Access Gateway Standard Edition enables you to set the value for the listener port of the RADIUS server.

To change the default port configured on the SRA server for RADIUS, complete the following procedure: