Lab: Part 20 – RDP Proxy with NetScaler Unified Gateway 11

RDP Proxy configuration with Citrix NetScaler 11. Connect with single sign-on to Remote Desktop (RDP) connections through NetScaler Gateway.

More from the Lab!

 

RDP Proxy is a new feature initially added in NetScaler 10.5.e and now fully integrated within NetScaler 11. In this post, we will see how to configure RDP Proxy with NetScaler 11 and connect with single sign-on (CredSSP) to Remote Desktop (RDP) connections through NetScaler Gateway without having to configure any RDS server environment (RDS gateway/Web Access).

How does RDP Proxy work ?

1. User connects to Unified Gateway website (SSL VPN)
2. User authenticates (one-factor or two-factor authentication)
3. NetScaler gateway cookie is created
4. RDP ressources enumeration
5. User clicks on the RDP icon (Ex: https://NSGVIP/rdpproxy/ip:port)
6. RDPUser and RDPTarget information are sent and store on one of the STA server configured in the gateway virtual server
7. Authorization from the STA server. STA ticket creation
8. .rdp file is downloaded to the client (STA ticket included)
   • full address:s:NetScalerGatewayURL:port
   • loadbalanceinfo:s:STA Ticket
   • enablecredsspsupport:i:1
   • RDP Settings are provided by the RDP client profile
9. NetScaler accepts/proxies the connection to the RDPListener Gateway on the selected port (default 3389 but you can change it)
10. RDP Listener validates the STA ticket to the STA server
11. RDPUser and RDPTarget are provided to the RDP Listener by the STA server
12. Gateway session is created or reused
13. RDP Listener does the SSO (CredSSP) to the remote server on port 3389

Advantages of using RDP Proxy

• Cheap solution to access backend servers via RDP
• Microsoft Remote Desktop Services Gateway is not necessary (replaced by NetScaler Gateway)
• Authentication on the NetScaler Gateway
• Two-Factor authentication possible
• No Full VPN
• Single sign-on to the remote host (CredSSP)
• RDP session is only allowed after the user authentication
• You can change the port of the RDP session to anything you want
• With Unified Gateway, you can offer applications via ICA Proxy (XenApp apps, VDI, etc) and applications via RDP Proxy (RDP app) on the same website
• Easy to configure (rdp server profile, rdp client profile, bookmarks, session policy)

Requirements

• At least NetScaler 10.5.e
• Port 3389 open between the NetScaler HA Pair and the backend servers (via the SNIP addresses)
• The RDP listener can be configured on any port. The RDP listener can be configured on port 443 as long as you use a unique IP for it, which is different from the VPN server IP. In the lab, we will configure the RDP listener on the port 3389
• Port 3389/443 should be opened on firewall between end user machine IP and VPN virtual server VIP.
• DNS resolution working on the NetScaler
• Enterprise or Platinum NetScaler license
• Universal CCU license (5 by default)
• Unified Gateway virtual server. How to License a NetScaler Gateway Appliance.
• Any SSL/TLS server certificates, authentication policies must be bound to the NetScaler Gateway virtual server that is part of the chosen Unified Gateway formation.

Lab configuration

• NS Build 11.0 62.10.nc
• NetScaler HA Pair configured (192.168.1.201)
• Backend server CDC01.citrixguru.lab (10.0.0.71)
• CDC01.citrixguru.lab is properly resolved on the NetScaler (DNS suffix is configured)
• Unified Gateway virtual server configured (192.168.1.17)
• External Unified Gateway address: lab.citrixguru.com

Lab NetScaler Architecture

Configure RDP Proxy with NetScaler Gateway 11

Enable RDP Proxy feature

First, you need to enable the feature on the NetScaler.

Go to NetScaler > System > Settings and select Configure Advanced Features.

Enable RDP Proxy

Enable RDP Proxy

Shell

enable ns feature rdpproxy

1	enable ns feature rdpproxy

The feature must be licensed to run this command.

Create RDP Client Profile

Complete the following steps to create the RDP client profile.

Go to NetScaler > NetScaler Gateway > Policies > RDP > Profiles and Connections > Client Profiles and select Add.

• Name: rdp_profile_client
• RDP File name: app.rdp
• RDP Host: lab.citrixguru.com
• Pre Shared key: <key>
  • This attribute has been made mandatory with NetScaler 11

You can change RDP settings depending of your needs. For this lab, we are using the default settings.

Create RDP Server Profile (RDP Listener)

Complete the following steps to configure the RDP listener on port 3389. The server profile is configured on the RDPListener Gateway.

Go to NetScaler > NetScaler Gateway > Policies > RDP > Profiles and Connections > Server Profiles and select Add.

Make sure to use the same Pre Shared key as for the RDP Client profile.

• Name: rdp_server_profile
• RDP IP: 192.168.1.17
• RDP Port: 3389
• Pre Shared key: <key>
  • This attribute has been made mandatory with NetScaler 11

The RDP listener can be configured on any port. The RDP listener can be configured on port 443 as long as you use a unique IP for it, which is different from the VPN server IP.

RDP server profile

The same serverProfile cannot be reused on another vpn vserver.

Create session profile

Go to NetScaler > NetScaler Gateway > Policies > NetScaler Gateway Session Policies and Profiles > Session Profiles and select Add.

• Name: rdp_session_profile

Clientless VPN mode should be set to ON. ICA proxy should be OFF. ICA only should be OFF.

• Client access: On

• RDP Client Profile Name: rdp_profile_client

Session profile 4/4

Create session policy

Go to NetScaler > NetScaler Gateway > Policies > NetScaler Gateway Session Policies and Profiles > Session Profiles and select Add.

• Name: rdp_session_pol
• Profile: rdp_session_profile
• Expression: ns_true

Create Bookmark for Unified Gateway

• Name: CDC01
• Text to display: CDC01
• Bookmark: rdp://cdc01.citrixguru.lab
• Use NetScaler Gateway as reverse proxy

Add bookmark

Configure virtual server for RDP proxy

Go to NetScaler > NetScaler Gateway > NetScaler Gateway Virtual Servers and select your virtual server.

• RDP Server Profile: rdp_server_profile
• ICA proxy not checked

Bind session policy to virtual server.

• Name: rdp_session_pol

Publish bookmark.

Select the bookmark previously created.

Published Applications 4/4

Testing

Connect to your external website.

The CDC01 shortcut is available in the Web Apps folder.

You can also type /rdpproxy/YourRDPServer (IP/DNS) in the address bar to start the session.

Click on the icon the start your RDP session.

RDP session is open and the only authentication was on the NetScaler gateway website.

Below is the content the the app.rdp file downloaded from the NetScaler unified gateway.

Go to NetScaler > NetScaler Gateway > Policies > RDP Profiles and Connections > Connections.

You can see the current session.

RDP Proxy is pretty cool feature of Citrix NetScaler which can resolve some of the use cases we are facing with our remote access resolution. However the current implementation is too limited to fully replace Microsoft RDS environment. Let’s just hope that Citrix continues to develop this feature in the next version of NetScaler.

Sources:

CTX200853
Zooming in on RDP Proxy on Unified Gateway
Unified Gateway FAQ
Stateless RDP Proxy

More from the Lab!