Deep Dive: Connections in Presentation Server

5/24/2006 — You already know that Citrix Presentation Server 4.0 integrates Web Interface, Conferencing Manager, Secure Gateway and other components. But how, exactly, do those components communicate, and what are the connections? Here, you’ll find a diagram, a list of the connections and ports used, and other helpful information for configuring your network, access and firewall policies.

To see the inner workings of the entire Access Suite 4.2, download the white paper Citrix Access Suite 4.2 Connections at the end of this article.

Scenario I
On the Surface:
Users telecommute from home and use an Internet browser to securely connect to the list of server-based applications available to them. Users of sensitive data or applications use RSA SecurID tokens.

In Depth:
Users connect to a Presentation Server site on Web Interface server through the Secure Gateway server, and then get access to the published Citrix Presentation Server applications and resources. They use either the Citrix Web client or Citrix Client for Java to launch the published applications and open ICA sessions.

Sensitive applications are made available from a different Presentation Server site on the same Web Interface server. This site is configured with two-factor authentication using RSA SecurID tokens. Both an RSA SecurID token and Windows (domain) password are required to log on. After users enter both credentials, they get a list of the sensitive applications. They then use the Citrix Web client or Citrix Client for Java to launch the published applications and open ICA sessions.

Scenario II
On the Surface:
Users collaborate with external consultants who are given temporary guest access to connect via the Web to a conference and participate in editing.

In Depth:
A “Guest User Web Interface for Conferencing Manager” site is configured on the Web Interface server. Guests connect to Conferencing Manager meetings without getting access to other server resources. Consultants are given a guest username that is configured for access to a specific conference in which a regular user launches an application to review and edit documents.
Conferencing Manager is installed and configured on the Citrix Presentation Server, and External Conferencing Service is also configured (required for Guest User Web Interface to work).

The Picture Worth a Thousand Words
This diagram illustrates connections performed when external access to Presentation Server and its components are configured using a Secure Gateway session. The Secure Gateway is an application that runs as a service on a server deployed in the DMZ. This server is a single point of access to the secure enterprise network. The Secure Gateway acts as an intermediary for every connection request originating from the Internet to the enterprise network.

Configuration

• The environment shown in the diagram is external access to the Citrix Presentation Server 4.0 farm.

• Authentication is performed by Microsoft Active Directory. (Presentation Servers are member servers of the Active Directory domain.)

• The Secure Gateway server is installed and configured.

• The Web Interface server contains several sites configured for different tasks, including a site that is configured with two-factor authentication using RSA SecurID 6.0 tokens.

• Conferencing Manager is installed and configured in the Presentation Server farm, and Guest User Web Interface for Conferencing Manager is configured on the Web Interface server. External Conferencing Service is installed on a separate server to provide access for the external guest user through the Web Interface Guest User site. (Note: Although RSA authentication and Guest User Web Interface are both described here, it is not recommended to have both configured on the same Web Interface server at the same time.)

• RSA ACE 6.0 server is present in the network to allow for two-factor authentication.

• Client computers are shown as a single icon that represents all clients using a variety of connection methods, including Internet Explorer (or another browser) and Program Neighborhood. All clients are considered to be external to the corporate network in this scenario.

Click the link for more detailed information about the components, connections and ports of the entire Citrix Access Suite 4.2—including Presentation Server, Password Manager and Access Gateway.

Get the Big Picture Download the white paper, Citrix Access Suite 4.2 Connections, now.