Allow thru Firewall

[lstresrt]

I want too allow users to access our Citrix servers from home. I can punch a hole thru my Watchguard Firewall to allow citrix TCP port 1494 thru.

Is this safe?

How would you set this type of access up?

 

[JCDugas]

Check this out

http://support.citrix.com/kb/entry.jspa?entryID=134&categoryID=186

Install Web Interfaces on a server in the DMZ, open port 443 to it. (This is the address your users will connect to) Allow 1494 access from the DMZ to the Internal network where your Citrix boxes reside.

You'll need Certificates, either 3rd party or your own (If own, you'll need to have all users install the "root" certificate on their local PC's.)

If you need more info, let me know.

JD

 

[Stevieraycover]

We are having a similar issue where we have everything setup on our firewall. We get IP addr ranges from the "customers" that need to connect to our Citrix farm. The majority of the time we encounter a problem on the customer's side where their security team does not allow outgoing traffic on port 1494. This creates a lot of confusion for the end-user and then the Security teams need to get involved and the whole process is tedious explaining how this needs to be setup in order for the users to connect to our citrix farm. Is there a workaround I can use to avoid this problem???
Desparate.
Steve C

Scover@ciena.com

 

[JCDugas]

If you setup Secure Gateway, the only port that needs to be open on the clients side is 443.

 

[Stevieraycover]

Where would that "secure gateway" setting be?


Scover@ciena.com

 

[ascotta]

Secure Gateway is an add on product from Citrix.

[blue]Arguably the best cat skinner around ! [/blue]

Cheers
Scott

 

[JCDugas]

Secure Gateway is a product not a setting you turn off/on. You'll need to visit My Citrix to download a copy.

http://www.mycitrix.com

 

[lstresrt]

This is how I did it.

I am having my outside users connect with PPTP VPN connection and authenticate to our Watchguard Firewall. Once they authenticate to the firewall they must log on to our domain.

It works, seems to be safe.