PLEASE help me setup citrix to be access from outside

[rmcp2k]

Hello,

currently i have citrix ps4.0 to be setup to use internally. It is setup with everything in it; Web interface, licensing, secure gateway and secure ticketing authority. Now that we like it, i want to set it up to be access from outside. i would like people to access using ip address instead of FQDN. Please help with this. i would need to install the certificate also but do not know where i need to install.

info:

citrix box ip: 172.20.1.80
outside ip: 69.x.x.x

 

[newbie000]

Do you have fix IP address ?

You can the SSL certificate from Thawte or many others. Can be installed right away. You have to install this tichet on your server where you have web interface.
Let me know if you need more.

 

[newbie000]

forget one thing.
If you have fix IP address, then access via browser will be

https://69.x.x.x

Standard will be port 443. You will need your webinterface to listen ONLY on port 443 and talk with citrix box on port 80 and 1494 (if you don't use PAT ) and internal encryption.

 

[rmcp2k]

it would be static ip, how would i set this up in citrix? i would like to use NAT. i would also like to put this on the dmz.

 

[newbie000]

Okay, I'll try to explain but you will need to reference the admin guide for detail.
1. Firewall (better to have professional one like checkpoint). Open only 443. Tranfer all incoming to CSG.
2. Install CSG in DMZ. WI and SSL on this server. Listen ONLY on 443 on all interfaces. Let the CSG talk to Citrix servers behind second firewall.

Try this step first to succeed with NAT. Test this from outside connection using ICA client.

If you succeeded, then install second firewall between DMZ and secured zone. Move the Citrix servers into this zone.

Test again from outside if still accessible.
If OK, then configure NAT and PAT on firewalls as you like. Write down each step you have change so that you can back track if you need. Change/configure ONE AT A TIME so you know what went wrong if not working.

I suggest you setup the CSG will SSL first and see the result if you can access from outside using https connection. There are cheaper SSL keys offering around 70$ per year.

let me know when you succeeded this first SSL step.
Are you using IIS or unix ?