Authorization policies will need to be created to define the network resources that users can access. When the Default Authorization Action is set to DENY, access to all network resources is restricted.

When the plug-in icon is combined into Citrix Workspace app/Receiver it makes it more difficult for the user to log off of VPN. Under Advanced Settings, the Show VPN Plug-in icon with Receiver option should be checked to prevent the Citrix Workspace app/Receiver icon from being combined with the Citrix Gateway plug-in icon. Because we are running a script to activate KMS after a connection is made, the VPN connection can be forcefully ended after a set time.

This setting allows administrators to force the SSL VPN connection to close, and the user must log in again. Create the profile first by clicking Add under Profile*.Ĭonfigure the profile with the following settings: In the AAA group, click the Policies tab and then the + sign to create a new session policy and profile. The session policy will define the settings for user connections. You can find AAA Groups under Citrix Gateway > User Administration.Īfter you create the AAA group, add a session policy and an authorization policy and bind them to the AAA group. When you create the AAA group, give it a name that matches the group name in Active Directory of the VPN users.

Deployment tool to push out the Citrix Gateway plug-inĬonfiguring the SSL VPN Gateway AAA Groupįirst, we’ll create an AAA group that defines the VPN users and restricts access only to the KMS server with session and authorization policies.

Firewall rules open from ADC SNIP to KMS server for port TCP 1688.

Before we get started, here’s what you’ll need: In this blog, I’ll show you how to add a Citrix Gateway VPN service to an existing ADC deployment for client device KMS activation. Instead of asking employees to come into the office to connect their device to the internal network or shell out for a VPN solution, you can use your existing Citrix ADC to create an SSL VPN gateway that only allows access to the KMS server for activation. Organizations that started teleworking in March can expect a deadline to check in around September.

For organizations that use a KMS server to activate Windows OS or Office, endpoints need to check in once every 180 days. Many organizations have already announced that remote work will extend to the fall or the end of the year.

Citrix Virtual Apps & Desktops Standard for AzureĪs we settle into our work-from-home routines, one consideration for many organizations that issue devices to employees and contractors is how those devices will check in to the Microsoft Key Management Service (KMS) server.

Citrix Content Collaboration (ShareFile).

Citrix App Delivery and Security Service.

Kms client firewall settings