Configure Citrix Gateway to support Enlightened Data Transport and HDX Insight
EDT traffic through Gateway now has end-to-end visibility. Availability of both real-time and historical visibility data enables Citrix ADM to support a wide variety of use cases.
The following scenarios are supported:
| Scenario | EDT support |
|---|---|
| Citrix Gateway | Yes |
| Citrix Gateway with High Availability (HA) | Yes |
| Citrix Gateway with High Availability (HA) optimization | Yes |
| Citrix ADC with Unified Gateway | Yes |
| Citrix Gateway with GSLB | Yes |
| Citrix Gateway with Cluster | Yes |
| Citrix Workspace app to Citrix Gateway DTLS encryption | Yes |
| Dual Secure Ticket Authority (STA) on Citrix Gateway | Yes |
| Citrix Gateway ICA session timeout | Yes |
| Citrix Gateway Multi-Stream ICA | Yes |
| Citrix Gateway session reliability (Port 2598) | Yes |
| Citrix Gateway Double-Hop | Yes |
| Citrix ADC to VDA DTLS encryption | Yes |
| HDX Insight | Yes |
| Citrix Gateway in IPv6 mode | No |
| Citrix Gateway SOCKS (Port 1494) | No |
| Citrix ADC pure LAN proxy | No |
Configure Citrix Gateway to support Enlightened Data Transport
If you use Enlightened Data Transport (EDT), Datagram Transport Layer Security (DTLS) must be enabled to encrypt the UDP connection used by EDT. The DTLS parameter must be enabled at the Gateway VPN virtual-server level. Also, the Citrix Virtual Apps and Desktops components must be correctly upgraded and configured to achieve encrypted traffic between the Gateway VPN virtual server and the user device.
Note:UDP port (for example port 443) configured for the Citrix Gateway front end virtual server must be opened in the DMZ for the virtual server to receive the DTLS connections. DTLS and CGP are prerequisites for EDT to be compatible with Citrix Gateway.
To configure Citrix Gateway to support EDT using GUI
Deploy and configure Citrix Gateway to communicate with StoreFront and authenticate users for Citrix Virtual Apps and Desktops.
On the Configuration tab in the Citrix ADC GUI, expandCitrix Gatewayand selectVirtual Servers.
ClickEditto display Basic Settings for the VPN Virtual Server, and then verify the state of the DTLS setting.
ClickMoreto display other configuration options.
SelectDTLSto provide communications security for datagram protocols. ClickOK. TheBasic Settingsarea for the VPN virtual server shows that the DTLS flag is set toTrue.
To configure Citrix Gateway for EDT support using CLI
set vpn vserver vs1 -DTLS ONConfigure Citrix Gateway to support HDX Insight
HDX Insight provides end-to-end visibility for HDX traffic to virtual apps and desktops passing through Citrix ADC. It also enables administrators to view real-time client and network latency metrics, historical reports, end-to-end performance data, and troubleshoot performance issues.
To configure Citrix Gateway to support HDX Insight using GUI
On theConfigurationtab navigate toSystem> AppFlow>Collectors, and clickAdd.
On theCreate AppFlow Collectorpage, populate the following fields, and clickCreate. Name – Name for the collector
IP address – IPv4 address of the collector
Port – Port on which the collector listens
Net Profile - Net profile to associate with the collector. The IP address defined in the profile is used as the source IP address for AppFlow traffic for this collector. If you do not set this parameter, the Citrix ADC IP (NSIP) address is used as the source IP address.
Transport – Transport type of collector.
Navigate toSystem> AppFlow>Actions, clickAdd.
On theCreate AppFlow Actionpage, populate the following fields, and clickCreate. AppFlow Action Name – Name for the action
Comment – Any comment about the action
Collector – Select the names of collectors to be associated with the AppFlow action.
Transaction Log – Transactions type to be logged.
Navigate toSystem> AppFlow>Policies, clickAdd.
On theCreate AppFlow Policypage, populate the following fields, and clickCreate.
Name – Name for the policy.
Action – Name of the action to be associated with the policy.
UNDEF——演示applow行动是同事的名字d with this policy when an undefined event occurs.
Expression - Expression or other value against which the traffic is evaluated. Must be a Boolean expression.
Comments – Any comments about this policy.
Navigate toCitrix Gateway>Virtual Servers, select the virtual server and clickEdit.
Scroll down theVPN Virtual Serverpage and underPoliciessection, click+.
On theChoose Typescreen, in theChoose Policydrop-down menu, selectAppFlow. In theChoose Typedrop-down menu, chooseRequestorICA Requestand clickContinue.
Click the highlighted arrow underSelect Policy.
Select theAppFlow policyand clickSelect.
Finally clickBind.
To configure Citrix Gateway for HDX Insight support using the CLI, type the following command
add appflow collector col3 -IPAddress add appflow action act1 add appflow policy true bind vpn Vserver -pol - priority101 END -type Disable HDX Insight for non-NSAP HDX session
In a Citrix ADC appliance, you can now disable HDX Insight for the non-NSAP HDX sessions.
At the command prompt, type:
set ica parameter HDXInsightNonNSAP (YES | NO ) By default, HDX Insight for non-NSAP session is enabled.