Session policies
A session policy is a collection of expressions and settings that are applied to users, groups, virtual servers, and globally.
You use a session policy to configure the settings for user connections. You can define settings to configure the software users log on with. For example, the Citrix Gateway plug-in for Windows or the Citrix Gateway plug-in for Mac. You can also configure settings to require users to log on with Citrix Workspace app or Secure Hub. After the user is authenticated, session policies are evaluated and applied.
Session policies are applied according to the following rules:
- Session policies always override global settings in the configuration.
- Any attributes or parameters that are not set using a session policy are set on policies established for the virtual server.
- The global configuration sets other attributes not set by a session policy or the virtual server.
Important:
The following instructions are general guidelines for creating session policies. There are specific instructions for configuring session policies for different configurations, such as clientless access or for access to published applications. The instructions might contain directions for configuring a specific setting. However, that setting can be one of many settings that are contained within a session profile and policy.
If you deploy Citrix Endpoint Management or StoreFront in your network, Citrix recommends using the Quick Configuration wizard to configure session policies and profiles. When you run the wizard, you define the settings for your deployment. Citrix Gateway then creates the required authentication, session, and clientless access policies.
Create a session policy
- 在the configuration utility, on the Configuration tab, in the navigation pane, expandCitrix Gateway > Policiesand then click Session.
- 在the details pane, on the Policies tab, click Add.
- 在Name, type a name for the policy.
- Next to Request Profile, click New.
- 在Name, type a name for the profile.
- Complete the settings for the session profile and then click Create.
- 在创建会话配置文件对话框中,添加一个expression for the policy, click Create, and then click Close. Note: In the expression, select True value so the policy is always applied to the level to which it is bound.
Sample session policy expressions
Following are the expression examples of session policies:
add vpn sessionPolicy sessPol1 "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"CitrixReceiver\") || HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"CitrixWorkspace\")" sessAct1
add vpn sessionPolicy sessPol2 "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"CitrixReceiver\").NOT" sessAct2
add vpn sessionPolicy sessPol3 true sessAct3
Bind session policies
After you create a session policy, bind it to a user, group, virtual server, or globally. Session policies are applied as a hierarchy in the following order:
- Users
- Groups
- Virtual servers
- Globally
Bind a session policy to a virtual server by using the GUI
- Navigate toCitrix Gateway > Virtual Servers.
- Select a virtual server and clickEdit. You can also create a new virtual server.
- Scroll down to thePoliciessection, and click the+icon.
- 在Choose Policy, selectSession.
- 在Choose Type, selectRequest, and clickContinue.
- 在Select Policy, select the policy that you want to bind to this virtual server.
- 在Priority, enter the priority number of the policy.
- ClickBind.
Bind a session policy to an authentication, authorization, and auditing group by using the GUI
- Navigate toCitrix Gateway > User Administration > AAA Groups.
- Select an existing authentication, authorization, and auditing group, and clickEdit. You can also create an authentication, authorization, and auditing group.
- 在Advanced Settings,点击Policies,and then click the+icon.
- 在Choose Policy, selectSession, and clickContinue.
- 在Select Policy, select the policy that you want to bind to this authentication, authorization, and auditing group.
- 在Priority, enter the priority number of the policy.
- ClickBind.
Bind a session policy to an authentication, authorization, and auditing user by using the GUI
- Navigate toCitrix Gateway > User Administration > AAA Users.
- Select an existing Citrix ADC user, and clickEdit. You can also create an authentication, authorization, and auditing user.
- 在Advanced Settings,点击Policies,and then click the+icon.
- 在Choose Policy, selectSession, and clickContinue.
- 在Select Policy, select the policy that you want to bind to this authentication, authorization, and auditing user.
- 在Priority, enter the priority number of the policy.
- ClickBind.
Note: For details on priority, seehttps://support.citrix.com/article/CTX214588.
Create a session profile
A session profile contains the settings for user connections.
Session profiles specify the actions that are applied to a user session when the user device meets the policy expression conditions. Profiles are used with session policies. You can use the configuration utility to create session profiles separately from a session policy and then use the profile for multiple policies. You can only use one profile with a policy.
Configure network settings for user connections in a session profile
You can use theNetwork Configurationtab in the session profile to configure the following network settings for user connections:
- DNS server
- WINS server IP address
- Mapped IP address that you can use as an intranet IP address
- Spillover settings for address pools (intranet IP addresses)
- 在tranet IP DNS suffix
- HTTP ports
- Forced time-out settings
Configure connection settings in a session profile
You can use theClient Experiencetab in the session profile to configure the following connection settings:
- Access Interface or customized home page
- Web address for web-based email, such as Outlook Web Access
- plug-in type (Citrix Gateway plug-in for Windows, Citrix Gateway plug-in for macOS X, or Citrix Gateway plug-in for Java)
- Split tunneling
- Session and idle time-out settings
- Clientless access
- Clientless access URL encoding
- plug-in type (Windows, Mac, or Java)
- Single sign-on to web applications
- Credential index for authentication
- Single sign-on with Windows
- Client cleanup behavior
- Logon scripts
- Client debug settings
- Split DNS
- Access to private network IP addresses and local LAN access
- Client choices
- Proxy settings
For more information about configuring settings for user connections, seeConfiguring Connections for the Citrix Gateway plug-in.
Configure security settings in a session profile
You can use theSecuritytab in a session profile to configure the following security settings:
- Default authorization action (allow or deny)
- Secure Browse for connections from iOS devices
- Quarantine groups
- Authorization groups
For more information about configuring authorization on Citrix Gateway, see配置授权.
Configure Citrix Virtual Apps and Desktops settings in a session profile
You can use thePublished Applicationstab in a session profile to configure the following settings for connections to servers running Citrix Virtual Apps and Desktops:
- ICA Proxy, which is client connections using Citrix Workspace app
- Web Interface address
- Web Interface portal mode
- Single sign-on to the server farm domain
- Citrix Workspace app home page
Account Services Address
For more details, seeProviding Access to Published Applications and Virtual Desktops Through the Web Interface.
You can create session profiles independently of a session policy. When you create the policy, you can select the profile to attach to the policy.
To create a session profile by using the GUI
- 在the configuration utility, on the Configuration tab, in the navigation pane, expandCitrix Gateway > Policies,and then clickSession.
- 在the details pane, click theProfilestab, and then clickAdd.
- Configure the settings for the profile.
- ClickCreate, and then clickClose.
After you create a profile, you can include it in a session policy.
To add a profile to a session policy by using the GUI
- 在the configuration utility, in the navigation pane, expandAccess Gateway > Policiesand then clickSession.
- On thePoliciestab, do one of the following:
- ClickAddto create a session policy.
- Select a policy, and then clickOpen.
- 在Request Profile, select a profile from the list.
- Finish configuring the session policy, and then do one of the following:
- ClickCreate,and then clickCloseto create the policy.
- ClickOK,and then clickCloseto modify the policy.