Configure Access Scenario Fallback
SmartAccess allows Citrix Gateway to determine automatically the methods of access that are allowed for a user device based on the results of an endpoint analysis scan. Access scenario fallback further extends this capability by allowing a user device to fall back from the Citrix Gateway plug-in to the Web Interface or StoreFront by using Citrix Workspace app if the user device does not pass the initial endpoint analysis scan.
To enable access scenario fallback, you configure a post-authentication policy that determines whether users receive an alternative method of access when logging on to Citrix Gateway. This post-authentication policy is defined as a client security expression that you configure either globally or as part of a session profile. If you configure a session profile, the profile is associated to a session policy that you then bind to users, groups, or virtual servers. When you enable access scenario fallback, Citrix Gateway initiates an endpoint analysis scan after user authentication. The results for user devices that do not meet the requirements of a fallback post-authentication scan are as follows:
- If client choices are enabled, users can log on to the Web Interface or StoreFront by using Citrix Workspace app only.
- If clientless access and client choices are disabled, users can be quarantined into a group that provides access only to the Web Interface or StoreFront.
- If clientless access and the Web Interface or StoreFront are enabled on Citrix Gateway and ICA Proxy is disabled, users fall back to clientless access.
- 如果Web接口或店面不是configured and clientless access is set to allow, users fall back to clientless access.
When clientless access is disabled, the following combination of settings must be configured for the access scenario fallback:
- Define client security parameters for the fallback post-authentication scan.
- Define the Web Interface home page.
- Disable client choices.
- If user devices fail the client security check, users are placed into a quarantine group that allows access only to the Web Interface or StoreFront and to published applications.
Create policies for Access Scenario Fallback
To configure Citrix Gateway for access scenario fallback, you need to create policies and groups in the following ways:
- Create a quarantine group in which users are placed if the endpoint analysis scan fails.
- Create a global Web Interface or StoreFront setting that is used if the endpoint analysis scan fails.
- Create a session policy that overrides the global setting and then bind the session policy to a group.
- Create a global client security policy that is applied if the endpoint analysis fails.
When configuring the access scenario fallback, use the following guidelines:
- Using client choices or access scenario fallback requires the Endpoint Analysis plug-in for all users. If endpoint analysis cannot run or if users select Skip Scan during the scan, users are denied access. Note: The option to skip the scan is removed in Citrix Gateway 10.1, Build 120.1316.e
- When you enable client choices, if the user device fails the endpoint analysis scan, users are placed into the quarantine group. Users can continue to log on with either the Citrix Gateway plug-in or the Citrix Workspace app to the Web Interface or StoreFront. Note: Citrix recommends that you do not create a quarantine group if you enable client choices. User devices that fail the endpoint analysis scan are quarantined are treated in the same way as user devices that pass the endpoint scan.
- If the endpoint analysis scan fails and the user is put in the quarantine group, the policies that are bound to the quarantine group are effective only if there are no policies bound directly to the user that have an equal or lower priority number than the policies bound to the quarantine group.
- You can use different web addresses for the Access Interface and, the Web Interface or StoreFront. When you configure the home pages, the Access Interface home page takes precedence for the Citrix Gateway plug-in and the Web Interface home page takes precedence for Web Interface users. The Citrix Workspace app home page takes precedence for StoreFront.
Create a quarantine group
- In the configuration utility, on the Configuration tab, in the navigation pane, expandCitrix Gateway > User Administration, and then clickAAA Groups.
- In the details pane, clickAdd.
- InGroup Name, type a name for the group, clickCreate,and then clickClose.Important: The name of the quarantine group must not match the name of any domain group to which users might belong. If the quarantine group matches an Active Directory group name, users are quarantined even if the user device passes the endpoint analysis security scan.
After creating the group, configure Citrix Gateway to fall back to the Web Interface if the user device fails the endpoint analysis scan.
Configure settings to quarantine user connections
- In the configuration utility, on the Configuration tab, in the navigation pane, expand Citrix Gateway and then clickGlobal Settings.
- In the details pane, underSettings, clickChange global settings.
- In theGlobal Citrix Gateway Settingsdialog box, on thePublished Applicationstab, next toICA Proxy, selectOFF.
- Next toWeb Interface Address, type the web address for StoreFront or the Web Interface.
- Next toSingle Sign-On Domain, type the name of your Active Directory domain, and then clickOK.
After configuring the global settings, create a session policy that overrides the global ICA Proxy setting and then bind the session policy to the quarantine group.
Create a session policy for Access Scenario Fallback
- In the configuration utility, on the Configuration tab, in the navigation pane, expandCitrix Gateway > Policiesand then clickSession.
- In the details pane, clickAdd.
- InName, type a name for the policy.
- Next toRequest Profile, clickNew.
- On thePublished Applicationstab, next toICA Proxy, clickOverride Global, selectOn,and then clickCreate.
- In theCreate Session Policydialog box, next toNamed Expressions, selectGeneral, selectTrue value, clickAdd Expression, clickCreate,and then clickClose.
创建会话策略后,绑定the policy to a quarantine group.
Bind the session policy to the quarantine group
- In the configuration utility, on the Configuration tab, in the navigation pane, expandCitrix Gateway > User Administration, and then clickAAA Groups.
- In the details pane, select a group, and then clickOpen.
- Click Session.
- On thePoliciestab, selectSession, and, then clickInsert Policy.
- UnderPolicy Name, select the policy, and then clickOK.
After creating the session policy and profile enabling the Web Interface or StoreFront on Citrix Gateway, create a global client security policy.
Create a global client security policy
- In the configuration utility, on the Configuration tab, in the navigation pane, expand Citrix Gateway and then clickGlobal Settings.
- In the details pane, underSettings, clickChange global settings.
- On theSecuritytab, clickAdvanced Settings.
- InClient Security, enter the expression. For more information about configuring system expressions, seeConfiguring System ExpressionsandConfiguring Compound Client Security Expressions
- InQuarantine Group, select the group you configured in the group procedure, and then clickOK.