PoC Guide: URL Redirection with Secure Browser and Citrix ADC in Azure

Overview

Here are the configuration steps for setting up an ADC, configuring SSL Forward Proxy, and SSL Interception using the latest Citrix ADC marketplace template. The URL Redirection to Secure Browser capability of the ADC enables administrators to define specific website categories to be redirected from the local browser to Secure Browser automatically. The Citrix ADC acts as an intermediate proxy to do the interception between local browsing and the internet, thus achieving web isolation and protecting the corporate network. This capability increases security without compromising user experience.

Conceptual Architecture

Scope

This proof-of-concept guide describes the following:

1. Obtain Secure Browser Trial Account
2. Set up ADC in Azure
3. Set up Citrix ADC appliance as proxy
4. Set up SSL Interception
5. Set up Rewrite Policy and Actions

Deployment Steps

Section 1: Obtain Secure Browser Trial Account

[Reference doc for Remote Browser Isolation service]/en-us/citrix-remote-browser-isolation)

Request a Secure Browser trial

1. Navigate to your Citrix Cloud account and enter user name and password

2. Click Sign In. If your account manages more than one customer select the appropriate one

   

3. Double-click theSecure Browser Tile.

   

4. If you know who your account team is, then reach out to them to get the trial approved. If you are unsure who your account team is, then continue to the next step.

5. ClickRequest a Call

   

6. Enter your details and in theCommentssection specify“Remote Browser Isolation service trial.”

7. ClickSubmit.

   

   Note:

   Citrix Sales will contact you to give you access to the service. This is not immediate, a Citrix sales rep will reach out

8. Once you have the Secure Browser trial approved, refer to thePublish a Secure Browsersection of the Citrix Docto publish a Secure Browser app.

Enable URL Parameters

1. In your Citrix Cloud subscription, double-click theSecure Browsertile

2. On your published browser, called “browser” in this example, click the three dots and selectPolicies

   

3. EnableURL Parameters policyon your published browser

   

Section 2: Set up ADC in Azure

The ADC can be set up in any cloud of choice. In this example Azure is our Cloud of choice.

Configure an ADC instance

1. Navigate toAll Resourcesand click+ Addbutton, search for Citrix ADC

2. SelectCitrix ADC template

3. Select the software plan according to your requirements (in this example Bring Your Own License)

4. ClickCreate

   

Configure NIC Card

1. Navigate toAll Resourcesand select the NIC card for the ADC instance

2. SelectIP Configurations, make a note of theADC management address

3. Enable IP Forwarding Settings, save the changes.

   

Configure Virtual IP

1. ClickAdd, setvirtualipas the name of the new config

2. SelectStaticand add new IP address after the management address

3. Enable Public address option and create a new public IP address

4. Save the changes

   

设置FQDN on the client

1. Navigate to the Public IP address resource created for thevirtualipconfiguration

2. ClickConfiguration, and add a DNS label (in this example,urlredirection.eastus.cloudapp.azure.com)

   

Set up Networking rules

1. Add the following Networking rules

   

   Note:

   You may choose to close the ports 22 and 443 after the configuration is done, as those ports are only needed for logging into management console for configuration purposes.

2. At this pointthe ADC instance in Azure is set up

Section 3: Set up Citrix ADC appliance as proxy

设置ADC as a proxy to route the traffic from the client browser to the Internet.

Log in to ADC management console

1. Navigate to the Citrix ADC management console by inputting the instance’s public IP address in the search bar of your browser

   Note:

   Use the IP address of the machine you provisioned in the previous steps, in this examplehttps://40.88.150.164/

2. Log in to the console by inputting the user name and password you set up in the previous steps

   

3. From the initial configuration screen, clickContinue

Upload the licenses

1. Navigate toSystem > Licenses > Manage Licenses

2. Upload the necessary licenses for ADC.

   Note:

   The licenses you bring must support the features highlighted in the steps 11 and 13 under Configure Basic Features and Configure Advanced Features (e.g CNS_V3000_SERVER_PLT_Retail.lic, and CNS_WEBF_SSERVER_Retail.lic)

   

3. Rebootthe server after uploading both licenses.

4. After reboot, log in to the management again

5. Navigate toSystem > Settings > Configure Modes

6. Only two options must be enabledMac based forwardingandPath MTU Discovery

   

   

7. Navigate toSystem > Settings > Configure Basic Features

   

8. Select:SSL Offloading,Load Balancing,Rewrite,Authentication, Authorization, and Auditing,Content Switching, andIntegrated Caching

   

9. Navigate toSystem > Settings > Configure Advanced Features

   

10. Select:Cache Redirection,IPv6 Protocol Translation,AppFlow,Reputation,Forward Proxy,Content Inspection,Responder,URL Filtering, andSSL Interception

    

设置NTP Server

1. Navigate toSystem > NTP Servers > Add

   

2. Create a server for examplepool.ntp.org

   

3. Enable NTP when prompted and set server to enabled

   

4. Save the Configuration from the management portal save action

   

5. Open SSH Session to ADC management address, log in with credentials you used while provisioning the ADC from Azure

Set up TCP Profile and vServer

1. Get thevirtualipfrom the steps in Section 2 and input in the command (in this example 10.1.0.5)

2. Run the following commands with thesslproxyaddress for example,virtualip:

3. To add TCP profile:

   add ns tcpProfile proxy-tcpprofile01 -dynamicReceiveBuffering ENABLED -KA ENABLED -mptcp ENABLED -mptcpDropDataOnPreEstSF ENABLED -mptcpSessionTimeout 360 -builtin MODIFIABLE 

4. To add virtual server

   add cs vserver sslproxy01 PROXY 10.1.0.5 8080 -cltTimeout 360 -tcpProfileName proxy-tcpprofile01 -persistenceType NONE bind cs vserver sslproxy01 -lbvserver azurelbdnsvserver add netProfile proxy-netprofile01 -srcIP 10.1.0.5 -srcippersistency ENABLED -MBF ENABLED -proxyProtocol ENABLED -proxyProtocoltxversion V2 set cs vserver sslproxy01 -netProfile proxy-netprofile01 set ssl vserver sslproxy01 -sslProfile ns_default_ssl_profile_frontend save ns config 

5. To change theCache settingsgo back to management session on browser

6. Navigate toOptimization > Integrated Caching

7. Navigate toSettings > Change cache settings

   

8. SetMemory Usage Limitto250 MBand clickOK

   

设置client for URL Redirection

1. On a client, for example Firefox

2. Configure your browser proxy tovirtualip, Public IP, or FQDN: 8080 that you configured in Section 2 (for example,urlredirection.eastus.cloudapp.azure.com:8080)

   

3. Now that we have an ADC set up, test for any website connectivity from the browser with the ADC acting as a proxy.

Section 4: Set up SSL Interception

SSL interception uses a policy that specifies which traffic to intercept, block, or allow. Citrix recommends that you configure one generic policy to intercept traffic and more specific policies to bypass some traffic.

References:

SSL Interception

URL categories

Video example of configuration

Create an RSA Key

1. Navigate toTraffic management > SSL > SSL Files > Keys

2. SelectCreate RSA Key

   

3. Select the key file name and required key size

   

4. Once the key is created, download the.keyfile for later use

   

Create a Certificate Signing Request (CSR)

1. Navigate toTraffic management > SSL > SSL Files > CSRs > Create Certificate Signing Request (CSR)

   

2. Name the request file, for examplesemesec_req1.req

   

3. ClickKey Filename > Appliacethe key file name is the one created in the previous step, in this examplesmesec_key1.key

   

4. After selecting the Key continue to fill in the blanks required: Common Name, Organization Name, and State or Province

5. Click Create

Create a Certificate

1. Navigate to交通管理> SSL文件> > SSL证书s > Create Certificate

   

2. Give the certificate a name and choose both the Certificate Request File (.req) and the Key File name (.key) created in the previous steps

   

3. Click Create

4. Once the certificate is created, download the.certfile for later use

   

Create SSL INTERCEPT policy

1. Navigate toTraffic management > SSL > Policies

2. Click Add

   

3. Give the policy a name and select the INTERCEPT action

4. Expression to intercept news:

   client.ssl.detected_domain.url_categorize(0,0).category.eq("News")

5. Click Create

   

6. To bind the Intercept policy to the virtual server navigate toSecurity > SSL Forward Proxy > Proxy Virtual Servers

   

7. Select the virtual server, in this examplesslproxy01

8. Selectadd SSL Policiesand clickNo SSL Policy Binding

9. Bind the intercept policy:

   

Create SSL BYPASS policy

1. Navigate toTraffic management > SSL > Policies

2. Click Add

   

3. Give the policy a name and select the NOOP action - there is no BYPASS option, see next step

4. Expression to bypass policy:CLIENT.SSL.DETECTED_DOMAIN.CONTAINS("cloud")

   

5. Navigate toSecurity > SSL Forward Proxy > SSL Interception Policies

   

6. Select the policy to edit it

7. Change Action from NOOP to BYPASS

8. Click OK

   

9. Double check that the Action is now BYPASS

10. Go back toTraffic management > SSL > Policiesto double check the change

    

11. To bind the Bypass policy to the virtual server navigate toSecurity > SSL Forward Proxy > Proxy Virtual Servers

    

12. Double-click the virtual server, in this examplesslproxy01

13. Selectadd SSL Policiesand clickSSL Policy Binding

14. Bind the bypass policy > Add

    

15. Click Bind

    

    Note:

    This policy is created to bypass the ADC interception for traffic going to secure browserlaunch.cloud.com

Create SSL Profile

1. Navigate toSystem > Profiles > SSL Profile > Add

   

2. Create the profile by giving it a name, in this examplesmesec_swg_sslprofile

   

3. Check the box to enable SSL Sessions Interception, then click OK

   

4. Click OK to create SSL Profile

5. Must install the cert-key pair

6. Make sure you have a.pfxformat of the cert-key pair before. See the following step for guidance on how to generate a.pfxfile from the.certand.keyfiles that you previously downloaded.

Prepare cert-key pair

1. Start byinstalling the SSL tool

2. Add theopensslinstallation path to the system environment variables

   

3. From PowerShell, run the command:

   openssl pkcs12 -export -out smesec_cert1.pfx -inkey smesec.key1.key -in smesec.cert1.cert

   

Bind an SSL Interception CA Certificate to the SSL Profile

1. Navigate toSystem > Profiles > SSL Profile

2. Select the profile created previously

3. Click+ Certificate Key

4. Click Install

5. Choose the .pfx file prepared previously

6. Create a password (you need it later)

7. Click Install

   

Bind the SSL Profile to the virtual server

1. Navigate toSecurity > SSL Forward Proxy > Proxy Virtual Servers

   

2. Select the virtual server, in this examplesslproxy01

3. Click to edit SSL Profile

   

4. Choose the SSL profile created in previously, in this examplesmesec_swg_sslprofile

5. Done

Section 5: Set up Rewrite Policies and Actions

重写策略由规则和行动。The rule determines the traffic on which rewrite is applied and the action determines the action to be taken by the Citrix ADC. The rewrite policy is necessary for URL redirection to happen to Secure Browser based on the category of the URL entered in the browser, in this example “News”.

Reference

Create rewrite policy and action

1. Navigate toAppExpert > Rewrite > Policy

2. Click Add

   

3. Create the policy by naming it, cloud_pol in this example and use the expression:HTTP.REQ.HOSTNAME.APPEND(HTTP.REQ.URL).URL_CATEGORIZE(0,0).CATEGORY.EQ("News")

4. Click create

   

5. Create the Action in PuTTy

6. Run the following command:

   add rewrite action cloud_act REPLACE_HTTP_RES q{"HTTP/1.1 302 Found" + "\r\n" + "Location: https://launch.cloud.com//?url=https://" + HTTP.REQ.HOSTNAME.APPEND(HTTP.REQ.URL.PATH) + "\r\n\r\n\" "}

   Note:

   In the command replacewith your Citrix Cloud customer account name and replacewith the Secure Browser published app name for which the URL parameters policy is enabled. Referring to the published app you created in Section 1.

Bind rewrite policy to virtual server

1. Back to the ADC management console

2. Navigate toAppExpert > Rewrite > Policy

3. Go to the policy cloud_pol and change the action to cloud_act (the one created previously)

   

4. To choose the type of the rewrite policy navigate toSecurity > SSL Forward Proxy > Proxy Virtual Servers

5. Select “+ Policies”

6. Policy: Rewrite

7. Type: Response

   

8. Select the policy created, in this examplecloud_pol

9. Priority: 10

10. Bind

    

11. Click done

12. Save configuration

Bind Certificate key to Profile

1. Navigate toSystem > Profiles > SSL Profile

2. Select the profile created, for examplesmesec_swg_sslprofile

3. Double-click+ Certificate Key

   

4. Select the certificate key, for examplesmesec_cert_overall

   

5. Click Select
6. Click Bind
7. Click Done
8. Save configuration

Import the certificate file to the browser

1. Upload the certificate into firefox (per our example with News category websites)

2. Go toOptionsin your browser of choice, Firefox in this example

3. Search“certs” > click “View Certificates”

   

4. In the Certificate Manager window click “Import…”

   

5. Browse for your cert and click open,smesec_cert1.certin this example

   

6. Input the password you created when making the certificate

7. Your certificate authority must be installed properly

   

Demo

News websites from the local browser are redirected to Secure Browser automatically. See the followingdemo

Summary

In this PoC guide, you have learned how to set up Citrix ADC in Azure and Configure SSL Forward Proxy and SSL Interception. This integration allows the dynamic delivery of resources by redirecting browsing to Remote Browser Isolation service. Thus, protecting the company network without sacrificing user experience.