NetScaler Gateway 11.1 – RDP Proxy

RDP Proxy

NetScaler supports RDP Proxy through NetScaler Gateway. No VPN required. In 11.1 and newer, RDP can connect to Gateway on 443. In older NetScaler, RDP connects on 3389.

There are several ways of launching RDP sessions through NetScaler Gateway RDP Proxy:

• Bookmarks on the Clientless Access portal page.
  • Bookmarks can be defined by the administrator.
  • Or users can add their own RDP bookmarks.
• After logging in, change the URL in the browser to /rdpproxy/MyRDPServer. MyRDPServer can be IP or DNS.
• In the RfWebUI Portal Theme, the Add Bookmark link lets users enter an RDP address, and click Go.
  

The easy configuration is for one Gateway to do both authentication and RDP Proxy. Alternatively, you can have one Gateway vServer that authenticates the user and a different Gateway vServer to proxy the RDP connection. The Gateways use Secure Ticket Authority (STA) for mutual authentication. See Stateless RDP Proxy at docs.citrix.com for more information.

Links:

• RDP Proxy at Citrix Docs
• Kenny Baldwin blog post RDP-Proxy on NetScaler!
• Citrix Blog Post RDP Gateway on a NetScaler SSLVPN Virtual Server
• Citrix CTX200853 How to Configure RDP Profile on NetScaler Gateway
• RDP Proxy section in Unified Gateway FAQ at docs.citrix.com
• Anton van Pelt NetScaler Gateway = RD Gateway

Here are some requirements for RDP Proxy:

• NetScaler Enterprise Edition or Platinum Edition.
• NetScaler Gateway Universal Licenses for each user.
• TCP 443 opened to the NetScaler Gateway Virtual Server. If older NetScaler, open TCP 3389 to the Gateway.
• TCP 3389 opened from the NetScaler SNIP to the RDP Servers.

Do the following to configure RDP Proxy:

1. Go to System > Settings, and click Configure Advanced Features.
   
2. Check the box for RDP Proxy, and click OK.
   
3. Expand NetScaler Gateway, expand Policies, and click RDP.
   
4. On the right, switch to the Client Profiles tab, and click Add.
   
5. Give the Client Profile a name, and configure it as desired. Scroll down.
   
6. It is no longer necessary to configure a Pre shared key or RDP Host. Just click Create.
   
7. It is no longer necessary to create a RDP Server Profile.
8. If you want to put RDP bookmarks on the Clientless Access portal page, on the left, expand NetScaler Gateway, expand Resources, and click Bookmarks.
9. Alternatively, Simon Gottschlag Publish RDP Proxy Link via StoreFront shows how NetScaler Rewrite can insert an RDP Proxy link into a StoreFront web page.
   
10. On the right, click Add.
    
11. Give the Bookmark a name.
12. For the URL, enter rdp://MyRDPServer using IP or DNS.
13. Check the box next to Use NetScaler Gateway As a Reverse Proxy, and click Create.
14. Create more bookmarks as desired.
    
15. Create or edit a Session Profile/Policy.
16. On the Security tab, set Default Authorization Action to ALLOW. Or you can use Authorization policies to control access.
    
17. On the Remote Desktop tab, Override Global and select the RDP Client Profile you created earlier.
    
18. If you want to use Bookmarks, on the Client Experience tab, set Clientless Access to On.
    
19. On the Published Applications tab, make sure ICA Proxy is OFF.
    
20. Edit or Create your Gateway Virtual Server.
21. In the Basic Settings section, click More.
    
22. It is no longer necessary to bind a RDP Server Profile. Instead, RDP is proxied through 443 on the Gateway.
23. Scroll down. Make sure ICA Only is not checked. This means you’ll need NetScaler Gateway Universal licenses for each user that connects through this Gateway.
    
24. Bind a certificate.
25. Bind authentication policies.
26. Bind the session policy/profile that has the RDP Client Profile configured.
    
27. You can bind Bookmarks to either the NetScaler Gateway Virtual Server, or to a AAA group. To bind to the NetScaler Gateway Virtual Server, on the right, in the Advanced Settings section, click Published Applications.
    
28. On the left, in the Published Applications section, click where it says No Url.
    
29. While editing your Gateway vServer, you can also enable the new RfWebUI Portal Theme. This requires StoreFront to be 3.6 or newer.
    
30. Bind your Bookmarks.
    
31. Since this NetScaler Gateway Virtual Server has ICA Only unchecked, make sure your NetScaler Gateway Universal licenses are configured correctly. On the left, expand NetScaler Gateway and click Global Settings.
    
32. On the right, click Change authentication AAA settings.
    
33. Change the Maximum Number of Users to your licensed limit.
    
34. If you want to connect to RDP servers using DNS, make sure DNS servers are configured on the appliance (Traffic Management > DNS > Name Servers).
    
35. If you want to use the short names instead of FQDNs, add a DNS Suffix (Traffic Management > DNS > DNS Suffix).
    
36. Connect to your Gateway and login.
    
37. If you configured Bookmarks, if RfWebUI theme, on the Apps tab, click Web and SaaS Apps.
    
38. If X1 theme, the bookmarks are on the Web Apps page.
    
39. Then click the Bookmark. If RfWebUI theme, you can also click Details to mark the Bookmark as a Favorite.
    
40. Or you can change the address bar to /rdpproxy/MyRDPServer. You can enter an IP address (e.g. rdpproxy/192.168.1.50) or a DNS name (/rdpproxy/myserver).
    
41. If you edit the downloaded .rdp file, notice that it’s connecting on port 443.
    
42. Then open the downloaded .rdp file.
    
43. You can view the currently connected users by going to NetScaler Gateway > Policies > RDP, and on the right is the Connections tab.
    
44. If using the RfWebUI theme, another way to launch RDP sessions is to click the Add Bookmark link, enter a destination DNS/IP, check the box next to RDP Link, and click Go.
    
45. You can also Save the bookmark.
    
46. Then access the saved bookmark from Apps > Personal Bookmarks.
    
    
47. Personal bookmarks are stored in /var/vpn/bookmarks on the appliance. You might want to back these up and replicate them to other Gateway appliances participating in GSLB. See NetScaler 11.1 Personal Bookmarks at Citrix Discussions.
    
48. The X1 theme has an Add button on the Web Apps page.
    
49. But there is no Go button. Instead, you save the Bookmark and launch it from the list.