SSL VPN Gateway- "Citrix Secure Access" Client Just Opens Browser

[Bashar Bader]

Been trying to configure a SSL VPN Gateway on my ADC, and the clientless access is working correctly. However, when trying to connect using "Citrix Secure Access", it just opens a browser and loads the login page of the gateway.

 

Am I missing some software, or some special configuration to enable access through the client?

[CarlStalhood]

For full VPN, your session policy needs Clientless set to Disabled and then set VPN Plug-in to Windows/Mac. There are other settings related to IP Addresses, split tunnel timeouts, authorization policies, etc.

 

Full VPN puts the client machine on your network as if the user was in your office.

 

Clientless proxies all traffic through a browser so you're not doing full VPN since full VPN has security implications.

[CarlStalhood]

"Citrix Secure Access" is full VPN client. Do you have session policies configured with full VPN settings? https://www.carlstalhood.com/citrix-gateway-ssl-vpn/

 

Clientless does not need a VPN client.

[Bashar Bader]

19 hours ago, Carl Stalhood1709151912 said:

"Citrix Secure Access" is full VPN client.

I'm kinda new to Citrix in general, what does full VPN client mean exactly?

Also, what's the difference between the clientless access and the client access if both connect from the browser? 

or is this not the case and I have some missing configurations?

19 hours ago, Carl Stalhood1709151912 said:

Do you have session policies configured with full VPN settings? https://www.carlstalhood.com/citrix-gateway-ssl-vpn/

I'm not sure about the full VPN settings. However, I followed your guide for my initial configuration of the session profile

[Bashar Bader]

On 6/21/2022 at 12:23 PM, Carl Stalhood1709151912 said:

For full VPN, your session policy needs Clientless set to Disabled

The VPN Client works. I forgot to set the Clientless access to Disabled in my initial configurations.

Also, I had some misconceptions about the client that were cleared.

 

Another problem that appeared. After the connection is established with the client, when I do "nslookup" i get the following output, even though this is not my DNS server. Why is this happening? 

 

 

[CarlStalhood]

That's how the Gateway client redirects DNS requests across the VPN tunnel.

[Bashar Bader]

Thanks.

One last question. How do I configure the SSL VPN Gateway to allow both clientless access and access from the "Citrix Secure Access" client?

Or do I have to download some other client for this to be possible?

[CarlStalhood]

In a Session Profile, on Client Experience tab, click Advanced. There's a checkbox for Client Choices. The user can then choose if they are using a browser.

[Bashar Bader]

Does that include changing the clientess access option from "disabled" to "on"?

[CarlStalhood]

You would need to enable all options that you want to see in Client Choices. Full VPN is always enabled. Clientless VPN and ICA Proxy are enabled separately.