Do the Citrix ADC cache. O yes it does, even when the feature is not licensed. This can give some funny trouble shooting issues.
I resent have some problems about the logon page to an Access Gateway function. After a change in the logon page code, the client still gets the old look.
To check if your Citrix ADC is caching anything use this command:
As you can se the Citrix ADC is caching loginstatcobjects, but the feature is not licensed !!!!
If you run this, you will get a static of the caching function on the Citrix ADC:
The good is that you can disable this build in cache of loginstatcobjects. You can do this by running this command:
And to check that it is set:
I took me a while to find that is was the caching function that give me the strange behavior, as the function was not licensed, and I never thought that is could be enabled by default. I hope this can help others.
This blog is from a lesson learned in the field. I have done a normal upgrade from 11.1 to 12.1 on a Citrix ADC HA pair. After the upgrade users complained that they get an error when logging in to some Web sites that where protected by a Security Server on the ADC.
We found that the sites where all
located in a Partition on the ADC.
LDAP test run without any error.
Radius test give this error:
Ok, the problem where with the MFA Radius authentication.
But there where no trace files in /var/partition/radius_test/nstrace. I did this again but still no trace files.
What was going on???????
After some more debugging I did a trace
on Default partition, and now I got some data in my trace:
But the request was coming from the NSIP and not from the SNIP in the partition. Do to Firewall configuration the Radius server could not be accessed this way.
It turns out that the Radius test is
done from the default partition. You can’t use the test with in at partition as
the request is not send from the source address you think.
I later found this in ns.log:
The learned lesson is that if you use Partitions, you can not relay on the Radius test function, as this may not give you a correct response, do to the way traffic is going out of the ADC.
We found a
bug in ADC 12.1 build 55.18. Challenge-Response Radius request from a Partition
got stuck at the ADC, and the users never received their token, and where not
prompted for it.
As the ADC
11.1 build 63.15 had the same bug from default partition, we ended up with a
total rollback, and is now waiting for Citrix to fix this.
LDAP channel binding and LDAP signing provide ways to increase the security of network communications between an Active Directory Domain Services (AD DS) or an Active Directory Lightweight Directory Services (AD LDS) and its clients. There is a vulerability in the default configuration for Lightweight Directory Access Protocol (LDAP) channel binding and LDAP signing and may expose Active directory domain controllers to elevation of privilege vulnerabilities. Microsoft Security Advisory ADV190023 address the issue by recommending the administrators enable LDAP channel binding and LDAP signing on Active Directory Domain Controllers. This hardening must be done manually until the release of the security update that will enable these settings by default.
Microsoft intends to release a security update on Windows Update to enable LDAP channel binding and LDAP signing hardening changes and anticipate this update will be available in March 2020.
And why is
this important for the Citrix ADC. Well that is because that we can use 3 mode
of LDAP communications on the Citrix ADC:
PLAINTEXT:
TLS:
SSL:
If your configuration uses PLANTEXT, that it will stop working after marts, if you patch your Windows Domain Controllers, and who don’t do that.
Get out
there and check your configuration and change it if you are using PLAINTEXT.
Once again,
a was struggling to get User Certificate Authentication to work, until I
suddenly remembered why:
You cannot put your Certification
Authentication Virtual Server behind a Content Switching Virtual Server.
You can, but then you must enable Client Authentication on the Content Switching Virtual Server, and as this often have a lot of other web sites configured all of them will have Client Authentication enabled.
The reason
for this is that when you use Content Switching Virtual Server the SSL session
is established to this and the you need Client Authentication configured here.
So, if you
have a special web site that you need to protect with Client Authentication you
need a direct accessible Authentication Virtual Server.
Let me show
the configuration I ended up with:
Create an Authentication Virtual Server:
Bind your public certificate and your root ca certificate:
For test a use a local user account, but this is normal an Active Directory account:
Then add the Certificate Authentication policy:
You will end up with 2 primary authentication policies:
Change the SSL Parameters so that Client Authentication is enabled:
Now create the Load Balancing Virtual Server and enable Authentication on this:
That is,
it, and when we test, we will get this.
When testing with a user that have no certificate the site will close the connection:
And testing with a user that have a certificate the user is prompted for the certificate to use:
After selected the certificate, the user is redirected to the Authentication Virtual Server for logon:
Conclusion:
You can use User certificates when protecting web sites with authentication. Just remember that the authentication virtual server can often not be behind a content switching server as this will enable user certification on all web site configured on the content switching server.
Again, by a customer I was asked to deliver a solution to there Citrix ADC. The customer has a web server farm which is controlled and maintained by their web developers. There needed their web developers to control witch servers where active in the farm and witch there where in maintains mode.
The easy way is to create a login for the web developers for the Citrix ADC, but there where other system load balanced through the Citrix ADC, and the web developers may not change the configuration for the other systems. We could have created a partition on the Citrix ADC, but I came up with a custom monitor solution. The web developers agreed to put a file on the web servers, and I created a monitor the checked for the content of that file.
If the “nodstatus.txt” return online, the monitor detects the web server as “up” and the load balancing will send traffic to the web server. If anything, else than online is received the monitor will set the web server as “down” and no traffic will be sent to it.
The web developers control the content of the nodestatus.txt file, and in that way, they can control which web servers receive request and which is not, and the developers have no login/access to the Citrix ADC.
