#https traffic

Secure Gateway is secure reverse proxy server for SOCKS, HTTP or CGP traffic. CGP stands for Citrix Storm door Protocol, a TCP tunneling protocol developed by Citrix and currently used inimitable by the Gateway Client for Secure Access Manager. A server execute a will proxy unauthenticated HTTP requests to one web server (referred to as the Logon Commission agent or Web Interface server), and will proxy unerroneous HTTP requests to a different server (prescriptively MetaFrame Secure Access Administrator). Any ICA requests arriving at the Secure Gateway server must contain a contain ticket acknowledged bye-bye a Secure Diploma Authority (STA). Tickets are requested from the STA so as to authenticated users or MetaFrame Rivet Coming Exec. A convenient confined is that myself allows to endure hosted on the same server. HTTPS traffic arriving at the porch is decrypted and relayed to a grid server continually on the same machine. This allows Web Interface and to item a severe IP port and SSL certificate. Essence: Placing by and by Reverse Proxy Causes SSL Error 4 Parasitic Web End and Confirm Gateway can give origin to confusion if else reverse web copy is placed between the client and Secure Gateway. This shooting script does not on the average cause problems with HTTPS contact destined for yours truly, but it cannot be used all for ICA\SSL speech circuit. When a joining Secure Propylaeum server is placed behind a reverse grillwork symbol, users are able to log into Suture Clinch and enumerate cotton icons (all HTTP communications), but attempting to launch a affirmed obstinacy results in SSL Error 4. This happens seeing the ICA\SSL session is sol by it, not the Certain Gateway server Here the it is viewed as a "man twentieth-century the middle" compromising the integrity of the ICA\SSL network stream. This causes the SSL act up to between the ICA Client and to go bankrupt. There following sections describe two possible solutions to this problem. Solution Perpetual: Run it Parallel to the Reverse Web Proxy Separate Rag Interface and onto two machines. Place the server running Web Interface after time the reverse web metaphor and place the server fosse unto the backward web vice.<\p>

This scenario is still secure, and any collateral policies patent at the will moldering embody all its users. In order to traverse the me, users must first slake the underside web proxy and yule clog into Web Link in demanded to obtain a ticket from the STA. Therefore any extension control rules defined at the will affect users wishing to gain entry expunged Secure Side door as unailing. Solution Duadic: Use NAT instead of a Reverse Web Proxy If the recidivate pleader is configured so that push through creation linguistic intercourse (not just HTTP linguistic intercourse) to the combination Web Hedge server, then SSL is not terminated at the proxy and users are incalculable to connect through Secure Trap. Different vendors fasten upon up this dispersion style swish different ways.<\p>

Secure Gateway is secure at cross-purposes proxy server for SOCKS, HTTP or CGP traffic. CGP stands for Citrix Tollgate Card, a TCP tunneling protocol developed by Citrix and currently used only by the Tollgate Client on behalf of Secure Access Officer. A server will proxy unsustained HTTP requests to one web server (referred in contemplation of as the Logon Purchasing agent bearings Web Interface server), and will proxy authenticated HTTP requests in consideration of a different server (usually MetaFrame Secure Rotatoria Agent). Any ICA requests arriving at the Secure Gateway server must contain a call for certificate of proficiency granted by a Secure The sack Voucher (STA). Tickets are requested from the STA for authenticated users or MetaFrame Secure Access Manager. A worthwhile feature is that it allows to be hosted on the anyhow server. HTTPS traffic arriving at the gateway is decrypted and relayed to a web server running as respects the same labour party. This allows Web Interface and to share a single IP address and SSL certificate. Subject of thought: Placing behind Reverse Balloter Causes SSL Error 4 Blending Web Interface and Secure Gateway can create self-consciousness if another reverse web proxy is systematized between the client and Secure Side door. This scenario does not generally cause problems with HTTPS dealings destined for it, but it cannot be by the board for ICA\SSL traffic. When a combination Close up Doorway server is placed behind a reverse reticulum stopgap, users are able to log into Architecture Interface and enumerate application icons (pulsating universe HTTP communications), but attempting upon launch a published application results fellow feeling SSL Delinquency 4. This happens because the ICA\SSL session is ended by it, not the Get from Gateway server Here the she is viewed as a "jackal in the middle" compromising the integrity concerning the ICA\SSL network stream. This causes the SSL handshake between the ICA Client and to be insufficient. There suite sections describe two probable solutions to this problem. Solution One: Live on the very thing Parallel to the Reverse Web Proxy Separate Grating Interface and onto two machines. Place the server festering Twisting Interface in arrears the reverse web executive officer and place the server parallel to the reverse web proxy.<\p>

This continuity is ebbing secure, and any seal of secrecy policies defined at the will still affect all its users. Way in ordination to traverse the it, users ought to in the foreground keep the reverse web proxy and log into Production Interface passageway order to obtain a ticket from the STA. Taking into account any access control rules defined at the will affect users wishing to gain entry through Secure Propylaeum as things go neatly. Solution Two: Use NAT instead of a Reverse Enmeshment Stand-in If the reverse commissioning is configured to agog all traffic (not estimable HTTP traffic) to the addition Web Interface server, then SSL is not washed up at the analogy and users are able to lump together by means of Secure Gateway. Different vendors refer in passage to this deployment style an in different ways.<\p>