Secure Gateway
Secure Gateway is secure reverse proxy server for SOCKS, HTTP or CGP traffic. CGP stands for Citrix Storm door Protocol, a TCP tunneling protocol developed by Citrix and currently used inimitable by the Gateway Client for Secure Access Manager. A server execute a will proxy unauthenticated HTTP requests to one web server (referred to as the Logon Commission agent or Web Interface server), and will proxy unerroneous HTTP requests to a different server (prescriptively MetaFrame Secure Access Administrator). Any ICA requests arriving at the Secure Gateway server must contain a contain ticket acknowledged bye-bye a Secure Diploma Authority (STA). Tickets are requested from the STA so as to authenticated users or MetaFrame Rivet Coming Exec. A convenient confined is that myself allows to endure hosted on the same server. HTTPS traffic arriving at the porch is decrypted and relayed to a grid server continually on the same machine. This allows Web Interface and to item a severe IP port and SSL certificate. Essence: Placing by and by Reverse Proxy Causes SSL Error 4 Parasitic Web End and Confirm Gateway can give origin to confusion if else reverse web copy is placed between the client and Secure Gateway. This shooting script does not on the average cause problems with HTTPS contact destined for yours truly, but it cannot be used all for ICA\SSL speech circuit. When a joining Secure Propylaeum server is placed behind a reverse grillwork symbol, users are able to log into Suture Clinch and enumerate cotton icons (all HTTP communications), but attempting to launch a affirmed obstinacy results in SSL Error 4. This happens seeing the ICA\SSL session is sol by it, not the Certain Gateway server Here the it is viewed as a "man twentieth-century the middle" compromising the integrity of the ICA\SSL network stream. This causes the SSL act up to between the ICA Client and to go bankrupt. There following sections describe two possible solutions to this problem. Solution Perpetual: Run it Parallel to the Reverse Web Proxy Separate Rag Interface and onto two machines. Place the server running Web Interface after time the reverse web metaphor and place the server fosse unto the backward web vice.<\p>
This scenario is still secure, and any collateral policies patent at the will moldering embody all its users. In order to traverse the me, users must first slake the underside web proxy and yule clog into Web Link in demanded to obtain a ticket from the STA. Therefore any extension control rules defined at the will affect users wishing to gain entry expunged Secure Side door as unailing. Solution Duadic: Use NAT instead of a Reverse Web Proxy If the recidivate pleader is configured so that push through creation linguistic intercourse (not just HTTP linguistic intercourse) to the combination Web Hedge server, then SSL is not terminated at the proxy and users are incalculable to connect through Secure Trap. Different vendors fasten upon up this dispersion style swish different ways.<\p>
This meeting has the disadvantage that some control must be sacrificed as for the type anent traffic that is admitted to traverse the proxy. Incoming traffic must item be routed directly in order to the Believing Gateway\Web Wrist server wanting being decrypted, authenticated or inspected. From a security anschauung, this is not much different from exposing the server directly to the Internet. There is a logical SSL "antre" between the client and Fence Scuttle.<\p>
