PIX 501 & CITRIX ICA

[YIPPEEE]

I'm fairly new to the Cisco world and trying to setup a test lab with a Citrix server (172.16.12.20) behind the firewall (PIX 501). My ISP is providing the outside address (DHCP) and NATing on the inside. Need help setting up config on PIX to allow Citrix ICA connections. ALTADDR has been set to outside interface address... See config below.



PIX Version 6.2(2)
interface ethernet0 10baset
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password **************** encrypted
passwd ******************* encrypted
hostname TESTPIX
domain-name TESTPIX.COM
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
name 172.16.12.20 TEST-01
pager lines 24
logging console informational
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 172.16.12.1 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
pdm location 172.16.12.0 255.255.255.0 inside
pdm location 172.16.12.0 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface citrix-ica TEST-01 citrix-ica netmask 255.255.255.255 0 0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 172.16.12.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection tcpmss minimum 48
sysopt noproxyarp outside
sysopt noproxyarp inside
telnet 172.16.12.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 172.16.12.2-172.16.12.10 inside
dhcpd lease 43200
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80



Any help would be appreciated...

 

[yizhar]

HI.

Either use the "rules" tab in PDM or use command line to add "access-list" that will allow incoming traffic to the citrix server.

> My ISP is providing the outside address (DHCP) and NATing on the inside
> ip address outside dhcp setroute
If you don't use a fixed ip, then how will external users access the server?
While it is possible to workaround the dynamic ip addresses and dual nat (pix+router), it is best to use fixed registered ip addresses for the pix, and no nat in the router.
If you have an ADSL PPPoE connection, you can dismiss the router and use the pix in conjunction with a simple ADSL-Etherenet modem, and then the pix will get the public ip and not the modem.
Ask your ISP about how can you get registered ip address(es) for the pix.

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[hoinvip]

Yizhar is right - you'll need both an access-list and a matching access-group statement on the outside interface allowing port 1494 on TCP and UDP through the firewall for Citrix ICA to work.

However, without a static IP it's going to be difficult to offer your users a reliable service.

Go for a static IP - with DSL services, it's normally easy enough to obtain a fixed allocation from your ISP - you just need to justify your requirement.

Hope this helps.