Verisign Certificate Necessary for CSG?

[netadminTO]

I am trying to deploy a CSG in my environment - complete rookie at this but trying! Please disregard any silly questions, I really am out to lunch with this stuff! This was a project thrown at me with a VERY short timeline.

I have a windows 2003 server running Secure Gateway and Web Interface on the same hardwarein the DMZ. I also have a 2003 server running STA on the LAN with port 443 opened from the firewall. I have generated a certificate through Administrative Tools on the server, however, it is my understanding that this will only work if you purchase a valid SSL certificate from i.e. Verisign (even though I was told otherwise). I can hit this server no problem from the outside world, but cannot login and/or authenticate. The web server can ping/resolve the STA server and picks up the certificate, but does not seem to communicate. I get the "authority server specified cannot be contacted message.

The Web server has an external IP address which can be hit, but I also have a 192.168.X.X nat policy on our firewall setup to hit this server in the DMZ

My questions are:
1. If I only want to publish applications on the Web using a Citrix MetaFrame XP server, what specifically needs to be intsalled on what server?
2. Is the Logon Agent Configuration necessary if you're not running a Secure Access Manager Enterprise environment? Is there another way of authenticating applications?
3. Lastly, any help would be greatly appreciated!


N.A.TO

 

[rjs]

First - get your SSL certs from InstantSSL. $49 and works fine for CSG (but make sure to add root certificates from InstantSSL to all your farm servers).

1. Web Interface and CSG on the server in the DMZ. SSL cert goes here. STA on one or more of your Farm servers. SSL cert optional here if you want SSL between the CSG and the STA.

2. No logon agent for farm access. Only if you use Secure access manager.

3. There is documentation on putting the Web Interface and CSG on the same server. Trick is to bind 2 IP addresses to that server - one for IIS and one for CSG. Then find the document that describes how to keep IIS and CSG listening only on their own respective IPs.

A thorough read of the CSG admin manual is essential.

R.Sobelman

http://www.tracklogins.com

 

[ascotta]

Microsoft Certificate Server certificates work too.

[blue]Arguably the best cat skinner around ! [/blue]

Cheers
Scott

 

[DrGryphon]

If you are using CSG 2.0 then you do not need any "tricks" to install the secure gateway component and web interface on the same box. The easiest configuration has Secure gateway listening to the Internet on port 443 and redirecting HTTPS requests to your local Web Interface server and ICA traffic to your internal LAN. In this configuration Web Interface does not listen directly to the Internet.

Also, because you only use one IP address externally, you can get away with just one certificate, and one NAT/firewall rule.

The original Citrix Guru...

http://www.citrixguru.com