NetScaler Gateway 11 footer customization

Ran into difficulties customizing a new NetScaler 11 Gateway.  Although I was happy to finally be able to apply themes per NetScaler Gateway vServer, I quickly saw that this new option presents new challenges if you are looking to customize beyond what the themes allow.

Our goal was to add footer information on the front page in order to provide Help Desk contact info, a Citrix Receiver download link and the RSA Self Service portal.   With NS 11, the problem is that the index.html file is no longer constructed the same as it was with 10.x.

Lets understand this a bit more.

With NetScaler Gateway 11, the logon form and pretty much the entire index.html body, is generated by 2 javascript files (gateway_login_view.js and gateway_login_form_view.js).

  1. gateway_login_view.js – creates the body and tables for the actual form
  2. gateway_login_form_view.js – creates the form itself, username and password fields, domain dropdown box, etc.

This naturally creates a headache if you are use to working with the 10.x firmware.  As with 10.x you can accomplish most of the customization by directly modifying the index.html file, and creating a custom global policy user interface.  On the other hand, this presented a challenge if you had to run multiple Gateway vServers  with a custom UI, and you had to get pretty creative on how to overcome  it.

For NS 11, I read a post where someone was struggling with a similar situation, luckily it pointed me in the right direction.  The post suggested to modify or create a new gateway_login_view.js  and/or gateway_login_form_view.js (you can read the post here).  

Rather than modifying existing code or creating new files then having to deal with responder policies, etc.  I figure I try to do this via the NetScaler Rewrite Policies and Actions to make it look something like the picture below.

ns11_rw_final

Environment:

  • Citrix NetsScaler 11.0Build 63.16.nc
  • StoreFront 3.0
  • RSA 8.1

Let’s get started.

  1. Add links at the bottom of the authentication page, unfortunately rewrite actions have a 255 character limit which you can easily bypass by adding “+” to the expression. Click here to view/download the syntax as WordPress messes with it.

2. Enable the EULA box by default:

add rewrite action ns_gtw_eula_checked_action replace_all “http.RES.BODY(120000).SET_TEXT_MODE(ignorecase)” “\”type=\’checkbox\’ checked\”” -pattern “type=\’checkbox\'”
add rewrite policy ns_gtw_eula_checked_pol “HTTP.REQ.URL.CONTAINS(\”gateway_login_form_view.js\”)” ns_gtw_eula_checked_action
bind vpn vserver portal_netscaler -policy ns_gtw_eula_checked_pol -priority 110 -gotoPriorityExpression NEXT -type RESPONSE

3. Enable the Logon Button by default:

add rewrite action ns_gtw_LogonAutoEnable_rw_act replace_all “http.RES.BODY(120000).SET_TEXT_MODE(ignorecase)” “\”\’disabled\’:\’\’\”” -pattern “\’disabled\’:\’disabled\'”
add rewrite policy ns_gtw_LogonAutoEnable_rw_pol “HTTP.REQ.URL.CONTAINS(\”gateway_login_form_view.js\”)” ns_gtw_LogonAutoEnable_rw_act
bind vpn vserver portal_netscaler -policy ns_gtw_LogonAutoEnable_rw_pol -priority 120 -gotoPriorityExpression END -type RESPONSE

Hope this helps 🙂

Disclaimer:

I do not accept any responsibility or liability for the accuracy, content, completeness, legality, or reliability of the information contained on this website.

Automatic NetScaler Gateway 11 EULA Acceptance

With the new release of Citrix NetScaler 11, we now have the  option to setup an End User License Agreement for users prior to logging in.  After getting the NetScaler Gateway configured and enabling EULA policies, I thought it would be useful to have the check box enabled, and the Log On button turned on by default.

Below are the steps on how to set up Rewrite Policies and Rewrite Actions on the NetScaler to automatically check  the EULA acceptance box, as well as turn on the Log on button.

The default behavior is to have users select the box every time prior to authenticating to the NetScaler Gateway 😦

unchecked_eula

Environment:

  • Citrix NetsScaler 11.0Build 63.16.nc
  • StoreFront 3.0
  • RSA 8.1

Fix:

Enable the check box

add rewrite action ns_gtw_eula_checked_action replace_all “http.RES.BODY(120000).SET_TEXT_MODE(ignorecase)” “\”type=\’checkbox\’ checked\”” -pattern “type=\’checkbox\'”
add rewrite policy ns_gtw_eula_checked_pol “HTTP.REQ.URL.CONTAINS(\”gateway_login_form_view.js\”)” ns_gtw_eula_checked_action
bind vpn vserver name_of_your_ns_gtw_vip -policy ns_gtw_eula_checked_pol -priority 100 -gotoPriorityExpression NEXT -type RESPONSE

Enable the Logon button – By default this is disabled in the gateway_login_form_view.js file

add rewrite action ns_gtw_LogonAutoEnable_rw_act replace_all “http.RES.BODY(120000).SET_TEXT_MODE(ignorecase)” “\”\’disabled\’:\’\’\”” -pattern “\’disabled\’:\’disabled\'”
add rewrite policy ns_gtw_LogonAutoEnable_rw_pol “HTTP.REQ.URL.CONTAINS(\”gateway_login_form_view.js\”)” ns_gtw_LogonAutoEnable_rw_act
bind vpn vserver name_of_your_ns_gtw_vip -policy ns_gtw_LogonAutoEnable_rw_pol -priority 110 -gotoPriorityExpression NEXT -type RESPONSE

Final result – The Checkbox and Logon box will be enabled when users go to the NetScaler Gateway site.

Disclaimer:

I do not accept any responsibility or liability for the accuracy, content, completeness, legality, or reliability of the information contained on this website.

Provide Citrix Receiver download link on NetScaler Gateway authentication page based on Client OS

While working on a new StoreFront/NetScaler Gateway implementation, I was asked to provide a Citrix Receiver link on the NetScaler Gateway authentication page, although I thought this was a pretty simple task, I figure we would make this fancier and detect the Client OS then provide the proper Citrix Receiver the company wanted to deploy.

Before you get started, I suggest reading the articles below.  These guides will give you a great understanding on the steps necessary to modify the NetScaler Gateway logon page.

Remember that the changes will be lost if the NetScaler reboots, so please make sure to follow the steps below after you are done.

Apply customization:

Putty in to NS

  • shell
  • mkdir /var/ns_gui_custom
  • cd /netscaler
  • tar -cvzf /var/ns_gui_custom/customtheme.tar.gz ns_gui/*

Now apply the package to your AGEE sites

  • In the configuration utility, under the Configuration tab, expand “NetScaler Gateway” and then click “Global Settings“.
  • In the details pane, under Settings, click Change global settings.
  • In Global NetScaler Gateway Settings, click the Client Experience tab.
  • Next to UI theme, click Custom and then click OK.
  • Save NS config and done!

Read these before getting started:

Environment:

  • Citrix NetsScaler 10.5 Safe Harbor Build 56.22.nc
  • StoreFront 2.6

Lets get started 🙂

Goals:

  • Create Receiver Download link based on OS (Windows, Mac, iOS and Linux)
  • Create Support Contact information
  • Create footer information

The final look (had to blur company info, logos and links)

final_page

Back up the index.html file under /var/netscaler/gui/vpn.  In this case this deployment is already set up with the StoreFront 3.0 look and feel, so I just need to mess with the index.html

Around line 15.  Lets add some CSS so we can then use to display the text.  Your code should look like this

<style type=”text/css”>
body
{
display : none;
visibility: hidden;
}

#auth-footer-disclaimer-wrapper {
width: 100%;
position: absolute;
bottom: 10px;
text-align: center;
}

#auth-footer-disclaimer {
color: white;
width: 80%;
margin: 0px auto;
font-family: tahoma, helvetica, arial;
font-size: 7pt;
}

#auth-footer-help-info {
color: white;
width: 80%;
margin: 0px auto;
font-family: tahoma, helvetica, arial;
font-size: 10pt;
}
#auth-footer-qrc-links {
color: white;
position: relative;
text-align: center;
font-family: source sans pro, segoe ui, arial;
font-size: 10pt;
padding: 10px;
}

#auth-footer-qrc-links a, a:link, a:visited {
color: white;
text-decoration: underline;
}

#auth-footer-qrc-links a:hover {
color: white;
text-decoration: underline;
}

</style>

Now lets create that java script for browser detection script to detect the presentation of ICA client download links

Inset this around line 87 after

function setFocus(obj)
{
if (obj != null) {
obj.focus();
}
}

You will need to insert the javascript here.  However WordPress is not allowing me to display it 😦

Take a look at the index.html file link

Now around line 236, look for

div id=”logonbelt-bottomshadow”

Then inset the code to call the CSS you used as well as the link and text you defined before

<!– Display Citrix Receiver link // –>
<div id=”auth-footer-qrc-links”>

document.write(dlLink);

Here is the entire Index.html file

Disclaimer:

I do not accept any responsibility or liability for the accuracy, content, completeness, legality, or reliability of the information contained on this website.

 

 

NetScaler Gateway front page à la StoreFront 3.0

Below are the steps on how to brand the NetScaler Gateway front page to look similar to the new release of StoreFront 3.0.

If you are enabling the VPN (AKA Client Choices), then I also suggest you read my Citrix NetScaler Gateway Client Choices branding post.  And finaly take a peek at my previous post on Customizing Citrix NetScaler Gateway 10.5 logon page with Dual Factor Authentication,

Please note I tested this on several 10.1 Firmware Releases as well as the 10.5 Safe Harbor Build 56.22.nc release.

Environment 

  • Citrix NetsScaler 10.5 Safe Harbor Build 56.22.nc
  • StoreFront 2.6

Lets take a look at the Default Logon Page to be utilized with Citrix Web Interface 5.x (not 5.4) to match the carbon-black look and feel

ns_gateway_default

Ok now lets make this Green Bubble, once you apply the changes, you will notice the files will change under /var/netscaler/gui/vpn

Head over to your NS management IP:

Go under NetScaler > NetScaler Gateway > Global Settings and click on “Change Global settings”
Now click on the “Client Experience” Tab and change the “UI Theme” from “Default” to “Green Bubble”

This will update the authentication page to the horrendous looking Bubble Green theme

ns_gateway_green

Now lets have some fun 😛

Backup the entire  /var/netscaler/gui/vpn directory

Since I am using second factor authentication for this roll out, we need to modify the login.js file in order to customize the password fields

ns_password

 

Around line 89 you will see the showpwd function, this will need to be manipulated so it does not displays the word “Password: 1” but rather something as simple as “Password:” or whatever you like.  Your code should look this this.

function ns_showpwd_greenbubble()
{
var pwc = ns_getcookie(“pwcount”);
document.write(‘<div class=”field CredentialTypepassword”><div class=”left”><label class=”label plain”><SPAN>’ + _(“Password”));

// Original password settings with Password: 1
// if ( pwc == 2 ) { document.write(‘&nbsp;1’); }
// Removes password value 1 when using dual factor

if ( pwc == 2 ) { document.write(‘&nbsp;’); }
document.write(‘:</SPAN></label></div>’);
document.write(‘<div class=”right”><input class=”prePopulatedCredential” autocomplete=”off” spellcheck=”false” type=”Password” title=”‘ + _(“Enter password”) + ‘” name=”passwd” size=”30″ maxlength=”127″></div></div>’);
if ( pwc == 2 ) {
document.write(‘<div class=”field CredentialTypepassword”><div class=”left”><label class=”label plain”><SPAN>’ + _(“Password2″) + ‘</SPAN></label></div><div class=”right”><input class=”prePopulatedCredential” autocomplete=”off” spellcheck=”false” type=”Password” title=”‘ + _(“Enter password”) + ‘” name=”passwd1″ size=”30″ maxlength=”127″></div></div>’);
}
UnsetCookie(“pwcount”);
}

Now lets modify the “Password 2:” entry by heading over to the “en.xml” under the “resources” folder

Around line 83 change the “Password2″ String to something like “RSA Code”

<String id=”Password2″>RSA Code:</String>

Ok that takes care of the Password fields 🙂

ns_password2

 

Now lets modify some CSS.  Head over to “ctxs.authentication.css” in the “css” folder

Lets add that funky shadow border StoreFront 2.6 has, which by default it is missing

ns_no_shadow_border

 

Around line look for “#logonbelt-topshadow” and “#logonbelt-bottomshadow” and lets add the shadow pics StoreFront uses.

Your code should look like this when you are done, make sure you copy those files from the StoreFront servers under the media directory on your StoreFront site (Ex: c:\inetpub\wwwroot\Citrix\NetScalerGatewayWeb\media\) copy both Screen_shadow_top.png and Screen_shadow_bottom.png to the “media”folder on your NS.

#logonbelt-topshadow {
background: url(“../media/Screen_shadow_top.png”) no-repeat transparent;
position: relative;
top: 205px;
margin: 0 auto;
width: 1009px;
height: 15px;
}

#logonbelt-bottomshadow {
background: url(“../media/Screen_shadow_bottom.png”) no-repeat transparent;
position: relative;
bottom: 0;
margin: 205px auto 0;
width: 1009px;
height: 15px;
}

Now lets change that darn green vertical bar, which is actually a pic that Citrix calls in their code.

ns_greenbar

Look for “#logonbox-container”, you will need to crank up that Photoshop or whatever image utility you use, and paint it the color you like, then point to the new file.  As you can tell Citrix is using a file called “VerticalGreenBarOnly.png” under the media folder.  Make changes and upload the new pic file and make a call to it in the CSS.  Your code should look like this.

#logonbox-container
{
/* background: url(“../media/VerticalGreenBarOnly.png”) repeat-y scroll 0 0 transparent; */
background: url(“../media/VerticalPurpleBarOnly.png“) repeat-y scroll 0 0 transparent; */
min-height: 230px;
margin: auto;
min-width: 654px;
position: relative;
top: 205px;
}

Now lets use that StoreFront 3.0 background file, head over to your X1 installaton and grab the bg_x1.jpg file under your Sites deployment (Ex: C:\inetpub\wwwroot\Citrix\PrivateCloudWeb\media)

Upload bg_x1 to the media folder on your NS and make a call to it under “#authentication”  Your code should look like this when you are done.

#authentication
{
background-image: url(‘../media/bg_x1.jpg’);
background-size: cover;
height: 100%;
width: 100%;
}

Now lets go after that logo.  You will need to mess around with the height and width and top settings based on the size of the log you are using.

Upload your company log to the media folder on NS, then head to the “#logonbox-logoimage” section and make a call to it.  Your code will look something like this when you are done.

#logonbox-logoimage
{
background-image: url(“../media/company_logo.png”);
border: 0 none;
float: right;
height: 43px;
position: absolute;
right: 69%;
top: 92px;
width: 354px;
}

Now lets make this work with IE11, and force the index.html file to render with IE9. Lets also change the default “NetScaler Gateway” Tab to match your company name.  In my case I am also loading a custom ico file when you save the link.

Open the index.html file and modify the code so it looks something like this

<HEAD><TITLE>Name of your Company</TITLE>

<META http-equiv=”X-UA-Compatible” content=”IE=EmulateIE9″ />

<link rel=”SHORTCUT ICON” href=”/vpn/images/company_icon.ico” type=”image/vnd.microsoft.icon”>

Almost done, except that the background picture you used “bg_x1.jpg” is not dynamic, meaning it will display a static size and will not re-size on the screen based on the browser size, and you get this very annoying scroll bar at the bottom right.

ns_non_dynamic_back

The reason is Citrix is using 9px as a margin to allocate that green bar “background: url(“../media/VerticalGreenBarOnly.png”) repeat-y scroll 0 0 transparent;” So lets delete that margin and also make the background image cover the browser screen.  Your code should look like this

#logonbox-innerbox {
background: url(“../media/Screen_SemiTranslucent.png”);
display: table;
height:242px;
position: relative;
width: 100%;
/* margin-left: 9px; Remove margin on the right. Makes the front page scroll 😦 */
}

#authentication
{
background-image: url(‘../media/bg_x1.jpg’);
background-size: cover;
height: 100%;
width: 100%;
}

We are done.  End result will look something like this.  Hope this helps and please remember to do the following or your will lose your work when the Netscaler is rebooted

Open Putty and log in as nsroot, then type (Note the name of the compressed file, this needs to match “customtheme.tar.gz“)

  • shell
  • mkdir /var/ns_gui_custom
  • cd /netscaler
  • tar -cvzf /var/ns_gui_custom/customtheme.tar.gz ns_gui/*

Now apply the package to your AGEE sites

  • In the configuration utility, under the Configuration tab, expand “NetScaler Gateway” and then click “Global Settings“.
  • In the details pane, under Settings, click Change global settings.
  • In Global NetScaler Gateway Settings, click the Client Experience tab.
  • Next to UI theme, click Custom and then click OK.
  • Save NS config and done!

ns_final

 

Disclaimer:

I do not accept any responsibility or liability for the accuracy, content, completeness, legality, or reliability of the information contained on this website.

GSLB services for Citrix NetScaler Gateway – Active/Passive setup

Below is a guide on how to set up GSLB services for the Citrix NetScaler Gateway.

Before we get started, lets understand the flow a bit as well as the NetScaler services you need. I also really suggest you read the GSLB configuration guide by Dave Brett, which walks you trough the process of setting up ADNS, as well as GSLB servers, and finally this training video from John Smith which does an escellent job showing you the GSLB setup.

What is needed on the NetScaler?

ADNS – Authoriative DNS Service – This is required on the NetScaler to return the correct IP Address of the currently active NetScaler Gateway – this needs to be in place for GSLB to work correctly.

GSLB Site – This is basically a virtual data centre in its simplest terms.  For Example – Data Center 1 as a primary site and Date Center 2 as a fail over site.

NetScaler Gateway – Basically a secure application/desktop visualization solution to securely deliver access to data center applications/ desktops (virtual or physical).

NetScaler DNS View – Used to  identify various types of clients and provide an appropriate IP address to a group of clients who query for the same GSLB domain.

DNS views are configured by using DNS policies that select the IP addresses sent back to the client.  In the example below when an internal client queries a GSLB CName, the NetScaler will return with an internal DMZ IP of the Gateway and not the public IP.

What is the external DNS query doing?

  • Request name.domain.com
  • Ask Public DNS Servers for IP (Not found so will be passed to next hop i.e. ISP DNS Servers)
  • Public IP Address(s) for ADNS Service NAT’s to Internal ADNS IP present on NetScaler
  • ISP Servers have record for name.domain.com but control is delegated to Public IP Address(s) of ADNS Service for company
  • Public IP Address(s) for ADNS Service NAT’s to Internal ADNS IP present on NetScaler
  • ADNS Service on NetScaler returns the current live external IP Address for NetScaler Gateway

Environment:

  • Citrix NetsScaler 10.5 Safe Harbor Build 56.22.nc
  • StoreFront 2.6

Configuration:

1. Add Gateway Server records with IPs of your NetScaler Gateways

add server remote_gateway_dc1 192.168.150.100
add server remote_gateway_dc2 192.168.250.100

2. Setup your DNS view (Ex. client request comes from subnet 10.10.x.x) will receive an internal IP vs the external public IP.  In the example below I am binding this globally, which means all your GSLB services will have the DNS View enabled, you will just need to enter the internal IP you need to provide to the 10.10.x.x client requests

add dns view internal_dns_view
add dns action internal_dns_action ViewName -viewName internal_dns_view
add dns policy internal_dns_policy “CLIENT.IP.SRC.IN_SUBNET(10.10.0.0/16)” internal_dns_action

bind dns global internal_dns_policy 100 -gotoPriorityExpression END -type REQ_DEFAULT

3. Add GSLB services for Data Center 1 and Data Center 2, provide external IPs and bind to the server gateways created earlier.  Please note I disabled AppFlow as there are still some known issues with 10.5 and I rather not take any changes 😛

add gslb service remote_gateway_dc1_gslbsvc remote_gateway_ny SSL 443 -publicIP external_ip_address -publicPort 443 -maxClient 0 -siteName NY -cltTimeout 180 -svrTimeout 360 -downStateFlush DISABLED -appflowLog DISABLED

add gslb service remote_gateway_dc2_gslbsvc remote_gateway_nj SSL 443 -publicIP external_ip_address-publicPort 443 -maxClient 0 -siteName NJ -cltTimeout 180 -svrTimeout 360 -downStateFlush DISABLED -appflowLog DISABLED

add gslb vserver remote_gateway_dc1_gslbvs HTTP -lbMethod RTT -backupLBMethod ROUNDROBIN -tolerance 0 -EDR ENABLED -MIR ENABLED -appflowLog DISABLED

add gslb vserver remote_gateway_dc2_gslbvs HTTP -lbMethod RTT -backupLBMethod ROUNDROBIN -tolerance 0 -EDR ENABLED -MIR ENABLED -appflowLog DISABLED

4. Bind your services to your GSLB vServers

bind gslb vserver remote_gateway_dc1_gslbvs -domainName gateway.gslb.domain.com -TTL 5

bind gslb vserver remote_gateway_dc2_gslbvs -serviceName remote_gateway_dc2_gslbsvc

5. Bind those DNS View settings with the internal DMZ IP address of your Gateways

bind gslb service remote_gateway_dc1_gslbsvc -viewName internal_dns_view 192.168.150.100

bind gslb service remote_gateway_dc2_gslbsvc -viewName internal_dns_view 192.168.250.100

6. Set up a failover GSLB vServer, in my case Data Center 1 is active, and Data Center 2 will remain passive.  When you do this, the passive node will use the active GSLB vServer as a proxy, which contains the gateway.gslb.domain.com

set gslb vserver remote_gateway_dc1_gslbvs -backupVServer remote_gateway_dc2_gslbvs -lbMethod RTT -backupLBMethod ROUNDROBIN -tolerance 0 -EDR ENABLED -MIR ENABLED -appflowLog DISABLED

Failover node

Won’t go into details, as the fail over node will need the same configuration, just note that the domain name being added, in our case gateway.gslb.domain.com and the backup vServer when setting up the GSLB vServers should be set exactly the same as the primary site.

set gslb vserver remote_gateway_dc2_gslbvs -backupVServer remote_gateway_dc1_gslbvs -lbMethod RTT -backupLBMethod ROUNDROBIN -tolerance 0 -EDR ENABLED -MIR ENABLED -appflowLog DISABLED

Hope this helps and drop a comment if you need any additional help

Disclaimer:

I do not accept any responsibility or liability for the accuracy, content, completeness, legality, or reliability of the information contained on this website.