Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page
Integrating Web Security with Citrix > Filtering Citrix server users
Filtering Citrix server users
Deployment and Installation Center | Web Security Solutions | Version 7.7.x
 
Applies to:                                         
In this topic                                       
*
Web Filter and Web Security, v7.7.x
*
Filtering both Citrix and non-Citrix users
When Websense Web Filter or Web Security is integrated with Citrix:
*
A recommended maximum of 10 Citrix servers can be connected to one Websense Filtering Service. This number can be configured and depends on the user load.
Multiple Filtering Services are needed if more than 15 Citrix servers are used, with each Citrix server handling about 20 to 30 Citrix users.
*
The Filtering Service and Websense Network Agent monitoring Citrix traffic should be installed on a dedicated machine, and not on a Citrix server.
*
The Filtering Service and Network Agent instances monitoring Citrix traffic use the same Policy Broker, Policy Server, User Service, and so on as Filtering Service and Network Agent instances used to monitor non-Citrix traffic.
*
Separate Filtering Service and Network Agent instances must be used to monitor non-Citrix traffic.
*
Do not configure a separate integration product to filter HTTP, HTTPS, FTP, or SSL requests from Citrix servers.
*
If you want to use Network Agent to filter protocol traffic from the Citrix servers:
*
Network Agent must be located where it can see all of the traffic between the Citrix servers and the Filtering Service instances. For example, the machine running Network Agent could be connected to a span port on the same network switch as the machines running Filtering Service.
*
If the Citrix server is configured to use virtual IP addresses, configure Network Agent to monitor the entire range of the IP addresses. Also, a single policy should be set for this range. See the "Network Configuration" topic in the TRITON - Web Security Help for instructions on configuring IP ranges for Network Agent.
*
If you have standalone instances of Filtering Service (not configured to integrate with Citrix or any other integration product), use a dedicated instance of Network Agent to monitor users of the Citrix servers. Do not monitor non-Citrix traffic with this Network Agent.
While Network Agent can be used to filter protocols for Citrix, user-based and group-based policies cannot be applied. Policies can be applied to individual computers and network ranges, identified by IP addresses or IP address ranges. Otherwise, the Default policy is applied to all users.
Also, Network Agents monitoring non-Citrix traffic (users who access the Internet without going through a Citrix server) must not be used to monitor Citrix traffic.
This diagram shows a typical deployment to filter users who access the Internet through a Citrix server. To simplify the diagram, not all individual Websense components are shown.
The main Websense filtering components are installed on a separate, dedicated machine that can communicate with all of the Citrix server machines, and non-Citrix users, if applicable. The Websense Citrix Integration Service must be installed on each Citrix server to allow it to communicate with Filtering Service. No other Websense components should be installed on the Citrix server machines.
Filtering both Citrix and non-Citrix users
If your network includes some users who access the Internet via a Citrix server, and others who access the Internet through another gateway (firewall, caching appliance, or proxy server), the integrations can be configured to work together.
*
To install the Citrix Integration Service on a Citrix Server, see .
*
If you have Citrix users and non-Citrix users in your network, the same Websense components, except for Network Agent, can be used for both sets of users. A separate installation of Network Agent is needed for the Citrix users. See Install Filtering Service and Network Agent to integrate with Citrix for instructions.
*
To install Websense Web Filter or Web Security for non-Citrix users, refer to the appropriate section of this Deployment and Installation Center for that integration product.
*
To configure the Websense components installed with the non-Citrix integration to communicate with Citrix, refer to the section pertaining to your integration in Combining Citrix with another integration.

Go to the table of contents Go to the previous page Go to the next page
Integrating Web Security with Citrix > Filtering Citrix server users
Copyright 2016 Forcepoint LLC. All rights reserved.