1. Citrix Extranet 2.0 Product Overview
This presentation will give you a product overview of Citrix Extranet It will help you understand what the product is, what the features are as well as the advantages. At the end of the presentation there are also slides to help you with commonly used terms.
Copyright 2000, Citrix Systems, Inc.

2. Agenda What is Citrix Extranet 2.0? Citrix Extranet Features
Architecture
System Requirements
Citrix Extranet Features
Access Control
Identification & Authentication
Encryption
On-line Registration
Citrix Extranet Admin
Event Logging
Citrix Extranet Advantages
Commonly Used Terms
Copyright 2000, Citrix Systems, Inc.

3. What Is Citrix Extranet 2.0?
Citrix Extranet provides a virtual private network (VPN) which allows you to securely deploy the latest business- critical applications to users around the world, via the Internet – all while maintaining the manageability, scalability, reliability and control you’ve grown to expect from Citrix.
Citrix Extranet provides a VPN which allows the ICA protocol to pass through a firewall at both ends of a connection: The server allows a MetaFrame application server to use a single port to reach the Internet; The Citrix Extranet client software allows the user to utilize a single configurable port to reach the Internet.
Copyright 2000, Citrix Systems, Inc.

4. Citrix Extranet Architecture
Leverage your existing network design
Citrix Extranet server is easy to install and configure behind a firewall, on the same network as the MetaFrame server. An administrator simply sets up the Server and creates an access permission under the TCP tab in the Citrix Extranet Admin module. This permission will allow either certain users, or groups to access the Citrix server on port To allow outside traffic onto the private network, a single port on the firewall is opened so TCP traffic can be directed to the Citrix Extranet server. This single port allows access to , Web, Telnet, and other applications and services. Each user is authenticated, and traffic from unauthorized users is simply dropped.
Copyright 2000, Citrix Systems, Inc.

5. Citrix Extranet System Specifications
Windows NT
Microsoft Windows NT Server operating system 4.0, service pack 5 or 6a
Pentium II processor at 350 MHz
2 or more network adapter cards
64 MB of RAM
10 MB of free hard disk space
Sun SPARC
Sun Solaris 2.6, 7, or 8
20 MB minimum of free hard disk space
All required software packages
2 or more network adapter cards
Copyright 2000, Citrix Systems, Inc.

6. Client Specifications
Citrix Extranet 2.0
All Users
Internet access
Connection to a network using TCP/IP protocol
The Citrix Extranet Client software
PC Users
Microsoft Windows 95 osr2, 95b, 98, 98 SE, or Windows NT Workstation 4.0, with service pack 5 or 6a or Windows 2000 SP1(proxy mode only)
2 MB free hard disk space
Microsoft Internet Explorer 4.0x, 5.0, or 5.01, or Netscape Navigator 4.5, 4.5.1, 4.6, 4.61, 4.7, 4.71, 4.72, or 4.73
Copyright 2000, Citrix Systems, Inc.

7. Client Specifications
Citrix Extranet 2.0
Macintosh Users
Apple or other Macintosh OS–compatible Power PC computer
1 MB free disk space
Macintosh OS Version 8.1 or later (8.5 or later recommended)
Open Transport 1.3 or later (2.0 or later recommended)
Netscape Navigator 4.x or Microsoft Internet Explorer 4.x, or 5.0
UNIX Users
A computer with Sun SPARC Systems running Solaris 2.6 or later
5 MB minimum of free hard disk space
A suitable UNIX Web browser (must support forms)
Copyright 2000, Citrix Systems, Inc.

8. Client Specifications
Citrix Extranet 2.0
Windows CE/PocketPC Users
CE Devices
Handheld PC (SH3 and MIPS)
Handheld PC Professional Edition (SH3, SH4, MIPS, ARM, and StrongARM)
Palm-size PC (SH3 and MIPS)
Copyright 2000, Citrix Systems, Inc.

9. Citrix Extranet 2.0 Features
Copyright 2000, Citrix Systems, Inc.

10. Citrix Extranet Features
Access Control
Identification and
Authentication
Event
Logging
In the next few slides, we will discuss some of the features of Citrix Extranet…
Specifically we’ll talk about: access control in which user access is controlled by permissions to network services, IP addresses and Web pages, the Dynamic Configuration downloads access permissions at startup and regular intervals; strong authentication, and support for multiple authentication methods; DES (56-bit) and Triple DES (168-bit) encryption which is exportable via BXA approved Key recovery; on-line registration, where the User ID is generated automatically or via a UID server where access permissions are assigned as configured by the administrator; the Citrix Extranet Admin which easily and securely manages the server locally or from a remote location detailed log files; and event logging that provides a complete audit trail of all user activity.
Encryption
Citrix Extranet
Admin
On-Line Registration (OLR)
Copyright 2000, Citrix Systems, Inc.

11. Access Control
Citrix Extranet 2.0
TCP-based access permissions are defined for individuals or groups
Access Control essentially controls access to TCP-based services and Web resources by defining a set of access permissions for either an individual user or a group of users.
Citrix Extranet implements the security policy that "Access is forbidden unless explicitly permitted“. The Citrix Extranet Server administrator establishes and maintains access control for the user community.
Copyright 2000, Citrix Systems, Inc.

12. Access Control
Citrix Extranet 2.0
Permissions are identified by host name/IP address and the port
TCP – FTP, Telnet, POP3, etc…
Web – server and port
Access permissions are defined as the associations between users and connections. These permissions are identified by their hostname or IP address and their port.
Citrix Extranet categorizes access permissions into two groups:
TCP permissions (FTP, Telnet, POP3, etc.)—these permissions are stored in sgate.acl.
Web permissions, which consists of a Web server (host) and a port—these permissions are stored in sweb.acl.
In both cases, permission is given to either a user or a group to access a single destination.
Copyright 2000, Citrix Systems, Inc.

13. Access Control
Citrix Extranet 2.0
User-based policy management ensures secure application access
Access permissions are defined according to each user’s token identity on the server. Linking access control to authentication enables user-based policy management.
Copyright 2000, Citrix Systems, Inc.

14. Access Control Access permissions are received: Permission sources:
Citrix Extranet 2.0
Access Control
Access permissions are received:
At the time the Citrix Extranet Client initiates
At regular user-defined intervals
Permission sources:
User
Users’ group
“All” users
They receive their access permissions through Dynamic Configuration each time they start Citrix Extranet Client and at regular intervals as defined by the user. Every Citrix Extranet Client user is assigned to one group, in addition to the group “all.” Users receive these permissions from the following sources: Explicitly assigned to the user; Assigned to the user’s group; Assigned to the group “all”
*Assigning permissions to groups avoids unnecessary duplication and is more efficient than assigning permissions to individual users.
Copyright 2000, Citrix Systems, Inc.

15. Access Control Dynamic Configuration
Citrix Extranet 2.0
Dynamic Configuration
3. Citrix Extranet Client contacts every Citrix Extranet Server for which the user has an authentication key and requests the user’s current access permissions
1. Prompts user for Access Code
2. User’s authentication key(s) accessed
5. User’s access permissions are dynamically updated at startup and at regular intervals as defined by the end user
The Citrix Extranet Client first prompts user for Access Code, then the user’s authentication key(s) accessed. Citrix Extranet Client contacts every Citrix Extranet Server for which the user has an authentication key and requests the user’s current access permissions. User’s TCP access and Web permissions are read; the current permissions are then sent to Citrix Extranet Client.
Dynamic Configuration virtually eliminates the need for local configuration by the end user. Dynamic Configuration operates on the principle that the Citrix Extranet Server is the final authority for “fine-grained access control.” After successful user authentication, access to all TCP and Web services is controlled through Citrix Extranet’s Authentication Server. The Dynamic Configuration Server can be detached from the Citrix Extranet Server, however, it must reside on the same machine as the Authentication Server.
Citrix Extranet Server w/Dynamic Configuration (DC) Server Or DC Server on a separate machine
4. User’s TCP access permissions are read from sgate.acl and their Web permissions from sweb.acl; the current permissions are then sent to Citrix Extranet Client
NOTE: The Dynamic Configuration Agent always resides on the Citrix Extranet Server
Copyright 2000, Citrix Systems, Inc.

16. Identification and Authentication
Citrix Extranet 2.0
Citrix Extranet Server is the final authority when authenticating session requests:
User authentication
Access Management
User and group additions
The Citrix Extranet Authentication Server is the final authority determining if a user attempting to connect via Citrix Extranet will be granted access.
It is responsible for: (1) User authentication by validating the identity of the user using two factor authentication – an authentication token that the user has, and an access code that the user knows. Mutual authentication adds value to third-party systems by ensuring application identity; the client authenticates to the server and the server authenticates to the client. (2) Managing access control by deciding, based on access permissions, if their access request is legitimate. And (3), adding new users to the user database following successful On-Line Registration (OLR).
Copyright 2000, Citrix Systems, Inc.

17. Identification and Authentication
Citrix Extranet 2.0
Key exchange methods are flexible for the Administrator
Tokens
FIPS token (FIPS compliant)
VCAT token
RADIUS
SecurID
Entrust/Netrust
Physical Smart Cards
MCOS
MCOS-B
STARCOS 2.1
PKI (X.509) Certificates
Baltimore
Entrust
Microsoft
Netscape
VeriSign
The Citrix Extranet Authentication Server is responsible for the key exchange and allows for the use of multiple authentication methods.
You have the option of one authentication server being used by multiple Citrix Extranet Servers, or it can be detached from the Citrix Extranet Server as a stand-alone.
Smart Card Readers
PCAT
Smarty
CHIPDRIVE external
Copyright 2000, Citrix Systems, Inc.

18. Identification and Authentication
Citrix Extranet 2.0
Identification and Authentication
Citrix Extranet uses two authentication factors
Access code
Token
Citrix Extranet’s two-factor authentication determines if the ICA session is initiated. The client will intercept the information and encrypt the information using the access code and the token. Client application opens the TCP connection; the SP intercepts, encrypts, and prepares a ticket. The Ticket Encryption Key (TEK) is covered by a shared secret key.
URL request sent to Server
Copyright 2000, Citrix Systems, Inc.

19. Identification and Authentication
Citrix Extranet 2.0
Identification and Authentication
The session is initiated
Each Client TCP connection uses a unique session key
When the user is validated, the connection is initiated.
Each Client TCP connection generates a new authentication ticket. Each Client TCP connection has a unique session key.
Shared Secret Key is combination of
1/2 shared secret key generated by client &
1/2 shared secret key generated by server
Copyright 2000, Citrix Systems, Inc.

20. Encryption The ticket contents are encrypted
Citrix Extranet 2.0
The ticket contents are encrypted
Initialization Vector (IVEC)
User ID
Ticket time/TTL
Encryption algorithm
Session key
Destination
MD5
The server returns the results that are encrypted via session key. The (encrypted) ticket contents are an IVEC (Initialization Vector), User ID, Ticket time/TTL, Encryption Algorithm, the Session key, Destination (host & port), and MD5 hash.
Copyright 2000, Citrix Systems, Inc.

21. On-line Registration (OLR)
Citrix Extranet 2.0
Automated registration of the Citrix Extranet Client is via the Internet
User registers
IDs automatically generated
Flexible UID server assignments
On-line Registration (OLR) greatly reduces administration time and enables thousands of users instantly. The user registers the Citrix Extranet Client via the Internet. User IDs are automatically generated without interaction from an administrator. Alternately, a UID Server can be used to assign specific administrator-controlled User IDs (except with PKI).
Simple firewall navigation can be configured during OLR. Manual configuration by the end user is not necessary unless they pass through proxy servers.
Copyright 2000, Citrix Systems, Inc.

22. On-line Registration (OLR)
Citrix Extranet 2.0
On-line Registration (OLR)
Seamless registration process
A user installs the Citrix ICA and Citrix Extranet clients on his computer. The user then runs the Citrix Extranet Client to register with the Citrix Extranet Server protecting the Citrix server.
(For more detail) Once the user initiates the URL request to the server. The server sends an OLR form & server’s public key to the user. The Citrix Extranet Client generates 1/2 shared secret key, creates session key, and encrypts 1/2 shared secret key & OLR data w/session key. Encrypted with session key enclosed with Server’s public key and sent back to the server. The server decrypts it with a private key, and receives user’s OLR data & shared secret key. Then it creates 1/2 shared secret key & User ID and sends back an encrypted session while creating a shared secret key from the client and server. The client and server both store the secret key, User ID, Authenticator name, and Server’s Domain Name and the server displays the OLR results to the Web Browser.
Shared Secret Key is combination of
1/2 shared secret key generated by client &
1/2 shared secret key generated by server
Copyright 2000, Citrix Systems, Inc.

23. Citrix Extranet Admin Manage individual or groups of servers and users
Assigns Web and TCP permissions
Configures OLR Web form
Specifies management levels
Utilizes database functions like sort, filter and find
Citrix Extranet Admin is a Graphical User Interface (GUI). It allows administrators to manage multiple Citrix Extranet Servers from a single, remote console, or manage a Microsoft Windows NT Citrix Extranet Server locally. It manages users individually or by groups, assigns Web and TCP access permissions, configures OLR Web form, specifies management levels using administrative rights functionality, utilizes database functionality (i.e., sort, filter, find)
Copyright 2000, Citrix Systems, Inc.

24. Event Logging
Citrix Extranet 2.0
Allows for easy troubleshooting by logging critical information
Session start/end
User added/deleted
User enabled/disabled
User key changed
Successful/ unsuccessful user login
Server up/down
Citrix Extranet logs critical events necessary for security auditing and client/server troubleshooting to UNIX and NT.
It logs events such as: Session start/end, User added/deleted, User enabled/disabled, User key changed, Successful/unsuccessful user login, and server up/down
Copyright 2000, Citrix Systems, Inc.

25. Citrix Extranet 2.0 Advantages
All of the Citrix Extranet features deliver generous advantages.
Copyright 2000, Citrix Systems, Inc.

26. Citrix Extranet Advantages
Flexible system integration
Rapid deployment
Centralized management
Simplicity and ease of use
Cost-effectiveness
Citrix Extranet provides many advantages for MetaFrame. It addresses the challenges of deploying applications quickly and securely to large extranet user populations, while providing the manageability, scalability, cost benefits and ease of use that characterize Citrix application server solutions. Citrix Extranet extends MetaFrame by providing a stronger degree of extranet user authentication, authorization, accounting, encryption, key distribution, and application-level proxy capabilities.
Copyright 2000, Citrix Systems, Inc.

27. Flexible System Integration
Citrix Extranet 2.0
Flexible System Integration
Network Connections
Public Network
LAN/WAN
Corporate Intranet/Extranet
Internet
Client Support
Windows 95/98/NT/2000
Macintosh
Solaris
Linux
Windows CE
Windows PocketPC
Token Support
Hard Drive
Floppy (FIPS or VCAT)
Smart Card
Netrust/Entrust/X.509 digital certificate
SecurID
Radius
MetaFrame servers
Citrix Extranet
Internet
Clients
VPN
Citrix Extranet offers a full range of network, client and token support for ultimate flexibility.
Copyright 2000, Citrix Systems, Inc.

28. Flexible System Integration
Citrix Extranet 2.0
Allows ICA Protocol to securely pass through both ends of a connection
Citrix Extranet Client uses TCP traffic on port 443
The Client believes the servers are on the same network
Citrix Extranet allows the ICA protocol to pass through a firewall at both ends of a connection: the Citrix Extranet Server allows a MetaFrame application server to use a single port to reach the Internet; (2) the Citrix Extranet client software allows a Citrix client to use a single configurable port to reach the Internet. When Citrix ICA is passed through a Citrix Extranet Client to a Citrix Extranet Server, the Citrix Extranet proxy intercepts the calls from the ICA client to the Citrix server. This leads the Citrix client to believe that the server is on the same network. In this case, the Citrix ICA client uses TCP traffic on port 443 to communicate with the Citrix server.
When ICA passes through the Client to the Server, Citrix Extranet proxy intercepts the calls
Copyright 2000, Citrix Systems, Inc.

29. Flexible System Integration
Citrix Extranet 2.0
Flexible System Integration
Export ready for use at any available strength encryption
Triple DES (168-bit)
RC4
DES (56-bit)
Citrix Extranet’s export ready. Approval from BXA lets customers do business globally with strong encryption and control their own keys. Any customer can use any strength encryption to protect any application in any non-embargoed country.
*Embargoed countries are Cuba, Libya, North Korea, Syria, Sudan, Iran, Iraq
Copyright 2000, Citrix Systems, Inc.

30. Rapid Deployment
Citrix Extranet 2.0
Easy deployment and token enrollment of large user bases via On-line Registration (OLR)
Citrix Extranet uses On-Line Registration (OLR), unique to Citrix Extranet, to quickly and efficiently distribute VPN access credentials to remote users. OLR allows shared secret keys and user IDs to be generated without interaction from an administrator, and enables users to begin accessing the system within a few minutes. Looking at the larger picture, Citrix Extranet allows users to connect to applications faster because no special hardware needs to be implemented.
Copyright 2000, Citrix Systems, Inc.

31. Centralized Management
Citrix Extranet 2.0
Powerful GUI allows for local or remote administrator management
Remotely using the Citrix Extranet Client
Locally on a Windows NT platform
The Citrix Extranet Admin, Citrix Extranet’s powerful graphical user interface (GUI), provides administrators with the ability to configure multiple Citrix Extranet Servers remotely using the Citrix Extranet client, or locally on a Windows NT platform. Upon each session authentication, valid access permissions are downloaded through Dynamic Configuration; thereby giving the Citrix Extranet administrator complete control over user access.
Copyright 2000, Citrix Systems, Inc.

32. 1 2 Ease of Use Simple 2-step client activation
Citrix Extranet 2.0
Simple 2-step client activation
Install Citrix Extranet client software
Register online 1 2
Citrix Extranet simplifies the establishment of VPN connections by remote users through a simple, two-step client activation process. Users install the client software using the friendly Windows Wizard program and then register online.
Copyright 2000, Citrix Systems, Inc.

33. Cost-effectiveness Leverage existing systems
Citrix Extranet 2.0
Leverage existing systems
No costly leased lines or modem banks
Minimal client management and user support costs
By supporting multiple server and client platforms, Citrix Extranet allows organizations to leverage their existing computing systems. It also saves the telecommunications cost of installing and managing expensive, complex leased lines or modem banks. Support costs are also reduced with centralized client management and electronic user registration.
Copyright 2000, Citrix Systems, Inc.

34. Connect Business Securely
Citrix Extranet 2.0
Permit secure online information exchange via the Internet
Mobile users
Suppliers
Business partners
End-customers
Branch and international offices
Copyright 2000, Citrix Systems, Inc.

35. Citrix Extranet 2.0 Powerful End-to-end security
Centralized management
Virtual Private Networks offer the best solution for delivering applications securely over the Internet, thanks to their added security, rapid implementation, cost savings and global reach. Choosing a VPN platform should include evaluation of specific security features, cost and complexity, manageability, client and server support, and ease of use.
By selecting Citrix Extranet, a VPN software solution that offers powerful, end-to-end security combined with centralized server and client management, organizations can have confidence in their ability to quickly and securely deliver application access to their extended workforce, business partners, suppliers, and customers over the Internet.
Copyright 2000, Citrix Systems, Inc.

36. Commonly Used Terms
Citrix Extranet 2.0
3DES: Cipher that applies the DES cipher three times with either two or three different DES keys. The Citrix Extranet implementation uses three DES keys (2168 combinations).
Access Code: The secret code, similar to a PIN on an ATM card—required to unlock the authentication key stored on the user’s token each time the user accesses a secure service. This code, defined by the user during registration, must be at least four characters in length with a maximum of 16, and can be any combination of letters and numbers.
Access Control: Allowing or denying connections through the use of access permissions.
Access Permissions: The associations between users and connections, as defined by a User ID, group name, service (TCP or Web), or destination. Citrix Extranet access permissions can be either individual user permissions or group permissions.
Authentication: The process of determining the identity of a user attempting to access a system.
Copyright 2000, Citrix Systems, Inc.

37. Commonly Used Terms
Citrix Extranet 2.0
Authentication Key: The key is a 32-character hexadecimal key assigned to a user during installation by the registration server administrator, consisting of the numbers 0 to 9 and letters A to F.
The Citrix Extranet authentication system supports virtual smart cards and ISO-standard smart cards for both authentication and stored data. A user with a physical smart card must use a smart card reader connected to their PC. Virtual smart card information (FIPS or VCAT token) may be stored on either the PC hard drive or a removable (floppy) disk.
The user’s Citrix Extranet authentication key is stored on the smart card, whether physical or virtual. This information is shared with the Citrix Extranet Server, where it is stored in the Citrix Extranet Server’s user database.
Authentication Token: A portable device used for authenticating a user. Authentication tokens operate by challenge/response, time-based code sequences, or other techniques.
Copyright 2000, Citrix Systems, Inc.

38. Commonly Used Terms
Citrix Extranet 2.0
Authenticator: The name assigned to a Citrix Extranet Server through which users can access a particular service. This name can be up to 14 alphanumeric characters in length and it is recommended that it be a derivative of your Citrix Extranet Server hostname.
Domain Name: Identifies a ‘location’ on the Internet (e.g., citrix.com) that has been registered with the Internet Network Information Center (InterNIC). Currently the domain name is limited to 47 characters. Through the use of aliases, however, it is possible to accommodate longer names.
DES: Data Encryption Standard is a NIST-standard encryption algorithm for secure data protection. A binary number is used as an encryption key with 720 quadrillion possible combinations (256). The key is randomly generated for each session (TCP connection).
FIPS Token: (Virtual Smart Card or Soft Token) A software emulation of a hardware authentication token that is in compliance with the FIPS140–1 coding standards. It stores your private information (authentication key) in an single encrypted file, either on a floppy disk or on your hard drive. FIPS Token is the default authentication method.
Copyright 2000, Citrix Systems, Inc.

39. Commonly Used Terms
Citrix Extranet 2.0
OLR: Citrix Extranet provides On-Line Registration (OLR) services which you may wish to implement depending on your system configuration and the functional requirements of your organization.
RC4: Is a stream cipher developed by RSA Data Security, Inc. This variable key-size stream cipher uses byte-oriented operations to perform random permutations. The typical cipher period is greater than Since eight to sixteen machine operations are required per output byte, the cipher runs very quickly in software. It is commonly used for secure communications, such as encrypting secure web site traffic using the SSL protocol.
VCAT Token: Identical to the FIPS Token, except that it stores your private information (authentication key) in an encrypted file system, rather than a single file.
Virtual Private Network (VPN): A private network created over a public network (e.g., the Internet) by using encryption, where exclusive client and host communications can occur.
Copyright 2000, Citrix Systems, Inc.

40. With Citrix, now everything computes.
Citrix Extranet 2.0
Now you’ve seen why Citrix is making a real difference in today’s computing environment.
With Citrix, now everything computes.
Copyright 2000, Citrix Systems, Inc.