Network Access Control 编辑

You can use your Network Access Control (NAC) solution to extend the Endpoint Management device security assessment for Android and Apple devices. Your NAC solution uses the Endpoint Management security assessment to facilitate and handle authentication decisions. After you configure your NAC appliance, the device policies and NAC filters that you configure in Endpoint Management get enforced.

Using Endpoint Management with a NAC solution adds QoS and more granular control over devices that are internal to your network. For a summary of the advantages of integrating NAC with Endpoint Management, see Access control.

Citrix supports these solutions for integration with Endpoint Management:

• Citrix Gateway
• ForeScout

Citrix doesn’t guarantee integration for other NAC solutions.

With a NAC appliance in your network:

• Endpoint Management supports NAC as an endpoint security feature for iOS, Android Enterprise, and Android devices.

• You can enable filters in Endpoint Management to set devices as compliant or non-compliant for NAC, based on rules or properties. For example:

  • If a managed device in Endpoint Management doesn’t meet the specified criteria, Endpoint Management marks the device as non-compliant. A NAC appliance blocks non-compliant devices on your network.

  • If a managed device in Endpoint Management has non-compliant apps installed, a NAC filter can block the VPN connection. As a result, a non-compliant user device cannot access apps or websites through the VPN.

  • If you use Citrix Gateway for NAC, you can enable split tunneling to prevent the Citrix Gateway plug-in from sending unnecessary network traffic to Citrix Gateway. For more information on split tunneling, see Configuring Split Tunneling.

Supported NAC compliance filters

Endpoint Management supports the following NAC compliance filters:

Anonymous Devices: Checks if a device is in anonymous mode. This check is available if Endpoint Management can’t reauthenticate the user when a device attempts to reconnect.

Forbidden Apps: Checks if a device has forbidden apps, as defined in an App Access policy. For more information about that policy, see App access device policies.

Inactive Devices: Checks if a device is inactive as defined by the Device Inactivity Days Threshold setting in Server Properties. For details, see Server properties.

Missing Required Apps: Checks if a device is missing any required apps, as defined in an App Access policy.

Non-suggested Apps: Checks if a device has non-suggested apps, as defined in an App Access policy.

Noncompliant Password: Checks if the user password is compliant. On iOS and Android devices, Endpoint Management can determine whether the password currently on the device is compliant with the passcode policy sent to the device. For instance, on iOS, the user has 60 minutes to set a password if Endpoint Management sends a passcode policy to the device. Before the user sets the password, the passcode might be non-compliant.

Out of Compliance Devices: Checks whether a device is out of compliance, based on the Out of Compliance device property. Typically, automated actions or third parties using Endpoint Management APIs change that property.

Revoked Status: Checks whether the device certificate is revoked. A revoked device cannot re-enroll until it is authorized again.

Rooted Android and Jailbroken iOS Devices: Checks whether an Android or iOS device is jailbroken.

Unmanaged Devices: Check whether Endpoint Management is managing a device. For example, a device enrolled in MAM or an unenrolled device is not managed.

Note:

The Implicit Compliant/Not Compliant filter sets the default value only on devices that Endpoint Management is managing. For example, any devices that have a blocked app installed or are not enrolled, get marked as Not Compliant. The NAC appliance blocks those devices from your network.

Configuration overview

We recommend that you configure the NAC components in the order listed.

1. Configure device policies to support NAC:

   For iOS devices: See Configure the VPN device policy to support NAC.

   For Android Enterprise devices: See Create an Android Enterprise managed configuration for Citrix SSO.

   For Android devices: See Configure the Citrix SSO protocol for Android.

2. Enable NAC filters in Endpoint Management.

3. Configure a NAC solution:

   • Citrix Gateway, detailed in Update Citrix Gateway policies to support NAC.

     Requires that you install Citrix SSO on devices. See Citrix Gateway Clients.

   • ForeScout: See the ForeScout documentation.

Enable NAC filters in Endpoint Management

1. In the Endpoint Management console, go to Settings > Network Access Control.

   

2. Select the check boxes for the Set as not compliant filters you want to enable.

3. Click Save.

Update Citrix Gateway policies to support NAC

You must configure advanced (not classic) authentication and VPN sessions policies on your VPN virtual server.

These steps update a Citrix Gateway with either of these characteristics:

• Is integrated with Endpoint Management.
• Or, is set up for VPN, not part of the Endpoint Management environment, and can reach Endpoint Management.

On your virtual VPN server from a console window, do the following. The FQDNs and IP addresses in the commands and examples are fictitious.

1. If you are using classic policies on your VPN virtual server, remove and unbind all classic policies. To check, type:

   show vpn vserver <VPN_VServer>

   Remove any result that contains the word Classic. For example: VPN Session Policy Name: PL_OS_10.10.1.1 Type: Classic Priority: 0

   To remove the policy, type:

   unbind vpn vserver <VPN_VServer> -policy <policy_name>

2. Create the corresponding advanced session policy by typing the following.

   add vpn sessionPolicy <policy_name> <rule> <session action>

   For example: add vpn sessionPolicy vpn_nac true AC_OS_10.10.1.1_A_

3. Bind the policy to your VPN virtual server by typing the following.

   bind vpn vserver _XM_EndpointManagement -policy vpn_nac -priority 100

4. Create an authentication virtual server by typing the following.

   add authentication vserver <authentication vserver name> <service type> <ip address>

   For example: add authentication vserver authvs SSL 0.0.0.0 In the example, 0.0.0.0 means that the authentication virtual server is not public facing.

5. Bind an SSL certificate with the virtual server by typing the following.

   bind ssl vserver <authentication vserver name> -certkeyName <Webserver certificate>

   For example: bind ssl vserver authvs -certkeyName Star_mpg_citrix.pfx_CERT_KEY

6. Associate an authentication profile to the authentication virtual server from the VPN virtual server. First, create the authentication profile by typing the following.

   add authentication authnProfile <profile name> -authnVsName <authentication vserver name>

   For example:

   add authentication authnProfile xm_nac_prof -authnVsName authvs

7. Associate the authentication profile with the VPN virtual server by typing the following.

   set vpn vserver <vpn vserver name> -authnProfile <authn profile name>

   For example:

   set vpn vserver _XM_EndpointManagement -authnProfile xm_nac_prof

8. Check the connection from Citrix Gateway to a device by typing the following.

   curl -v -k https://<Endpoint Management_server>:4443/Citrix/Device/v1/Check --header "X-Citrix-VPN-Device-ID: deviceid_<device_id>"

   For example, this query verifies connectivity by obtaining the compliance status for the first device (deviceid_1) enrolled in the environment:

   curl -v -k https://10.10.1.1:4443/Citrix/Device/v1/Check --header "X-Citrix-VPN-Device-ID: deviceid_1"

   A successful result is similar to the following example.

   HTTP/1.1 200 OK
   < Server: Apache-Coyote/1.1
   < X-Citrix-Device-State: Non Compliant
   < Set-Cookie: ACNODEID=181311111;Path=/; HttpOnly; Secure
   <!--NeedCopy-->