citrix xenapp and xendesktop 7.6 ltsr fips 140-2 … xenapp and xendesktop 7.6 ltsr fips 140-2...

Citrix XenApp and XenDesktop 7.6 LTSR FIPS 140-2 Sample Deployments

Citrix XenApp and XenDesktop 7.6 LTSR FIPS 140-2 Sample Deployments 1

Table of contents

Introduction ........................................................................................................................................................... 2

Audience .................................................................................................................................................................. 2

Security features introduced in XenApp and XenDesktop 7.6 LTSR .......................................... 2

FIPS 140-2 with XenApp and XenDesktop ............................................................................................. 3

Sample deployments ............................................................................................................................. 4

XenApp (internal network) ............................................................................................................................. 7

How the components interact .......................................................................................................... 8

XenApp using NetScaler Gateway MPX FIPS (external access) .................................................... 9

How the components interact ....................................................................................................... 10

XenDesktop (internal network) ................................................................................................................. 11


XenDesktop using NetScaler Gateway MPX FIPS (external access) ........................................ 13


Finding more information ........................................................................................................................... 15


Introduction When deploying XenApp and XenDesktop within large organizations, particularly in

government environments, security standards are an important consideration. Many

government bodies specify a preference or requirement for applications to be

compliant with Federal Information Processing Standards 140-2 (FIPS 140-2).

The document provides an overview of the security features that apply to XenApp and

XenDesktop, with an emphasis on FIPS 140-2. Sample deployments are shown,

providing guidance on FIPS 140-2 compliance. For more information regarding details

of the individual security features, refer to the relevant product or component

documentation.

Audience This document is designed to meet the needs of security specialists, systems

integrators, and consultants, particularly those working with government

organizations worldwide.

Security features introduced in XenApp

and XenDesktop 7.6 LTSR The new security features and enhancements in XenApp and XenDesktop 7.6 LTSR

provide a more streamlined route to deploy Citrix products securely and in

accordance with FIPS 140-2. The new features provide the following benefits:

You can secure traffic from user devices right through to hosted desktops and

applications using Transport Layer Security (TLS) protocol encryption. With

enhancements to the broker and VDA on XenApp and XenDesktop, TLS can be

configured through to the VDA.

The FIPS-enabled NetScaler Gateway MPX-FIPS appliance (NetScaler Gateway 10.x)

is fully compatible, allowing full TLS configuration in deployments that include

NetScaler Gateway. You can secure traffic using TLS from user devices to hosted


desktops and applications. NetScaler Gateway MPX-FIPS appliances are FIPS 140-2

Level 2 compliant, offering encrypted and FIPS- secured communication between:

o Citrix Receiver user devices and the NetScaler Gateway

o NetScaler Gateway and XenApp and XenDesktop VDA

o NetScaler Gateway and StoreFront

You can achieve FIPS compliance without any dependency on IPsec network

configuration.

You no longer need to use additional components such as the SSL Relay for TLS

configuration.

FIPS 140-2 with XenApp and

XenDesktop FIPS 140-2 is a U.S. federal government standard that details a benchmark for

implementing cryptographic software. The Cryptographic Module Validation Program

(CMVP), that is administered by the National Institute of Standards and Technology

(NIST) and the Communications Security Establishment (CSE), allows encryption

product vendors to demonstrate the extent to which they comply with the standard

and thus, the trustworthiness of their implementation.

Some U.S. government organizations restrict purchases of products and use of

services from suppliers and nonfederal organizations.

The security community at large values products that follow the guidelines detailed in

FIPS 140-2 and the use of FIPS 140-2-validated cryptographic modules.

To facilitate implementing secure application server access and to meet the FIPS

requirements, Citrix products can use cryptographic modules that are FIPS 140-2-

validated for implementations of secure SSL/TLS connections.

The following Citrix products and components included in the sample deployments

can use cryptographic modules that are FIPS 140-validated:

Citrix XenApp 7.6 LTSR


Citrix XenDesktop 7.6 LTSR

NetScaler Gateway MPX FIPS edition hardware appliance 10.1

StoreFront 2.6

Citrix Receiver for Windows 4.1

When using these products with the TLS connections enabled, the cryptographic

modules that are used are FIPS 140-2-validated. Citrix XenApp and XenDesktop,

StoreFront and Receiver, use cryptographic modules provided by the Microsoft

Windows operating system. NetScaler uses the FIPS 140-2-validated Cavium

cryptographic module.

Sample deployments

To ensure XenApp and/or XenDesktop deployments are FIPS 140-2 compliant, you

need to consider each communication channel within the deployment. The following

sample deployments show how users can connect and access resources on XenApp

and XenDesktop with different configurations of components and firewalls. In

particular, the samples provide general guidance on how to make each

communication channel secure using TLS so that the system as a whole is FIPS 140-2

compliant.

The following sample deployments are shown:

Product Deployment

XenApp Direct internal access [LAN]

External remote access [via Internet]

XenDesktop Direct internal access [LAN]

External remote access [via Internet]

These deployment scenarios utilize the following components to secure data

communications using the TLS protocol. TLS provides server authentication,

encryption of the data stream, and message integrity checks.

The NetScaler Gateway MPX FIPS hardware appliance is deployed in the DMZ to

provide secure remote access to XenApp and XenDesktop environments. It provides

FIPS 140-2 Level 2 TLS encryption of traffic to encrypt and secure communication

between:


Citrix Receiver and the NetScaler Gateway MPX FIPS hardware appliance

The NetScaler Gateway MPX FIPS hardware appliance and Storefront, Delivery

Controller, and VDA

StoreFront provides TLS encryption and secure communication between:

Citrix Receiver and the XenApp and XenDesktop VDA (for the internal access

deployment scenarios)

Citrix Receiver and StoreFront (for the remote access deployment scenarios)

Delivery Controller and StoreFront

Virtual Desktop Agent (VDA) runs on XenApp or XenDesktop and provides encryption

and secure communication between:

Citrix Receiver and the XenApp and XenDesktop VDA (for the internal access

deployment scenarios)

NetScaler Gateway MPX FIPS hardware appliance and the XenApp and/or

XenDesktop VDA (for the remote access deployment scenarios)

XenApp, XenDesktop, and StoreFront can be configured to use government approved

cryptography to protect data by using the applicable ciphersuites:

RSA_WITH_3DES_EDE_CBC_SHA supports RSA key exchange and TripleDES

encryption, as defined in Internet RFC 2246 (http://www.ietf.org/rfc/rfc2246.txt).

RSA_WITH_AES_128_CBC_SHA supports RSA key exchange with Advanced

Encryption Standard (AES) and 128-bit keys for TLS connections, as defined in FIPS

197 http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf and Internet RFC

3268 (http://www.ietf.org/rfc/rfc3268.txt). For more information about AES, see

http://csrc.nist.gov/cryptval/des.htm.

RSA_WITH_AES_256_CBC_SHA supports RSA key exchange with AES and 256-bit

keys for TLS connections, as defined in FIPS 197 and RFC 3268.

NetScaler Gateway MPX FIPS hardware appliances can be configured to use

government-approved cryptography to protect data by using the applicable

ciphersuites:

http://www.ietf.org/rfc/rfc2246.txt)

http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf

http://www.ietf.org/rfc/rfc3268.txt)

http://csrc.nist.gov/cryptval/des.htm

http://csrc.nist.gov/cryptval/des.htm


Cipher Name: SSL3-DES-CBC3-SHA

Description: SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1

Cipher Name: TLS1-AES-256-CBC-SHA

Description: TLSv1 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1

Cipher Name: TLS1-AES-128-CBC-SHA

Description: TLSv1 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1

Note that ‘SSL3-DES-CBC3-SHA’ is relevant to TLS encryption (despite the reference to

SSL3 in the cipher name and description).

For more information and support regarding these deployment scenarios, including

the operating system requirements, contact Technical Support or your Citrix partner.

Note that the sample deployments assume User Datagram Protocol (UDP) audio is

disabled. Although a popular protocol for applications such as Lync and Skype, UDP is

not compatible with TLS.


XenApp (internal network) This deployment provides end-to-end TLS encryption between the user device and the

applications hosted on XenApp. The deployment includes Citrix Receiver, StoreFront,

the Delivery Controller and the VDA.

The following table lists the components of the deployment and the operating

systems required for the servers and user devices.

Product/Components Operating System

XenApp

Delivery Controller

(Secure Ticket Authority is part of the

Desktop Controller)

XenApp VDA

Windows Server 2012 R2 x64

Windows Server 2008 R2 SP1 x64

StoreFront StoreFront 2.6 Windows Server 2012 R2 x64

User

Devices

Citrix Receiver for Windows 4.1 TLS-

enabled web browser Windows 8.1 Update 1 x64


How the components interact

Traffic between the web browser on the user device and StoreFront is secured using

HTTPS. All other traffic is secured using TLS.

The diagram below shows a detailed view of the deployment including the

components and certificates on each server, plus the communication and port

settings.

The MS SQL database must be hosted on a dedicated server, and the connection

between the database and Delivery Controller must be secured. For details regarding

securing this link, see http://support.citrix.com/article/CTX137556.

http://support.citrix.com/article/CTX137556


XenApp using NetScaler Gateway MPX

FIPS (external access) The deployment includes Citrix Receiver, NetScaler Gateway MPX FIPS appliance,

StoreFront, the Delivery Controller, and the VDA. The NetScaler Gateway MPX FIPS

hardware appliance terminates the TLS/HTTPS connections from the user device

(browser and Citrix Receiver). Traffic from the NetScaler Gateway MPX FIPS appliance

through StoreFront, the Delivery Controller, and the VDA is secured using TLS.


systems required for the servers and client devices.


XenApp

Delivery Controller


Desktop Controller)

XenApp VDA


Windows Server 2008 R2 SP1 x64

NetScaler

Gateway NetScaler Gateway MPX FIPS hardware appliance 10.1


User

Devices





Traffic between the web browser on the user device and NetScaler Gateway is secured

using HTTPS. All other traffic is secured using TLS.

This diagram shows a detailed view of the deployment including the components and

certificates on each server, plus the communication and port settings.






XenDesktop (internal network) This deployment provides end-to-end TLS encryption between the user device and the

resources hosted on XenDesktop. The deployment includes Citrix Receiver, StoreFront,

the Delivery Controller, and the VDA.


systems required for the servers and client devices.


XenDesktop

Delivery Controller


Desktop Controller)

XenDesktop VDA


Windows 7 SP1 x64


User

Devices





Traffic between the web browser on the user device and StoreFront is secured using

HTTPS. All other traffic is secured using TLS.

This diagram shows a detailed view of the deployment including the components and

certificates on each server, plus the communication and port settings.

The MS SQL database must be hosted on a dedicated server and the connection





XenDesktop using NetScaler Gateway

MPX FIPS (external access) The deployment includes Citrix Receiver, NetScaler Gateway MPX FIPS hardware

appliance, StoreFront, the Delivery Controller, and the VDA. NetScaler Gateway

terminates the TLS/HTTPS connections from the user device (browser and Citrix

Receiver). Traffic from NetScaler Gateway through StoreFront, the Delivery Controller,

and the VDA is secured using TLS.


systems required for the servers and user devices.


XenDesktop

Delivery Controller


Desktop Controller)

XenDesktop VDA


Windows 7 SP1 x64

NetScaler

Gateway NetScaler Gateway MPX FIPS hardware appliance 10.1


User

Devices





Traffic between the web browser on the user device and NetScaler Gateway is secured

using HTTPS. All other traffic is secured using TLS.

This diagram shows a detailed view of the deployment including where the

components and certificates on each server, plus the communication and port

settings.






Finding more information For more information regarding the products, requirements, and specific procedures,

please see:

Product-specific content at the Citrix product documentation site

(https://docs.citrix.com/).

For more information about secure NetScaler Gateway deployments, see

http://support.citrix.com/article/CTX129514.

For more information regarding the XenApp and XenDesktop 7.6 LTSR FIPS

support and features, see http://blogs.citrix.com/2014/10/16/xenapp-and-

xendesktop-7-6-security-fips-140-2-and-ssl-to-vda/

For additional guidance regarding certificate management see,

http://blogs.citrix.com/2014/12/11/how-to-secure-ica-connections-in-xenapp-and-

xendesktop-7-6- using-ssl/

https://docs.citrix.com/



http://blogs.citrix.com/2014/10/16/xenapp-and-xendesktop-7-6-security-fips-140-2-and-ssl-to-vda/

http://blogs.citrix.com/2014/10/16/xenapp-and-xendesktop-7-6-security-fips-140-2-and-ssl-to-vda/

http://blogs.citrix.com/2014/12/11/how-to-secure-ica-connections-in-xenapp-and-xendesktop-7-6-using-ssl/




Product Documentation

docs.citrix.com

Locations

Corporate Headquarters | 851 Cypress Creek Road Fort Lauderdale,

FL 33309, United States Silicon Valley | 4988 Great America

Parkway Santa Clara, CA 95054, United States

© 2017 Citrix Systems, Inc. All rights reserved. Citrix, the Citrix logo,

and other marks appearing herein are property of Citrix Systems,

Inc. and/or one or more of its subsidiaries, and may be registered

with the U.S. Patent and Trademark Office and in other countries.

All other marks are the property of their respective owner(s).

.


citrix xenapp and xendesktop 7.6 ltsr fips 140-2 … xenapp and xendesktop 7.6 ltsr fips 140-2...

Documents

Apple FIPS Cryptographic Module, v1.0 FIPS 140-2 Non-Proprietary

Getting Started with Citrix XenApp and XenDesktop Security · Citrix products within US Federal environments, the deployment must be FIPS compliant. Citrix products offer substantial

Xendesktop Reviewers Guide

Nimsoft Monitor xendesktop Guidedocs.nimsoft.com/prodhelp/zh/Probes/Catalog/xendesktop/2.0/...6 xendesktop Guide Appendix A: Troubleshooting 41 ... For information on configuring PowerShell

1Y0-203 Citrix XenApp and XenDesktop 7.15 Administration Prep...administration for Citrix XenApp and XenDesktop 7.15 LTSR. • CXD-210: Citrix Virtual Apps and Desktops 7.1x Administration

Citrix End2End - XenDesktop

LietuvosTarybųSocialistinėRespublika LTSR R. E. E.src-h.slav.hokudai.ac.jp/publictn/54/04_sato.pdf · LietuvosTarybųSocialistinėRespublika LTSR R. E. E. VersnaPopovski,National

FIPS 140-2 Sample Deployments - Citrix.com€¦ · CVAD 7 1912 LTSR FIPS 140-2 Sample Deployments Citrix 5 communications using the TLS protocol. TLS provides server authentication,

XenDesktop and XenApp - Ram Prasad · XenDesktop and XenApp ... Training & Support ... XenDesktop deployments which have more than 50 concurrent users of Desktop Director

LTSR DARBO ĮSTATYMŲ KODEKSAS

Citrix XenDesktop™ Provisioning & Machine …...Citrix XenDesktop Provisioning & Machine Creation Deep Dive Exploring Citrix XenDesktop v7.1 Provisioning & Machine Creation on VMware

Citrix XenDesktop Product Overview - Insight NL · Citrix XenDesktop is built to be secure by design and is the only solution that is FIPS-140 compliant and on the Common Criteria

XenDesktop 5 - QSG

XenDesktop and XenApp -

Citrix VDI Handbook and Best Practices · PDF fileCitrix VDI Handbook - XenApp and XenDesktop 7.15 LTSR Page 12 Section 2: Assess Overview Creating an app and desktop delivery solution

HDX RealTime Optimization Pack 2.9 LTSR

XenApp y XenDesktop 7.6 Long Term Service Release...Se recomienda usar los siguientes componentes en entornos 7.6 LTSR CU6. Estos componentes no dan derecho a las Estos componentes

Citrix XenDesktop Datasheet · Citrix XenDesktop Datasheet citrix.com Citrix XenDesktop Citrix® XenDesktop® transforms Windows desktops and apps into a cloud service available to

XenApp and XenDesktop

Xendesktop Deployment Blueprint

MSA FIPS to CBSA FIPS in Class’ Website

Overview XenDesktop

Introducing XenDesktop, built on the Avalon platformleblogdemiel.com/webmiel/docs/pdf/citrix_fp_xd7.pdfcitrix.com Introducing XenDesktop, built on the Avalon platform Citrix XenDesktop

CA Unified Infrastructure Management xendesktop …docs.nimsoft.com/prodhelp/es/Probes/Catalog/xendesktop/2.1/...6 xendesktop Guide Appendix A: Troubleshooting for xendesktop Probe

Aplicación Citrix Workspace 1912 LTSR para Windows

OpenSSL FIPS Object Moduleopenssl.cs.utah.edu/docs/fips/UserGuide-1.2.pdf · 2012-06-27 · OpenSSL FIPS Object Module FIPS 140-2 User Guide Acknowledgments The Open Source Software

Chapter 1: XenDesktop 7.6 – Upgrading, Installation, and ... 1: XenDesktop 7.6 – Upgrading, Installation, and Configuration Upgrading from XenDesktop 5.6/7.x to XenDesktop 7.6

Philips FIPS Object Module for OpenSSL FIPS 140-2 Non

XenDesktop 5 Installation

Adding XenMobile Users to XenDesktop Environment Design Guide · Adding XenMobile Users to an Existing XenDesktop Environment Understanding the Impact. ... XenDesktop environment

FIPS codes and county names - careertech.k12.wv.uscareertech.k12.wv.us/documents/FIPSCodes.pdf · FIPS codes and county names Page 1 FIPS codes and county names, by State FIPS code

XenDesktop Implementation Guide

Citrix VDI Handbook and Best Practices · Citrix VDI Handbook - XenApp and XenDesktop 7.15 LTSR Page 12 Section 2: Assess Overview Creating an app and desktop delivery solution begins

XenApp and XenDesktop 7.6 Long Term Service Release (LTSR) · XenAppandXenDesktop7.6LongTermServiceRelease(LTSR) Contents What’snew 3 CumulativeUpdate8(CU8) 4 Fixedissues 9 CumulativeUpdate7(CU7)

Citrix XenDesktop Product Overview - ADNmedia.adn.de/media/DE/DocLib/citrix-xendesktop-product-overview.… · Citrix XenDesktop Product Overview ... Combined with Citrix CloudBridge™,