Discussion Locked

Citrix and the VPN

0 helpful
4 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

At Home: Windows 98, Citrix ICA client, Microsoft VPN adapter.
At Employer: Windows TSE 4.0, Citrix Metaframe 1.8, dial-up permissions.

I have established a VPN connection after taking care of error 645 by reinstalling virtual private networkingin windows setup.
I have also connected to our Citrix server and even viewed my Outlook inbox.
Now, I get to the Citrix screen and its done. Can't do anything. Nothing has changed unless something happened on the Server end. We've not had the best of luck with this VPN setup and I know there are better more secure means available using IPSec etc. Is there a missing element in this setup? Is the fact that my 98 box does not indicate PPTP usage mean that it is using PPP and cannot use PPTP? How secure is this connection and how reliable can it be?
Thanks for any help.

4 replies

by stillatit

It should work as you described. Hopefully your 98 is 98SE. (If not, and if you have encryption working, please tell us all how you did it!)

Checking the basics, you should have a 32 bit ICA client installed on your home box. The connection for your server should specify your server by IP number, and should specify screen settings compatible with your system. Your account on the server needs to be enabled to use the terminal server.

In your vpn connection definition there is a checkbox marked "Use default gateway on remote server" (or similar). If you can live with not having internet access while your vpn is up, check this box and it will make your life simpler.

If not, uncheck the box, and you will need to run a ROUTE command after you bring up your.

The ROUTE command will tell your system how to get to your server. The general form is:
ROUTE ADD MASK 1
where the SERVERIPADDRESS is the address of your Citrix server, MASKNUMBERS is the subnet mask (typically 255.255.255.0 for a class C), and VPNSERVERADDRESS is the address that the server assigns itself for talking to the vpn clients. You can put this in a batch file and run it by double-clicking a shortcut on your desktop.

As far as connection security is concerned, if you are using "Microsoft VPN Adaptor" you are actually using PPTP, even if it does not say so. There are settings in the connection properties which specify:
a) which forms of password encryption may be used
b) whether to encrypt the data payload
c) whether to insist on encryption (on the NT side - registry setting in 98)

If you are not encrypting the data payload, someone could theoretically snoop your session, and reconstruct your screens. If this worries you, use encryption. There is also a secure version of the ICA client which does its own encryption.

(continued in comment)

by stillatit

(CONTINUED)

Are these good enough security? It depends on what you are doing and whether it is worth someone's (lots of) time to crack the encryption, then reconstruct the screen from the updates Citrix is sending. My rule of thumb is to use the maximum encryption easily available, but not to get crazy about it. If your business requires more security than the Microsoft 128-bit encryption, you probably have a Security Administrator on staff, and that is the person to ask.

In general, I have found PPTP connections to be as reliable as the IPS you are using. We use these PPTP connections to our remote offices and remote users, and often have connections up for days (where a remote user is on DSL). If the ISP messes up, or you have toomuch line noise and you lose the connection for a few seconds, the vpn drops.

Good luck.

by dgates_1

Updating the ICA browser seemed to help. Also updating the microsoft dial-up adapter helped. I am connecting with more success now.

This discussion is closed to new replies.