First to clear up the confusion, what is the Access Gateway Advanced Control Option?

It s the technology formerly known as MSAM (MetaFrame Secure Access Manager) and AGE (Access Gateway Enterprise).

This is the software add-on to the Access Gateway appliance (although currently it is a standalone product until another version release in 2005) that allows all of the end point analysis to be carried out as well as the tailoring of advanced access policies.  It is the Advanced Control Option that allows the controlling of access to different resources (File Shares, Web Applications, Citrix Presentation Server Applications etc) as well as controlling how those applications can be used (what virtual channels are available in PS Apps, can users download or only preview files etc).

Later in 2005 we should see another release of this technology that will also allow us to use the Advanced Control Option to control the configuration of the Access Gateway Appliance.  For example, based upon advanced end point analysis of the Advanced Control Option we will be able to control the Networks and ports accessible via the hardware device.

Hi Craig

I wouldn't worry about the confusion, to be honest very few people seem to understand what fits where at the moment (and that can include employees of a certain vendor )

Today the Access Gateway appliance (current 4.0 release) contains two technology components (if we forget the not so useful kiosk mode) namely the full SSL VPN as developed by Net 6 and also the Secure Gateway Code base so that the appliance can front the delivery of Presentation Server Applications.  Apart from the inclusion of SG the appliance does not integrate with any of the Citrix products.  Administration and Licensing are all separate.  Of course you could use the Access Gateway appliance to access other Citrix technologies such as PS delivered applications and internally deployed MSAM implementations.  You would just use the gateway appliance to get yourself connected to the internal network.

MSAM 2.x was effectively a low end portal product with some basic SSL VPN functionality to allow email synchronisation which was known as the Advanced Gateway Client (Product marketing really do deserve an award for making all these names so confusing).

The next incarnation of MSAM (originally named MSAM 4.0) was a completely different product.  It still included the functionality of MSAM 2.x in terms of Access Centres which can be used as an alternative UI but this product was focussed on delivering on the 'Access' story that Citrix have been telling for the last couple of years.  The main focus of the technology is in allowing 3 dimensional Access control ie based on who a user is, where a user is and what the state of the device is that the user is connecting from, a completely tailored Access Scenario is delivered.  So we have:

• Advanced End Point Analysis (for example is the client running AV, what OS are they accessing from, is a firewall enabled etc etc)
• The ability to create complex access filters based on different End Point analysis.
• A 'new' UI know as the NAV UI
• Ability to control access to a variety of resources including PS Applications, Web Applications, File Shares, Web Email, IP Tunnels.

As part of the Access Suite 4.0 release the name MetaFrame was dropped so the product was renamed to Access Gateway Advanced Control Option however today there is no direct integration with the Access Gateway Appliance.  Currently for secure external access the Advanced Control Option uses the Citrix Secure Gateway technologies and IP tunnels are created by the Advanced Gateway Client (as used in MSAM 2.2).

Towards the end of 2005 we should hopefully see another release of both the Access Gateway Appliance and the Advanced Control Option software.  This will replace the software Secure Gateway component used today and the Advanced Control Option software will then be able to provide policy based control to the Access Gateway itself.

So as you can see there are plenty of reasons to be confused, this will have either answered your questions or sent your head into a spin!

Tim

Well iam not sure you could it niggles but, the main problem we have is that it would seem that the installation of the full access client requires admin rights, not cool at all, plus the performance is not what we were expecting, iam not sure why because its early days yet for our testing. In the beging we did think that it was going to be smarter that using the full client would´nt pump everything down the vpn tunnel but be more selective dependant on polices, and not dependant on using split dns. Its nice to know that there is more options on the way. I will naturally leave feedback at the forum under our trials.

Regards Craig

Can the Advanced Access Control option only be used with the AG appliance or can the features of the Advanced Access Control option, i.e end point analysis, access filters etc be used with an SG implementation?

Thanks, Lee.

Hi Brian,

Thanks for responding so quickly. I want to take an SG/WI and MetaFrame environment, upgrade it to PS 4.0 and the latest SG/WI versions. In addition add in access control features (end point scanning, access filters) and be able to configure what can be accessed based on device type, connection speed etc. I'm not sure what the options are and the products required. My understanding is the CAG is not a replacement for SG so can the access control be achieved by just using Secure Gateway plus somthing else? Apologies if I'm missing something obvious.

Thanks

Lee.

Hi Lee

Your not missing anythign obvious. As one of the Citrix guys said to me at iForum 'Was there anything we missed to make this more confusing?' so they know its a tricky one.

Basically if you want to use the AAC functionality then you need to buy Citrix Access Gateway Enterprise (CAGE) software and licenses. If you buy before the end of June then buy MSAM 2.2 licenses with a Citrix Access Gateway (CAG) appliance Then use the power-up promotion to upgrade to CAGE.

If you buy after June, then buy just CAGE 4.0 licenses. This will requrie 2 windows servers, one on the LAN to run the Access Manager and one in the DMZ to run the Gateway as the Gateways for SG and CAGE aren't compatible. (For this you could also think about using VMware to minimse hardware requirements).

When the next release of CAGE comes out, then the Secure Gateway component will be ported to the appliance (CAG) so to get the next verion og CAGE you will need to buy the appliance, hence using th epower-up option before the end of June is a good way to get there. You simply buy the gateway for now, either use it as a VPN or stick in the cupboard until October (ish).

Does this help? If you want bit more of a chat then drop me a mail.

Thanks

brian

The CAG Appliance does have basic end point functionality included (limited to checking for a file, registry key or a process).  The Advanced Access Control Option gives you a blank page in terms of what you can check for and how you check for it (with the use of the SDK).  It also includes a number of out the box end point scans for different A/V vendors. personal Firewall vendors, IP Scans, MAC Scnas, IE Versions, OS Versions patch levels etc.  You can then build up comprehensive access policies with the AAC based upon these advanced scans, something that cannot be done with just the appliance.

Plus the CAG appliance can only use its end point scans to limit access to IP ranges and Ports.  The AAC can use its end point scans to limit access at the resource level (File Shares, Web Apps, PS Apps, PS Virtual Channels, how clients can interact with files etc).

Thanks,

Tim

Hi there

The current version available for AGE is 4.0. Version 4.2 is due out this month provided there are no delays. So if you buy today you get version 4.0 and would upgrade to 4.2 using the subscription advantage, with this in mind you would purchase:

• Citrix Access Gateway appliance
• Citrix Access Gateway Enterprise licenses

You would leave the appliance on the shelf and turn it on when you move to 4.2. With 4.2 you would install the AAC onto a Windows server on the LAN the same as with 4.0.

A user coming into the system from a client that is unable to download anything would be able to run web based resources, e.g. :

• Outlook web access
• Intranet
• File shares (through AAC interface)

Whilst this is what is possible with no client, you need to configure AAC to allow access when it can't even install the end point client.

In terms of RSA to gain access to ICA applications, this would be possible to scan for, but only if you can download the end point client.

Finally, depending upon load you may split the WI and AAC server.

Hope this helps

Thanks

bd

You can allow users to log onto PS applications with RSA authentication without the need for any client components, the active X clients are not required for PS as this can be configured to fall back to the Java client.

Does this answer your question?

Tim

Is the AAC (Advanced Access Control) always going to be a separate component (separate from the Access Gateway)?  Or is the component ever going to be a part of the Access Gateway appliance itself.

We have the Access Gateway installed.  It looks like we need to install the AAC component on a standalone server.

Can anyone tell me what the minimum specs of the server should be?

We have been told that the server should be running Windows 2003 Web Edition.

Thank you.