The new Citrix Receiver theme on NetScaler/Access Gateway 10 is not enabled by default.  The theme is on the appliance, but the old Black theme will be used by default.  I looked and searched the NetScaler 10 and Access Gateway 10 release notes, admin guides, and eDocs on the Citrix support  only to find that it can be done but there were no easily found instructions on how to do it.

From the Release notes for NetScaler 10 and Access Gateway 10:

Apply the Citrix Receiver theme to the logon page. You can use the command line to overwrite the original Access Gateway logon page with the Citrix Receiver theme.

That is all you get in the release notes, admin guides, and eDocs.  Ok, so now what?  Well, after upgrading the firmware to 10 from 9.3.x, I did some looking around on the appliance (connected using WinSCP to browse and search for files) and finally found the Citrix Receiver theme by doing a search for receiver*.  Now that I found the theme, how do I apply it?

Before applying the Citrix Receiver Theme

Tools needed to apply the Citrix Receiver Theme:

• WinSCP or any other secure file transfer tool
• Putty or any other SSH client

Apply the Citrix Receiver Theme

1. Connect to your NetScaler/Access Gateway appliance using WinSCP

2. Browse to netscaler > ns_gui and backup to the entire contents of the folder

3. Connect to your NetScaler/Access Gateway appliance using Putty

4. Once authenticated type the following commands pressing enter after each command:

1.  shell

2.  cd /var/netscaler/gui/vpns/customization/receivertheme

3.  tar -xvzf receivertheme.tar.gz

*Edit /var/netscaler/gui/vpns/customization/receivertheme/ns_gui/epa/epa.html and /var/netscaler/gui/vpns/customization/receivertheme/ns_gui/vpns/postepa.html

Change nsversion one line 19 from 1,1,1,1 to the NetScaler/Access Gateway version you are using.

To apply the Citrix Receiver Theme immediately.

4.  cp -r /var/netscaler/gui/vpns/customization/receivertheme/ns_gui/* /netscaler/ns_gui

To reapply the theme after the NetScaler/Access Gateway appliance reboots.

5.  mkdir /var/customizations

6.  cp -r /var/netscaler/gui/vpns/customization/receivertheme/ns_gui/* /var/customizations

Only do step 7 if rc.netscaler does not already exist.  If rc.netscaler exists, goto step 8.

7.  touch /nsconfig/rc.netscaler

8.  echo cp –r /var/customizations/* /netscaler/ns_gui >> /nsconfig/rc.netscaler

5. Make sure to copy files/make directory structure on both appliances if you have a NetScaler/Access Gateway high availability pair setup.

After applying the Citrix Receiver Theme

Thanks to Henny Louwers and his post on Citrix NetScaler 10: Apply Citrix Receiver Theme for verifying after my post in the Citrix Forums: Apply the Citrix Receiver theme to the AGEE logon page – How?

Update – This is now in the Citrix eDocs – Applying the Citrix Receiver Theme to Logon Page.  Even though the method above works, there is another way to reapply theme after the NetScaler/Access Gateway appliance reboots.  I have updated the instructions above to edit the epa.html and postepa.html pages for the Citrix Receiver Theme change.

Update – There is now another theme for Access Gateway Enterprise, see The Citrix Blog – Green Bubble Theme for Citrix NetScaler.  This new theme has more modifications than the default Citrix Receiver theme in the NetScaler 10/Access Gateway Enterprise firmware.

If you have found this article interesting or if you have any other insights, please feel free to leave comments on this article.

In Access Gateway I have two session policies bound to the Access Gateway Virtual Server.  One session policy is for the Citrix Receiver and the other session policy is for Web Interface ICA/HDX access only.   No issues with connecting to the environment using the Citrix Receiver or Web Interface ICA/HDX access only.  I recently enabled the option to use VPN or Web Interface ICA/HDX access with Client Choices by using AAA Groups with a session policy in Access Gateway for testing.  VPN and Web Interface ICA/HDX access worked fine but I could not logon using the Citrix Receiver.  I tested the Citrix Receiver from the iPad and Android mobile devices.  See the screenshots below for the different errors on each device.

Citrix Receiver error on the iPad.

Citrix Receiver error on Android.

After reviewing my configuration, a session policy conflict was found between the Citrix Receiver session policy bound to the Access Gateway Virtual Server and a session policy bound to an AAA Group.  The session policies both had the same priority of 0.  See the screenshots below for the Access Gateway Virtual Server and AAA Group session policies configurations.

Access Gateway Virtual Server session policies.

Access Gateway AAA Group session policy.

After some configuration changes and testing, there are two ways to fix the issue.  One option is to make the AAA Group session policy a lower priority by giving it a higher priority number than the Access Gateway Virtual Server Citrix Receiver session policy.  The other option is to configure the AAA Group session policy with a policy expression of REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver.  See the screenshots below for the AAA Group session policies configuration options.

AAA Group lower priority session policy

AAA Group policy expression session policy

By using either of the options above for the AAA Group session policy, you should now be able to connect using the Citrix Receiver without any errors.  I wish Access Gateway had a resultant set of policy tool like XenApp and XenDesktop has.

What is the Access Gateway Platform License?

The Access Gateway platform license allows users to connect to XenApp and XenDesktop published resources just like they do through Secure Gateway on the Access Gateway platform without Access Gateway Standard Edition or Access Gateway Universal Licenses installed.  The Access Gateway platform license adds support for the Receiver (published applications only) and Dazzle along with strong authentication and secure SSL relay of ICA session traffic.  The Access Gateway platform license allows basic connections to your Citrix published resources.  The only limitation on total connections is the appliance/underlying hypervisor resources.  The Access Gateway platform license will be included with all Access Gateway appliances (physical or virtual) and include a year of Subscription Advantage.

The Access Gateway appliance (physical or virtual) with an Access Gateway Platform license installed allows the following connections:

• ICA over SSL connections to XenApp published resources using the Citrix online plug-ins
• ICA over SSL connections to XenDesktop published resources using the Citrix online plug-ins
• Citrix Receiver connections to the Citrix Merchandising Server
• Connections from Citrix Dazzle
• Connections to Web Interface

Access Gateway Universal licenses are needed for the following connections:

• SSL VPN
• Endpoint Analysis Scanning
• Smart Access (Advanced or Enterprise Editions)
• Clientless Access ( Email, Web Sites, and File Shares in Advanced or Enterprise Editions)
• Streamed Applications using the Citrix offline plug-in

Note: If the Access Gateway appliance has licenses available (Standard or Universal), those licenses will be used for sessions even if they are sessions that are included with the Access Gateway platform license.

Initial support for the Access Gateway platform license will be on the Standard Edition Access Gateway VPX and 2010 appliances.  Support for Advanced and Enterprise editions will be coming later.  You can get evaluation licenses from your Citrix partner or Citrix for Advanced and Enterprise Editions in the meantime.

If you currently have an Access Gateway appliance that is still under maintenance, you can obtain the Access Gateway platform license in Product Upgrades/Fulfillment in MyCitrix (Logon Required).

For more information and a complete overview of the Access Gateway Platform License see the Citrix Documentation Library – Access Gateway VPX Licensing.

What is the Access Gateway VPX?

The Access Gateway VPX is an Access Gateway virtual appliance that runs on XenServer.  Access Gateway VPX should available for ESX and Hyper-V in future releases.  The Access Gateway VPX has the same features and functionality as an Access Gateway Standard Edition appliance.  You can deploy the Access Gateway VPX with your existing Access Gateway 2010 appliance.  Access Gateway VPX can take advantage of all the features of XenServer like XenMotion and high availability.   The Access Gateway VPX includes the Access Gateway platform license.  Access Gateway VPX is priced at $995 per virtual appliance (Same cost or cheaper than a physical server for Secure Gateway and cheaper than an Access Gateway 2010 appliance) that gives you unlimited Secure Gateway like access to your XenApp and XenDesktop published resources.

What are the requirements to run Access Gateway VPX on XenServer?

The Access Gateway VPX needs the following resources to run on a XenServer host:

• 1 vCPU (2 vCPUs recommended)
• 1GB RAM
• 12GB Virtual Disk (10GB and 2GB Virtual Disks)
• 1 or 2 Virtual Network Interfaces

Access Gateway VPX Installation Procedure:

1. Download the Access Gateway VPX from MyCitrix (Login Required)

2. In XenCenter, select VM and then Import from the menu bar

3. On the Import Source screen, browse to the Access Gateway VPX XVA file you downloaded from MyCitrix.  Select Exported VM and click Next.

4. On the Home Server screen, select the XenServer you want to install the Access Gateway VPX on and click Next.

5. On the Configure storage for the new VM screen, select the storage repository and click Import.

6. On the Configure virtual network interfaces screen, select the network for the interface or networks for multiple interfaces and click Next.

7. On the Complete the import screen, leave Start VM after import checked or uncheck it, and click Finish.

8. You should now have a Citrix Access Gateway VM on your XenServer host ready to login and configure.

9. Login with the username root and default password of rootadmin and configure the Access Gateway’s IP address by going to the menu option for express setup.

10. You should be now able to access the Access Gateway’s web admin page by going to https://ipaddress:9001, login with the username root and default password rootadmin, download and install the Access Gateway Administration Tool, and configure your Access Gateway VPX.

You can now also export your SSL certificate in PFX format with the private key from your Secure Gateway server, convert it PEM format, and uploaded to your Access Gateway VPX.  The steps are outlined in Citrix Knowledgeable Article CTX106028 - How to Convert PFX Certificate to PEM format for use with Access Gateway.

Citrix Merchandising Server and Receiver integration with the Access Gateway VPX

The Access Gateway VPX also has Merchandising Server and Receiver Integration where you can upload the Citrix Receiver and Access Gateway plug-in for deployment from the Access Gateway VPX.

You can also configure settings for the Merchandising Server and Dazzle for users to receive updates to their Citrix Receiver using the Access Gateway Platform license rather than having to use Access Gateway Standard or Universal license.

The Access Gateway VPX is good upgrade/replacement for Secure Gateway.  I would recommend going to a pair of NetScaler Standard appliances (hardware appliances or the VPX appliances with the proper bandwidth license) because of the built-in high availability, load balancing with monitors for your Citrix infrastructure, and in place upgrade/expandability to NetScaler Enterprise or Platinum editions later down the road.

For more information on the Access Gateway VPX, see Citrix Knowledgeable articles CTX124000 – Citrix Access Gateway VPX Reference Architecture, CTX124138 – Citrix Access Gateway VPX and 2010 Licensing Changes FAQ, and Getting Started with Access Gateway VPX.  You can also see Citrix TV for more information - Citrix Access Gateway VPX Overview Demo.

I think the Access Gateway platform license and Access Gateway VPX are a great move by Citrix to transition customers using Secure Gateway to the Access Gateway product line.  The only question now is if or when are we going to see the last release of Secure Gateway?

If you have found this article interesting or if you have any other insights, please feel free to leave comments on this article.