This article describes how to integrate Authentication Manager (AM) with Citrix NetScaler using RADIUS.

Configure AM

Perform these steps to configure AM.

Procedure

1. Sign in to Security Console.
2. Navigate to RADIUS > RADIUS Servers and make a note of the IP address of the selected RADIUS server.
   
3. Navigate to RADIUS > RADIUS Clients > Add New.
4. On the Add RADIUS Client page, enter the following:
   1. Client Name: Enter a descriptive name for the RADIUS client.
   2. IPv4 Address: Enter the IP address of the RADIUS client (NetScaler IP Address - NSIP).
   3. Make/Model: Standard Radius.
   4. Shared Secret: Create and enter a secure shared secret. This secret will be used for secure communication between the RADIUS client and the RADIUS server.
5. Click Save & Create Associated RSA Agent.
6. On the Add New Authentication Agent page, click Save, then confirm by clicking Yes, Save Agent.

Notes

• RSA Authentication Manager RADIUS server listens on ports UDP 1645 and UDP 1812.
• The relationship of the agent host record to the RADIUS client in the Authentication Manager can be 1 to 1, 1 to many, or 1 to all (global).
• Shared Secret must be an alphanumeric string between 1 and 31 characters in length and is case-sensitive.

Configure Citrix NetScaler

Perform these steps to configure Citrix NetScaler.

Procedure

1. Log in to the NetScaler ADC VPX with nsroot account.
2. In the left pane, navigate to Security > AAA - Application Traffic > Policies > Authentication > Basic Policies > RADIUS.
3. On the Servers tab, click Add, enter values for the following parameters, and click Create.
   • Name: Name of the RADIUS server.
   • Choose Server IP to enter the IP address of the RADIUS server.
   • IP Address: Enter the IP address of the RSA Identity Router.
   • Secret Key: Enter the secret key for RADIUS communication. This should match the same key entered in the RSA configuration section.
   • Transport: UDP
   • Time-out: Increase the timeout value to 30 seconds.
   • Test RADIUS Reachability: Click the button to ensure successful communication between the RADIUS server and the client over UDP before committing and creating the RADIUS server. 
     
4. Create a corresponding RADIUS policy.
   1. Navigate to Security > AAA - Application Traffic > Policies > Authentication > Advanced Policies > Policy and click Add.
   2. On the Create Authentication Policy page, provide the following details:
      1. Name: Specify a name for the RADIUS policy.
      2. Action Type: Select RADIUS as the authentication action type.
      3. Action: Select the RADIUS server profile created to bind the RADIUS policy with.
      4. Expression: Displays the name of the rule or expression that the RADIUS policy uses to determine if the user must authenticate with the RADIUS server. In the textbox, set the value true for the policy to take effect and the corresponding RADIUS action to be run.
         
5. Bind the RADIUS policy to the authentication virtual server.
   1. Navigate to Security > AAA - Application Traffic > Virtual Servers.
   2. In the Virtual Server settings, associate the RADIUS policy created above with the authentication virtual server.
      
6. Associate the authentication server with the appropriate traffic management virtual server.
   1. Navigate to Traffic Management > Load Balancing (or Content Switching) > Virtual Servers, select the virtual server, and associate the authentication virtual server with it.
      

The configuration is complete.