Applies To:

Show Versions

Manual Chapter: Configuring Remote Desktop Access

Table of Contents | << Previous Chapter | Next Chapter >>

Configuring Remote Desktop Access

What are remote desktops?

Remote desktops in Access Policy Manager^® allow users to access the following types of internal servers in virtual desktop sessions:

Microsoft Remote Desktop servers
Citrix^® servers
VMware View Connection servers

You can configure remote desktops by name or by their internal IP addresses, and grant or deny users the ability to set up their own favorites.

What is Microsoft remote desktop?

Using an Access Policy Manager^® (APM^®) RDP type remote desktop, clients can access a server that runs Microsoft Remote Desktop Services. Microsoft Remote Desktop servers run the Microsoft Remote Desktop Protocol (RDP) server. RDP is a protocol that provides a graphical interface to another computer on a network.

To provide Microsoft RDP connections natively, APM provides these alternatives.

Java Client: APM provides a Java Client option in the remote desktop configuration. The option supports native connections for Windows, Mac, and Linux clients. When this option is selected, a user on any compatible platform is presented with a simple Java Client interface to the Microsoft RDP server with reduced visual display features.
APM as a gateway for RDP clients: With proper BIG-IP^® system configuration, Microsoft RDP clients can use APM as a gateway. The configuration supports Microsoft RDP clients on Windows, Mac, iOS, and Android. When a user types the address or hostname of the gateway into an RDP client and specifies a particularly configured virtual server for it, APM authorizes the client. When the client requests connections to resources on backend servers, APM authorizes the access.

For support information, refer to BIG-IP APM Client Compatibility Matrix on AskF5™ at http://support.f5.com/.

What is Citrix remote desktop?

Citrix^® remote desktops are supported by Citrix XenApp™ and ICA clients. With Access Policy Manager^® you can configure clients to access servers using Citrix terminal services. You provide a location from which a client can download and install a Citrix client for a Citrix ICA connection.

About ACLs to control access from remote desktop resources

When you create a remote desktop resource, Access Policy Manager^® (APM^®) automatically creates an allow ACL for the IP addresses and ports specified in the resource. To disallow access to any other IP addresses and ports, you must create ACLs that deny access to them and assign the ACLs in the per-session policy. F5 recommends that you create an ACL that rejects access to all connections and put it last in the ACL order.

Configuring an ACL to reject all connections

You can place an access control list (ACL) that rejects all connections last in the ACL order to keep users from accessing any host and port combinations other than those to which they have been explicitly allowed access by the other ACLs assigned to the policy.

On the Main tab, click Access > Access Control Lists .
The User-defined ACLs screen opens.
Click Create.
The New ACL screen opens.
In the Name field, type a name for the access control list.
From the Type list, retain the default value Static.
Optional: In the Description field, add a description of the access control list.
Optional: From the ACL Order list, select Last to add the ACL at the last position in the list.
Click the Create button.
The ACL Properties screen displays.
In the Access Control Entries area, click Add to add an entry.
The New Access Control Entry screen displays.
From the Type list, select L4.
For the Source IP Address, Source Port(s), Destination IP Address, and Destination Port(s) fields, retain the default value Any.
From the Action list, select Reject.
The reject action drops the packet. On TCP flows, it also sends a TCP RST message. On UDP flows, it also sends proper ICMP messages. On other protocols, it drops the packet silently.
Click Finished.

To use the ACL, assign it to a session using an Advanced Resource Assign or ACL Assign action in a per-session policy.

Note: If you assign this ACL and Network Access or Portal Access resources to the same policy, you might need to also create and assign ACLs that allow access for Network Access and Portal Access resources.

Task summary for remote desktops

To set up remote desktops, perform the procedures in the task list.

Task list

Configuring a resource for Citrix remote desktops

You can configure BIG-IP APM so users can access Citrix internal srvers in virtual desktop sessions. Refer to the online help for more information about the parameters you can configure for remote desktops.

On the Main tab, click Access > Connectivity / VPN > VDI / RDP > Remote Desktops .
The Remote Desktops screen opens.
Click Create.
The New Resource screen opens.
In the Name field, type a name for this desktop resource.
From the Type list, select Citrix.
In the Description field, type a description for the new resource.
For the Destination setting, specify an IP address as your destination, and accept or change the Port.
For the Server Side SSL setting, select the check box to provide SSL functionality between the BIG-IP system and the resource server.
If this option is selected, the system changes the port number from 80 to 443.
For the Auto Launch option, select whether to enable auto launch for Citrix.
If you select Enable, the first application runs automatically.
In the Custom Parameters field, type one or more lines to specify custom settings.
These parameters affect the rendering of certain features for Citrix. A line should contain a section name enclosed in brackets ([ ]) or a name-value pair separated by an equal (=) sign.
For the Enable SSO setting, select whether to enable single sign-on to the server.
Click Finished.

Configuring a resource for RDP remote desktop session host

You can configure BIG-IP APM so users can access Microsoft Remote Desktop internal srvers in virtual desktop sessions. Refer to the online help for more information about the parameters you can configure for remote desktops.

On the Main tab, click Access > Connectivity / VPN > VDI / RDP > Remote Desktops .
The Remote Desktops screen opens.
Click Create.
The New Resource screen opens.
In the Name field, type a name for this desktop resource.
From the Type list, select RDP.
In the Description field, type a description for the new resource.
For the Server Type, select Remote Desktop Session Host.
For the Client Type, select the client type as either Native, Java, or ActiveX.
For the Destination setting, specify an IP address as your destination, and accept or change the Port.
In the Custom Parameters field, type one or more lines to specify custom settings.
These parameters affect the rendering of certain features for RDP. For Microsoft RDP, a line should inclue a name, type, and a value, with a colon as a separator, shown in the examples below:
- screen mode id:i:1
- use multimon:i:0
- desktopwidth:i:1440
- desktopheight:i:900
- session bpp:i:32
For Enable SSO, select whether to enable single sign-on to the server.
Click Finished.

You have now configured an RDP resource for a remote desktop session host.

Configuring a resource for RDP remote desktop web access

On the Main tab, click Access > Connectivity / VPN > VDI / RDP > Remote Desktops .
The Remote Desktops screen opens.
Click Create.
The New Resource screen opens.
In the Name field, type a name for this desktop resource.
From the Type list, select RDP.
In the Description field, type a description for the new resource.
For Server Type, select Remote Desktop Web Access.
For Client Type, select the client type as either Native, Java, or ActiveX.
For the Destination setting, specify an IP address as your destination , and accept or change the Port.
In the Custom Parameters field, type one or more lines to specify custom settings.
These parameters affect the rendering of certain features for RDP. For Microsoft RDP, a line should inclue a name, type, and a value, with a colon as a separator, shown in the examples below:
- screen mode id:i:1
- use multimon:i:0
- desktopwidth:i:1440
- desktopheight:i:900
- session bpp:i:32
For Enable SSO, select Enable.
Click Finished.

You have now configured an RDP resource for APM webtop.

Configuring an access policy to include a remote desktop

This procedure is applicable if you want to configure Access Policy Manager for Citrix or Microsoft RDP terminal services.

On the Main tab, click Access > Profiles / Policies .
The Access Profiles (Per-Session Policies) screen opens.
Click the name of the access profile for which you want to edit the access policy.
The properties screen opens for the profile you want to edit.
On the menu bar, click Access Policy.
In the General Properties area, click the Edit Access Policy for Profile profile_name link.
The visual policy editor opens the access policy in a separate screen.
Click the (+) icon anywhere in the access policy to add a new item.

Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.

A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
On the Assignment tab, select the Advanced Resource Assign agent, and then click Add Item.
The Resource Assignment screen opens.
Click the Add/Delete link below the entry.
The screen changes to display resources on multiple tabs.
On the Remote Desktop tab, select the remote desktop that you configured previously.
On the Static ACL tab, select an ACL that rejects all connections.

Important: Adding an ACL that is last in order and rejects all connections keeps users from accessing any host and port combinations other than those to which they have been explicitly allowed access by the other ACLs assigned to the policy.
On the Webtop tab, select a full webtop.
Select any other resources that you want to assign to the policy.
If you assign a Network Access resource to the policy, be sure to also assign an ACL that allows access to the resources that you want users to have. Otherwise, the ACL that rejects all connections blocks access.

If you assign a Portal Access resource to the policy, be sure to also assign an ACL that allows access to all parts of the web sites specified in the start URI or hosted content fields of the Portal Access configuration. Otherwise, the ACL that rejects all connections blocks access.
Click Update.
Click Save.

Your remote desktop is assigned to the session along with system-defined (allow) and user-defined (deny) ACLs.

To complete the process, you must apply the access policy, and associate the access policy and connectivity profile with a virtual server so users can launch the remote desktop session.

Note: To ensure that logging is configured to meet your requirements, verify the log settings for the access profile.

Sample access policies for Native RDP client and APM webtop

These sample access policies are a reference for configuring RDP for APM webtop, a standalone client, or both.

Access policy for an APM webtop

Access policy for a standalone client

Access policy for both an APM Webtop and a standalone client

Access policy for APM webtop and standalone client

Attaching an access policy to a virtual server for remote desktops

When creating a virtual server for an access policy, specify an IP address for a single host as the destination address.

On the Main tab, click Local Traffic > Virtual Servers .
The Virtual Server List screen opens.
Click the name of the virtual server you want to modify.
In the Destination Address field, type the IP address for a host virtual server.
This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
For the HTTP Profile setting, verify that the default HTTP profile, http, is selected.
In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
If you are using a connectivity profile, from the Connectivity Profile list, select the connectivity profile.
If you are creating a virtual server to use with portal access resources in addition to remote desktops, from the Rewrite Profile list, select the default rewrite profile, or another rewrite profile you created.
If you want to provide connections to Java RDP clients for application access, allow Java rewriting for portal access, or support a per-app VPN connection that is configured on a mobile device, select the Application Tunnels (Java & Per-App VPN) check box.
You must enable this setting to make socket connections from a patched Java applet. If your applet does not require socket connections, or only uses HTTP to request resources, this setting is not required.
If you want to provide native integration with an OAM server for authentication and authorization, select the OAM Support check box.
You must have an OAM server configured in order to enable OAM support.
Click Update.

The access policy is now associated with the virtual server.

Verifying log settings for the access profile

Confirm that the correct log settings are selected for the access profile to ensure that events are logged as you intend.

Note: Log settings are configured in the Access > Overview > Event Log > Settings area of the product. They enable and disable logging for access system and URL request filtering events. Log settings also specify log publishers that send log messages to specified destinations.

On the Main tab, click Access > Profiles / Policies .
The Access Profiles (Per-Session Policies) screen opens.
Click the name of the access profile that you want to edit.
The properties screen opens.
On the menu bar, click Logs.
The access profile log settings display.
Move log settings between the Available and Selected lists.
You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.
Note: Logging is disabled when the Selected list is empty.
Click Update.

An access profile is in effect when it is assigned to a virtual server.