Citrix Integration > Installing the Citrix Integration Service

Installing the Citrix Integration Service

Applies to

Web Filter v7.6

Web Security v7.6

Web Security Gateway v7.6

In this topic

Overview

Installing Web Security to integrate with Citrix

Installing the Citrix Integration Service on a Citrix Server

Configuring user access on Citrix servers

Overview

Most Websense components must be installed on a separate machine from the Citrix server. Only the Citrix Integration Service is installed on each Citrix server machine.

If you have a v7.5.x or earlier version of the Citrix Integration Service installed, you must remove it completely before deploying the version 7.6.x service. See Upgrading Citrix Integration Service to 7.6.

 

Important  Installing the v7.6.x Citrix Integration Service on a machine where the v7.5.x or earlier Citrix Integration Service is running does not upgrade or remove the old components. The services attempt to run concurrently, and filtering problems are likely to result. Please make sure you have used the Windows Add/Remove tool to uninstall the prior-version Citrix Integration Service before deploying the v7.6.x service.

If Websense will be filtering both Citrix and non-Citrix users, refer to Combining Citrix with another integration after installing the Websense Citrix Integration Service.

Installing Web Security to integrate with Citrix

The core Websense Web filtering components, including Network Agent, must be installed before you install the Websense Citrix Integration Service on your Citrix servers.

 

Note  Only the Citrix Integration Service is installed on the Citrix server. All other Websense components must reside on a separate machine.

To prepare Web Security filtering components to integrate with Citrix:

1.	When you install Filtering Service:

On the Integration Option screen, select Integrated with another application or device.

On the Select Integration screen, select Citrix.

Note that while Filtering Service cannot be installed on the Citrix server, it can be installed with other Web Security components, including Policy Broker, Policy Server, and User Service.

 

Important  Because you are integrating with Citrix, do not install Network Agent on the same machine as Filtering Service.

For detailed instructions on performing a custom installation of Web Security components, see Installing Web Security components.

2.	Perform a custom Web Security installation to install Network Agent on a separate machine from Filtering Service. The Network Agent machine must be positioned where it can view traffic from Citrix users, in order to enable filtering for protocols other than HTTP, HTTPS, and FTP.

For instructions on performing a custom installation of Web Security components, see Installing Web Security components.

Installing the Citrix Integration Service on a Citrix Server

After Filtering Service is installed in Citrix integration mode, the Citrix Integration Service must be installed on every Citrix server machine in your network that will be integrated with Websense Web Security. The Citrix Integration Service can be installed only on Windows-based Presentation Servers or XenApp.

 

Important  Make sure any v7.5.x or earlier versions of the Citrix Integration Service are uninstalled before continuing.

Installing Citrix Integration Service is a three-stage process:

1.	Installing the Citrix configuration package

2.	Customizing the Citrix installation package

3.	Installing the Citrix Integration Service

Installing the Citrix configuration package

The Citrix configuration package can be installed directly onto the Citrix server or on a separate machine. The configuration package consists of:

A self-extracting archive containing the Citrix configuration utility.

A default Citrix installation package to use as a template (consisting of an MSI file, several DLLs, and configuration files).

The configuration utility is used to customize the template installation package for your deployment.

Note that if you use the Websense installer to install the Citrix configuration package directly on the Citrix server, other Websense files and utilities that are not strictly required are also installed. If you do not want these extra files on the Citrix server, you can:

Install the Citrix configuration package on a separate machine, then use that machine to "stage" the Citrix installation package.

Copy the Citrix configuration package from the TRITON management server (or any other Windows server that includes Web filtering components).

By default, the files are located in the C:\Program Files (x86)\Websense\Web Security\CitrixPlugin directory.

The configuration utility can run on most Windows platforms, and does not have to be run on a server. Run the configuration utility on your workstation (or any convenient Windows machine) then deploy the customized Citrix installation packages to the appropriate Citrix servers. See Customizing the Citrix installation package for more information about configuring for multiple Citrix servers.

If you want to use the Websense installer to specifically install the Citrix configuration package, rather than copying the files from a machine where other Websense Web filtering components are installed:

 

Note  If you are running version 7.6.0, a Citrix Integration Service hotfix is available from mywebsense.com. 1. Log on to MyWebsense and click the Downloads tab. 2. Select Hotfixes & Patches. 3. Enter your product, and version 7.6.0. 4. Select the v7.6 Citrix Plugin hotfix to download. 5. Follow the instructions in the hotfix ReadMe file to complete the installation.

6.	Start the Websense installer, and perform a custom Web Security installation.

During installation:

On the Select Components screen, select Filtering Plug-in.

On the Select Integration screen, select Citrix.

For instructions on performing a custom installation of Web Security components, see Installing Web Security components.

7.	The Citrix configuration package is installed to C:\Program Files (x86)\Websense\Web Security\CitrixPlugin\32-bit or 64-bit, by default.

Note that there are 32- and 64-bit versions of the configuration package. Be sure to use the version appropriate for the target Citrix server's operating system. For example, if the Citrix server is running on Windows Server 2008 R2, you should use the 64-bit endpoint package.

Customizing the Citrix installation package

The Citrix configuration package is a self-extracting archive containing the Citrix configuration utility and a default Citrix installation package (consisting of an MSI file, several DLLs, and configuration files) to use as a template. The configuration utility is used to customize the installation package for your deployment.

1.	Navigate to the folder containing the appropriate configuration package (32-bit or 64-bit), then double-click the self-extracting executable and click Extract. The configuration package self-extracting executables are:

WCISUtil_Win32_nnnn.exe (32-bit)

WCISUtil_x64_nnnn.exe (64-bit)

2.	To launch the configuration utility, double-click Websense Citrix Integration Service Configuration.exe.

 

Important  Both the 32- and 64-bit versions of the configuration utility have the same name. Make sure you are in the correct folder.

3.	On the Profile Source screen, click Browse, then navigate to the folder containing the Citrix installation package.

The template package is located in the C:\Program Files (x86)\Websense\Web Security\CitrixPlugin\32-bit or 64-bit folder.

4.	Click Next.

If an error message alerts you that "The selected installation package does not include all of the necessary files," make sure that all files from the extracted Citrix configuration package are present in the specified directory.

A complete list of files is provided at the start of the next section, Installing the Citrix Integration Service.

5.	On the Connections screen, specify all Filtering Service instances the Citrix server should use for Web filtering, then click Next.

a.	If 127.0.0.1:15868 appears (as shown above), select the entry and click Remove.

This should not be used because Filtering Service should never be installed on the Citrix server machine.

b.	Add the IP address and port (15868, by default) for each Filtering Service you want the Citrix Server to use, then click the right arrow key to add it to the selected list.

 

Note  The port Filtering Service uses to communicate with integration products and Network Agent must be in the range 1024-65535. To determine which port Filtering Service is using, check the eimserver.ini file—located in C:\Program Files\Websense\Web Security\bin (Windows) or /opt/Websense/bin (Linux)—on the Filtering Service machine. Look for the WebsenseServerPort value. Important: Do not modify the eimserver.ini file.

Multiple Filtering Service instances might be specified in case one instance is down. If the first Filtering Service is not available, the Citrix Integration Service attempts to contact the next instance in the list.

 

Note  Each Filtering Service instance tracks continue, quota, and password override information independently. If the Citrix Integration Service fails over from one Filtering Service instance to another, usage quotas may be different and override passwords may need to be entered again.

If no Filtering Service instance responds, the Citrix Integration Service continues to attempt communication every 1 minute. Until communication is established, the Citrix Integration Service either permits all requests (fails open) or blocks all requests (fails closed), depending on your configuration. See Step d.

c.	If you do not want user names (when available) to be sent to Filtering Service for use in filtering and logging, select Do not send user name information to Filtering Service. This selection applies to all Filtering Service instances listed.

d.	If you want the Citrix Integration Service to fail closed when it cannot contact Filtering Service, select Block all HTTP/HTTPS/FTP traffic if unable to connect to a Filtering Service.

6.	On the Client Settings screen, configure user notification and anti-tampering controls, as described below, then click Next.

Notify users when HTTPS or FTP traffic is blocked: When this option is enabled, users see a pop-up message when HTTPS or FTP traffic is blocked. If you enable this option, specify how long the pop-up message should stay visible to the user.

Protect installation directory from modification or deletion: This option prevents tampering with the Citrix Integration Service on the Citrix server. Attempts to delete it, replace files, or modify registry entries are not allowed.

7.	On the Trusted Sites screen, specify any URLs or domains that should not be filtered, then click Next.

a.	Click Add.

b.	In the dialog box that appears, enter a URL or a regular expression specifying a set of URLs. Any regular expression adhering to ISO/IEC TR 19768 (within the character-number limit) is valid.

c.

Click OK.

To edit a URL or regular expression, select it and then click Edit.

To remove a URL or regular expression, select it and then click Remove.

Note that the URLs you specify here are trusted by the particular Citrix server on which this Citrix Integration Service will be installed. It has no bearing on how Filtering Service instances filter requests from non-Citrix users and other Citrix servers not using the same Citrix Integration Service configuration.

8.	On the Save screen, specify how you want the customized installation package saved, then click Finish.

Overwrite the existing installation: Select this option to overwrite the Citrix installation package you used as a template. This is the package residing in the folder you selected in Step 3.

Save the customized installation package to a new location: Select this option to save the customized installation package to a different location. Click Browse, and select the folder to which you want to save (note that the folder must already exist; if not, use a Windows file explorer to create the folder). The package you used as a template remains unchanged (unless you choose to save to the same folder). It is a best practice to save to an empty folder. Then, you can be certain that all files in that folder are part of the installation package.

The Citrix installation package is now ready for use to install Citrix Integration Service.

If you have multiple Citrix servers for which you want different customized settings, repeat this procedure, starting at Step 2, to create an installation package for each. Save each customized installation package to different folders.

Installing the Citrix Integration Service

A Citrix installation package consists of the following files:

0x0409.ini

CI.cab

CIClientConfig.hsw

CIClientMessage.hsw

setup.exe

Setup.ini

Websense Citrix Integration Service.msi

WEP.cab

 

Note  If you want to use the same Citrix Integration Service configuration on multiple Citrix servers, use the same Citrix installation package for all of them.

To install the Citrix Integration Service.

1.	Log on with local administrator privileges to the machine running Citrix Presentation Server, MetaFrame Presentation Server, or XenApp.

2.	Close all applications and stop any antivirus software.

3.	Copy the Citrix installation package (all files listed above) to the Citrix server. Keep the files in the same folder.

If you installed the Citrix endpoint package to the Citrix server itself, and customized the installation package there, skip this step.

4.	Double-click setup.exe to start the Citrix Integration Service installer. When the installer starts, click Next.

5.	on the Subscription Agreement screen, click I accept the terms in the subscription agreement, then click Next.

6.	On the Destination Folder screen, accept the default location shown or click Change to select a different location, then click Next.

7.	On the Ready to Install the Program screen, click Install to install the Citrix Integration Service.

8.	Wait until the InstallShield Wizard Completed screen appears, then click Finish.

9.	If you stopped your antivirus software, be sure to start it again.

Citrix Integration > Installing the Citrix Integration Service