| If end-users will be connecting to the Citrix MetaFrame Access Suite via the Internet, firewall modification might be necessary. If you will be using Secure Gateway for MetaFrame 2.0 then TCP port 443 is the only port required to be open for client to server communications on any of the firewalls in your environment. Please refer to the Secure Gateway section of this document later on in this project for more information on what port might be required to be open in a DMZ environment. If the SSL Relay service is used for ICA connections then TCP port 443 is the only port that is required to be open. If during the Design Phase you assigned someone other than yourself with the responsibility for firewall modifications then you will need to get with the appropriate party to verify the appropriate modifications are taking place. After all, it is your project and you are ultimately responsible to the complete outcome. You will also be required to document any changes made that affect the MetaFrame deployment and included them in with the complete project documentation. The following is a list of Citrix-related TCP and UDP ports that may need to be opened on firewalls and routers: | Port | Description | | TCP - 80 | Default port for unsecured Web Interface web servers and or TCP+HTTP browsing (XML port) and or Secure Gateway for MetaFrames Secure Ticket Authority (STA) unsecured port. | | TCP - 443 | Default port for Secure Gateway for Windows, SSL Relay Service, ICA connections using SSL+HTTPS browsing and secure connections to a Web Interface web server) This is the only port need to be open on an external firewall for secure connections to a MetaFrame Access Suite environment utilizing the Secure Gateway for Windows technology. | | TCP - 1494 | Default ICA port, this can be changed if necessary. This port is not necessary to be open on the external firewall if you will be utilizing Secure Gateway for Windows. | | UDP - 1604 | This port is very rarely used today and only used if you will not be utilizing Web Interface or TCP+HTTP browsing. (highly not recommended) | | TCP 2512 | Citrix Independent Management Architecture (IMA) server to server communications. This port only needs to be open on a firewall if you will be communicating from server to server across a WAN. In this case you would secure the traffic with a point to point VPN or equivalent WAN security mechanism. | | TCP 2513 | Management Console for MetaFrame XP communication to the IMA Data Store. It is recommended to publish the Management Console in a MetaFrame XP session if you will be crossing into unsecured wires. | For more information regarding commonly used TCP/IP ports numbers, please refer to the following support articles. Windows NT, Terminal Server, and Microsoft Exchange Services Use TCP/IP Ports: (Q150543) http://support.microsoft.com/default.aspx?scid=kb;en-us;150543 Information About TCP/IP Port Assignments (Q174904) http://support.microsoft.com/default.aspx?scid=kb;en-us;174904 TCP Ports and Microsoft Exchange: In-depth Discussion (Q176466) http://support.microsoft.com/default.aspx?scid=kb;EN-US;176466
|