netscaler.adc.vpnsessionaction module – Configuration for VPN session action resource.

Note

This module is part of the netscaler.adc collection (version 2.6.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install netscaler.adc.

To use it in a playbook, specify: netscaler.adc.vpnsessionaction.

New in netscaler.adc 2.0.0

Synopsis

  • Configuration for VPN session action resource.

Parameters

Parameter

Comments

advancedclientlessvpnmode

any

Option to enable/disable Advanced ClientlessVpnMode. Additionaly, it can be set to STRICT to block Classic ClientlessVpnMode while in AdvancedClientlessMode.

Choices:

  • "ENABLED"

  • "DISABLED"

  • "STRICT"

allowedlogingroups

any

Specify groups that have permission to log on to Citrix Gateway. Users who do not belong to this group or groups are denied access even if they have valid credentials.

allprotocolproxy

any

IP address of the proxy server to use for all protocols supported by Citrix Gateway.

alwaysonprofilename

any

Name of the AlwaysON profile associated with the session action. The builtin profile named none can be used to explicitly disable AlwaysON for the session action.

api_path

string

Base NITRO API path.

Define only in case of an ADM service proxy call

Default: "nitro/v1/config"

authorizationgroup

any

Comma-separated list of groups in which the user is placed when none of the groups that the user is a part of is configured on Citrix Gateway. The authorization policy can be bound to these groups to control access to the resources.

autoproxyurl

any

URL to auto proxy config file

citrixreceiverhome

any

Web address for the Citrix Receiver home page. Configure Citrix Gateway so that when users log on to the appliance, the Citrix Gateway Plug-in opens a web browser that allows single sign-on to the Citrix Receiver home page.

clientchoices

any

Provide users with multiple logon options. With client choices, users have the option of logging on by using the Citrix Gateway Plug-in for Windows, Citrix Gateway Plug-in for Java, the Web Interface, or clientless access from one location. Depending on how Citrix Gateway is configured, users are presented with up to three icons for logon choices. The most common are the Citrix Gateway Plug-in for Windows, Web Interface, and clientless access.

Choices:

  • "ON"

  • "OFF"

clientcleanupprompt

any

Prompt for client-side cache clean-up when a client-initiated session closes.

Choices:

  • "ON"

  • "OFF"

clientconfiguration

any

Allow users to change client Debug logging level in Configuration tab of the Citrix Gateway Plug-in for Windows.

Choices:

  • "none"

  • "trace"

clientdebug

any

Set the trace level on Citrix Gateway. Technical support technicians use these debug logs for in-depth debugging and troubleshooting purposes. Available settings function as follows:

* DEBUG - Detailed debug messages are collected and written into the specified file.

* STATS - Application audit level error messages and debug statistic counters are written into the specified file.

* EVENTS - Application audit-level error messages are written into the specified file.

* OFF - Only critical events are logged into the Windows Application Log.

Choices:

  • "debug"

  • "stats"

  • "events"

  • "OFF"

clientidletimeout

any

Time, in minutes, after which to time out the user session if Citrix Gateway does not detect mouse or keyboard activity.

clientlessmodeurlencoding

any

When clientless access is enabled, you can choose to encode the addresses of internal web applications or to leave the address as clear text. Available settings function as follows:

* OPAQUE - Use standard encoding mechanisms to make the domain and protocol part of the resource unclear to users.

* CLEAR - Do not encode the web address and make it visible to users.

* ENCRYPT - Allow the domain and protocol to be encrypted using a session key. When the web address is encrypted, the URL is different for each user session for the same web resource. If users bookmark the encoded web address, save it in the web browser and then log off, they cannot connect to the web address when they log on and use the bookmark. If users save the encrypted bookmark in the Access Interface during their session, the bookmark works each time the user logs on.

Choices:

  • "TRANSPARENT"

  • "OPAQUE"

  • "ENCRYPT"

clientlesspersistentcookie

any

State of persistent cookies in clientless access mode. Persistent cookies are required for accessing certain features of SharePoint, such as opening and editing Microsoft Word, Excel, and PowerPoint documents hosted on the SharePoint server. A persistent cookie remains on the user device and is sent with each HTTP request. Citrix Gateway encrypts the persistent cookie before sending it to the plug-in on the user device, and refreshes the cookie periodically as long as the session exists. The cookie becomes stale if the session ends. Available settings function as follows:

* ALLOW - Enable persistent cookies. Users can open and edit Microsoft documents stored in SharePoint.

* DENY - Disable persistent cookies. Users cannot open and edit Microsoft documents stored in SharePoint.

* PROMPT - Prompt users to allow or deny persistent cookies during the session. Persistent cookies are not required for clientless access if users do not connect to SharePoint.

Choices:

  • "ALLOW"

  • "DENY"

  • "PROMPT"

clientlessvpnmode

any

Enable clientless access for web, XenApp or XenDesktop, and FileShare resources without installing the Citrix Gateway Plug-in. Available settings function as follows:

* ON - Allow only clientless access.

* OFF - Allow clientless access after users log on with the Citrix Gateway Plug-in.

* DISABLED - Do not allow clientless access.

Choices:

  • "ON"

  • "OFF"

  • "DISABLED"

clientoptions

any

Display only the configured menu options when you select the “Configure Citrix Gateway” option in the Citrix Gateway Plug-in system tray icon for Windows.

Choices:

  • "none"

  • "all"

  • "services"

  • "filetransfer"

  • "configuration"

clientsecurity

any

Specify the client security check for the user device to permit a Citrix Gateway session. The web address or IP address is not included in the expression for the client security check.

clientsecuritygroup

any

The client security group that will be assigned on failure of the client security check. Users can in general be organized into Groups. In this case, the Client Security Group may have a more restrictive security policy.

clientsecuritylog

any

Set the logging of client security checks.

Choices:

  • "ON"

  • "OFF"

clientsecuritymessage

any

The client security message that will be displayed on failure of the client security check.

defaultauthorizationaction

any

Specify the network resources that users have access to when they log on to the internal network. The default setting for authorization is to deny access to all network resources. Citrix recommends using the default global setting and then creating authorization policies to define the network resources users can access. If you set the default authorization policy to DENY, you must explicitly authorize access to any network resource, which improves security.

Choices:

  • "ALLOW"

  • "DENY"

dnsvservername

any

Name of the DNS virtual server for the user session.

emailhome

any

Web address for the web-based email, such as Outlook Web Access.

epaclienttype

string

Choose between two types of End point Windows Client

  1. Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed

  2. Activex Control - ActiveX control run by Microsoft Internet Explorer.

Choices:

  • "AGENT"

  • "PLUGIN"

forcecleanup

any

Force cache clean-up when the user closes a session. You can specify all, none, or any combination of the client-side items.

Choices:

  • "none"

  • "all"

  • "cookie"

  • "addressbar"

  • "plugin"

  • "filesystemapplication"

  • "application"

  • "applicationdata"

  • "clientcertificate"

  • "autocomplete"

  • "cache"

forcedtimeout

any

Force a disconnection from the Citrix Gateway Plug-in with Citrix Gateway after a specified number of minutes. If the session closes, the user must log on again.

forcedtimeoutwarning

any

Number of minutes to warn a user before the user session is disconnected.

fqdnspoofedip

any

Spoofed IP address range that can be used by client for FQDN based split tunneling

ftpproxy

any

IP address of the proxy server to be used for FTP access for all subsequent connections to the internal network.

gopherproxy

any

IP address of the proxy server to be used for GOPHER access for all subsequent connections to the internal network.

homepage

any

Web address of the home page that appears when users log on. Otherwise, users receive the default home page for Citrix Gateway, which is the Access Interface.

httpport

any

Destination port numbers other than port 80, added as a comma-separated list. Traffic to these ports is processed as HTTP traffic, which allows functionality, such as HTTP authorization and single sign-on to a web application to work.

httpproxy

any

IP address of the proxy server to be used for HTTP access for all subsequent connections to the internal network.

icaproxy

any

Enable ICA proxy to configure secure Internet access to servers running Citrix XenApp or XenDesktop by using Citrix Receiver instead of the Citrix Gateway Plug-in.

Choices:

  • "ON"

  • "OFF"

iconwithreceiver

any

Option to decide whether to show plugin icon along with receiver

Choices:

  • "ON"

  • "OFF"

iipdnssuffix

any

An intranet IP DNS suffix. When a user logs on to Citrix Gateway and is assigned an IP address, a DNS record for the user name and IP address combination is added to the Citrix Gateway DNS cache. You can configure a DNS suffix to append to the user name when the DNS record is added to the cache. You can reach to the host from where the user is logged on by using the user’s name, which can be easier to remember than an IP address. When the user logs off from Citrix Gateway, the record is removed from the DNS cache.

kcdaccount

any

The kcd account details to be used in SSO

killconnections

any

Specify whether the Citrix Gateway Plug-in should disconnect all preexisting connections, such as the connections existing before the user logged on to Citrix Gateway, and prevent new incoming connections on the Citrix Gateway Plug-in for Windows and MAC when the user is connected to Citrix Gateway and split tunneling is disabled.

Choices:

  • "ON"

  • "OFF"

linuxpluginupgrade

any

Option to set plugin upgrade behaviour for Linux

Choices:

  • "Always"

  • "Essential"

  • "Never"

locallanaccess

any

Set local LAN access. If split tunneling is OFF, and you set local LAN access to ON, the local client can route traffic to its local interface. When the local area network switch is specified, this combination of switches is useful. The client can allow local LAN access to devices that commonly have non-routable addresses, such as local printers or local file servers.

Choices:

  • "ON"

  • "OFF"

  • "FORCED"

loginscript

any

Path to the logon script that is run when a session is established. Separate multiple scripts by using comma. A “$” in the path signifies that the word following the “$” is an environment variable.

logoutscript

any

Path to the logout script. Separate multiple scripts by using comma. A “$” in the path signifies that the word following the “$” is an environment variable.

macpluginupgrade

any

Option to set plugin upgrade behaviour for Mac

Choices:

  • "Always"

  • "Essential"

  • "Never"

managed_netscaler_instance_id

string

added in netscaler.adc 2.6.0

The ID of the managed NetScaler instance to which NetScaler Console

has to configure as a proxy server.

Define only in case of an ADM service proxy call

managed_netscaler_instance_ip

string

added in netscaler.adc 2.6.0

The IP of the managed NetScaler instance to which NetScaler Console

has to configure as a proxy server.

Define only in case of an ADM service proxy call

managed_netscaler_instance_name

string

added in netscaler.adc 2.6.0

The name of the managed NetScaler instance to which NetScaler Console

has to configure as a proxy server.

Define only in case of an ADM service proxy call

managed_netscaler_instance_password

string

added in netscaler.adc 2.6.0

The password of the managed NetScaler instance.

Define only in case of an ADM service proxy call

In Settings > Administration > System Configurations > Basic Settings,

if you select Prompt Credentials for Instance Login,

ensure to configure username and password of a managed instance.

managed_netscaler_instance_username

string

added in netscaler.adc 2.6.0

The username of the managed NetScaler instance.

Define only in case of an ADM service proxy call

In Settings > Administration > System Configurations > Basic Settings,

if you select Prompt Credentials for Instance Login,

ensure to configure username and password of a managed instance.

name

any

Name for the Citrix Gateway profile (action). Must begin with an ASCII alphabetic or underscore (_) character, and must consist only of ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the profile is created.

The following requirement applies only to the Citrix ADC CLI:

If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “my action” or ‘my action’).

netmask

any

The netmask for the spoofed ip address

netscaler_console_as_proxy_server

boolean

added in netscaler.adc 2.6.0

The IP address of the NetScaler ADC appliance acting as a proxy server.

Define only in case of an ADM service proxy call

Choices:

  • false ← (default)

  • true

nitro_auth_token

string

The authentication token provided by a login operation.

nitro_pass

string

The password with which to authenticate to the NetScaler ADC node.

nitro_protocol

string

Which protocol to use when accessing the nitro API objects.

Choices:

  • "http"

  • "https" ← (default)

nitro_user

string

The username with which to authenticate to the NetScaler ADC node.

nsip

string / required

The ip address of the NetScaler ADC appliance where the nitro API calls will be made.

The port can be specified with the colon (:). E.g. 192.168.1.1:555.

ntdomain

any

Single sign-on domain to use for single sign-on to applications in the internal network. This setting can be overwritten by the domain that users specify at the time of logon or by the domain that the authentication server returns.

pcoipprofilename

any

Name of the PCOIP profile associated with the session action. The builtin profile named none can be used to explicitly disable PCOIP for the session action.

proxy

any

Set options to apply proxy for accessing the internal resources. Available settings function as follows:

* BROWSER - Proxy settings are configured only in Internet Explorer and Firefox browsers.

* NS - Proxy settings are configured on the Citrix ADC.

* OFF - Proxy settings are not configured.

Choices:

  • "BROWSER"

  • "NS"

  • "OFF"

proxyexception

any

Proxy exception string that will be configured in the browser for bypassing the previously configured proxies. Allowed only if proxy type is Browser.

proxylocalbypass

any

Bypass proxy server for local addresses option in Internet Explorer and Firefox proxy server settings.

Choices:

  • "ENABLED"

  • "DISABLED"

rdpclientprofilename

any

Name of the RDP profile associated with the vserver.

rfc1918

any

As defined in the local area network, allow only the following local area network addresses to bypass the VPN tunnel when the local LAN access feature is enabled:

* 10.*.*.*,

* 172.16.*.*,

* 192.168.*.*

Choices:

  • "ON"

  • "OFF"

save_config

boolean

If true the module will save the configuration on the NetScaler ADC node if it makes any changes.

The module will not save the configuration on the NetScaler ADC node if it made no changes.

Choices:

  • false ← (default)

  • true

securebrowse

any

Allow users to connect through Citrix Gateway to network resources from iOS and Android mobile devices with Citrix Receiver. Users do not need to establish a full VPN tunnel to access resources in the secure network.

Choices:

  • "ENABLED"

  • "DISABLED"

sesstimeout

any

Number of minutes after which the session times out.

sfgatewayauthtype

any

The authentication type configured for the Citrix Gateway on StoreFront.

Choices:

  • "domain"

  • "RSA"

  • "domainAndRSA"

  • "SMS"

  • "smartCard"

  • "sfAuth"

  • "sfAuthAndRSA"

smartgroup

any

This is the default group that is chosen when the authentication succeeds in addition to extracted groups.

socksproxy

any

IP address of the proxy server to be used for SOCKS access for all subsequent connections to the internal network.

splitdns

any

Route the DNS requests to the local DNS server configured on the user device, or Citrix Gateway (remote), or both.

Choices:

  • "LOCAL"

  • "REMOTE"

  • "BOTH"

splittunnel

any

Send, through the tunnel, traffic only for intranet applications that are defined in Citrix Gateway. Route all other traffic directly to the Internet. The OFF setting routes all traffic through Citrix Gateway. With the REVERSE setting, intranet applications define the network traffic that is not intercepted. All network traffic directed to internal IP addresses bypasses the VPN tunnel, while other traffic goes through Citrix Gateway. Reverse split tunneling can be used to log all non-local LAN traffic. For example, if users have a home network and are logged on through the Citrix Gateway Plug-in, network traffic destined to a printer or another device within the home network is not intercepted.

Choices:

  • "ON"

  • "OFF"

  • "REVERSE"

spoofiip

any

IP address that the intranet application uses to route the connection through the virtual adapter.

Choices:

  • "ON"

  • "OFF"

sslproxy

any

IP address of the proxy server to be used for SSL access for all subsequent connections to the internal network.

sso

any

Set single sign-on (SSO) for the session. When the user accesses a server, the user’s logon credentials are passed to the server for authentication.

NOTE : This configuration does not honor the following authentication types for security reason. BASIC, DIGEST, and NTLM (without Negotiate NTLM2 Key or Negotiate Sign Flag). Use VPN TrafficAction to configure SSO for these authentication types.

Choices:

  • "ON"

  • "OFF"

ssocredential

any

Specify whether to use the primary or secondary authentication credentials for single sign-on to the server.

Choices:

  • "PRIMARY"

  • "SECONDARY"

state

string

The state of the resource being configured by the module on the NetScaler ADC node.

When present, the resource will be added/updated configured according to the module’s parameters.

When absent, the resource will be deleted from the NetScaler ADC node.

When unset, the resource will be unset on the NetScaler ADC node.

Choices:

  • "present" ← (default)

  • "absent"

  • "unset"

storefronturl

any

Web address for StoreFront to be used in this session for enumeration of resources from XenApp or XenDesktop.

transparentinterception

any

Allow access to network resources by using a single IP address and subnet mask or a range of IP addresses. The OFF setting sets the mode to proxy, in which you configure destination and source IP addresses and port numbers. If you are using the Citrix Gateway Plug-in for Windows, set this parameter to ON, in which the mode is set to transparent. If you are using the Citrix Gateway Plug-in for Java, set this parameter to OFF.

Choices:

  • "ON"

  • "OFF"

useiip

any

Define IP address pool options. Available settings function as follows:

* SPILLOVER - When an address pool is configured and the mapped IP is used as an intranet IP address, the mapped IP address is used when an intranet IP address cannot be assigned.

* NOSPILLOVER - When intranet IP addresses are enabled and the mapped IP address is not used, the Transfer Login page appears for users who have used all available intranet IP addresses.

* OFF - Address pool is not configured.

Choices:

  • "NOSPILLOVER"

  • "SPILLOVER"

  • "OFF"

usemip

any

Enable or disable the use of a unique IP address alias, or a mapped IP address, as the client IP address for each client session. Allow Citrix Gateway to use the mapped IP address as an intranet IP address when all other IP addresses are not available.

When IP pooling is configured and the mapped IP is used as an intranet IP address, the mapped IP address is used when an intranet IP address cannot be assigned.

Choices:

  • "NS"

  • "OFF"

useraccounting

any

The name of the radiusPolicy to use for RADIUS user accounting info on the session.

validate_certs

boolean

If false, SSL certificates will not be validated. This should only be used on personally controlled sites using self-signed certificates.

Choices:

  • false

  • true ← (default)

wihome

any

Web address of the Web Interface server, such as http://<ipAddress>/Citrix/XenApp, or Receiver for Web, which enumerates the virtualized resources, such as XenApp, XenDesktop, and cloud applications. This web address is used as the home page in ICA proxy mode.

If Client Choices is ON, you must configure this setting. Because the user can choose between FullClient and ICAProxy, the user may see a different home page. An Internet web site may appear if the user gets the FullClient option, or a Web Interface site if the user gets the ICAProxy option. If the setting is not configured, the XenApp option does not appear as a client choice.

wihomeaddresstype

string

Type of the wihome address(IPV4/V6)

Choices:

  • "IPV4"

  • "IPV6"

windowsautologon

any

Enable or disable the Windows Auto Logon for the session. If a VPN session is established after this setting is enabled, the user is automatically logged on by using Windows credentials after the system is restarted.

Choices:

  • "ON"

  • "OFF"

windowsclienttype

string

Choose between two types of Windows Client\

  1. Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed\

  2. Activex Control - ActiveX control run by Microsoft Internet Explorer.

Choices:

  • "AGENT"

  • "PLUGIN"

windowspluginupgrade

any

Option to set plugin upgrade behaviour for Win

Choices:

  • "Always"

  • "Essential"

  • "Never"

winsip

any

WINS server IP address to add to Citrix Gateway for name resolution.

wiportalmode

any

Layout on the Access Interface. The COMPACT value indicates the use of small icons.

Choices:

  • "NORMAL"

  • "COMPACT"

Notes

Note

Examples

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

changed

boolean

Indicates if any change is made by the module

Returned: always

Sample: true

diff

dictionary

Dictionary of before and after changes

Returned: always

Sample: {"after": {"key2": "pqr"}, "before": {"key1": "xyz"}, "prepared": "changes done"}

diff_list

list / elements=string

List of differences between the actual configured object and the configuration specified in the module

Returned: when changed

Sample: ["Attribute `key1` differs. Desired: (<class 'str'>) XYZ. Existing: (<class 'str'>) PQR"]

failed

boolean

Indicates if the module failed or not

Returned: always

Sample: false

loglines

list / elements=string

list of logged messages by the module

Returned: always

Sample: ["message 1", "message 2"]

Authors

  • Sumanth Lingappa (@sumanth-lingappa)