OPSWAT Packet flow and
Troubleshooting:-
Netscaler 10.5 we have noticed the
new feature of OPSWAT Editor. It's just like the same EPA we have earlier but
with some extra features from 3rd Party OPSWAT.
Before you begin make sure your
client machine has the Root CA of the AGEE vserver under Trusted Root CA
certificate on your machine else it will fail in the initial check itself
To configure OPSWAT just go to the
OPSWAT editor and give the expression you like
Here I am testing for some
expression as below
First expression is checking if
Internet Explorer is running or My system domain belongs to
"WrongDomain" or My mozilla firefox browser should be my default
browser and must be above version 30.0.
CLIENT.APPLICATION('BROWSER_60000_RUNNING_==_TRUE[COMMENT:
Internet Explorer]') EXISTS ||
CLIENT.SYSTEM('DOMAIN_SUFFIX_anyof_WrongDomain[COMMENT: Domain check]') EXISTS
|| CLIENT.APPLICATION('BROWSER_61000_VERSION_>_30.0_DEFAULT_==_TRUE[COMMENT:
Mozilla Firefox]') EXISTS
The configuration part is pretty
simple in the OPSWAT as you can see it's easy to understand. As I did for my
Mozilla firefox check
Now it's time to Test this.
In my system from which I am
trying it has Internet explorer running, Mozilla firefox is default browser and
is of version 32.0 but my domain is not "wrongDomain" this I did
intentionally so this check should fail. But overall it should pass since my
expressions has 3 expressions and if any one of them match then Netscaler will
allow me to access.
Go to my AGEE Page and it prompted
for the EPA plugin scan , I clicked YES
After this I got prompted for the
AGEE credentials which means my scan is successful
Let's see the reason why, So that
you can troubleshoot yours.
Before Reproducing the issue make
sure you do the following things
1.
Disable SSL session
reuse from the AGEE vserver otherwise you won't be able to decrypt the trace.
You can enable it afterwards
2.
Make the following
changes in your client Registry for the OPSWAT log collection( it won't harm in
anyway)
HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Secure
Access Client
Make a
DWORD value with "EnableEPALogging" and set the value to 1
3.
Now start the trace on
Netscaler and reproduce the problem
4.
After that go to
command prompt run as administrator and go to
C:\Program
Files\Citrix\Secure Access Client
And run
the command
nsClientCollect.exe
<path where you want to save the outputfile\<filename.zip>
So the Logs are collected.
Analyzing the Logs:-
Wireshark:-
The Typical Packet Flow look like
this
·
You send a GET / to
the AGEE
·
Get redirected to 302
for the epa.html page
·
Next Get is for
epa.html page followed by a 200 OK
·
Then client send the
GET/ epatype for which the Netscaler replies with the type of epa being
performed. In my case it's just epa and no device cert hence that is off
·
Then comes the major
packet called GET/epaq where client request for the type of scan to be
performed
As you can see in the below highlighted that the NS replied with the scans to
be performed
First check is for Mozilla browser
version should be above 30.0 and should be default
Second is my domain should be
"Wrong Domain"
Third my browser must be running
Internet explorer
Before running these scans the
client check with netscaler about the OPSWAT library version. If it matches
then it continues otherwise it will download the new version from Netscaler. In
our case it same so no downloads
In the Next request the Netscaler
sends back it's epa scan result. Always 0 means successful and non zero means there is a failure
In my scenario
First check is for Mozilla browser
version should be above 30.0 and should be default----- Passed so value 0
Second is my domain should be
"Wrong Domain"--- Failed since I don't belong to this doman value 3
Third my browser must be running
Internet explorer----- Passed since my Internet explorer is running, Value 0
So I got the CSEC header value as
030 as you can notice below
Since in my Netscaler the
condition is to allow if any one of them matches hence I got a 200 OK with
value 10
For e.g. In case of failure scenario
the expression will fail and you will see following in the response as 00.
So getting a 10 is our main
concern and avoiding 00
Client Logs Analysis:-
When you will extract the Output
file you will notice the following files. Out of which highlighted are our
concern ( if you don't see epaHelper_epa_plugin file then that means you forgot
to enable Registry value as mentioned above or it's wrongly given)
In epaHelper_epa_plugin file you
can see all your result
Adv. EPA Scan log file
Date: 09/18/2014
Time: 23:42:22
=========================
23:42:22.500 Successfully parsed
tokens
23:42:23.125 Oesis framework init
SUCCESS
23:42:23.268 Version value 32.0.1
, expected 30.0
23:42:27.127 Scan Passed ( So
Mozilla firefox scan passed, since my version is 32.0 which is above 30.0)
23:42:27.127 Successfully parsed
tokens
23:42:27.127 Domain is lab.net
23:42:27.127 Scan failed for Scan
method SUFFIX ( Here its failed since my domain is lab.net but I Netscaler
tried to search for Wrong Domain)
scanQuery :
DOMAIN_SUFFIX_anyof_WrongDomain
23:42:27.127 Successfully parsed
tokens
23:42:27.200 Scan Passed
If you need more detailed analysis
then you can go for nsepa logs which will give you the same information as I
told you in wireshark. Most important is to check the CSEC value as you can see
it's 030 here.
23:42:27.201
<GET epas HTTP/1.1
Cookie:
NSC_EPAC=********************************
CSEC: 030
post body information is hidden
>
23:42:27.217 FQDN of the server is
agee.com
23:42:27.217 downloaded total 118
bytes
23:42:27.217 ns_HTTPrequest return
value is: 118
23:42:27.217 Received headers size
80
23:42:27.217 ns_start_epa
returning passed
Important Notes as of
10.5 build:-
·
In device cert check
is present then there will be one extra value EPA type ON and Device Cert ON
·
Except for Device Cert
auth , Epa package upgrade or running doesn't need admin right.
In OPSWAT scan,EPA plugin will check what version is there on Netscaler, If
Netscaler version is above then the installed on client then it will ask
for new library
with
GET /epapackage and will install the new epaPackage
·
To check the OPSWAT
EPA library you can got to following director of Netscaler and check the
version.xml file
/netscaler/ns_gui/epa
root@NG10#
more version.xml
<?xml
version="1.0" encoding="UTF-8"?>
<Windows>
<EPALib>1.1.1.8</EPALib>
</Windows>
root@NG10#
·
In mac the client logs
are situated at Library/Appliation support/citrix/epa plugin/epaplugin.log (
You don't have to run any command to collect logs)
·
Netscaler at present
has a limit of 1499 characters for expressions including all the fields of the
expression from starting till end
In case
you have a requirement then to overcome this by creating new policies
·
CSEC value limit is
25K of buffer. So if the scan CSEC value took more than 25K of buffer normally
in mac address scan then scan will fail
·
To upgrade the OPSWAT build no need of Netscaler
upgrade is required.
