MCP on Citrix PVS servers

[Former Member]

Hi, 

We have a request from a customer wanting us to filter traffic for Citrix users (connecting to our internal citrix servers) that serve the users with diffrent types of appliaction .

We have around 14 citrix (also called PVS OS VDA in citrix world) servers that serve the customer  with citrix session connections..

The customer have aprox 1500 citrix users connecting to a citrix desktop. When the session is estabilished they are then connected to one of our 14 citrix servers that maintain the citrix session.. .

We have 2 mwg's clustered that are beeing used currently by local workstations Win7/Win10 (with MCP). 

Citrix servers are of Windows server 2012/2016 and we can fully install McAfee agent/MCP on them. 

We have even tested this for a group of pilot - and the MCP is running successfully. The MCP seems to intercept all http/https traffic on the  citrix server since every user is browsing through that specific server.. 

My thinking is to deploy McP on all 14 servers (in stage) with specifik MCP bypass exclusions just for these servers. But we have never done this and dont know the outcome on how this might work once in production.. 

Do you have any experiance of this? 

Should we go on and use MCP with same/diffrent port or should we use DirectProx/ProxyPac for this matter? 

Regards. 

[jebeling]

Either PAC file or MCP should work in an explicit proxy environment. In a transparent proxy environment (no browser setting or PAC file) authentication without MCP on Citrix would need to use cookie auth instead of Session/IP. MCP would seem to be the best approach, but I personnally have no experience, or knowledge of implementations using that method to handle your Citrix use case.