Jump to content
Welcome to our new Citrix community!

Does Workspace App include EPA?


Paul Blitz

Recommended Posts

Workspace app and Gateway VPN plugin are separate installs. If you install both on the same machine, then the Gateway systray icon is merged into Workspace app's systray icon, but you can configure a registry key or Session Policy to split them again.

 

EPA plugin is a separate download/install from Gateway VIP. It can be updated on NetScaler outside of a firmware update. 

 

I think there's a MSI installer of Gateway VPN plug-in that also includes the EPA plug-in.

Link to comment
Share on other sites

Paul - my understanding is same as Carl's - that currently the workspace app does not yet manage the gateway client (and therefore the epa agent) and otherwise "absorbs" the gateway interface the same as the Citrix Receiver did previously.  (Same separation of settings in the gateway plugin still work).  Though I haven't looked to see if the latest workspace app has changed this.

 

I guess the real question is then will the workspace app ever "absorb" the vpn client and therefore the epa client function as the true universal client or will it continue to exclude the "gateway" components...?  

Link to comment
Share on other sites

  • 1 month later...

Over at https://docs.citrix.com/en-us/citrix-workspace-app-for-windows.html, it says "Citrix Workspace app aggregates and incorporates the full capabilities of Citrix Receiver as well as other Citrix client technologies - including HDX, the Citrix Gateway plug-ins, and Citrix Endpoint Management Secure Hub".....

 

Maybe this is just the MOBILE clients?? (In which case: does this add EPA to mobile clients??)

Link to comment
Share on other sites

(I read you original question as being about windows full clients and not mobile and so I misread your original question.)

I think it depends on versions we are comparing. Late last year the Workspace (for windows full, non mobile) did not yet handle gateway functions as vpn clients/epa had to still be distributed separately...  and I don't know how it would handle the vpn client/epa client on its own as it would have to be dependent on your gateway version you have deployed).

 

But the Workspace App for Windows Mobile I would expect to handle it as it essentially replaces Secure Hub + CR as a combined solution. And Secure Hub contained the "vpn/micro vpn" stuff (and epa wasn't a windows mobile function, if I recall correctly)

 

I would love it if an engineer would explain; because i've found the admin guides equally confusing on the what happens with Workspace App (but again, I was thinking regular windows and not mobile) now vs what happens in future on this point.

Link to comment
Share on other sites

  • 4 months later...

There is a setting in the session profile that keeps the vpn plugin icon separate from the Workspace App /Citrix Receiver icon. (Previously the setting was managed as a registry key against the client endpoint).  

 

The setting is located in the session profile > Client Experience >> Advanced Settings. Your looking for the "Show vpn plugin icon with receiver" setting.

https://support.citrix.com/article/CTX208914

Article is unclear whether enabling or disabling the setting does what you want, so try both ways.

Typically, if the interface is currently merged, after you change the setting you will need to exit the vpn client/workspace app and then on second launch you should see the split.

 

Reminder:  the vpn client includes the epa client.  The Workspace App (for windows/mac) at this point does not auto include the vpn client; but if both are deployed on same system the interface merges.   (For mobile devices, the conversation is different and not really handled separately.)

Link to comment
Share on other sites

Thanks for the response Rhonda.  Let me refine my question.  We have some corporate laptops that are configured in such a way (registry keys etc) that an EPA checks and if found it establishes a VPN connection (when using a browser connection).  However what we want to do in some scenarios is that we want to the Workspace App to connect instead using ICA Proxy i.e. not VPN - however when we use the Workspace App on a laptop that also has the EPA agent installed - it somehow uses this and instead establishes a VPN connection.  Is there a way to control this behavior?

Link to comment
Share on other sites

Short answer until I can elaborate more.

Option 1: two different gatweay access points:  VPN users and ica proxy only users.

Option 2:  In addition to your epa scan you need something like group membership that would identify who gets vpn and who doesn't and apply appropriate session policies based on the ica proxy only group as well.

 

If you all users goes to 1 vpn vserver, and an epa scan that says "meets requirement, do vpn" is true.   Then any user who passes the scan will be in vpn mode; and the vpn client will be deployed if they don't have it.

 

If your epa scan says vpn is possible, but another criteria like group membership has a ica proxy only policy applied that overrides the "vpn connection" setting that the vpn policy applied, then you can still make this subset of users ICA only.

 

 

 

 

Link to comment
Share on other sites

  • 6 months later...
On 11/29/2019 at 6:12 AM, Carl Stalhood1709151912 said:

Workspace app and Gateway VPN plugin are separate installs. If you install both on the same machine, then the Gateway systray icon is merged into Workspace app's systray icon, but you can configure a registry key or Session Policy to split them again.

 

EPA plugin is a separate download/install from Gateway VIP. It can be updated on NetScaler outside of a firmware update. 

 

I think there's a MSI installer of Gateway VPN plug-in that also includes the EPA plug-in.

Can we download EPA Plugin via workspace App ? We do not see an option to download when accessing through workspace App but can see the option to download when accessing through the web. Is it supported ?could not find any article related to this .

Link to comment
Share on other sites

The EPA client and the VPN client are not distributed by or through the Citrix Workspace App/former Citrix Receiver.

Once the VPN client (and likely the standalone EPA client if needed) are installed, the vpn interface can be integrated with Workspace App or left as a standalone icon (via various gateway session profile settings).  

 

Distribution of the VPN Client or the EPA client is done by either

1) directing user to the gateway login page and the client download prompt will be provided (admin rights needed for both).

2) Or an admin will have to go through steps for distribution separate from the gateway connection.

 

The VPN client can be deployed to Win, Mac, Linux.  For full vpn connections, the Win/Mac vpn client/gateway client includes the EPA capabilities.

The VPN client for mobile devices will be through mobile stores (or possibly in this cases via the mobile workspace app...I haven't reviewed that exact combo in a while.)

The standalone EPA client  for Citrix Workspace App and or clientless connections (aka devices not using the gateway vpn client install), is only available for Full Windows and Full Mac platforms.

 

 

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...