Using an Access Policy Manager^® (APM^®) RDP type remote desktop, clients can access a server that runs Microsoft Remote Desktop Services. Microsoft Remote Desktop servers run the Microsoft Remote Desktop Protocol (RDP) server. RDP is a protocol that provides a graphical interface to another computer on a network.

To provide Microsoft RDP connections natively, APM provides these alternatives.

Java Client

APM provides a Java Client option in the remote desktop configuration. The option supports native connections for Windows, Mac, and Linux clients. When this option is selected, a user on any compatible platform is presented with a simple Java Client interface to the Microsoft RDP server with reduced visual display features.

APM as a gateway for RDP clients

With proper BIG-IP^® system configuration, Microsoft RDP clients can use APM as a gateway. The configuration supports Microsoft RDP clients on Windows, Mac, iOS, and Android. When a user types the address or hostname of the gateway into an RDP client and specifies a particularly configured virtual server for it, APM authorizes the client. When the client requests connections to resources on backend servers, APM authorizes the access.

For support information, refer to BIG-IP APM Client Compatibility Matrix on AskF5™ at http://support.f5.com/.

Citrix^® remote desktops are supported by Citrix XenApp™ and ICA clients. With Access Policy Manager^® you can configure clients to access servers using Citrix terminal services. You provide a location from which a client can download and install a Citrix client for a Citrix ICA connection.

1. On the Main tab, click Access > Access Control Lists .
   The User-defined ACLs screen opens.
2. Click Create.
   The New ACL screen opens.
3. In the Name field, type a name for the access control list.
4. From the Type list, retain the default value Static.
5. Optional: In the Description field, add a description of the access control list.
6. Optional: From the ACL Order list, select Last to add the ACL at the last position in the list.
7. Click the Create button.
   The ACL Properties screen displays.
8. In the Access Control Entries area, click Add to add an entry.
   The New Access Control Entry screen displays.
9. From the Type list, select L4.
10. For the Source IP Address, Source Port(s), Destination IP Address, and Destination Port(s) fields, retain the default value Any.
11. From the Action list, select Reject.
    The reject action drops the packet. On TCP flows, it also sends a TCP RST message. On UDP flows, it also sends proper ICMP messages. On other protocols, it drops the packet silently.
12. Click Finished.

1. On the Main tab, click Access > Connectivity / VPN > VDI / RDP > Remote Desktops .
   The Remote Desktops screen opens.
2. Click Create.
   The New Resource screen opens.
3. In the Name field, type a name for this desktop resource.
4. From the Type list, select Citrix.
5. In the Description field, type a description for the new resource.
6. For the Destination setting, specify an IP address as your destination, and accept or change the Port.
7. For the Server Side SSL setting, select the check box to provide SSL functionality between the BIG-IP system and the resource server.
   If this option is selected, the system changes the port number from 80 to 443.
8. For the Auto Launch option, select whether to enable auto launch for Citrix.
   If you select Enable, the first application runs automatically.
9. In the Custom Parameters field, type one or more lines to specify custom settings.
   These parameters affect the rendering of certain features for Citrix. A line should contain a section name enclosed in brackets ([ ]) or a name-value pair separated by an equal (=) sign.
10. For the Enable SSO setting, select whether to enable single sign-on to the server.
11. Click Finished.

1. On the Main tab, click Access > Connectivity / VPN > VDI / RDP > Remote Desktops .
   The Remote Desktops screen opens.
2. Click Create.
   The New Resource screen opens.
3. In the Name field, type a name for this desktop resource.
4. From the Type list, select RDP.
5. In the Description field, type a description for the new resource.
6. For the Server Type, select Remote Desktop Session Host.
7. For the Client Type, select the client type as either Native, Java, or ActiveX.
8. For the Destination setting, specify an IP address as your destination, and accept or change the Port.
9. In the Custom Parameters field, type one or more lines to specify custom settings.
   These parameters affect the rendering of certain features for RDP. For Microsoft RDP, a line should inclue a name, type, and a value, with a colon as a separator, shown in the examples below:

   • screen mode id:i:1
   • use multimon:i:0
   • desktopwidth:i:1440
   • desktopheight:i:900
   • session bpp:i:32
10. For Enable SSO, select whether to enable single sign-on to the server.
11. Click Finished.

1. On the Main tab, click Access > Connectivity / VPN > VDI / RDP > Remote Desktops .
   The Remote Desktops screen opens.
2. Click Create.
   The New Resource screen opens.
3. In the Name field, type a name for this desktop resource.
4. From the Type list, select RDP.
5. In the Description field, type a description for the new resource.
6. For Server Type, select Remote Desktop Web Access.
7. For Client Type, select the client type as either Native, Java, or ActiveX.
8. For the Destination setting, specify an IP address as your destination , and accept or change the Port.
9. In the Custom Parameters field, type one or more lines to specify custom settings.
   These parameters affect the rendering of certain features for RDP. For Microsoft RDP, a line should inclue a name, type, and a value, with a colon as a separator, shown in the examples below:

   • screen mode id:i:1
   • use multimon:i:0
   • desktopwidth:i:1440
   • desktopheight:i:900
   • session bpp:i:32
10. For Enable SSO, select Enable.
11. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile for which you want to edit the access policy.
   The properties screen opens for the profile you want to edit.
3. On the menu bar, click Access Policy.
4. In the General Properties area, click the Edit Access Policy for Profile profile_name link.
   The visual policy editor opens the access policy in a separate screen.
5. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
6. On the Assignment tab, select the Advanced Resource Assign agent, and click Add Item.
   The Resource Assignment screen opens.
7. Click the Add/Delete link below the entry.
   The screen changes to display resources on multiple tabs.
8. On the Remote Desktop tab, select the remote desktop that you configured previously.
9. On the Static ACL tab, select an ACL that rejects all connections.
   Important: Adding an ACL that is last in order and rejects all connections keeps users from accessing any host and port combinations other than those to which they have been explicitly allowed access by the other ACLs assigned to the policy.
10. On the Webtop tab, select a full webtop.
11. Select any other resources that you want to assign to the policy.
    If you assign a Network Access resource to the policy, be sure to also assign an ACL that allows access to the resources that you want users to have. Otherwise, the ACL that rejects all connections blocks access.
    If you assign a Portal Access resource to the policy, be sure to also assign an ACL that allows access to all parts of the web sites specified in the start URI or hosted content fields of the Portal Access configuration. Otherwise, the ACL that rejects all connections blocks access.
12. Click Update.
13. Click Save.

These sample access policies are a reference for configuring RDP for APM webtop, a standalone client, or both.

Access policy for an APM webtop

Access policy for a standalone client

Access policy for both an APM Webtop and a standalone client

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server you want to modify.
3. In the Destination Address field, type the IP address for a host virtual server.
   This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
4. For the HTTP Profile setting, verify that the default HTTP profile, http, is selected.
5. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
6. If you are using a connectivity profile, from the Connectivity Profile list, select the connectivity profile.
7. If you are creating a virtual server to use with portal access resources in addition to remote desktops, from the Rewrite Profile list, select the default rewrite profile, or another rewrite profile you created.
8. If you want to provide connections to Java RDP clients for application access, allow Java rewriting for portal access, or support a per-app VPN connection that is configured on a mobile device, select the Application Tunnels (Java & Per-App VPN) check box.
   You must enable this setting to make socket connections from a patched Java applet. If your applet does not require socket connections, or only uses HTTP to request resources, this setting is not required.
9. If you want to provide native integration with an OAM server for authentication and authorization, select the OAM Support check box.
   You must have an OAM server configured in order to enable OAM support.
10. Click Update.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.
   The properties screen opens.
3. On the menu bar, click Logs.
   The access profile log settings display.
4. Move log settings between the Available and Selected lists.
   You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.

   Note: Logging is disabled when the Selected list is empty.
5. Click Update.