To effectively monitor Citrix environments, you first need to see inside the encrypted traffic. Without decryption, performance metrics and security threats within ICA/HDX sessions are invisible. ExtraHop Reveal(x) offers two primary strategies for this, depending on the type of encryption used: direct key upload for older ciphers and session key forwarding for modern ones.

The method you choose hinges on whether your environment uses ciphers that support Perfect Forward Secrecy (PFS). PFS is standard practice now, but some legacy setups might still use RSA-based key exchanges. For those, the process is straightforward. You simply upload your server's TLS certificate and its corresponding private key directly to the ExtraHop sensor. The sensor then uses this static key to decrypt any sessions it observes.

Most modern Citrix deployments use PFS-enabled ciphers like those based on Diffie-Hellman Ephemeral (DHE) or Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). In these cases, the server's private key is not enough because a unique session key is generated for each connection. To get visibility here, we need access to those session keys as they're created. This is where session key forwarding comes in.

The ideal approach for Citrix environments is to integrate directly with your NetScaler (now Citrix ADC). By deploying a lightweight WebAssembly (WASM) module on the ADC, you can instruct it to securely forward a copy of each new session key to the ExtraHop sensor. This happens out-of-band, meaning it doesn't add latency to the user's connection or burden the Citrix Delivery Controller.

For servers where you can't install a WASM module, like a standalone Windows or Linux server acting as a web front-end, ExtraHop provides a Session Key Forwarder agent. You install this lightweight agent on the server itself, and it performs the same function: securely transmitting session keys to the Reveal(x) sensor for decryption.

Once keys are being forwarded or have been uploaded, the final step is to tell Reveal(x) which traffic to decrypt. In the SSL Decryption settings, you specify the TCP ports associated with the encrypted protocols. For Citrix, the standard ports are 443 for general TLS-encrypted traffic and 2598 for the ICA protocol when it's wrapped in TLS (often called ICA-over-TLS).

With these configurations in place, ExtraHop can passively decrypt the traffic, reassemble the application-level data, and give you the deep visibility needed to troubleshoot complex performance issues and detect subtle security threats within your Citrix VDI environment.