(1) Article Details
- Author: Christopher S. Bates
Updated: March 24, 2025
Published: March 24, 2025
Configuring Citrix Native USB Redirection
Warning
Native / Generic USB redirection should only be used under specific circumstances, and as a last resort to get a device working.
Before you look into using Citrix USB Redirection, IGEL recommends reviewing the articles below to determine if the device you are using should use Native USB Redirection. - When to Use USB Redirection - Webcam Redirection and Optimization in IGEL OS
As of [CWA][CWA] 2405 Citrix has changed the way that USB redirection is handled in later versions of [CWA][CWA] works with USB redirection and has additional configuration requirements to allow USB redirection to function. These include minimum versions of Citrix [DDC][DDC] and [VDA][VDA].
This impacts IGEL OS 11 versions at or above 11.10.210 and any version of IGEL OS 12 with [CWAL][CWAL] 2405. If you are using IGEL OS 11 below 11.10.210 or you have [CWAL][CWAL] 2402 or lower deployed to your IGEL devices, please click the link below to go to the Legacy configuration. If you are running a modern version of IGEL OS or [CWAL][CWAL] 2405 or later, please scroll down to continue to Citrix Workspace App for Linux 2405 and Later.
Citrix Workspace App for Linux 2405 and Later (USB Redirection V2)
Info
Citrix KB - USB Device Configuration
Prerequisites
In order to utilize Citrix USB Redirection for [CWAL][CWAL] 2405 or later you will need to make sure that your Citrix Components below are updated to the minimum versions below.
Citrix Component Minimum Versions
- Citrix Virtual Apps and Desktops: 2212
- Citrix Delivery Controllers: 2212
- Citrix VDA: 2212
You must also see the "Client USB device redirection rules (Version 2)" policy available in your Citrix policies. If this is not available, you may need to update to a more current version.
Citrix Policy Configuration
Reference: https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/devices/usb-devices/configuration
Global USB Configuration
In order for USB Redirection to work you will need to enable the global "Client USB Redirection" policy and set it to "Allow".
- Setting: Client USB Redirection
- Value: Allowed
Auto Connect Rules
If you want to allow devices to automatically be redirected in to the session when a session is launched, or when a USB device is connected, you will need to change set the following policies:
- Setting: Allow existing USB devices to be automatically connected
-
Value: Automatically redirect available USB devices.
-
Setting: Allow newly arrived USB devices to be automatically connected
- Value: Automatically redirect available USB devices.
Citrix Device Rules & Options (V2)
Now that USB redirection has been set to allow, we need to look at the final setting Client USB device redirection rules (Version 2). This setting has entries by default, so if it is left in it's default setting it will use the default rules and ignore any client-side settings.
You now have to decide if you want to rely on endpoint policies (i.e. IGEL USB redirection settings, and Windows Endpoint Registry / GPO settings) or if you want to use a global Citrix policy.
Using Citrix Policy
If you want to guarantee that all endpoints use the same rules, or that you can apply rules to specific users, apps, or desktops you can use this policy to configure global USB rules. This will override any endpoint configurations.
To do this, you will need to update the Client USB device redirection rules (Version 2) Citrix policy, remove the Use default value option, and then replace or add your USB
- Setting: Client USB device redirection rules (Version 2)
- Value: Your USB Redirection rules
Using Endpoint Policies
If you want to rely on endpoint policies, you need to configure this policy, remove the "Use default value" option, and delete all items from the Values field.
- Setting: Client USB device redirection rules (Version 2)
- Value: empty
Citrix Workspace App for Linux 2402 (Legacy)
Citrix Policy Configuration
Prior to [CWAL][CWAL] 2402 the endpoint rules would take precedence over Citrix policy, so you should be able to use IGEL configured policies with only setting the Client USB Redirection.
Global USB Configuration
In order for USB Redirection to work you will need to enable the global "Client USB Redirection" policy and set it to "Allow".
- Setting: Client USB Redirection
- Value: Allowed
Citrix Client USB Configuration
Before configuring any devices for Native USB redirection, IGEL recommends reviewing the articles below to determine if the device you are working with is a good candidate for USB redirection, or if a better optimized channel may be better.
USB devices can be permitted or prohibited during a Citrix session on the basis of rules. Sub-rules for specific devices or device classes are also possible.
-
In the profile configuration dialog, go to Apps > Citrix > Global Settings > Native USB Redirection.
-
Edit the settings according to your needs. The parameters are described in the following.
Native USB redirection
Fabulatech Warning: Enable either native USB redirection or Fabulatech USB redirection, but not both together.
DrivelLock Warning: Disable USB redirection if you use DriveLock. Further information can be found under Using DriveLock with IGEL Devices.
IGEL Advanced Redirection Warning: Do not enable Native USB Redirection when using the IGEL Advanced Redirection Plugins.
-
Native USB redirection is enabled globally.
-
Native USB redirection is disabled. (Default)
Default rule
This rule will apply if no specific rule was configured for a class or a device.
Tip
To secure your endpoint and prevent redirection of undesired / unsupported devices, it is recommended to set Default rule to Deny and to configure Allow rules only for the required USB devices and USB device classes.
- Deny (Default)
- Allow
Class Rules
Class rules apply to USB device classes and sub-classes.
To add a class rule:
In the Class Rules are, click 
.
- Set the criteria according to your needs:
- Rule:
- Deny: Devices of this class/subclass will not be redirected automatically.
- Allow: When a device of this class/subclass is plugged in after the start of the session, it will be redirected. If you want an already plugged-in device to be redirected, unplug it and plug it in again.
- Connect: A device of this class/subclass is redirected, regardless of whether it has been plugged in before or after the start of the session.
- Class ID: Select the class to which this rule should apply.
- Subclass ID: Select the subclass to which this rule should apply.
- Name: Enter a name for this rule.
Product Rules
Product rules apply to individual USB devices.
Composite USB Redirection
You can configure composite USB redirection which is needed for multifunctional devices that use different interfaces. Examples of such composite USB devices are dictation microphones or Bloomberg keyboards which comprise a keyboard, fingerprint reader, an audio device, USB hub, etc.
To redirect the entire composite device to the session, only Vendor ID (
vid) and Product ID (pid) must be added.If you need to split the composite device and redirect only the child interfaces that use a generic USB channel, you must also add filter parameters
splitandintfunder Extra Config. For more information on composite USB redirection and sample device rules, see https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/usb.
To add a product rule:
In the Class Rules are, click 
.
- Set the criteria according to your needs:
- Rule:
- Deny: This device of this class/subclass will not be redirected automatically.
- Allow: Allow: Allows the device to be connected, but does not automatically connect it to the session. (The end user must initiate connection via the CItrix toolbar)
- Connect: This device will be automatically redirected to the session.
- Vendor ID: Enter the hexadecimal value of the vendor id for the device to which this rule should apply.
- Product ID: Enter the hexadecimal value of the product id for the device to which this rule should apply.
- Extra config: If desired, enter configuration parameters for the device.
Example:
CONNECT: vid=047F pid=C039 split=1 intf=00,01,02(For composite USB devices: Allow HID device and connect automatically) - Name: Enter a name for this rule.
