System and Connectivity Requirements

Citrix Cloud provides administrative functions (through a web browser) and operational requests (from other installed components) that connect to resources within your deployment. This article describes the system requirements, required contactable Internet addresses, and considerations for establishing connectivity between your resources and Citrix Cloud.

System requirements

Citrix Cloud requires the following minimum configuration:

• An Active Directory domain
• Two physical or virtual machines, joined to your domain, for the Citrix Cloud Connector. For more information, see Citrix Cloud Connector Technical Details.
• Physical or virtual machines, joined to your domain, for hosting workloads and other components such as StoreFront. For more information about system requirements for specific services, refer to the Citrix documentation for each service.

For information about scale and size requirements, see Scale and size considerations for Cloud Connectors.

Supported web browsers

• Latest version of Google Chrome
• Latest version of Mozilla Firefox
• Latest version of Microsoft Edge
• Microsoft Internet Explorer 11
• Latest version of Apple Safari

Transport Layer Security requirements

Citrix Cloud supports Transport Layer Security (TLS) 1.2 for TCP-based connections between components. Citrix Cloud doesn’t allow communication over TLS 1.0 or TLS 1.1.

To access Citrix Cloud, you must use a browser that supports TLS 1.2 and have accepted cipher suites configured. For more information, see Encryption and key management.

Citrix Cloud management console

The Citrix Cloud management console is a web-based console that you can access after signing in at https://citrix.cloud.com. The webpages that make up the console might require other resources on the Internet, either when signing in or at a later point when carrying out specific operations.

Proxy configuration

If you’re connecting through a proxy server, the management console operates using the same configuration applied to your web browser. The console operates within the user context, so any configuration of proxy servers that require user authentication should work as expected.

Firewall configuration

For the management console to operate, you must have port 443 open for outbound connections. You can test general connectivity by navigating within the console.

Console notifications

The management console uses Pendo to display critical alerts, notifications about new features, and in-product guidance for some features and services. To ensure you can view Pendo content within the management console, Citrix recommends that the address https://citrix-cloud-content.customer.pendo.io/ is contactable.

Services that display Pendo content include:

• Analytics
• Content Collaboration
• Virtual Apps and Desktops
• Workspace

Pendo is a third-party sub-processor that Citrix uses to provide cloud and support services to Citrix customers. For a complete list of these sub-processors, see Sub-Processors for Citrix Cloud & Support Services and Citrix Affiliates.

Session timeouts

After an administrator signs in to Citrix Cloud, the management console session times out after the following intervals have elapsed:

• Idle sessions (no console activity detected): 60 minutes
• Maximum session timeout (regardless of console activity): 24 hours

After the maximum session timeout elapses, any unsaved configuration changes are lost and the administrator must sign in again.

On-premises product registration

If you are using Citrix Cloud with Citrix License Server to register your on-premises products, ensure the following addresses are contactable:

• https://trust.citrixnetworkapi.net (for retrieving a code)
• https://trust.citrixworkspacesapi.net/ (for confirming the license server is registered)
• https://cis.citrix.com (for data upload)
• https://core-eastus-release-a.citrixworkspacesapi.net
• https://core.citrixworkspacesapi.net
• ocsp.digicert.com port 80
• crl3.digicert.com port 80
• crl4.digicert.com port 80
• ocsp.entrust.net port 80
• crl.entrust.net port 80

If you are using a proxy server with Citrix License Server, ensure the proxy server is configured as described in Configure a proxy server in the Licensing product documentation.

Citrix Cloud Connector

The Citrix Cloud Connector is a software package that deploys a set of services that run on Microsoft Windows servers. The machine hosting the Cloud Connector resides within the network where the resources you use with Citrix Cloud reside. The Cloud Connector connects to Citrix Cloud, allowing it to operate and manage your resources as needed.

For requirements for installing the Cloud Connector, see System requirements. To operate, the Cloud Connector requires outbound connectivity on port 443. After installation, the Cloud Connector might have additional access requirements depending on the Citrix Cloud service with which it is being used.

The machine hosting the Cloud Connector must have stable network connectivity with Citrix Cloud. Networking components must support HTTPS and long-lived secure web sockets. If a timeout is configured in the networking components, it must be greater than 2 minutes.

For help with troubleshooting connectivity between the Cloud Connector and Citrix Cloud, use the Cloud Connector Connectivity Check Utility. This utility runs a series of checks on the Cloud Connector machine to verify it can reach Citrix Cloud and related services and helps you add any missing connectivity addresses to the Trusted Sites zone in Internet Explorer. If you use a proxy server in your environment, all connectivity checks are tunneled through your proxy server. To download the utility, see CTX260337 in the Citrix Support Knowledge Center.

Cloud Connector common service connectivity requirements

Connecting to the Internet from your data centers requires opening port 443 to outbound connections. However, to operate within environments containing an Internet proxy server or firewall restrictions, further configuration might be needed. For more information, see Cloud Connector Proxy and Firewall Configuration.

The addresses for each service in this article must be contactable to properly operate and consume the service. The following list includes the addresses that are common to most Citrix Cloud services:

• https://*.citrixworkspacesapi.net (provides access to Citrix Cloud APIs that the services use)
• https://*.cloud.com (provides access to the Citrix Cloud sign-in interface)
• https://*.blob.core.windows.net (provides access to Azure Blob Storage, which stores updates for Citrix Cloud Connector)
• https://*.servicebus.windows.net (provides access to Azure Service Bus, which is used for logging, the Active Directory agent and Machine Creation Services)

These addresses are provided only as domain names because Citrix Cloud services are dynamic and their IP addresses are subject to routine changes.

As a best practice, use Group Policy to configure and manage these addresses. Also, configure only the addresses that are applicable to the services that you and your end-users are consuming.

If you are using Citrix Cloud with Citrix License Server to register your on-premises products, see On-premises product registration in this article for additional required contactable addresses.

Allowed FQDNs for Cloud Connector

For a complete list of the fully-qualified domain names (FQDNs) that the Cloud Connector accesses, refer to the JSON file located at https://fqdnallowlistsa.blob.core.windows.net/fqdnallowlist-commercial/allowlist.json. This list is grouped by product and includes a change log for each group of FQDNs.

Some of these FQDNs are specific to a customer and include templated sections in angular brackets. These templated sections must be replaced with the actual values before use. For example, for <CUSTOMER_ID>.xendesktop.net, you replace <CUSTOMER_ID> with the actual customer ID for your Citrix Cloud account. You can find the customer ID in the following console locations:

• In the top-right corner of the screen, beneath the customer name for your Citrix Cloud account.
• On the Account Settings page, under Citrix Cloud Customer ID (CCID).
• On the Secure Clients tab (Identity and Access Management > API Access > Secure Clients.

Some services still require wildcard URLs to be allowed. The wildcard for Machine Creation Services (*.servicebus.windows.net) must be added when the referenced service is used.

Certificate validation

Cloud Connector binaries and endpoints that the Cloud Connector contacts are protected by X.509 certificates that are verified when the software is installed. To validate these certificates, each Cloud Connector machine must meet the following requirements:

• HTTP port 80 is open to *.digicert.com. This port is used during Cloud Connector installation and during periodic Certificate Revocation List checks.
• The following addresses must be contactable:
  • http://*.digicert.com
  • https://*.digicert.com
  • https://dl.cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
  • https://dl.cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt

For more information about these certificates, see Certificate validation requirements.

SSL Decryption

Enabling SSL decryption on certain proxies might prevent the Cloud Connector from connecting successfully to Citrix Cloud. For more information about resolving this issue, see CTX221535.

Citrix Connector Appliance for Cloud Services

The Connector Appliance is an appliance that you can deploy in your hypervisor. The hypervisor hosting the Connector Appliance resides within the network where the resources you use with Citrix Cloud reside. The Connector Appliance connects to Citrix Cloud, allowing it to operate and manage your resources as needed.

For requirements for installing the Connector Appliance, see System requirements.

To operate, the Connector Appliance requires outbound connectivity on port 443. However, to operate within environments containing an Internet proxy server or firewall restrictions, further configuration might be needed.

To properly operate and consume the Citrix Cloud services, the following addresses must be contactable:

• https://*.cloud.com
• https://*.citrixworkspacesapi.net
• https://*.citrixnetworkapi.net
• https://*.*.nssvc.net
  • Customers who can’t enable all sub-domains can use the following addresses instead
    • https://*.g.nssvc.net
    • https://*.c.nssvc.net
• https://*.servicebus.windows.net
• https://iwsprodeastusuniconacr.azurecr.io
• https://iwsprodeastusuniconacr.eastus.data.azurecr.io

Citrix Analytics service connectivity

• For in-product messages including new features and critical communications: https://citrix-cloud-content.customer.pendo.io/
• Additional requirements: Prerequisites

For more information about onboarding data sources to the service, see Supported data sources.

Content Collaboration service connectivity

Citrix resource location / Cloud Connector:

• Cloud Connector common service connectivity requirements
• https://*.sharefile.com
• Additional requirements: ShareFile Firewall Configuration and IP Address (CTX208318)
• For in-product messages including new features and critical communications: https://citrix-cloud-content.customer.pendo.io/

Administration console:

• https://*.citrixworkspacesapi.net
• https://*.cloud.com
• Additional requirements: ShareFile Firewall Configuration and IP Address (CTX208318)

Endpoint Management service connectivity

Citrix resource location / Cloud Connector:

• Cloud Connector common service connectivity requirements
• Additional requirements: /en-us/citrix-endpoint-management/endpoint-management.html

Administration console:

• https://*.citrix.com
• https://*.citrixworkspacesapi.net
• https://*.cloud.com
• https://*.blob.core.windows.net
• Additional requirements: /en-us/citrix-endpoint-management/endpoint-management.html

Citrix Gateway service connectivity

• Cloud Connector common service connectivity requirements
• https://*.*.nssvc.net
  • Customers who can’t enable all subdomains can use the following addresses instead:
    • https://*.g.nssvc.net
    • https://*.c.nssvc.net

SD-WAN Orchestrator service connectivity

For complete Internet connectivity requirements, see Prerequisites for Citrix SD-WAN Orchestrator service usage.

Secure Browser service connectivity

Citrix resource location / Cloud Connector:

Cloud Connector common service connectivity requirements

Administration console:

• https://*.cloud.com
• https://*.citrixworkspacesapi.net
• https://browser-release-a.azureedge.net
• https://browser-release-b.azureedge.net

Citrix Secure Workspace Access service connectivity

• https://*.netscalergateway.net
• https://*.*.nssvc.net
  • Customers who can’t enable all subdomains can use the following addresses instead:
    • https://*.g.nssvc.net
    • https://*.c.nssvc.net

Virtual Apps and Desktops service connectivity

Citrix resource location / Cloud Connector:

• Cloud Connector common service connectivity requirements
• https://[customerid].xendesktop.net, where [customerid] is the customer ID parameter displayed on the Secure Clients tab (Identity and Access Management > API Access > Secure Clients) of the Citrix Cloud management console.
  • Customers using Citrix Virtual Apps Essentials need to use https://*.xendesktop.net instead.
• https://*.*.nssvc.net
  • Customers who can’t enable all subdomains can use the following addresses instead:
    • https://*.g.nssvc.net
    • https://*.c.nssvc.net

For an overview of how the Cloud Connector communicates with the service, refer to the Virtual Apps and Desktops diagram on the Citrix Tech Zone web site.

Administration console:

• https://*.citrixworkspacesapi.net
• https://*.citrixnetworkapi.net
• https://*.cloud.com
• https://[customerid].xendesktop.net, where [customerid] is the customer ID parameter displayed on the Secure Clients tab (Identity and Access Management > API Access > Secure Clients) of the Citrix Cloud management console.
  • Customers using Citrix Virtual Apps Essentials need to use https://*.xendesktop.net instead.
• https://*.*.nssvc.net (Not required for Virtual Apps and Desktops Standard for Azure)
  • Customers who can’t enable all sub-domains can use the following addresses instead:
    • https://*.g.nssvc.net
    • https://*.c.nssvc.net
• For in-product messages including new features and critical communications: https://citrix-cloud-content.customer.pendo.io/

Citrix Workspace service connectivity

• https://*.cloud.com
• https://*.citrixdata.com
• For in-product messages including new features and critical communications: https://citrix-cloud-content.customer.pendo.io/

To ensure subscribers can successfully access their content in Citrix Files and Content Collaboration through Workspace, Citrix recommends allowing the domains listed in CTX208318.

Workspace single sign-on with Citrix Federated Authentication Service

The console and FAS service access the following addresses using the user’s account and the Network Service account, respectively.

• FAS administration console, under the user’s account
  • *.cloud.com
  • *.citrixworkspacesapi.net
  • Addresses required by a third party identity provider, if one is used in your environment
• FAS service, under the Network Service account: *.citrixworkspacesapi.net

If your environment includes proxy servers, configure the user proxy with the addresses for the FAS administration console. Also, ensure the address for the Network Service account is configured as appropriate for your environment.

Workspace Environment Management service connectivity

https://*.wem.cloud.com