Gateway

Deploy NetScaler Gateway with the Web Interface

You can deploy NetScaler Gateway with the Web Interface and Secure Ticket Authority (STA) to provide access to published applications and desktops hosted in a server farm.

Deploying NetScaler Gateway in the DMZ is the most common configuration when NetScaler Gateway operates with a server farm. In this configuration, NetScaler Gateway provides a secure single point-of-access for the web browsers and Citrix Workspace app that access the published resources through the Web Interface. This section covers the basic aspects of about this deployment option.

The configuration of your organization’s network determines where you deploy NetScaler Gateway when it operates with a server farm. You have the following two options:

  • If your organization protects the internal network with a single DMZ, deploy NetScaler Gateway in the DMZ.
  • If your organization protects the internal network with two DMZs, deploy one NetScaler Gateway for each DMZ in a double-hop DMZ configuration. For more information, see Deploying NetScaler Gateway in a Double-Hop DMZ.

    Note: You can also configure a double-hop DMZ with the second NetScaler Gateway appliance in the secure network.

When you deploy NetScaler Gateway in the DMZ to provide remote access to a server farm, you can implement one of the following three deployment options:

  • Deploy the Web Interface behind NetScaler Gateway in the DMZ. In this configuration, as shown in the following figure, both the NetScaler Gateway and the Web Interface are deployed in the DMZ. The initial user connection goes to the NetScaler Gateway and is then redirected to the Web Interface. Figure 1. Web Interface Behind NetScaler Gateway in the DMZ Web Interface Behind NetScaler Gateway in the DMZ
  • Deploy NetScaler Gateway parallel to the Web Interface in the DMZ. In this setup, both the NetScaler Gateway and the Web Interface are deployed in the DMZ. The initial user connection goes to the Web Interface instead of NetScaler Gateway.
  • Deploy NetScaler Gateway in the DMZ and deploy the Web Interface in the internal network. In this setup, NetScaler Gateway authenticates user requests before relaying the request to the Web Interface in the secure network. The Web Interface does not do the authentication. However, it interacts with the STA and generates an ICA file to ensure that ICA traffic is routed through the NetScaler Gateway to the server farm.

The location in which you deploy the Web Interface depends on various factors, including:

  • Authentication. When users log on, either NetScaler Gateway or the Web Interface can authenticate user credentials. Where you place the Web Interface in your network is a factor that determines, in part, where users authenticate.
  • User software. Users can connect to the Web Interface with either the Citrix Secure Access client or Citrix Workspace app. You can limit the resources users can access by using Citrix Workspace app only, or give users greater network access with the Citrix Secure Access client. How users connect, and the resources to which you allow users to connect can help determine where you deploy the Web Interface in your network.

Deploy the Web Interface in a secure network

In this deployment, the Web Interface is in the secure, internal network. NetScaler Gateway is in the DMZ. NetScaler Gateway authenticates user requests before sending the requests to the Web Interface.

When you deploy the Web Interface in the secure network, you must configure authentication on the NetScaler Gateway.

If you deploy the Web Interface with Citrix Virtual Apps and Desktops, deploying the Web Interface in the secure network is the default deployment scenario. When the Desktop Delivery Controller is installed, a custom version of the Web Interface is also installed.

Important: When the Web Interface is in the secure network, you must enable authentication on NetScaler Gateway. Users connect to NetScaler Gateway, type their credentials, and then connect to the Web Interface. When you disable authentication, unauthenticated HTTP requests are sent directly to the server running the Web Interface. Disabling authentication on NetScaler Gateway is recommended only when the Web Interface is in the DMZ and users connect directly to the Web Interface.

Figure 1. Web Interface Located Inside the Secure Network

Deployment illustration

Deploy the Web Interface parallel to NetScaler Gateway in a DMZ

In this deployment, the Web Interface and NetScaler Gateway both are in the DMZ. Users connect directly to the Web Interface by using a web browser or Citrix Workspace app. User connections are first sent to the Web Interface for authentication. After authentication, the connections are routed through NetScaler Gateway. After users log on successfully to the Web Interface, they can access published applications or desktops in the server farm. When users start an application or desktop, the Web Interface sends an ICA file with instructions for routing ICA traffic through the NetScaler Gateway. The ICA file delivered by the Web Interface includes a session ticket produced by the Secure Ticket Authority (STA).

When Citrix Workspace app connects to NetScaler Gateway, the ticket is presented. NetScaler Gateway contacts the STA to validate the session ticket. If the ticket is still valid, the user’s ICA traffic is relayed to the server in the server farm. The following figure shows this deployment.

Figure 1. The Web Interface installed parallel to NetScaler Gateway

Web Interface Running Parallel to NetScaler Gateway

When the Web Interface runs parallel to NetScaler Gateway in the DMZ, you do not need to configure authentication on NetScaler Gateway. The Web Interface authenticates users.

Deploy the Web Interface behind NetScaler Gateway in a DMZ

In this configuration, both the NetScaler Gateway and the Web Interface are deployed in the DMZ. When users log on with Citrix Workspace app, the initial user connection goes to NetScaler Gateway and is then redirected to the Web Interface. NetScaler Gateway acts as a reverse web proxy for the Web Interface to route all HTTPS and ICA traffic through a single external port and use a single SSL certificate.

Figure 1. Web Interface Located Behind NetScaler Gateway

Deployment illustration

When the Web Interface is deployed behind the NetScaler Gateway in the DMZ, you can configure authentication on the appliance but it is not required. You can have either NetScaler Gateway or the Web Interface authenticates users because both are in the DMZ.

Deploy NetScaler Gateway with the Web Interface