Supported features
Important:
-
Citrix Secure Access is now called Citrix SecurAccess™. We are updating our documentation and the UI screenshots to reflect this name change.
-
The legacy VPN client was built using Apple's private VPN APIs that are now deprecated. VPN support in Citrix SecurAccess client for macOS/iOS is rewritten using Apple's public Network Extension framework. NetScaler Gateway plug-in and VPN for iOS and macOS are no longer supported. Citrix SecurAccess for iOS/macOS is the recommended VPN client to be used.
-
General availability of nFactor authentication support for Android devices would be available in one of the upcoming releases.
The Citrix SecurAccess clients support NetScaler Gateway and Citrix SecurAccess™ ZTNA deployments.
Citrix SecurAccess client features supported in NetScaler Gateway
The following table lists some of the commonly used features supported for each VPN client in NetScaler Gateway.
| Feature | Citrix SecurAccess for Windows | Citrix SecurAccess for macOS | Citrix SecurAccess for iOS | Citrix SecurAccess for Linux | Citrix SecurAccess for Android |
|---|---|---|---|---|---|
| Always On (user mode) | Yes (11.1 and later) | No | No | No | Yes (via MDM) |
| PAC file | Yes (12.0 and later) | Yes | Yes | No | No |
| Client proxy support | Yes | No | No | No | Yes. See note 1 |
| Max limit of Intranet Applications | 512 | No limit | No limit | 128 | No limit |
| Intranet IP (IIP) address support | Yes | Yes | Yes | Yes | Yes |
| Split tunnel ON | Yes | Yes | Yes | Yes | Yes |
| Split tunnel reverse | Yes | Yes | Yes | Yes | Yes. |
| Split DNS REMOTE | Yes | Yes | Yes | Yes | Yes. See note 5 |
| Split DNS BOTH | Yes | Yes | Yes | Yes. See note 7 | Yes. See note 5 |
| FQDN based split tunnel | Yes-Only ON (13.0 and later) | Yes | Yes | Yes | Yes. |
| Client idle timeout | Yes | Yes | No | No | No |
| Endpoint analysis | Yes | Yes | No | Yes | No |
| Device certificate (classic) | Yes | Yes | No | No | No |
| nFactor authentication | Yes (12.1 and later) | Yes | Yes | Yes | Yes. See note 3 |
| EPA (nFactor) | Yes (12.1 and later) | Yes | No | Yes | No |
| Device certificate (nFactor) | Yes (12.1 and later) | Yes | No | No | No |
| Push notification | Yes (12.1 and later) | No | Yes | No | Yes |
| OTP token autofill support. See note 2 | No | No | Yes | No | Yes |
| TLS 1.3 support | Yes | Yes. See note 6 | Yes. See note 6 | Yes | Yes |
| DTLS support. See note 5 | Yes (13.0 and later) | Yes | Yes | No | No |
| HTTPOnly cookies | Yes | Yes | Yes | Yes | Yes |
| Global server load balancing (GSLB) | Yes | Yes | Yes | Yes | Yes |
| Local LAN access | Yes | Yes. See note 6 | Yes. See note 6 | No | No |
Note:
-
Setting a proxy in the client configuration on the VPN virtual server in the gateway configuration for Android 10 and later is supported. Only basic HTTP proxy configuration with IP address and port is supported.
-
Only QR code-scanned tokens are eligible for auto filling. Auto filling is not supported in the nFactor authentication flow.
-
nFactor authentication support for Android devices is under preview and the feature is disabled by default. Contact NetScaler support for enabling this feature. Customers must provide their NetScaler Gateway's FQDN to the support team for enabling nFactor authentication for Android devices.
-
For details, see Configure DTLS VPN virtual server using SSL VPN virtual server.
-
For "Split DNS BOTH" mode, DNS suffixes must be configured on the gateway and only DNS A record queries ending in those suffixes are sent to the gateway. Rest of the queries are resolved locally. Citrix SecurAccess for Android also supports "Split DNS LOCAL" mode.
-
TLS 1.3 and local LAN access are disabled by default in the Citrix SecurAccess client for macOS and iOS. If required, contact Citrix Support.
-
The "Split DNS BOTH" mode functions the same as the "Split DNS LOCAL" mode in the Citrix SecurAccess client for Linux.