Citrix Secure Private Access™ Hybrid Deployment

Global server load balancing connection proxy

The global server load balancing (GSLB) connection proxy enables NetScaler Gateway to transparently detect misrouted requests and proxy them to the correct site without any user intervention.

In multi-site Citrix Secure Private Access hybrid deployments that use GSLB, DNS resolution might occasionally route a user request to a non-intended site. When this occurs, the user lands on a site where their session was not established, which can prevent access to internal web applications.

The GSLB connection proxy addresses this issue by enabling NetScaler Gateway to transparently detect misrouted requests and proxy them to the correct site without any user intervention. This process is transparent to end users and improves session persistence and eliminates dropped sessions and application access failures caused by non-optimal DNS routing.

Prerequisites

Ensure that the following prerequisites are met to support GSLB connection proxy:

  • Multi-site Secure Private Access hybrid deployment with GSLB configured across all sites.
  • Source IP persistency is enabled on GSLB. For details, see Configure persistence based on source IP address.
  • Static proximity is configured (IP database managed by the administrator). For details, see Static proximity.
  • NetScaler Gateway version is 14.1 or later.

Configure GSLB connection proxy

To enable the GSLB connection proxy, bind a certificate to all GSLB services and the VPN virtual server:

  1. Generate a self-signed client certificate with a common name, for example csg.proxy.ext.goog.
  2. Bind the certificate to all GSLB services across all sites.
  3. Bind the issuer certificate to the VPN virtual server as a CA certificate.
  4. Repeat the service binding for every GSLB service on every site in the deployment.

CLI commands:

  • Bind the certificate to a GSLB service.

    bind ssl service <gslb-service-name> -certKeyName <certificate-name>

  • Bind the issuer certificate to the VPN virtual server.

    bind ssl vserver <vpn-vserver-name> -certKeyName <certificate-name> -CA

Global server load balancing connection proxy