Configuring NetScaler Gateway to Support Enlightened Data Transport

December 13, 2019

Contributed by: C

If you use Enlightened Data Transport (EDT), Datagram Transport Layer Security (DTLS) must be enabled to encrypt the UDP connection used by EDT. The DTLS parameter must be enabled at the Gateway VPN virtual-server level, and XenApp and XenDesktop components must be correctly upgraded and configured to achieve encrypted traffic between the Gateway VPN virtual server and the user device.

Note: UDP port (for example port 443) configured for the NetScaler Gateway front end virtual server must be opened in the DMZ for the virtual server to receive the DTLS connections. DTLS and CGP are prerequisites for EDT to work with NetScaler Gateway.

The following scenarios are supported:

Scenario	EDT support
NetScaler Gateway	Yes
NetScaler Gateway with High Availability (HA)	Yes
NetScaler Gateway with High Availability (HA) optimization	Yes
NetScaler with Unified Gateway	Yes
NetScaler Gateway with GSLB	Yes
NetScaler Gateway with Cluster	Yes
Citrix Receiver to NetScaler Gateway DTLS encryption	Yes
Dual Secure Ticket Authority (STA) on NetScaler Gateway	Yes
NetScaler Gateway ICA session timeout	Yes
NetScaler Gateway Multi-Stream ICA	Yes
NetScaler Gateway session reliability (Port 2598)	Yes
NetScaler Gateway Double-Hop	Yes
NetScaler to VDA DTLS encryption	No
HDX Insight	No
NetScaler Gateway in IPv6 mode	No
NetScaler Gateway SOCKS (Port 1494)	No
NetScaler pure LAN proxy	No

Note: EDT support for NetScaler Gateway is available for port 2598 and not for port 1494.

To configure NetScaler Gateway to support EDT:

Deploy and configure NetScaler Gateway to communicate with StoreFront and authenticate users for XenApp and XenDesktop.
On the Configuration tab in the NetScaler GUI, expand NetScaler Gateway and select Virtual Servers.
Click Edit to display Basic Settings for the VPN virtual server, and then verify the state of the DTLS setting.
Click More to display other configuration options.
Select DTLS to provide communications security for datagram protocols. Click OK. The Basic Settings area for the VPN virtual server shows that the DTLS flag is set to True.

Note: If you make a DTLS setting change, you must unbind the SSL certificate and then bind it again to the gateway. Perform the following steps to do so.
Reopen the Server Certificate Binding screen and click the plus icon (+) to bind the certificate-key pair.
Next to the certificate-key pair that you bound, click Select.
Save the changes to the server-certificate binding.
When the certificate key pair appears, click Bind.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configuring NetScaler Gateway to Support Enlightened Data Transport

December 13, 2019

Contributed by: C

Configuring NetScaler Gateway to Support Enlightened Data Transport

Configuring NetScaler Gateway to Support Enlightened Data Transport

In this article