NetScaler Gateway

Deploying with the Web Interface

October 5, 2020

Contributed by:

When you deploy NetScaler Gateway to provide secure remote access to XenApp or XenDesktop, NetScaler Gateway works with the Web Interface and the Secure Ticket Authority (STA) to provide access to published applications and desktops hosted in a server farm.

Deploying NetScaler Gateway in the DMZ is the most common configuration when NetScaler Gateway operates with a server farm. In this configuration, NetScaler Gateway provides a secure single point-of-access for the web browsers and Citrix Receiver that access the published resources through the Web Interface. This section covers the basic aspects of about this deployment option.

The configuration of your organization’s network determines where you deploy NetScaler Gateway when it operates with a server farm. You have the following two options:

If your organization protects the internal network with a single DMZ, deploy NetScaler Gateway in the DMZ.
If your organization protects the internal network with two DMZs, deploy one NetScaler Gateway in each of the two network segments in a double-hop DMZ configuration. For more information, see Deploying NetScaler Gateway in a Double-Hop DMZ. Note: You can also configure a double-hop DMZ with the second NetScaler Gateway appliance in the secure network.

When you deploy NetScaler Gateway in the DMZ to provide remote access to a server farm, you can implement one of the following three deployment options:

Deploy the Web Interface behind NetScaler Gateway in the DMZ. In this configuration, as shown in the following figure, both NetScaler Gateway and the Web Interface are deployed in the DMZ. The initial user connection goes to NetScaler Gateway and is then redirected to the Web Interface. Figure 1. Web Interface Behind NetScaler Gateway in the DMZ
Deploy NetScaler Gateway parallel to the Web Interface in the DMZ. In this configuration, both NetScaler Gateway and the Web Interface are deployed in the DMZ, but the initial user connection goes to the Web Interface instead of NetScaler Gateway.
Deploy NetScaler Gateway in the DMZ and deploy the Web Interface in the internal network. In this configuration, NetScaler Gateway authenticates user requests before relaying the request to the Web Interface in the secure network. The Web Interface does not perform authentication, but interacts with the STA and generates an ICA file to ensure that ICA traffic is routed through NetScaler Gateway to the server farm.

The location in which you deploy the Web Interface depends on a number of factors, including:

Authentication. When users log on, either NetScaler Gateway or the Web Interface can authenticate user credentials. Where you place the Web Interface in your network is a factor that determines, in part, where users authenticate.
User software. Users can connect to the Web Interface with either the NetScaler Gateway Plug-in or Citrix Receiver. You can limit the resources users can access by using Citrix Receiver only, or give users greater network access with the NetScaler Gateway Plug-in. How users connect, and the resources to which you allow users to connect can help determine where you deploy the Web Interface in your network.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Deploying with the Web Interface

October 5, 2020

Contributed by:

October 5, 2020

Contributed by:

Deploying with the Web Interface

In this article