Product Documentation

English
日本語

NetScaler 11.1

NetScaler Release Notes
Getting Started with Citrix NetScaler
- Where Does a NetScaler Appliance Fit in the Network?
- How a NetScaler Communicates with Clients and Servers
- Introduction to the Citrix NetScaler Product Line
- Install the hardware
- Access a Citrix ADC
- Configure the ADC for the first time
- Configure high availability
- Configuring a FIPS Appliance for the First Time
- Understanding Common Network Topologies
- System management settings
- Load balance traffic on a NetScaler appliance
- Accelerate load balanced traffic by using compression
- Secure load balanced traffic by using SSL
- Features at a Glance
FAQs
- AppFlow
- AutoScale
- Call Home
- Clustering
- Connection Management
- NetScaler GUI
- Content Switching
- Debugging
- High Availability
- Hardware
- Integrated Caching
- Load Balancing
- SDX
- SSL
- Installing, Upgrading, and Downgrading
Solutions for Telecom Service Providers
- Large Scale NAT
- Dual-Stack Lite
- Large Scale NAT64
- Telco subscriber management
- Load Balance Control-Plane Traffic that is based on Diameter, SIP, and SMPP Protocols
- Provide DNS Infrastructure/Traffic Services, such as, Load Balancing, Caching, and Logging for Telecom Service Providers
- Provide Subscriber Load Distribution Using GSLB Across Core-Networks of a Telecom Service Provider
- Bandwidth Utilization Using Cache Redirection Functionality
- NetScaler TCP Optimization
NetScaler Solutions
- Setting Up NetScaler for XenApp/XenDesktop
- Global Server Load Balancing (GSLB) Powered Zone Preference
- NetScaler in a Private Cloud Managed by Microsoft Windows Azure Pack and Cisco ACI
Deploy a Citrix NetScaler VPX instance
- Support matrix and usage guidelines
- Install a NetScaler VPX instance on XenServer
  - Configuring NetScaler Virtual Appliances to use Single Root I/O Virtualization (SR-IOV) Network Interfaces
- Install a NetScaler VPX instance on VMware ESX
- Install a Citrix NetScaler VPX instance on Microsoft Hyper-V servers
- Install a NetScaler VPX instance on Linux-KVM platform
- Deploying NetScaler VPX Instances on AWS
- Deploy a NetScaler VPX instance on Microsoft Azure
- Deploying NetScaler VPX Instances on Oracle Public Cloud
- Deploying a NetScaler VPX Instance on Cisco CSP 2100
- Configuring the Basic System Settings
- Jumbo frames on NetScaler VPX instances
Hardware Installation
Licensing
- NetScaler licensing overview
- NetScaler Gateway Universal License
- NetScaler Pooled Capacity
Upgrade and downgrade a NetScaler appliance
AAA application traffic
- How AAA works
- Enabling AAA
- Setting up an authentication virtual server
- Creating an authentication profile
- Configuring users and groups
- Configuring AAA policies
  - Authentication policies
- Authorizing user access to application resources
- Auditing authenticated sessions
- Session settings
- Traffic settings
- Authenticating with client certificates
  - Client certificate pass-through
- Configuring AAA with commonly used protocols
  - Handling authentication, authorization and auditing with Kerberos/NTLM
- NetScaler Kerberos single sign-on
- SAML authentication
- OAuth authentication
- Multi-Factor (nFactor) authentication
Admin Partitioning
- Supported NetScaler configurations
- Configure admin partitions
- SNMP support for admin partitions
AppExpert
- Action Analytics
- AppExpert Applications and Templates
- AppQoE
- Entity Templates
- HTTP Callouts
- Pattern Sets and Data Sets
- Variables
- Policies and Expressions
- Rate Limiting
- Responder
- Rewrite
- String Maps
- URL Sets
AppFlow
- Configuring the AppFlow Feature
- Exporting Performance Data of Web Pages to AppFlow Collector
- Session Reliability on NetScaler High Availability Pair
Application Firewall
- FAQs and Deployment Guide
- Introduction
  - Web Application Security
  - How The Application Firewall Works
  - The Application Firewall Configuration Interfaces
- Configuring the Application Firewall
  - Enabling the Application Firewall
  - The Application Firewall Wizard
  - Manual Configuration
  - Manual Configuration By Using the Configuration Utility
  - Manual Configuration By Using the Command Line Interface
- Signatures
  - Manually Configuring the Signatures Feature
  - Adding or Removing a Signatures Object
  - Configuring or Modifying a Signatures Object
  - Protecting JSON Applications using Signatures
  - Updating a Signatures Object
  - Exporting a Signatures Object to a File
  - The Signatures Editor
  - Signature Updates in High-Availability Deployment and Build Upgrades
- Overview of Security checks
- Top-Level Protections
  - HTML Cross-Site Scripting Check
  - HTML SQL Injection Checks
  - Buffer Overflow Check
  - Cookie Consistency Check
  - Application Firewall Support for Google Web Toolkit
- Data Leak Prevention Checks
  - Credit Card Check
  - Safe Object Check
- Advanced Form Protection Checks
  - Field Formats Check
  - Form Field Consistency Check
  - CSRF Form Tagging Check
  - Managing CSRF Form Tagging Check Relaxations
- URL Protection Checks
  - Start URL Check
  - Deny URL Check
- XML Protection Checks
  - XML Format Check
  - XML Denial-of-Service Check
  - XML Cross-Site Scripting Check
  - XML SQL Injection Check
  - XML Attachment Check
  - Web Services Interoperability Check
  - XML Message Validation Check
  - XML SOAP Fault Filtering Check
- Managing Content Types
- Profiles
  - Creating Application Firewall Profiles
  - Configuring Application Firewall Profiles
  - Changing an Application Firewall Profile Type
  - Exporting and Importing an Application Firewall Profile
  - Configuring and Using the Learning Feature
  - Supplemental Information about Profiles
- Policy Labels
- Policies
  - Firewall Policies
  - Auditing Policies
- Imports
  - Importing and Exporting Files
- Global Configuration
  - Engine Settings
  - Confidential Fields
  - Field Types
  - XML Content Types
  - JSON Content Types
- Statistics and Reports
- Application Firewall Logs
- Appendices
  - PCRE Character Encoding Format
  - Whitehat WASC Signature Types for WAF Use
  - Streaming Support for Request Processing
  - Trace HTML Requests with Security Logs
  - Application Firewall Support for Cluster Configurations
- Debugging and Troubleshooting
  - High CPU
  - Memory
  - Large File Upload Failure
  - Learning
  - Signatures
  - Trace Log
  - Miscellaneous
  - References
Cache Redirection
- Cache redirection policies
  - Built-in cache redirection policies
  - Configure a cache redirection policy
- Cache redirection configurations
- Selective cache redirection
- Administer a cache redirection virtual server
- N-tier cache redirection
  - Configure the upper-tier NetScaler appliances
  - Configure the lower-tier NetScaler appliances
Clustering
- NetScaler configuration support in a cluster
- Prerequisites for cluster nodes
- Cluster overview
- Setting up a NetScaler cluster
- Distributing traffic across cluster nodes
  - Using Equal Cost Multiple Path (ECMP)
  - Using cluster link aggregation
- Managing the NetScaler cluster
- Cluster setup and usage scenarios
- Upgrading or downgrading the NetScaler cluster
- Operations supported on individual cluster nodes
- FAQs
- Troubleshooting the NetScaler cluster
  - Tracing the packets of a NetScaler cluster
  - Troubleshooting common issues
Content Switching
- Configuring Basic Content Switching
- Customizing the Basic Content Switching Configuration
- Content Switching for Diameter Protocol
- Protecting the Content Switching Setup against Failure
- Managing a Content Switching Setup
- Managing Client Connections
- Troubleshooting
DataStream
- Configuring Database Users
- Configuring a Database Profile
- Configuring Load Balancing for DataStream
- Configuring Content Switching for DataStream
- Configuring Monitors for DataStream
- Use Case 1: Configuring DataStream for a Master/Slave Database Architecture
- Use Case 2: Configuring the Token Method of Load Balancing for DataStream
- Use Case 3: Logging MSSQL Transactions in Transparent Mode
- Use Case 4: Database Specific Load Balancing
- DataStream Reference
Domain Name System
- Configure DNS resource records
- Configure a DNS zone
- Configure the NetScaler as an ADNS server
- Configure the NetScaler as a DNS proxy server
- Configure the NetScaler as an end resolver
- Configure the NetScaler as a forwarder
- Configure DNS logging
- Configure DNS suffixes
- DNS ANY query
- Configure negative caching of DNS records
- Domain name system security extensions
Firewall Load Balancing
- Sandwich Environment
- Enterprise Environment
- Multiple-Firewall Environment
Global Server Load Balancing
- How GSLB Works
- GSLB Deployment Types
  - Active-Active Site Deployment
  - Active-Passive Site Deployment
  - Parent-Child Topology Deployment using the MEP Protocol
- GSLB Configuration Entities
- Configuring Global Server Load Balancing (GSLB)
  - Configuring an Authoritative DNS Service
  - Configuring a Basic GSLB Site
  - Configuring a GSLB Service
  - Configuring a GSLB Virtual Server
  - Binding GSLB Services to a GSLB Virtual Server
  - Binding a Domain to a GSLB Virtual Server
  - Synchronizing a Configuration in a GSLB Setup
- Testing the GSLB setup
- Configuring the Metrics Exchange Protocol (MEP)
- Configuring Site-to-Site Communication
- Customizing Your GSLB Configuration
- Changing the GSLB Method
- Configuring Static Proximity
  - Adding a Location File to Create a Static Proximity Database
  - Adding Custom Entries to a Static Proximity Database
  - Setting the Location Qualifiers
  - Specifying the Proximity Method
  - Synchronizing GSLB Static Proximity Database
- Configuring the Dynamic Method (RTT)
- Configuring Persistent Connections
- Overriding Static Proximity Behavior by Configuring Preferred Locations
- Monitoring GSLB Services
- Monitoring GSLB Sites
- Protecting the GSLB Setup Against Failure
- Managing Client Connections
- Configuring GSLB for Disaster Recovery
- Configuring GSLB for Proximity
- Example of a Complete Parent-Child Configuration Using the Metrics Exchange Protocol
- Configuring GSLB Service Selection Using Content Switching
- Configuring Global Server Load Balancing for DNS Queries with NAPTR records
- Using the EDNS0 Client Subnet Option for Global Server Load Balancing
Link Load Balancing
- Configuring a Basic LLB Setup
- Configuring RNAT with LLB
- Configuring a Backup Route
- Resilient LLB Deployment Scenario
- Monitoring an LLB Setup
Load Balancing
- How load balancing works
- Set up basic load balancing
- Load balance virtual server and service states
- Support for load balancing profile
- Load balancing algorithms
  - Least connection method
  - Round robin method
  - Least response time method
  - Hashing methods
  - Least bandwidth method
  - Least packets method
  - Custom load method
  - Static proximity method
  - Token method
  - Configure a load balancing method that does not include a policy
- Persistence and persistent connections
  - About Persistence
  - Source IP address persistence
  - HTTP cookie persistence
  - SSL session ID persistence
  - Diameter AVP number persistence
  - Custom server ID persistence
  - IP address persistence
  - SIP Call ID persistence
  - RTSP session ID persistence
  - Configure URL passive persistence
  - Configure persistence based on user-defined rules
  - Configure persistence types that do not require a rule
  - Configure backup persistence
  - Configure persistence groups
  - Configure RADIUS load balancing with persistence
  - View persistence sessions
  - Clear persistence sessions
  - Override persistence settings for overloaded services
  - Troubleshooting
- Customize a load balancing configuration
  - Customize the hash algorithm for persistence across virtual servers
  - Configure the redirection mode
  - Configure per-VLAN wildcarded virtual servers
  - Assign weights to services
  - Configure the MySQL and Microsoft SQL server version setting
- Configure diameter load balancing
- Configure FIX load balancing
- Protect a load balancing configuration against failure
  - Redirect client requests to an alternate URL
  - Configure a backup load balancing virtual server
  - Configure spillover
  - Connection failover
  - Flush the surge queue
- Manage a load balancing setup
  - Manage server objects
  - Manage services
  - Manage a load balancing virtual server
  - Load balancing visualizer
- Manage client traffic
  - Configure sessionless load balancing virtual servers
  - Redirect HTTP requests to a cache
  - Direct requests according to priority
  - Direct requests to a custom web page
  - Enable cleanup of virtual server connections
  - Rewrite ports and protocols for HTTP redirection
  - Insert IP address and port of a virtual server in the request header
  - Use a specified source IP for backend communication
  - Set a time-out value for idle client connections
  - Manage RTSP connections
  - Manage client traffic on the basis of traffic rate
  - Identify a connection with layer 2 parameters
  - Configure the prefer direct route option
  - Use a source port from a specified port range for backend communication
  - Configure source IP persistency for backend communication
- Advanced load balancing settings
  - Gradually stepping up the load on a new service with virtual server–level slow start
  - The no-monitor option for services
  - Protect applications on protected servers against traffic surges
  - Enable cleanup of virtual server and service connections
  - Graceful shutdown of services
  - Direct requests to a custom web page
  - Enable access to services when down
  - Enable TCP buffering of responses
  - Enable compression
  - Maintain client connection for multiple client requests
  - Insert the IP address of the client in the request header
  - Use source IP address of the client when connecting to the server
  - Configure the source port for server-side connections
  - Set a limit on the number of client connections
  - Set a limit on number of requests per connection to the server
  - Set a threshold value for the monitors bound to a service
  - Set a timeout value for idle client connections
  - Set a timeout value for idle server connections
  - Set a limit on the bandwidth usage by clients
  - Redirect client requests to a cache
  - Retain the VLAN identifier for VLAN transparency
  - Configure automatic state transition based on percentage health of bound services
- Built-in monitors
  - TCP-based application monitoring
  - SSL service monitoring
  - FTP service monitoring
  - Secure monitoring of servers by using SFTP
  - Set SSL parameters on a secure monitor
  - SIP service monitoring
  - RADIUS service monitoring
  - Monitor accounting information delivery from a RADIUS server
  - DNS and DNS-TCP service monitoring
  - LDAP service monitoring
  - MySQL service monitoring
  - SNMP service monitoring
  - NNTP service monitoring
  - POP3 service monitoring
  - SMTP service monitoring
  - RTSP service monitoring
  - XML broker service monitoring
  - ARP request monitoring
  - XenDesktop Delivery Controller service monitoring
  - Web interface service monitoring
  - Citrix StoreFront stores monitoring
- Custom monitors
  - Configure HTTP-inline monitors
  - Understand user monitors
  - How to use a user monitor to check web sites
  - Understand the internal dispatcher
  - Configure a custom user monitor
  - Understand load monitors
  - Configure load monitors
  - Unbind metrics from a metrics table
  - Configure reverse monitoring for a service
- Configure monitors in a load balancing setup
  - Create monitors
  - Bind monitors to services
  - Modify monitors
  - Enable and disable monitors
  - Unbind monitors
  - Remove monitors
  - View monitors
  - Close monitor connections
  - Ignore the upper limit on client connections for monitor probes
- Manage a large scale deployment
  - Ranges of virtual servers and services
  - Configure service groups
  - Manage service groups
  - Configure automatic domain based service group scaling
  - Translate the IP address of a domain-based server
  - Mask a virtual server IP address
- Configure load balancing for commonly used protocols
  - Load balance a group of FTP servers
  - Load balance DNS servers
  - Load balance domain-name based services
  - Load balance a group of SIP servers
  - Load balance RTSP servers
  - Load balance remote desktop protocol (RDP) servers
- Use case 1: SMPP load balancing
- Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
- Use case 3: Configure load balancing in direct server return mode
- Use case 4: Configure LINUX servers in DSR mode
- Use case 5: Configure DSR mode when using TOS
- Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
- Use case 7: Configure load balancing in DSR mode by using IP Over IP
- Use case 8: Configure load balancing in one-arm mode
- Use case 9: Configure load balancing in the inline mode
- Use case 10: Load balancing of intrusion detection system servers
- Use case 11: Isolating network traffic using listen policies
- Use case 12: Configure XenDesktop for load balancing
- Use case 13: Configure XenApp for load balancing
- Use case 14: ShareFile wizard for load balancing Citrix ShareFile
- Troubleshooting
- Load balancing FAQs
Networking
- IP Addressing
- Interfaces
- Access Control Lists
- IP Routing
- Internet Protocol version 6 (IPv6)
- Traffic Domains
  - Inter Traffic Domain Entity Bindings
  - VMAC Based Traffic Domains
- VXLAN
Optimization
- Client Keep-Alive
- HTTP Compression
- Integrated Caching
- Front End Optimization
- Content Accelerator
- Media Classification
Reputation
- IP Reputation
SSL offload and acceleration
- Configuring SSL Offloading
  - Differences between the Old and the New SSL Profile Infrastructure
  - Enabling the Default Profiles
  - Loading an Old Configuration
  - Appendix A: Sample Migration of the SSL Configuration after Upgrade
  - Appendix B: Default Front-End and Back-End SSL Profile Settings
- Managing Certificates
  - Obtaining a certificate from a certificate authority
  - Importing Existing Certificates and Keys
  - Generating a Test Certificate
  - Generating a Diffie-Hellman (DH) Key
  - Adding a Group of SSL Certificates
  - Updating an Intermediate Certificate without Breaking the Links
  - Displaying a Certificate Chain
  - Generating a Server Test Certificate
  - Achieving Perfect Forward Secrecy With DHE
  - Modifying and Monitoring Certificates and Keys
  - Using Global Site Certificates
  - Converting the Format of SSL Certificates for Import or Export
  - Enabling Stricter Control on Client Certificate Validation
- Managing Certificate Revocation Lists
- Monitoring Certificate Status with OCSP
- Providing the Revocation Status of a Server Certificate to a Client
- Configuring Client Authentication
- Customizing the SSL Configuration
  - Configuring Diffie-Hellman (DH) Parameters
  - Configuring Ephemeral RSA
  - Configuring Session Reuse
  - Support for TLS Session Ticket Extension
  - Secure Implementation of Session Tickets
  - Configuring Cipher Redirection
  - Configuring SSLv2 Redirection
  - Configuring SSL Protocol Settings
  - Configuring Close-Notify
  - Configuring ECDHE Ciphers
  - Leveraging Hardware and Software to Improve ECDHE Cipher Performance
  - ECDSA cipher suites support on NetScaler appliances
  - Configuring a Common Name on an SSL Service or Service Group for Server Certificate Authentication
  - Configuring Advanced SSL Settings
  - Synchronizing Configuration Files in a High Availability Setup
  - Managing Server Authentication
  - Configuring User-Defined Cipher Groups on the NetScaler Appliance
- Configuring SSL Actions and Policies
  - Configuring User-Defined Actions for SSL Policies
  - Configuring SSL Policies
  - Configuring an SSL Default Syntax Policy
  - Configuring Built-in Actions for SSL Default Syntax Policies
  - Configuring SSL Policy Labels
  - Configuring Per-Directory Client Authentication
  - Configuring Support for Outlook Web Access
  - Configuring SSL-Based Header Insertion
  - Binding SSL Policies to a Virtual Server
  - Binding SSL Policies Globally
- Use Case 1: Configuring SSL Offloading with End-to-End Encryption
- Use Case 2: Configuring Transparent SSL Acceleration
- Use Case 3: Configuring SSL Acceleration with HTTP on the Front End and SSL on the Back End
- Use Case 4: SSL Offloading with Other TCP Protocols
- Use Case 5: Configuring SSL Bridging
- Use Case 6: Configuring SSL Monitoring when Client Authentication is Enabled on the Backend Service
- Use Case 7: Configuring a Secure Content Switching Server
- FIPS Approved Ciphers
- Cipher/Protocol Support Matrix on the NetScaler Appliance
- Server Certificate Support Matrix on the NetScaler Appliance
- Support for MPX 5900 and MPX/SDX 8900 Platforms
- MPX 9700/10500/11-1500/15500 FIPS appliances
  - Configuring the HSM
  - Creating and Transferring FIPS Keys
  - Configure FIPS appliances in a high availability setup
  - Update the firmware to version 2.2 on a FIPS card
  - Reset a locked HSM
  - FIPS Approved Algorithms and Ciphers
- MPX 14000 FIPS appliances
  - Configuring the HSM on the MPX 14000 FIPS Appliance
  - Creating FIPS Keys on the MPX 14000 FIPS Appliance
- Configuring an SDX 14000 FIPS Appliance
  - Limitations
  - Terminology
  - Initializing the HSM
  - Creating partitions
  - Provisioning a New Instance or Modifying an Existing Instance and Assigning a Partition
  - Configuring the HSM for an Instance on an SDX 14030/14060/14080 FIPS Appliance
  - Creating a FIPS Key for an Instance on an SDX 14030/14060/14080 FIPS Appliance
  - Upgrading the FIPS Firmware on a VPX Instance
- Support for a Hybrid FIPS Mode on the MPX/SDX 14000 FIPS Platform
- Support for Thales nShield® HSM
  - Architecture overview
  - Prerequisites
  - Configure the ADC-Thales integration
  - Limitations
  - Appendix
- Support for SafeNet Network Hardware Security Module
  - Prerequisites
  - Configure a SafeNet client on the ADC
  - Additional ADC configuration
  - High Availability Setup
  - Limitations
  - Appendix
  - FAQ
- Troubleshooting
- SSL FAQs
Security
System
- Basic operations
- Authentication and authorization
- TCP Configurations
- HTTP Configurations
  - Configuring HTTP/2 on the NetScaler Appliance
- SNMP
- Audit Logging
- Web Server Logging
- Call Home
- Reporting Tool
- AutoScale
- CloudBridge Connector
- High Availability
- TCP Optimization
Reference Material

This content has been machine translated dynamically.

Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)

Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)

Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)

This content has been machine translated dynamically.

Switch to english Auf Englisch anzeigen Lire en anglais Leer en inglés Switch to english Switch to english Switch to english

Translation failed!

Configuring Global Server Load Balancing (GSLB)

Feb 13, 2017

Global server load balancing is used to manage traffic flow to a web site hosted on two separate server farms that ideally are in different geographic locations. For example, consider a Web site, www.mycompany.com, which is hosted on two geographically separated server farms or data centers. Both server farms use NetScaler appliances. The NetScaler appliances in these server farms are set up in one-arm mode and function as authoritative DNS servers for the www.mycompany.com domain. The following figure illustrates this configuration.

Figure 1. Basic GSLB Topology

localized image

To configure such a GSLB setup, you must first configure a standard load balancing setup for each server farm or data center. This enables you to balance load across the different servers in each server farm. Then, configure both NetScaler appliances as authoritative DNS (ADNS) servers. Next, create a GSLB site for each server farm, configure GSLB virtual servers for each site, create GLSB services, and bind the GSLB services to the GSLB virtual servers. Finally, bind the domain to the GSLB virtual servers. The GSLB configurations on the two appliances at the two different sites are identical, although the load-balancing configurations for each site is specific to that site.

Note: To configure a GSLB site in a NetScaler cluster setup, see Setting Up GSLB in a Cluster.

Configuring a Standard Load Balancing Setup

Updated: 2013-08-30

A load balancing virtual server balances the load across different physical servers in the data center. These servers are represented as services on the NetScaler appliance, and the services are bound to the load balancing virtual server.

For details on configuring a basic load balancing setup, see Load Balancing.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

THIS SERVICE MAY CONTAIN TRANSLATIONS POWERED BY GOOGLE. GOOGLE DISCLAIMS ALL WARRANTIES RELATED TO THE TRANSLATIONS, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTIES OF ACCURACY, RELIABILITY, AND ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Send us your feedback about this article

Support: https://www.citrix.com/support

Feedback and forums: https://discussions.citrix.com