In XenApp and XenDesktop, you can configure the servers to only accept connections that are routed through NetScaler Gateway. In XenApp 6.5, you configure a policy in Citrix AppCenter to route connections through NetScaler Gateway. In XenDesktop 7.1, you use Citrix Studio to configure the settings.
You can restrict access to a Delivery Group's machines. You can restrict access for users by using SmartAccess that filters user connections made through NetScaler Gateway. You can perform this task in the Policy node in Studio, or through policy settings as described in Quick reference table.