High availability deployments

Last published : Nov 13, 2026
You can configure high availability for Citrix SecurAccess™ ZTNA in just a few straightforward steps.
High availability deployment
Related information
Advanced Citrix SecurAccess™ ZTNA features

High availability within the data center

The following sections provide more information about high availability within the data center.

NetScaler

For high availability, it is recommended to Create NetScaler high-availability Pair. This is an active-passive NetScaler pair.
If the active NetScaler is down, the passive NetScaler is automatically promoted as active, and all user traffic is routed to the new active NetScaler. Users are not required to re-authenticate as the sessions are also synchronized across the NetScaler high availability pair.
For more details on NetScaler HA pair, see High Availability.

Cloud Connectors (Citrix SecurAccess ZTNA servers)

Configure a NetScaler load balancer for Citrix SecurAccess ZTNA with service group configuration.
  1. Create a new service group on NetScaler: Navigate to Configuration > Traffic Management > Load Balancing > Service Groups.
  2. Click Add.
  3. Enter a Name for the service group, for example, primary_spa_servers.
  4. Depending upon the type of load balancer (SSL or SSL_BRIDGE), choose the appropriate Protocol for the service group.
  5. Leave other fields with default values and click OK to save the service group.
  6. Click No Service Group Member to add Cloud Connectors from the current data center.
  7. Use the IP Based option and add the current data center’s Cloud Connectors IP address and Port. By default, Citrix SecurAccess ZTNA uses port 8443. Other fields can be retained with default values.
  8. Repeat this step if additional Cloud Connectors must be added.
  9. Click Create to create the load balancer service.
  10. Click OK to add the service to the service group.
    Note:
    Optionally you can add an HTTP Monitor for the Citrix SecurAccess ZTNA service. The following URL path can be used to do so.
    /secureAccess/health
    It returns 200 OK if Citrix SecurAccess ZTNA is up and running.
  11. Click Done.
  12. Now create a load balancer. Navigate to Configuration > Traffic Management > Load Balancing > Virtual Servers.
  13. Click Add.
  14. Enter a load balancer name.
  15. Choose the appropriate Protocol, for example, SSL or SSL_BRIDGE.
  16. Set IP Address Type as IP Address and Port as 443.
    Note:
    The protocol must be SSL or SSL_BRIDGE. HTTP type is not supported for Citrix SecurAccess ZTNA load balancer. The port must be 443. Custom HTTPS ports are not supported.
  17. Click OK.
  18. Click No Load Balancing Virtual Server ServiceGroup Binding.
  19. Click to select the service group created earlier, then click Select.
  20. Set Order value as 10. Click Bind, then Continue.
  21. If using SSL type Protocol, click No Server Certificate to bind the appropriate server certificate. For SSL_BRIDGE type load balancer, no server certificate is required in the load balancer, but the server certificate must be configured in the Cloud Connector for Citrix SecurAccess ZTNA service. For details, see Configure TLS/SSL certificates for the Citrix SecurAccess ZTNA service on Cloud Connector.
This concludes the load balancer configuration with the service group for Citrix SecurAccess ZTNA.
All the Citrix SecurAccess ZTNA servers in the load balancer are active. If one Citrix SecurAccess ZTNA server goes down, users are not impacted as the other Citrix SecurAccess ZTNA servers continue to serve the traffic. The Citrix SecurAccess ZTNA servers are stateless, so there is no persistency requirement.

StoreFront servers

StoreFront servers also behave the same as Citrix SecurAccess ZTNA servers during failover within the same data center.