System requirements and prerequisites
The following sections provide more information about system requirements and prerequisites.
Software version requirements
The following software versions are required for the Citrix SecurAccess™ ZTNA hybrid configuration:
-
NetScaler: 14.1–66.54 and later
-
StoreFront: 2507 LTSR CU1 or 2511 CR and later
-
Cloud Connector: 6.141.0 / 4.420.200 and later
The following minimum software versions are required on the end user devices:
-
For web/SaaS applications:
-
Google Chrome: 142
-
Citrix Workspace app for Windows: 2507.1 LTSR or 2508
-
Citrix Workspace app for Mac: 2508.10
-
-
For TCP/UDP applications:
-
Citrix SecurAccess for Windows: 25.5.1.15
-
Citrix SecurAccess for Mac: 25.11.1.1
-
-
For endpoint analysis (EPA):
-
EPA client for Windows: 25.10.1.7
-
EPA client for Mac: 25.10.3
-
Firewall requirements
The following firewall requirements assume that the standard HTTPS port 443 is used for StoreFront servers and the StoreFront load balancer. If a non-standard port is used, adjust the port settings accordingly.
| Source | Source IP | Destination | Protocol | Port | Description |
|---|---|---|---|---|---|
| Internet | Any | NetScaler Gateway | TCP | 443 | - |
| StoreFront servers | StoreFront server machine IP address | Citrix SecurAccess ZTNA load balancer | TCP | 443 | - |
| Cloud Connector | Cloud Connector machine IP address | Active Directory | TCP | 389 or 636 | - |
If same NetScaler contains gateway and load balancers for StoreFront and Citrix SecurAccess ZTNA configurations:
| Source | Source IP | Destination | Protocol | Port | Description |
|---|---|---|---|---|---|
| NetScaler | NetScaler Subnet IP (SNIP) address | StoreFront servers | TCP | 443 | - |
| NetScaler | NetScaler Subnet IP (SNIP) address | Cloud Connector | TCP | 8443 | Assuming the default port is used for Citrix SecurAccess ZTNA |
| NetScaler | NetScaler Subnet IP (SNIP) address | NetScaler outbound proxy | TCP | Depends on the outbound proxy port | - |
| NetScaler | NetScaler Subnet IP (SNIP) address | Backend applications (Web app or client/server apps) | Depends on the back-end application protocol | Depends on the back-end application port | - |
If different NetScalers are used for gateway and load balancers for StoreFront and Citrix SecurAccess ZTNA configurations:
| Source | Source IP | Destination | Protocol | Port | Description |
|---|---|---|---|---|---|
| NetScaler Gateway | NetScaler Subnet IP (SNIP) address | StoreFront Load balancer | TCP | 443 | - |
| StoreFront load balancer | StoreFront load balancer IP address | StoreFront servers | TCP | 443 | - |
| NetScaler Gateway | NetScaler Subnet IP (SNIP) address | Citrix SecurAccess ZTNA load balancer | TCP | 443 | - |
| Citrix SecurAccess ZTNA load balancer | Citrix SecurAccess ZTNA load balancer IP | Cloud Connectors | TCP | 8443 | Assuming the default port is used for Citrix SecurAccess ZTNA |
| NetScaler Gateway | NetScaler Subnet IP (SNIP) address | NetScaler outbound proxy | TCP | Depends on the outbound proxy port | - |
| NetScaler Gateway | NetScaler Subnet IP (SNIP) address | Backend applications (Web app or client/server apps) | Depends on the backend application protocol | Depends on the back-end application port | - |