Integrate NetScaler Gateway with StoreFront or StoreFront Cloud for HDX routing only

Last published : Sep 03, 2026
This article describes how to configure a NetScaler Gateway virtual server for HDX routing only. In this configuration, the NetScaler Gateway does not provide any authentication or remote access to StoreFront. Instead you only use the NetScaler Gateway to proxy the HDX (ICA) connection between the user's endpoint and the virtual apps and desktops in your resource location.
Related information
Integrating with Citrix® products

Use cases

This configuration can be used in the following scenarios.

StoreFront

By default when using StoreFront, the same NetScaler Gateway is used to both provide remote access to StoreFront and to the virtual apps and desktops. However if you have resources in a separate location to the StoreFront server, you may deploy a NetScaler Gateway to that location for HDX routing only. Use StoreFront's Optimal gateway routing feature to tell Storefront to use that gateway to reach the resources in a specific site or zone.

StoreFront Cloud

Unlike an on-premises StoreFront deployment, StoreFront Cloud hosts the store UI and performs user authentication itself. Therefore, you should configure the NetScaler Gateway for HDX routing only.

Prerequisites

  • A NetScaler Gateway instance reachable from the internet, with a valid SSL certificate available to bind to the virtual server.
  • A resource location added to Citrix Cloud with Cloud Connectors installed.

Configure NetScaler Gateway for HDX routing

To configure NetScaler Gateway for HDX routing with StoreFront Cloud, complete the following steps:
  1. Create a session profile and policy
  2. Create a NetScaler Gateway virtual server
  3. Add the NetScaler Gateway to StoreFront or StoreFront Cloud

1. Create a session profile and policy

  1. Navigate to Configuration > NetScaler Gateway > Policies > Session.
  2. In the Session Profiles tab, click Add.
  3. Assign a name to the session profile.
  4. In the Client Experience tab, set Session Time-out (mins) to Override Global and specify a value. This is an inactivity timeout: it is reset by network traffic and does not disconnect an active HDX connection, since ICA traffic keeps the session from going idle. It only ends the session if the connection is genuinely idle for the configured duration.
  5. In the Security tab, enable Default Authorization Action and set it to ALLOW.
  6. In the Published Applications tab, set ICA Proxy to ON.
  7. Click Create.
  8. In the Session Policies tab, click Add.
  9. In Name, assign a name to the session policy.
  10. In Profile, select the session profile that you created.
  11. In Expression, enter true so that the policy applies to all connections to this virtual server.
  12. Click Create.

2. Create a NetScaler Gateway virtual server

  1. Navigate to Configuration > NetScaler Gateway > Virtual Servers and click Add.
  2. Assign a name and IP address, then click Continue.
  3. In Basic Settings, clear Enable Authentication and select ICA Only.
  4. Bind a certificate.
    1. In the Certificate section, click No Server Certificate.
    2. Under Select Server Certificate, choose the SSL certificate for the public FQDN of this virtual server, or click Add to install one if it is not already available.
    3. Click Bind.
  5. Click Continue.
  6. Bind the policy.
    1. In the Policies section, click +.
    2. Leave Choose Policy as Session and Choose Type as Request and select Continue.
    3. Under Policy Binding, click in Click to select.
    4. Select the session policy that you created in the previous step and click Select.
    5. Click Bind.
  7. Add the STA servers.
    1. In the Advanced Settings column, click Published Applications to add that section to the virtual server.
    2. In the Published Applications section, click No STA Server.
    3. Enter the address of a Cloud Connector in the resource location then click Bind.
    4. Repeat for every Cloud Connector in the resource location.
  8. Click Done.

3. Add the NetScaler Gateway to StoreFront or StoreFront Cloud

If you are using StoreFront Cloud, see Connectivity to DaaS resources.
If you are using StoreFront on-premises, see Configure Citrix Gateways. Set the Usage or role to HDX routing only.