I currently have a citrix secure gateway on a Window sever 2003 behind a firewall (ASA 5505) with the citrix ports forwarding to the citrix servers. It is on the same LAN as the two citrix servers that it points to. When a user connect inside the LAN I want the gateway to give them the private IP address of the citrix server they are trying to connect to and when they connect from the internet I was the public IP to be given.
If I set the connection to direct then everything works on the LAN but since the address in the ICA file will be the private address they can not connect to it.
If I set to gateway direct the public IP will be given and internet users can connect but users on the LAN wont be able to connect. The ASA seems to stopping the connection since it is a LAN IP trying to access the public IP and then come back inside the LAN.
What I ended up doing was changing the setting to translated. I added a DNS record that points to the public address and private address. If you are on the lan it will resolve to the private and if you are on the internet then it resolves to the public. This seems to be working but now on the LAN a couple apps will not load and there are a bunch of SSL handshake errors.
Any sugestions on the proper way to do this?