Citrix secure gateway, DMZ settings not working as expected

Question

Here's the scenario.

I have a client with an old Citrix farm (PS4.5 + CSG 3.1),

On doing some discovery about the network I discovered that all their Citrix connection traffic coming from the web interface goes through a CSG, whether it's internal or external. This CSG is under lots of load and is struggling to cope with it as it's old hardware ... After doing some reading I found that there are DMZ settings within the web interface settings that should allow me to point internal IP range directly to the server, and external IPs to the CSG.

I configured the settings as so under the "Edit DMZ Settings" window (cant post an image):

Client IP | Mask | Access method

172.16.0.0 255.255.0.0 Direct

Default Gateway Direct

However, in this setup all connections are still going through the gateway. I know the settings are actually applying because if I change the default to "Direct", external access stops working (!).

Does anyone have any advice on this? This setting doesn't seem to do what it's supposed to :(

Answer 1

I built this up in my home lab environment (thank god for virtualisation!) and this functionality doesn't work if the Web Interface and Secure Gateway are on the same server. However, if you split the WI and CSG roles onto different servers, it works as expected (internal traffic in the specified local subnet goes direct, external uses CSG). I doubt many others are using a setup this old and convoluted but hopefully this helps someone ;)