We are currently using Citrix Netscaler to provide users with Virtual Desktops. Netscaler is located in DMZ and has access from whole internet. Unfortunately Netscaler has access to LDAP (to authenticate users) and Citrix Desktop Servers (for Virtual Desktops) that are located in LAN. IMO it is not very secure and in such case DMZ looses its point since no traffic should be normally flowing from DMZ to LAN. If Netscaler will get compromised attacker would easily gain further access to the whole LAN afterwards.

What are your thoughts/opinions? Is there any other approaches where to better place those components? Maybe there are some Citrix recommendations about this?


You simply cannot deploy a citrix netscaler without access to the LAN behind it... remember, that you want to securely give access to Virtual Desktops to your users, so the netscaler must be able to forward traffic to the hosted servers!

Of course, you could cut off LDAP authentication, and establish some sort of authentication servers (the Netscaler / VPX instance has such options). But in my point of view, this makes no sense, and creates a lot of work afterwards.

The only thing what makes sense is to move netscaler / LDAP server (probably windows domain controller) and Windows Terminal Servers to its own dedicated LAN (VLAN), so that it is separated from the rest of your network. And, you can deploy a firewall between netscaler and your hosted servers, since the ports in use are well known...

[Edit] In response to the comment below:

  • a vpn in front of netscaler gets you nowhere - from the attackers point of view, it doesn't matter if he attacks IP a.b.c.d or IP e.f.g.h ...
  • 2FA is possible and supported by Citrix, this is definitely an option for increased security. Just remember that your users need to enter the 2FA every time they login, so this might create some "annoyance"...
  • In your Virtual Desktop Deployment, you are able to define a Group of users, which are allowed to access the deployment - so you are able to define a group which does not contain any Domain Admin - it is a good idea to disallow Domain Admins the login from outside...
  • Don't forget the firewall! if your netscaler gets compromised, the firewall is your first line of defence!
  • Maybe it is worth having some sort of VPN in front of Netscaler? Maybe it is worth having a copy of users (excl. admins) of domain controller in DMZ that is being pushed from LAN? Maybe it is worth having 2FA for Virtual Desktops if it even possible? I completely understand that it is not possible to cut Netscaller from accessing LDAP or Virtual Desktops however I would like to understand what are the options to limit security related risks.
    – user54507
    Nov 4 '20 at 9:00
  • I've extended my response according to your questions...
    – Martin
    Nov 4 '20 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.