I currently have a citrix secure gateway on a Window sever 2003 behind a firewall (ASA 5505) with the citrix ports forwarding to the citrix servers. It is on the same LAN as the two citrix servers that it points to. When a user connect inside the LAN I want the gateway to give them the private IP address of the citrix server they are trying to connect to and when they connect from the internet I was the public IP to be given.

If I set the connection to direct then everything works on the LAN but since the address in the ICA file will be the private address they can not connect to it.

If I set to gateway direct the public IP will be given and internet users can connect but users on the LAN wont be able to connect. The ASA seems to stopping the connection since it is a LAN IP trying to access the public IP and then come back inside the LAN.

What I ended up doing was changing the setting to translated. I added a DNS record that points to the public address and private address. If you are on the lan it will resolve to the private and if you are on the internet then it resolves to the public. This seems to be working but now on the LAN a couple apps will not load and there are a bunch of SSL handshake errors.

Any sugestions on the proper way to do this?


The correct way is to have two different Web Interface sites set up. One for external use and one for internal use.

The even better way is to put the CSG in between two firewalls, or in your DMZ and then have another Web Interface server behind your firewall for internal use.

Alternatively, can you not configure two different connection types? One Direct, one Gateway Direct?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.