Once the web interface gets the ticket (a random 32 character hash value) from the STA, it builds the ICA file to present back to the client and this value will be included. When a user hits the Access Gateway and comes in through the web interface, the web interface will send this request to the STA. The ctxsta.dll is an ISAPI extension for IIS that will take the ticket request, process it, and send back the generated ticket. You may be using port 80 so you would not to enter the port. In my case, I am using port 8080 for the XML Service port so that needs to reflect here in my STA URLs. All it will be used for is to pull the ticket hash value when a client hits the web interface and then later to validate that ticket. Just 2-3 STAs for redundancies sake is enough. You DO NOT need to add an STA from every farm you are connecting to. The last page is to add the STAs (Secure Ticket Authorities). So keep that in mind when opening up firewall ports: So this means all ICA traffic will be on port 1494, not 2598. Session Reliability is not supported on iPad and other devices using Citrix Receiver. Also make sure to disable Session Reliability. This is presented to your iPad and other devices through the Web Interface in the form of an ICA file later so it needs to be the same. This is the site that will be handling traffic from the CAG (Citrix Access Gateway): This one is setup as Gateway Direct mode. The second site is the one I created manually called “AccessGateway”. This services site is setup for Direct access and will service all my internal iPads and other devices that need it. The default site is PNAgent (which is a reference to the old legacy Program Neighborhood).

So I need to make sure I have 2 Services sites on my web interface: I want anyone external to have to come in through the Access Gateway to get access. In this example, I want users sitting inside the building with their iPads connected to the corporate WiFi direct access to XenApp and XenDesktop. First you need to prep your Citrix Web Interfaces. This can be done pretty easily using a Netscaler and the Access Gateway (aka CAG/Citrix Access Gateway, AGEE/Access Gateway Enterprise Edition) which is an SSL VPN among other things. So you want to give iPads, iPhones, Android phones and other mobile devices and tablets that have Citrix Receiver access to your enterprise infrastructure securely.

Netscaler gateway citrix receiver