Citrix · Infrastruttura · YoctoIT tech page

NetScaler

The application delivery controller: load balancing, application security and remote access — the apps' traffic, governed.

FOCUS · IN FRONT OF THE APPSLoad balancing, WAF and Gateway: the crossing point that protects and accelerates
Request the Free Assessment Learn more
YoctoIT material for clients and partners · Citrix, NetScaler, HDX and the other products mentioned are trademarks of Cloud Software Group, Inc.
01 · What it is

NetScaler, made clear.

NetScaler stands in front of the applications: it balances (L4-L7, GSLB between sites), protects (WAF, bot management, DDoS), accelerates (SSL offload, caching) and — in the Citrix world — it's the Gateway: the single, authenticated entrance to the HDX sessions, with MFA and smart access. One appliance, many trades done well.

L7
the balancing that understands the application: content switching and persistence
WAF
the application defense: OWASP, bots and zero-days mitigated in front of the app
Gateway
the Citrix entrance: MFA and policies before every session
NetScaler
OFFICIAL CITRIX BRANDING · NETSCALER
CONSOLE REALE · NETSCALER CONSOLE DASHBOARD · FONTE: NETSCALER DOCS
REAL CONSOLE · NETSCALER CONSOLE DASHBOARD · SOURCE: NETSCALER DOCS
02 · How to use it well

The things that make the difference.

The front

Users & internetthe traffic that arrives
LB & GSLB
WAF & bots
Gateway (ICA proxy)
distribute · defend · let in
SSL offload & policiesthe TLS and the rules, centralized
Apps, storefront, APIswhat's behind, protected
One entrance, all the defenses

Config as code

The configurations versioned and promoted per environment: the NetScaler without archaeology.

GSLB between sites

The geographic failover of the workspace and the apps: the user doesn't know which site serves them.

Priority patches

NetScaler is a known target (recurring critical CVEs): our calendar doesn't forgive.

Modern TLS

Ciphers, HSTS and automated certificates: the front door always up to code.

03 · In depth

ADC: Gateway, WAF and GSLB

NetScaler stands in front of everything: as Gateway it's the VDI's single entrance (ICA proxy with MFA, smart access policies), as ADC it balances the apps (L4-L7, content switching, SSL offload with HSM), the WAF protects (signatures + positive security model), the GSLB dispatches between data centers by proximity and health, nFactor builds step-based authentication flows; the forms are MPX (iron), VPX (virtual), CPX (container), managed by console/ADM.

  • ICA Proxy + MFA — the VDI entrance armored: a single 443 exposed, everything else inside
  • nFactor — conditional-factor authentication: certificate+OTP+LDAP depending on who
  • GSLB — the users to the right data center: the entry point's DR
  • WAF — positive model and signatures: the web apps covered even unpatched
  • SSL offload — the cryptography on the ADC: the servers breathe, the keys in the HSM
  • MPX/VPX/CPX — iron, VM or container: the same policy everywhere
04 · Numbers and lifecycle

The numbers that matter.

1
exposed port for the VDI: the Gateway's 443
99,999%
the availability with an HA pair + GSLB
Tbps
the scale of the high-end MPXs
critico
NetScaler patching: historically exploited CVEs, mandatory watch
The NetScaler is the front gate: hardening, timely patching and policies — we guard it as it should be.
05 · Use cases

Where it really pays off.

The Citrix entrance

The redundant Gateway for the workspace.

Critical web apps

Balanced and defended by the WAF.

Multi-site

GSLB: the geographic continuity from the DNS.

Everything passes through the door: NetScaler keeps it open to the right ones and closed to the rest — we guard it.