This message was deleted.

Have you looked at Policy Based Routes? Although if you have a SNIP in each of those networks and it's directly connected, wouldn't there be a direct route it'd use with a distance value of 0? What type of traffic are you talking about sourcing from the NSIP? Maybe I'm confused.

You need a VIP also with your SNIP to have a working flow, only SNIP is not enough.

I think you need to take a step back and clarify what you're trying to setup overall first so we understand whether we're fixing the right issue to begin with. Where are the clients and what are they trying to connect to? Where exactly is the layer 3 switch and how does its routing table compare to the NS? "Providing Citrix Gateway servers into all the networks" doesn't make a ton of sense - a gateway VIP will happily route to anything the NS can see by default until you restrict it via policy/etc. A gateway VIP is just a client-facing entry point, it has nothing to do with backend traffic at all.

Hey, since you are connecting to ldap, could the traffic come from an authentication action? then it would be the nsip if not chanced via et aaa parameter -aaadnatIp ip_addr The other possibility could be that it is the ldap monitor. The monitor uses a custom script (nsldap.pl) and those monitors are always using the nsip. 🙂 Best Regards, Marion SORRY this is totally wrong and more confusing than helping. the answer belongs to another chat.

Additionally, make sure MBF and L3 are off. If PBR don’t do the trick, you might want to use netprofiles. But as @CTXMike said, take a step back first and consider all angles. Solving routing issues over Slack isn’t ideal when you don’t have the complete picture, regardless of what type of traffic you try to handle.

It depends on what you are trying to achieve here, as others have said what reply traffic are we talking about. Also worth nothing for authentication traffic unless it's behind a load balanced VIP the. It will source from the nsip by default, that's for LDAP and radius etc. I'm thinking at the moment that the information we are missing might be that you have separate, domains/Citrix installs in each of these vlans otherwise adding SNIPs to might be unnecessary.