Hello all, We are testing a new citrix gateway vip. With local host entry to that vip ip, we are able to access the portal and apps. We'd like to allow this vip to be visible only to our test/validation team members home or public ip. how can we allow citrix gateway vip to only specific ips? Also, is it done through allowing public ips, or allowing private ips for our validation users?

in your Public DNS you would need a A record to point the NS GW URL at your public IP. If that is not possible at this stage you would have to get them to use the windows host file. On your edge firewall that the Netscalers sits behind you will be able to allow traffic from a specific source IP (Public ip of testers) to the NS GW public IP on tcp/udp 443

public dns - A record is already created. We want to know if there is an internal way in doing it from within the netscaler.

Would an AD group be viable? if not, you're loooking at a responder policy with all the public IPs on the gateway

Couple of things: • you want to filter on the test user’s public ip address. so it will matter if you do Destination NAT/Port forwarding on the firewall. If you are doing NAT, you can do the filtering there. • If you don’t do NAT, because the NS uses public ip addresses, or you can’t filter on the firewall, you can put a responder on the gateway domain and ip address to only allow specific source ip address. But it all depends on the public record that you can/will use. If it is the same record as your current environment, you’ll have to use a hosts file…

Found a way to do it: Create data set, responder policy, bind that responder policy to the gateway vip. https://www.knowcitrix.com/posts/allow-netscaler-gateway-to-few-ips/