hey gang. we proxy all internal and external users through NS gateway. we have one delivery group that we want to block external connections from accessing. I've been playing with access policy at the delivery group level but haven't figured it out yet. anyone done this before?

So I know, it's not a netscaler thing. but you can just create a blocklist of the delivery group and assign an AD group containing external users.

That would block them coming internal or external

In the properties of the delivery group you can pick internal only, internal and Gateway, and Gateway only for allowing logins. https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/delivery-groups-manage.html

All users, internal and external, route thru the GW so not sure it would know the difference

Would something like this work, where AG Farm is the VIP name and Access Condition is the session policy it's matched. The Session Policy expression would be something like client.IP.SRC.IN_SUBNET(10.0.0.0/8)" where the subnet is your internal IP range. And a corresponding policy with a deny and a similar expression with .NOT on the end of it that would be hit by external users. Your Gateway VIP needs to be in smart access mode for this to work.

Then you can set two policies on the gateway. One that connects users on your internal IP addresses at priotity 100 and one that permits all connections at priority 110, then set different session policies on each that permit the delivery groups based on which session policy. Then create the assosicated profiles and that should work for you. https://docs.netscaler.com/en-us/netscaler-gateway/current-release/vpn-user-config/session-policies.html#configure-citrix-vir[…]in-a-session-profile

Just make sure that the gateway is also using smartaccess and not gateway only, also put that in play on your storefront