Anyone have experience connecting an on-prem Citrix gateway (Netcaler) as external access for a resource location in Citrix Cloud? I'm just getting STA error when connecting through this gateway, even though the Citrix Cloud "STA test" is OK.

I assume you are referring to the checkbox? by default, the management IP performs the check. If an outgoing WAN connection from the mgmt IP is prohibited (which it should), the check will fail.