Question for discussion: StoreFront 2507 + NetScaler Gateway + SNAT issue Hi all, I’m facing an issue with NetScaler Gateway → StoreFront integration that appeared after upgrading StoreFront to 2507 LTSR. Topology: • User logs in to NetScaler Gateway • Gateway forwards traffic to Load Balancer • LB goes through NAT (StoreFront sees requests coming from a pool of NAT IPs) • All requests for a session eventually reach the same StoreFront server but each packet from pool of NAT IP’s (random) Symptoms: • StoreFront 2203 CU4 works fine with this NAT/SNAT setup • After upgrading to StoreFront 2507, login via Gateway fails with: “Cannot complete your request” My suspicion: I suspect that StoreFront 2507 enforces stricter session/client context validation, and a changing IP within a single session may invalidate the auth session, which did not occur in 2203. I could not find any official confirmation in release notes / Citrix documentation. Questions: 1. Has anyone encountered a similar issue using a NAT pool for Gateway → StoreFront traffic on 2507? 2. Does StoreFront 2507 implement new session/IP validation that could cause SNAT pool traffic to fail authentication? 3. Are there any official Citrix articles (CTX) or docs confirming this behavior? Any pointers, links to CTX articles, or experiences with similar cases would be greatly appreciated.

I'd guess IIS before Storefront. What were the underlying OS versions before/after? Could be something as similar as IIS Extended Protection enforcement on the new install, where your 2203 CU4 setup did not have EXTP enabled.

Windows Server 2022 for SF 2507 & Windows Server 2016 for SF 2203 CU4. Maybe some .Net security enhancements… 🤔

previous version of Windows was cut out in the message above

Updated 👍

On second thought, I was conflating two different issues. While I'd still think it's in the IIS/Windows vs a change in Storefront versions, I doubt it's Extended Protection since Gateway -> Storefront wouldn't be doing kerberos/ntlm

Source of issue: probably software bug in ADC. After ubgrade 14.1 from build 56.xx to 66.xx all works fine.