With each new wave of vulns I'm more open to the idea of using the Citrix Gateway Service to do HDX proxy for our on prem environments. After migrating to EXO the only things we're load balancing at this point are StoreFront and Director - still running VAD on prem for the time being. I realize doing so involves giving up some control over availability but the scales have tilted in my mind for removing our public facing NetScaler presence. Am I a crazy person? Is there anyone here that's gone down this path that wants to talk me off the ledge?

There are quite alot of Citrix customers using gateway service. I think its a great solution if you are Ok wiht the availability service levels.

The biggest challenge I've seen companies experience in moving that direction is you can't say why it's down nor can you predict how long it is down etc. The impression their users have gotten is that because the IT team is not “working on the problem” then they don't know etc. instead of the fact that fixing the problem is out of your hands. The environment is not down often, but when it is, it seems to me that customers are less patient or understanding. Maybe it's my experience, but that's what I've seen. It's not a bad idea, just know the pros and cons before you make the switch. And there are ways to make your controlled NetScalers update quickly and automatically if you want.

Most of our users, probably 80-90% during business hours, are on prem anyway. My answer to an outage would be use VPN as a backup if you have time sensitive duties, use M365 for the things you can, or deal with it. 😅 theoretically.