Hi, I have a client running CVAD 2507. In StoreFront, the enabled authentication methods are AD username and password, Domain pass-through, and Pass-through from Citrix Gateway*.* When users try to add the store in Citrix Workspace using the external URL, for example

<https://access-citrix.com>

, and they are on the internal network, they are still routed through ADC, where 2FA is required. The requirement is that internal users should access StoreFront directly, without going through ADC. My understanding is that I need to create an internal DNS record for

<http://access-citrix.com|access-citrix.com>

that points to an internal VIP/load balancer, which then points to the StoreFront servers. My question is: • should I also change the Store URL, which is currently something like

<https://storefront.domain.local>

, to

<https://access-citrix.com>

? • Also, in this scenario, what should I configure as the internal and external beacons? Thanks for your help!

If you want to use the same URL, you will need to set up some split brain DNS. Externally access-citrix.com will point to the Netscaler, internal DNS will point to your storefront server/ SF LB. Keeping them separate saves some sanity when troubleshooting though. How are internal clients accessing storefront? Are they using a browser, configuring the workspace app or are you deploying the config via GPO? If its the latter, the name really doesn't matter because the workspace app will discover both URL's and redirect the user based on the beacons. If they are manually using a browser or a workspace, have you considered configuring this for them? 🙂 In this case though, its probably easier to have the URL identical internally and externally for simplicity.

Ty for reply! We are using mostly Workspace app. Right now, people are getting 2FA prompt when they access `https://access-citrix.com`from internal network, because its routed thru ADC. I want to achieve to go directly to SFs if they access from internal. So I want to create internall DNS for `https://access-citrix.com`pointing to SF. Questions are: • should I also change the Store URL, which is currently something like

<https://storefront.domain.local>

, to

<https://access-citrix.com>

? • Also, in this scenario, what should I configure as the internal and external beacons?

if your storefront address is something like .local or another internal URL that should be enough. What are your beacons set to currently? If its set to the default, can you ping your storefront FQDN from a workstation that is connecting to the gateway? Workspace tries the internal beacons first to connect directly to storefront. if its unable to reach that address, it will send connections to the internet. Did you add a DNS record for storefront.domain.local within your domain?