Hi eveyone, hope that you are having a wonderful day. Its quite hot here so not THAT nice 😄 I have an interesting(or maybe not) question that I would like to hear your opinions about. A quite large customer is running 2 Citrix farms and in both citrix farms they have configured one gateway for authentication (IDP/SAML) and the second gateway for HDX routing only. When I check through the NS node, I see that 100+ users are connected through the HDX routing gateway and only a few through the authentication only gateway. The HDX routing gateway has no authentication configured. I'm not sure why they configured it this way and why not just have 1 gateway with bith authentication and HDX routing. Is this separated usually because of security reasons so that all authentication is happening through one gateway while the traffic runs through the HDX routing gateway? its confusing because there are users connected to both of them on the NS. My thought is to implement IDP on the HDX routing only gateway aswell because right now username and password prompt shows up when you launch the HDX routing only gateway URL externally. But then I would have 2 gateways with IDP/SAML where one is for authentication while the second one would be used for HDX routing only WITH IDP activated.. not sure if that would break the login for users but in my world it shouldn't.

I believe normally those settings are for multi-datacenter/region deployments so you can control the resources the appliance is tied to. It can also be used to force internal connections through a gateway for analytics. Is the auth only gateway on an internal only network, or is it also external

its also on external Paul, both of them are available from external endpoints and networks

you could put auth on both if you want, the main reason to have them split is for GSLB with HDX routing. Normally you don't want people logging into one side directly, GSLB will send you to the right place after hitting the auth one.

Thanks Mike, makes sense! good one.