I shared my thoughts (again) with Citrix on IP Rep db channel. Currently it requires either direct connection to the webroot to fetch the files or via proxy. If they’d just had the option to install the db manually (even that it’s not up-to-date after 5mins) or an alternate delivery via the Agent. The stuff we’re dealing here with often targets to deploy a webshell, which might render unusable if internet access from NetScaler (initiated by NS) would be blocked. I'm well aware that for bigger enterprises this is not a problem because they often have a proxy or DNS rule cabaple FW. But this is not the case in many smaller envs…