This message was deleted.

correct your NS GW VIP is normally in the DMZ subnet so alot of companies will not allow your SF servers to communicate to the NS GW VIP on 443 for callback as your going from int > DMZ. So you create a dummy NS GW VS/VIP but on the internal subnet range and you bind the SSL cert / STA's on the dummy NS GW VS/VIP. You then configure the callback URL on the Netscaler appliance in SF and add a host file entry that points to the dummy NS GW VIP. Callback is used for smartaccess as well as required if your using SAML

I just use a dummy callback dns record to an internal gw

Cool, thanks Guys. I never knew about that Dummy VIP until last night. Good to know it a real thing

it’s also required when doing single FQDN even without smartaccess

I have another question, if your using a dummy vip for the nsg, after you tell storefront to look here how does it know your connecting externally when the information is not coming through from the dummy vip?

in my experience it only wanted to validate the SSL cert matched

I'm going to be using this for smart access, im trying to understand how to block printers external. The dummy vip just doesn't flow in my brain

I’m almost 100% sure it’s only checking the SSL cert

Ok fair enough. I was reading this. Seems like you dont need nsg policies and can just use it all from studio. Which goes back to the dummy vip. How does it understand that? https://dennisspan.com/making-limited-use-of-citrix-smartaccess-without-universal-licenses/

you can have a dummy vip on the nside leg of that ns, but can’t do double hop

So for me to use smart access I need a call back URL. Then some say uncheck ica on the Netscaler part. But then I was told that didn't matter only of your not using EPA. You can leave it checked and smart access will still work. I'm trying to logically understand how when u have a dummy vip. Are u saying it checks base on the ssl cert from the call back?

for ica proxy mode I’m pretty sure that’s all it does

When u say ica proxy mode that is the ica only box or basic access in other terms?

ica only

Ok. So I'm thinking the dummy vip will not work for smart access for ica proxy mode then. I guess what is confusing me is some articles say uncheck ica and set session policies on Netscaler, then put that in studio. Then some say don't worry about unchecking it and you don't need Netscaler session policies. Very confusing

it all depends on which parts you want to use

Smart control is Netscaler and smart access is studio I thought

yeah I always get them back to front

Just gotta figure out the call back URL deal now. Around the dummy vip and how that actually working

just try setting up an SSL VIP with the cert on it and put it in DNS or the storefront hosts file

Will do Thanks man.

it’s been a while since I had to do it, but I’m almost certain it’ll work if you aren’t using any policies on the NS

Yea I'm reading that as well. I think the dummy vip will work because it's having to perform a call back. Because of it actually being set In the remote location portion of the storefront servers. If it has to do a call back then it understands it's external. I think

i did a blog a while ago on smart access might come in handy https://c4rm0.wordpress.com/improve-security-with-netscaler-smartaccess/

Thank you