This message was deleted.

Can you give some more information of your infrastructure and how you use and manage your ADC? If your just want to secure your external interface in my opinion there shouldn’t be a problem dropping it behind the FW. That’s how I use it. Mgmt access should not be reachable from external at all for sure. But this is also secured in our infrastructure with FW. I‘m sure there was a list of ports you have to configure in your FW from Citrix. I will have a look and let you know.

ours are behind a palo

No problems on that front. It'll be fine.