This message was deleted.

CVPN in my experience only works for apps that Citrix specifically document and support (ie OWA and SharePoint), as it rewrites the URLs on the way through and there are lots of instances where this breaks. LB with AAA for auth is the way to go - you can put it through a content switch as well but be aware only one AAA per content switch is supported

100% on Daniels side. CVPN never was working well except OWA/SP. Lots of re-writing. It is much more easier and just working when publishing via CS&AAA

Additional with Traffic Action you define your SSO behavior for your internal web app.

I got CVPN working for my Synology GUI, I guess it depends of your app. I am also using it for Nagios but some links within the app won't work so yes it is not perfect.

Thanks for the input guys. any example with CS that you guys can share ? Do I absolutely need to configure AAA since the web app already handle logins ?

I would say no, the AAA is bound to the gateway virtual server, not the CS so you don't even hit it when doing this. I can unbound the policy gateway virtual server from CS and it still works. Maybe you'll need it to create /configure it through the GUI but in CLI it should be ok, never tried. I'll see to share an example, it is really only like a standard CS policy.

AAA is optional. Lets say you want to secure OWA with 2FA. If you just want to use the Form Based Authentication of webmail you do not need AAA. Indeed it is better to use it specially regarding brute-force attacks and account lockouts

Here is an example

add service NAS_Http NAS_Server HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP NO

add lb vserver NAS_Photo HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180

bind lb vserver NAS_Photo NAS_Http

add cs policy NS-Synology -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).PATH.STARTSWITH(\"/photo\")"

bind cs vserver UG_NB1_CS -policyName NS-Synology -targetLBVserver NAS_Photo -priority 63010

If you need an example. Check my Exchange ADC CS/AAA blog. There is some content: https://citrixguyblog.com/2017/07/22/citrix-netscaler-loadbalancing-exchange-20132016-walkthrough-guide/