This message was deleted.

I would say definitely, but this isn't just specific to Citrix, it's just good practice to segregate different parts of the infrastructure from each other and only allow well defined and necessary traffic flows in between. Specific to VDAs in most cases users will be the vector for malicious actors to enter the infra, so I always try to maximize segregation of user facing infra. That includes separate vlans, all outbound traffic going through ips/ids/network firewalls, all inbound traffic restricted by client firewalls, and where possible blocking all intra-vlan traffic so one compromised host can't communicate with any others

Thanks Gary!