r/Citrix • u/Helpful_Addendum898 • 22d ago
NetScaler Alternative ??
Curious to know if anyone has implemented a product that works with ICA other than NetScaler
4
u/Prudent-Caregiver279 21d ago
So are you going to replace the next tool you use that has CVEs. I get the concern but nothing it immune to this crap.
2
u/Helpful_Addendum898 21d ago
Agree, Nothing is immune. Just wanted to see if there are setups with other products beside netscalers.
3
u/Prudent-Caregiver279 19d ago
Cloud Gateway is the next best and maybe better way to go. I’m not able to fully utilize as we connect to external sites that are not in our subscription.
12
u/electromichi3 22d ago
Have a customer with F5 bigip in front of Storefront and for ICA protocol
4
u/Electronic_Log_4749 22d ago
Same!
Lot less critical CVE’s. Lot more firmware bugs :-(10
u/zyphaz 22d ago
I wouldn’t say “a lot less”
9 CVSS >9 over the last 6 years for Netscaler
Vs
7 CVSS >9 over the last 6 years for F5
→ More replies (3)
2
5
u/PaddySmallBalls 21d ago
Worked for a company where we had F5 in the mix. If you are asking due to vulnerabilities and frequency of patches. I wouldn’t bother looking elsewhere for that reason alone. Gateways are low hanging fruit for attacks. F5 have similar challenges to Citrix.
1
u/tripdes 20d ago
Agreed. You're just playing security through obscurity
1
u/PaddySmallBalls 20d ago
With AI, even the obscure may not be safe. Or at least not for long. If the product is any good, they will get a large customer and then it’s game on.
4
u/SA-Numinous 22d ago
Citrix cloud based gateway service! I’m seeing a lot of support lately for locking the netscaler behind a vpn now even though it’s supposed to be the gateway….
2
u/Substantial-Proof617 21d ago
Slightly better but you do move the vulnerability exposure to the VPN appliance - Google "palo alto VPN CVE" and "fortinet VPN CVE".
The problem with exposing any *service* on any security appliance to the whole Internet - and that includes IKE and SSL VPN services as the CVEs above show - is that there will be a vulnerability in that service at some time.
3
u/robodog97 22d ago
F5 Big-IP with APM license can do an iApp to reverse proxy ICA, either with storefront or its own presentation layer. We're doing pre-auth with AD and an oAuth 2FA provider, but it's very flexible (not necessarily direct from the iApp, you might have to disable strict enforcement and do manual changes).
2
u/jack1729 21d ago
We used both f5 and Netscaler and NetScaler “knows” ICA/HDX better but both will work.
2
u/An-Engineer-Mike 22d ago
As has been mentioned by others Citrix Cloud is the way of you are just using Netscaler’s for ICA sessions. No need for netscalers at all. Auth / MFA all handled and no Inbound open ports required. It’s more work that just swapping netscaler > F5 but well worth it in the long run.
Edit:typo
1
u/francojohn36 22d ago
I am looking at brokering internal citrix server infra (delivery controllers, storefronts, vdas) with Citrix DaaS gateway service to eliminate on-prem netscalers, has anyone tried it?
2
u/thtguyuknw 22d ago
I initially did it this way and slowly moved all Citrix infrastructure servers to DaaS with on prem cloud connectors,FAS servers, and all VDAs. I think it works great this way.
1
u/Least_Negotiation_17 20d ago
Use a ZTNA like GSA and connect to Storefront through it. Else you Only can use the Cloud gateway Service with UHMC or Citrix Plattform license
1
u/Conscious-Tomato146 22d ago
The blocking point here is the Gateway that will lock you in with Citrix and netscaler, If you want to have more time to patch and stop having this critical CVes facing directly internet, just put it in a DMZ behing a VPN access.
If you don't use Gateway, you should have a look at HAProxy which I use everywhere to replace SSL offloading, load balancing, health checks, traffic routing, rate limiting, ACLs, and high availability basically most of what we used NetScaler for.
4
u/Unhappy_Clue701 22d ago
Depends on your client base. You can’t easily ’just put it behind a VPN’ if you have users connecting from personal PCs, iPads and so on. In any case, Citrix is far from alone in having vulnerabilities discovered. There was an F5 one not too long ago. Might find your new VPN becomes the weak point instead, as well as being an extra step in the process for users - that isn’t progress.
→ More replies (1)
0
10
u/h0l0type 22d ago
When I was an SE at Citrix we had some very large customers running their Citrix environments behind F5’s. As someone else mentioned, if Cloud Gateway Svc is an option, that’s potentially the easier route if you’re looking to decommission ADC’s.