NetScaler Gateway forms the secure boundary between external endpoints and internal Citrix resources. It can authenticate users through methods such as LDAP, RADIUS, SAML, certificates, or multifactor authentication. It also accepts secure external connections from Citrix Workspace app and proxies the traffic into the internal environment. During application or desktop launches, Gateway operates as an HDX proxy, establishing the protected external connection and forwarding ICA/HDX traffic to the selected VDA without exposing internal VDA addresses. Resource enumeration and aggregation are StoreFront responsibilities.
StoreFront contacts Delivery Controllers, obtains the resources assigned to the authenticated user, and presents the resulting application and desktop list. Gateway transports these requests but does not perform the underlying broker-resource enumeration. Citrix documents Gateway authentication and secure single-URL access in the official NetScaler Gateway documentation .
Study Guide Reference: Providing Access to App and Desktop Resources - Gateway authentication, reverse proxy, HDX proxy, and StoreFront functions.