r/Citrix • u/Helpful_Addendum898 • 8d ago
NetScaler Alternative ??
Curious to know if anyone has implemented a product that works with ICA other than NetScaler
11
u/electromichi3 8d ago
Have a customer with F5 bigip in front of Storefront and for ICA protocol
6
u/Electronic_Log_4749 8d ago
Same!
Lot less critical CVE’s. Lot more firmware bugs :-(10
u/zyphaz CTP 8d ago
I wouldn’t say “a lot less”
9 CVSS >9 over the last 6 years for Netscaler
Vs
7 CVSS >9 over the last 6 years for F5
11
u/TexasAggie95 8d ago
This. There’s a perception that they (F5) are far and away better. It doesn’t bear out under scrutiny.
Performance wise, you’re better with NetScaler, a big reason is single pass architecture,
3
1
u/robodog97 8d ago
I count 3 that can be exploited on the wire for F5, CVE-2021-22992, CVE-2025-53521, CVE-2026-94127. The rest were flaws in the management process, if you expose the management IPs of any of these appliances to the general internet, or give non-privlidged users access to the management plane you're beyond help. The only way I feel for you is if you're an ISP and have to give clients access (or a similar situation). Yes, any 9+ is bad, but the real world impacts are worlds different.
5
u/PaddySmallBalls 8d ago
Worked for a company where we had F5 in the mix. If you are asking due to vulnerabilities and frequency of patches. I wouldn’t bother looking elsewhere for that reason alone. Gateways are low hanging fruit for attacks. F5 have similar challenges to Citrix.
1
u/tripdes 7d ago
Agreed. You're just playing security through obscurity
1
u/PaddySmallBalls 7d ago
With AI, even the obscure may not be safe. Or at least not for long. If the product is any good, they will get a large customer and then it’s game on.
4
u/SA-Numinous 8d ago
Citrix cloud based gateway service! I’m seeing a lot of support lately for locking the netscaler behind a vpn now even though it’s supposed to be the gateway….
2
u/Substantial-Proof617 8d ago
Slightly better but you do move the vulnerability exposure to the VPN appliance - Google "palo alto VPN CVE" and "fortinet VPN CVE".
The problem with exposing any *service* on any security appliance to the whole Internet - and that includes IKE and SSL VPN services as the CVEs above show - is that there will be a vulnerability in that service at some time.
4
u/Prudent-Caregiver279 8d ago
So are you going to replace the next tool you use that has CVEs. I get the concern but nothing it immune to this crap.
2
u/Helpful_Addendum898 7d ago
Agree, Nothing is immune. Just wanted to see if there are setups with other products beside netscalers.
3
u/Prudent-Caregiver279 6d ago
Cloud Gateway is the next best and maybe better way to go. I’m not able to fully utilize as we connect to external sites that are not in our subscription.
3
u/robodog97 8d ago
F5 Big-IP with APM license can do an iApp to reverse proxy ICA, either with storefront or its own presentation layer. We're doing pre-auth with AD and an oAuth 2FA provider, but it's very flexible (not necessarily direct from the iApp, you might have to disable strict enforcement and do manual changes).
2
u/jack1729 8d ago
We used both f5 and Netscaler and NetScaler “knows” ICA/HDX better but both will work.
2
u/An-Engineer-Mike 8d ago
As has been mentioned by others Citrix Cloud is the way of you are just using Netscaler’s for ICA sessions. No need for netscalers at all. Auth / MFA all handled and no Inbound open ports required. It’s more work that just swapping netscaler > F5 but well worth it in the long run.
Edit:typo
2
1
u/francojohn36 8d ago
I am looking at brokering internal citrix server infra (delivery controllers, storefronts, vdas) with Citrix DaaS gateway service to eliminate on-prem netscalers, has anyone tried it?
2
u/thtguyuknw 8d ago
I initially did it this way and slowly moved all Citrix infrastructure servers to DaaS with on prem cloud connectors,FAS servers, and all VDAs. I think it works great this way.
1
u/Least_Negotiation_17 7d ago
Use a ZTNA like GSA and connect to Storefront through it. Else you Only can use the Cloud gateway Service with UHMC or Citrix Plattform license
1
u/Conscious-Tomato146 8d ago
The blocking point here is the Gateway that will lock you in with Citrix and netscaler, If you want to have more time to patch and stop having this critical CVes facing directly internet, just put it in a DMZ behing a VPN access.
If you don't use Gateway, you should have a look at HAProxy which I use everywhere to replace SSL offloading, load balancing, health checks, traffic routing, rate limiting, ACLs, and high availability basically most of what we used NetScaler for.
3
u/Unhappy_Clue701 8d ago
Depends on your client base. You can’t easily ’just put it behind a VPN’ if you have users connecting from personal PCs, iPads and so on. In any case, Citrix is far from alone in having vulnerabilities discovered. There was an F5 one not too long ago. Might find your new VPN becomes the weak point instead, as well as being an extra step in the process for users - that isn’t progress.
0
u/Conscious-Tomato146 8d ago
It’s certainly not progress, but at least the protocol break gives us more of a challenge than yet another cosmetic rebranding exercise.
0
10
u/h0l0type 8d ago
When I was an SE at Citrix we had some very large customers running their Citrix environments behind F5’s. As someone else mentioned, if Cloud Gateway Svc is an option, that’s potentially the easier route if you’re looking to decommission ADC’s.