How can users be educated to use a single URL, while still having a StoreFront base URL that is different from the NetScaler Gateway URL? We’re going to show you.

Please keep in mind this solution works best for Receiver for Web. This solution does work with the Native Receiver, but the Provisioning file would be the easiest way to configure the Native Receiver in my opinion.

In this scenario, I will use for external access to the Citrix environment. will be used for internal access to the Citrix environment.

Here is an overview of the requirements for the scenario:

  1. SAN certificate for and
  2. will resolve to the publicly accessible NetScaler Gateway VIPs.
  3. will resolve to the internal StoreFront Load Balanced VIPs.
  4. CNAME on the internal DNS. –>
  5. Responder Policy to redirect from to

Now for the magic of creating the single FQDN that users need to know.

In this example, the “single URL” for users is On the internal DNS infrastructure, create a CNAME for to point to Then, on the NetScaler appliance, create a Responder Policy that redirects traffic with the HTTP Host header of “” to “”. Bind this policy to the StoreFront LB VIP on NetScaler.

So, what is the expected user behavior?

A user on the internal network types into their browser. resolves as a CNAME for The user will resolve After obtaining the IP address for, the user connects to the SF LB VIP using the IP address and the HTTP host header The Responder policy redirects the user to The user’s browser follows the redirect and is able to access the StoreFront LB VIP. By using a SAN certificate with the names we need, the user will not receive a certificate warning.

Single FQDN Diagram

The workflow above is seamless to the internal user. From their perspective, internal users type, and that takes them to the resources they need to focus on their job. External users will use for their connection to be proxied via an external facing NetScaler Gateway VIP.

Please keep in mind that this workflow is unique to Receiver for Web. Users that manually configure Receiver on the internal network will need to type out “” to connect to the StoreFront VIP and avoid a redirect. I recommend using the provisioning file from StoreFront to configure the Native Receiver.

Let me know, in the comments section below, if you have questions!