Engineering analysis · Sources reviewed November 14, 2026
A DaaS team can retain its existing remote sign-in URL and move the session traffic for selected resources to Citrix Gateway Service. The right unit of planning is the site or zone that StoreFront routes. Start with a list of resources and their network requirements before sizing an appliance replacement.
Draw two paths on the architecture review
On the first path, a remote employee signs in through the existing NetScaler Gateway and sees the resources in StoreFront. On the second, launching one of those resources establishes an HDX session. StoreFront’s Optimal HDX Routing rules can select a managed gateway for particular sites or zones. Other resources can retain their customer-managed HDX path. Moving one zone leaves ownership of the sign-in tier with the customer.
Build the renewal case around costs you can retire
Consider a branch that launches virtual desktops and also uses the appliance for a network VPN. Managed HDX may reduce the proxy capacity the team must operate. The VPN and external authentication still need an owner, capacity and maintenance. Ask the network team which appliance, capacity increment or support task can actually be retired during the contract term. A smaller peak load yields a cash saving only if it changes a purchase or an operating expense.
Compare both designs over the same term. Include the retained NetScaler tier, StoreFront upgrades, Windows Cloud Connectors, network connectivity and staff time. Citrix lists Universal HMC, CPL and existing DaaS customers as entitled to the StoreFront integration. Match the entitlement to the order before assigning a subscription cost to either design.
Gate the pilot on the deployed versions
For the DaaS integration with on-premises StoreFront, the documented starting versions are StoreFront 2407 and NetScaler 13.1. Geographic routing needs StoreFront 2503 or later. Record the installed build and maintenance status separately. The integration uses Windows Cloud Connectors. Teams carrying forward a cloud gateway definition from the StoreFront 2311 or 2402 technical preview should budget time to recreate that definition when moving to 2407.
Write the acceptance record before switching routes
- Pick a pilot zone and a control zone. List every application affected by the rule. Save the current routing choice and identify who can restore it.
- From a representative branch, record sign-in completion, enumeration, and time to a usable application as separate observations. Agree a launch-time threshold with the application owner.
- Change the pilot routing rule. Verify which gateway a new session used, then repeat the launch at peak hours and reconnect after a brief interruption. Check that the control zone still uses its intended gateway.
- If route evidence is missing or launch time exceeds the threshold, restore the prior rule and validate a fresh launch. Record timings, network location, resource and actual route so that a second engineer can review the decision.
Questions from a design review
Can we decommission NetScaler after the first successful cloud-routed launch?
In this design NetScaler still handles external access to StoreFront. Inventory authentication, VPN, RDP proxy and any remaining HDX routes before making a retirement decision.
Can a single application be our pilot?
Check which site or zone StoreFront uses for that application. Other resources matched by the same routing rule share the change.
Is an application icon enough to validate the cutover?
An icon confirms enumeration. Validate the next stage by launching a fresh session, confirming its gateway and reconnecting from a user network.
Bring the current order, product builds and retained appliance functions to your licensing review. Citrix licensing and renewal · Citrix Gateway product overview