NetScaler ADC vs Gateway: Roles & Security Updates

NetScaler ADC (formerly Citrix ADC) is an application delivery controller that load balances, optimizes, and secures traffic to backend servers, while NetScaler Gateway (formerly Citrix Gateway) is a secure remote access appliance that lets users reach internal applications from outside the network. If you run either product, you must apply security updates to both the ADC and Gateway components, because they share the same codebase and vulnerabilities often affect both. This article explains what each does, how they work together, and which systems need patching.

Background: The NetScaler Product Line

NetScaler started as a standalone load balancer in the late 1990s and was acquired by Citrix in 2005. Over time, Citrix split the functionality into two main virtual appliances:

• NetScaler ADC – focuses on traffic management, load balancing, content switching, and application-level security (Web App Firewall).
• NetScaler Gateway – focuses on remote access, SSL VPN, and clientless access to internal web applications.

Both run on the same underlying NetScaler operating system (based on FreeBSD) and share many components. In recent releases, Citrix has been merging them back into a single product called NetScaler (with ADC and Gateway as features), but the separate names persist in documentation and common usage.

What NetScaler ADC Does

NetScaler ADC is a reverse proxy that sits in front of your application servers. It receives client requests and forwards them to the most appropriate backend server based on health checks, load, and configured policies. Key functions include:

• Load balancing – distributes traffic across multiple servers to avoid overload.
• Health monitoring – periodically checks server availability and removes unhealthy servers from rotation.
• SSL/TLS offloading – terminates encrypted connections at the ADC, reducing CPU load on backend servers.
• Content switching – routes requests to different server groups based on URL, header, or other attributes.
• Caching and compression – improves response times and reduces bandwidth.
• Web App Firewall (WAF) – filters malicious traffic and protects against common attacks like SQL injection and XSS.

ADC is typically deployed in a data center or cloud environment, often in a high-availability pair. It is not designed for remote access; it expects clients to reach it directly or through a load balancer.

What NetScaler Gateway Does

NetScaler Gateway provides secure remote access to internal resources. It acts as a VPN concentrator, allowing remote users to connect to the corporate network from anywhere. Its main capabilities:

• SSL VPN – encrypts all traffic between the user’s device and the gateway.
• Clientless access – users can access internal web applications through a browser without installing any client software (using a portal page).
• Endpoint analysis – checks that the connecting device meets security policies (e.g., antivirus running, OS version).
• Single sign-on (SSO) – passes user credentials to backend applications so users don’t have to log in repeatedly.
• Citrix Workspace integration – often used to publish virtual desktops and apps (XenApp/XenDesktop) securely.

Gateway is often deployed in the DMZ, facing the internet, and can be configured to authenticate against Active Directory or other identity providers. It can also be used as a reverse proxy for specific web applications, but its primary role is remote access.

How They Work Together (and How They Differ)

In many enterprise environments, ADC and Gateway are deployed together. For example, you might have:

• An ADC pair in the data center load balancing your web servers.
• A Gateway in the DMZ that provides VPN access to the internal network.
• The Gateway might itself be load balanced by another ADC for high availability.

They can also be combined on the same appliance: a single NetScaler can act as both ADC and Gateway, with both features enabled. However, this is less common in large deployments because separate appliances allow for better isolation and scaling.

The key difference is direction of traffic: ADC handles inbound traffic to your servers (north-south), while Gateway handles inbound remote user traffic to your internal network (also north-south, but with a VPN component). Gateway adds authentication and authorization layers that ADC does not have by default.

Which Systems Need Security Updates?

Both ADC and Gateway require security updates. Because they share the same codebase, a vulnerability in the NetScaler OS affects both. Citrix has issued critical security bulletins in recent years that apply to both products, such as CVE-2023-4966 (Citrix Bleed) and CVE-2019-19781. These vulnerabilities allowed unauthorized access or remote code execution.

When a security advisory is released, you must:

1. Check if your version is affected (the advisory lists specific versions).
2. Apply the update to all NetScaler appliances, regardless of whether you use ADC or Gateway features.
3. If you have a high-availability pair, update both nodes to avoid version mismatch.
4. If you have a separate Gateway appliance, update it even if you don’t use ADC features – it’s still running the same vulnerable code.

A common misconception is that if you only use ADC (load balancing) and not Gateway (VPN), you don’t need to patch Gateway-related vulnerabilities. That is false – the vulnerability is in the shared NetScaler OS, so any exposed appliance is at risk. Even if you don’t enable Gateway features, the code is present and can be exploited.

Additionally, if you use NetScaler in a cloud service (like Citrix Cloud), the service provider handles patching, but you should still verify that the underlying infrastructure is updated.

How to Apply Security Updates

Updating NetScaler is a multi-step process that requires planning:

1. Back up your current configuration (use the built-in backup feature or export the config).
2. Download the new firmware from Citrix’s official site (requires a valid license).
3. Upload the firmware to the appliance via the management GUI or CLI.
4. Install the update – this typically reboots the appliance, so schedule maintenance.
5. Verify the new version and test your applications.

For a high-availability pair, you can usually update one node at a time to avoid downtime. For standalone appliances, you’ll need a maintenance window.

Common Mistakes and Pitfalls

• Ignoring updates because “we don’t use Gateway� – as explained, both share the same code.
• Not updating both nodes in an HA pair – running mismatched versions can cause failover issues.
• Forgetting to update the management interface – the management IP is also exposed and can be targeted.
• Not checking the release notes – some updates change default behavior or require configuration changes.
• Assuming cloud-managed services handle everything – if you run your own NetScaler in a cloud VM, you are responsible for patching.

Frequently Asked Questions

Is NetScaler Gateway the same as Citrix Gateway?

Yes, Citrix rebranded Citrix Gateway to NetScaler Gateway in 2022. The product is the same, just a new name. Older documentation may still say Citrix Gateway.

Can I use NetScaler ADC without a Gateway?

Absolutely. ADC is a standalone load balancer and does not require Gateway. Many organizations use ADC purely for load balancing and have a separate VPN solution (like a firewall’s VPN) for remote access.

Do I need to update both ADC and Gateway if they are on the same appliance?

Yes, you update the appliance itself, and that update covers both features. There is no separate update for ADC vs Gateway – it’s one firmware.

What is the difference between NetScaler and Citrix ADC?

They are the same product. Citrix renamed Citrix ADC to NetScaler ADC in 2022. The name change was part of a broader rebranding of Citrix’s networking products.

How often do NetScaler security updates come out?

Citrix typically releases security updates monthly, but critical vulnerabilities may trigger out-of-band updates. You should subscribe to Citrix security advisories to stay informed.

Can I run NetScaler on-premises and in the cloud?

Yes, NetScaler is available as a virtual appliance for VMware, Hyper-V, and cloud platforms like AWS and Azure. The same patching responsibilities apply regardless of where you run it.

Related

• Why Headphones Sound Quiet? Causes & Fixes
• Call of Duty Mobile Battle Royale Mode Explained
• Business Phone Systems for Remote Teams: Which Fits?