I85PREP
⌘ K
Citrix Virtual Apps and Desktops Service Integration with Microsoft Azure study materials
Citrix Virtual Apps and Desktops Service Integration with Microsoft Azure study resources

Citrix Virtual Apps and Desktops Service Integration with Microsoft Azure: Manage Azure networking and connectivity for Citrix

Citrix Virtual Apps and Desktops Service Integration with Microsoft Azure · Work through your exam, one topic at a time.

All guide sections

Manage Azure networking and connectivity for Citrix

What this domain covers

Networking questions focus on VNet and subnet design, NSGs, user-defined routes, Azure Firewall, VPN or ExpressRoute, DNS, private endpoints, and the traffic paths used by Citrix Cloud, Cloud Connectors, VDAs, and Citrix Gateway. You need to know which flows are inbound and which are outbound.

Core rules and concepts

  • Cloud Connectors initiate outbound TCP 443 to Citrix Cloud. They do not require inbound internet exposure. VDAs communicate with Cloud Connectors over TCP 80 and 443 in standard Citrix Cloud deployments.
  • Citrix Gateway or Citrix ADC is placed in a perimeter or DMZ subnet with a public IP and inbound 443. The Gateway proxies user connections to internal VDAs or StoreFront/Workspace.
  • NSGs are stateful and evaluated by priority. Default rules allow VNet-to-VNet and Azure Load Balancer traffic; explicit deny rules can break health probes or Citrix registration.
  • UDRs can force traffic through Azure Firewall or a network virtual appliance. Ensure asymmetric routing does not break return traffic.
  • DNS must resolve AD DS, Cloud Connector names, and internal VDA names. Use Azure Private DNS zones for private endpoints and custom DNS forwarding for on-premises name resolution.
  • VPN and ExpressRoute connect on-premises users and domain controllers; plan gateway transit and address space to avoid overlap.

Worked example

External users must reach published desktops. A Citrix Gateway VPX sits in a DMZ subnet with public IP 443 allowed inbound. The Gateway sends traffic to VDAs in an internal subnet. Cloud Connectors in a management subnet have no public IP and an NSG that allows outbound 443 to Citrix Cloud and inbound 80/443 only from the VDA subnet. An Azure Firewall policy allows the Citrix Cloud FQDNs and blocks general internet access. A UDR sends VDA internet-bound traffic to the firewall. The reasoning is that only the Gateway is internet-facing; management and VDA tiers remain private.

Traps that cost marks

Opening inbound 443 to Cloud Connectors is unnecessary and expands attack surface. Overly broad NSG deny rules can block Azure Load Balancer probes. Incorrect DNS forwarding causes VDA registration and domain join failures. Overlapping VNet address spaces break VPN and peering. Forcing all traffic through a firewall without return-path symmetry causes dropped sessions.

Key points

  • Cloud Connectors need outbound 443 to Citrix Cloud, not inbound public access.
  • Citrix Gateway is the internet-facing component and requires inbound 443.
  • NSG priority and default rules affect load balancer probes and Citrix traffic.
  • DNS design must cover AD DS, Cloud Connectors, and private endpoints.
  • Avoid overlapping address spaces and asymmetric UDR routing.