Retiring a Citrix Gateway with APM Sessions
A healthcare network with 8,000 employees runs a patient portal behind a pair of BIG-IP 2000 appliances on version 12.1, licensed for LTM only. The security team wants to retire a Cisco ASA AnyConnect deployment and a Citrix Gateway, replace them with a single remote-access solution, add SAML single sign-on to Epic, and enforce Duo MFA for 1,200 concurrent remote clinicians. The reseller's quote adds "APM, 1,200 access sessions" to the existing LTM and states that the Citrix Gateway can then be decommissioned. The customer asks two things before signing: whether 1,200 sessions is enough for 8,000 staff, and whether anything is lost when Citrix Gateway goes away. The appliances are approaching end of support, and the project window is six months.
1. What technical checks must be completed before the APM quote can be accepted as accurate?
Read the worked answer
Four checks, any of which can invalidate the quote.
- Is APM provisioned, and can it be? Run
tmsh show sys provision. On a 2000-series platform, enabling APM alongside LTM, ASM, and anything else consumes memory and CPU; confirm the module fits before selling it. - Version. Version 12.1 is out of support. Adding a new access tier on an unsupported release is not defensible for a healthcare customer, so the project must include an upgrade to a supported release first. That upgrade is the real critical path, not the license.
- Capacity for the actual workload. 1,200 concurrent VPN sessions is a different load from 1,200 web SSO sessions. Check SSL TPS, concurrent connections, and memory against the platform datasheet, and leave 20 to 30 percent headroom.
- Licensing model. Confirm whether the quote is per concurrent access session or per named user, whether it is an add-on to the existing LTM license, and what happens at the session ceiling. Also confirm log storage and retention, which healthcare audits will ask about.
2. The customer asks whether 1,200 sessions covers 8,000 employees. Explain the licensing logic and the operational risk.
Read the worked answer
1,200 access sessions is a concurrency entitlement, not a headcount entitlement, so in principle 8,000 staff can share 1,200 sessions if no more than 1,200 are active at once. That is the right model for shift-based clinical work, where the peak is concentrated in handover windows.
The operational risk is that a "session" is not the same as a person. A clinician on a laptop, a tablet, and a phone can consume three sessions; a browser that reconnects after a network drop can hold the old session until it times out. A 1,200-session ceiling against 8,000 users can therefore be exhausted at a fraction of the headcount. Mitigate by measuring actual concurrency during a pilot, tuning session idle and maximum timeouts to clinical workflow, and buying headroom rather than sizing to the observed peak. At renewal, use tmsh show apm session and the session-count history to justify the tier rather than guessing.
3. Can the Citrix Gateway be decommissioned once APM is in place? What has to be confirmed first?
Read the worked answer
Only after confirming what Citrix is actually doing today, because the two products overlap but are not identical.
APM replaces the access role: network access (VPN), SAML service-provider and identity-provider functions, MFA integration, endpoint posture checks, and a per-application webtop. That covers the AnyConnect replacement cleanly and gives Epic SSO.
Citrix Gateway also performs the ICA proxy role - brokering connections to published applications and desktops through StoreFront. APM does not publish Citrix ICA applications. If the organization only uses Citrix as a VPN wrapper around Epic and a handful of intranet sites, it can go. If clinicians rely on published applications or virtual desktops, StoreFront and a gateway function are still required, and the project scope must include that or the clinicians lose access on cutover day.
The answer to give: "Yes for remote access, conditional for application publishing - let us inventory the published apps before we commit." Then verify against the Citrix configuration, not against the customer's recollection.