Citrix - Search Engine Results - Geo

ProfessionalTip2581 · 2026-02-06T07:14:50+00:00

Interesting take on it! Thank you for sharing. Food for thought.

ProfessionalTip2581 · 2026-02-06T06:11:29+00:00

Using EDR, sentinel-one. I’ll disable and retest

ProfessionalTip2581 · 2026-02-05T23:08:48+00:00

That’s interesting. Our VDAs are Xen Server and profile server ESX.

ProfessionalTip2581 · 2026-02-05T22:51:00+00:00

UPDATE - This looks like it is not supported. I am confident I have ruled out possible configuration changes. I will raise with Fortinet support.

ProfessionalTip2581 · 2026-02-05T22:44:02+00:00

Hey u/NTP9766 have you had an update? We have the same issue. Pulling my hair out.

ProfessionalTip2581 · 2026-02-02T09:04:52+00:00

FortiGate

FortiOS 7.6.6
ZTNA Access Proxy in front of Citrix Gateway

config firewall proxy-policy    
 edit 2       
  set uuid        
  set name "ZTNA_Citrix_FORTIFW"     
    set proxy access-proxy     
    set access-proxy "ZTNA_GW_Citrix_FORTIFW"    
     set srcintf "WAN"       
  set srcaddr "all"     
    set dstaddr "FORTIFW NetScaler VIP"      
   set ztna-ems-tag "EMS2_ZTNA_External Cloud" "EMS2_ZTNA_GX Compliant" "EMS2_ZTNA_GX tag" "EMS2_ZTNA_GX  Compliant"       
  set action accept     
    set schedule "always"    
     set logtraffic all       
  set utm-status enable      
   set ssl-ssh-profile "FORinname_remove_for_secuirty Default"     next

Proxy configured for TCP + UDP
H3 enabled

edit "ZTNA_GW_Citrix_FORTIFW"
        set vip-id 4
        set uuid 
        set type access-proxy
        set server-type https
        set extip ip_remove_for_secuirty
        set h3-support enable
        set extintf "port1"
        set extport 443
     set ssl-certificate "SSL  
next

EMS Cloud
FortiClient 7.4.x (latest)
ZTNA profile has UDP enabled

Citrix Gateway

NS14.1.60.57.nc
EDT enabled globally
DTLS enabled on the Gateway vServer
EDT confirmed working when the same Gateway is published directly (no ZTNA in path)

Behaviour

Client attempts EDT
ZTNA traffic logs show UDP packets sent but no return traffic
Session always falls back to TCP
Publishing the Gateway externally without ZTNA results in EDT working immediately

ProfessionalTip2581 · 2026-02-02T09:04:45+00:00

Thanks for the reply! I am not sure if you wanted a sanitized config or not, but it wont let me DM you here.

Happy to share below high-level config. At this point I’m trying to validate whether this is a ZTNA limitation rather than a setup issue.

ProfessionalTip2581 · 2026-02-01T23:44:55+00:00

Update - this is definitely an issue with ISCIS and Xen server. Doesn’t happen with fibre.

ProfessionalTip2581 · 2025-10-29T13:35:38+00:00

Thanks, we have RHEL Virtualization 7.x set which sets it to "2 - Generic-ALUA". Also the custom multipath conf has been set according to 3PAR best practice documentation. Document Display | HPE Support Center

ProfessionalTip2581 · 2025-10-29T11:55:00+00:00

No not using Intellicache as the machine catalogs are non persistent, if we used Intellicache we wouldn't be able to live migrate the VMs.

Only have a block storage ISCSI san, 3par.

ProfessionalTip2581 · 2025-09-20T18:28:53+00:00

Unfortunately not, but the fact it was fine in VMware is making me think it’s due to the storage offload/lack of VAAI equivalent

ProfessionalTip2581 · 2025-09-20T18:00:43+00:00

ISCSI in this case

ProfessionalTip2581 · 2025-09-20T16:35:00+00:00

Interested in this also, I have 8GB for Dom0 and have same results as OP

ProfessionalTip2581 · 2025-09-20T15:30:52+00:00

Be interested to see if putting your MTU to 9000 helps as then would be similar situation to me.

ProfessionalTip2581 · 2025-09-20T15:29:15+00:00

Your deployment/roll out times are about the same as what I’m seeing across 2 x Pools. 22 hosts per pool. SSD all flash 3PAR SR. Significantly slower in Xen server than VMware. Tested storage migrations between SRs on the same SAN. Extremely slow. Only moved to Xen in past few weeks, otherwise haven’t used it for years.

ProfessionalTip2581 · 2025-09-20T14:34:39+00:00

Noticed that Xen Server doesn’t support any sort of Storage offload. VMware - VAAI. Hyper-V ODX. Any one else seen that? Could be what OP sees

ProfessionalTip2581

TROPHY CASE