You can configure the network ranges for which you want users' application or desktop launch traffic (ICA traffic) to be routed through NetScaler Gateway to the XenApp server. This configuration is typically used to provide external access to Citrix-published resources integrated with Workspace ONE Access.

When a user launches an application or desktop from the Workspace ONE Intelligent Hub portal or app, if the user's IP address falls in the IP range configured for NetScaler Gateway, the ICA traffic is routed through NetScaler Gateway to the XenApp server.

Note: To configure resource launch for internal networks, see Configuring Citrix Resource Launch for Internal Networks in Workspace ONE Access.
Note: The information in this topic also applies to Citrix Secure Gateway. If you are using Citrix Secure Gateway instead of NetScaler Gateway, enter the Secure Gateway host name and port, and select the NetScaler check box.



  1. In the VMware Workspace ONE Access console, select the Catalog > Virtual Apps Collections tab.
  2. Click the Citrix collection for which you want to set network ranges.
  3. Click Edit Network Range.
  4. In the Network Ranges page, click the network range to configure for Netscaler Gateway.
    1. Click the network range to edit or click Create Network Range to create a new network range, if required.
    2. If you are creating a new network range, enter a name, optional description, and the IP address range.
    3. Scroll to the XenApp Farm section.
      This section lists all the XenApp servers configured in the Citrix virtual apps collection.
    4. For each XenApp server, enter the appropriate values for this network range.
      Option Description
      Client Access FQDN

      The NetScaler Gateway appliance host name. For example:

      Port The NetScaler Gateway appliance port. For example: 443
      NetScaler Set this option to Yes.

      edit network range dialog box

    5. Click Save.
    6. Repeat these steps to edit the other network ranges, if required.
    7. Click Finish in the Network Ranges page.