NetScaler : Load Balancing Storefront 1.1

In this article I’ll cover setup of an internal NetScaler VPX Load Balancer for Storefront 1.1. Note that this configuration will also work with Storefront 1.0, just the Storefront MMC snap-in doesn’t work as-of the 1st April this year!

Use the following article to install and configure Storefront for internal use first.


1. Lab Environemnt

2. SSL Certificate Requirements

3. Service Group Definition

4. Virtual Server Definition

5. DNS Configuration

6. Testing


1. Lab Environemnt

The environment for this example configuration is as follows:

  • – – Citrix XenApp 6.5 Server with Storefront 1.1 Locally Installed (in a production environment I would seperate Storefront onto it’s own server)
  • – – Citrix XenApp 6.5 Server (as above!)
  • Two-arm NetScaler HA Pair also using VMAC’s:
    • NS1 –
    • NS2 –

I have allocated as the Load Balancer IP address for Storefront.

I’m using an Internal IP address for the Load Balancer, this could equally be an external IP address (an IP address that corresponds to a NIC other than the one that the NetScaler IP is served from).


2. SSL Certificate Requirements

I woud suggest you generate or purchase a SAN SSL certificate for the Load Balancer Virtual Server. In this lab environment I’m using the following Subject Names:

  • ctx1
  • ctx2
  • ctx

As I plan on using the LB internally only an internal PKI/AD CS certificate is fine, even for my Access Gateway setup as it’s the endpoint connetcion SSL certificate that is key. Importantly, all internal devices trust the RootCA, hence the issued cert will work as required.

The image below shows I’m using a Common Name of ‘’ for the Certificate Subject name, with DNS Alternative Names (including and those listed above) :



3. Service Group Definition

Browse to Load Balancer > Service Groups and click ‘Add…’ at the bottom of the window.

Enter a name of Storefront_SSL and select SSL as the protocol, then for each server add the Storefront Server IP address with a port of 443.


Add the https-ecv montior then click OK to create the Service Group:


Under Advanced enable the Compression override:


Note; You don’t need to add the SSL Certificate to the Service Group, we’ll add it to the Virtual Server in a minute.


4. Virtual Server Definition

Browse to Load Balancer > Virtual Server and click ‘Add…’ at the bottom of the window.

Set Protocol as SSL and add an IP address, in this example


Add the Service Group you just defined.


Under LB Method select Least Connection & under persistance set SOURCEIP:


Finally, bind the SSL Certificate you imported for the Storefront Server to the Virtual Server



5. DNS Configuration

Create a DNS A Record that matches the name of a SAN in your certificate; the IP address for the record is that of your Virtual Server. For this lab I created;


All receiver clients should be configured ot use this DNS name.


6. Testing

Confirm you can browse to the StoreFront URL (note that you will have to enter the complete URL, not just the FQDN). In this example I’d browse to


Confirm that you can point the receiver client at the Load Balancer and it works as expected.

Create an account; enter the URL as


Logon (I haven’t configured SSO yet):


Test access to applications:


Leave a Reply

Your email address will not be published. Required fields are marked *