1Y0-253 · Question #182
A Citrix Administrator needs to configure a load balanced RADIUS virtual server for authentication on the NetScaler. Which IP address should the administrator configure on the RADIUS server client…
The correct answer is B. NetScaler IP (NSIP). Note: The IP address to enter is the NetScaler IP (NSIP). https://support.citrix.com/article/CTX126691
Question
A Citrix Administrator needs to configure a load balanced RADIUS virtual server for authentication on the NetScaler. Which IP address should the administrator configure on the RADIUS server client configuration?
Options
- AVirtual IP (VIP)
- BNetScaler IP (NSIP)
- CSubnet IP (SNIP)
- DClient IP (CIP)
How the community answered
(42 responses)- A12% (5)
- B81% (34)
- C5% (2)
- D2% (1)
Explanation
Note: The IP address to enter is the NetScaler IP (NSIP). https://support.citrix.com/article/CTX126691
Topics
Community Discussion
6
Grace U.Jun 17, 2026The correct answer is B, the NetScaler IP (NSIP). When NetScaler communicates outbound with a backend RADIUS server, that traffic originates from the NSIP, so the RADIUS server needs to list the NSIP as a trusted client, not the VIP which is just the front-facing address users connect to.
Jovan I.Jun 19, 2026Right, NSIP by default, but if you have multiple SNIPs and the RADIUS monitor or session policy routes through a specific SNIP, confirm in ns.log which source IP actually hits the server before locking down that ACL.
Jovan I.Jun 27, 2026The SNIP is what the NetScaler actually uses as the source IP when it proxies the RADIUS request back to the server, so the RADIUS server has to recognize that address as a trusted client, not the VIP which is just where the traffic lands on the way in.
Grace U.Jun 28, 2026Jovan, the NetScaler actually sends RADIUS requests using the NSIP as the source address, not the SNIP, because authentication traffic originates from the appliance itself rather than from the data plane doing the proxying. That is why the RADIUS server needs the NSIP listed as a trusted client, which is what option B is pointing to.
Isolde G.Jun 11, 2026Going with A on this one, the Virtual IP, and here is my reasoning. The VIP is the address that represents the load balanced service on the NetScaler, so from the RADIUS server's perspective, any authentication request it receives is going to appear to originate from or be destined toward that VIP as the logical front end of the service. If you tell the RADIUS server to trust a SNIP or the NSIP instead, you are pointing it at infrastructure addresses that exist below the load balancing layer, and that does not reflect how the traffic is actually being presented to it through a virtual server construct. The whole point of building a load balanced virtual server is that the VIP becomes the identity of that service, so the RADIUS client configuration needs to recognize that address as the trusted source. I have seen candidates overthink this by confusing how backend servers communicate with how the RADIUS server itself should identify its clients, but the question is specifically about the RADIUS server client config, which means you are answering from the RADIUS server's point of view looking inward at the NetScaler's presented address.
Grace U.Jun 12, 2026Isolde, that is a really thoughtful argument, but the traffic actually flips direction here: when NetScaler initiates the connection outbound to the RADIUS server, it sources that traffic from the SNIP, so the RADIUS server sees the SNIP as the client address and that is what needs to be trusted. The VIP is the address external clients use to reach the NetScaler, not the address the NetScaler uses when it reaches out to backend services.