1Y0-301 · Question #39
Scenario: A Citrix Engineer needs to configure external access to resources hosted on Server OS machines. The engineer has configured a NetScaler Gateway vServer and bound a certificate for…
The correct answer is D. 192.168.1.4; portal.mycompany.com. External users reach the NetScaler Gateway through its Virtual IP (VIP), so the public DNS name must resolve to the Gateway VIP, and the certificate bound to that Gateway vServer must be trusted by StoreFront for the callback URL to succeed.
Question
Scenario: A Citrix Engineer needs to configure external access to resources hosted on Server OS machines. The engineer has configured a NetScaler Gateway vServer and bound a certificate for portal.mycompany.com. On the StoreFront server the engineer specified the callback URL of https://portal.mycompany.com/CitrixAuthService/AuthService.asmx. NetScaler IP = 192.168.1.2 Subnet IP = 192.168.1.3 NetScaler Gateway VIP = 192.168.1.4 StoreFront VIP = 192.168.1.5 The engineer needs to validate that the portal.mycompany.com address resolves to __________ and that the certificate bound to __________ is trusted by the StoreFront server. (Choose the correct set of options to complete the sentence.)
Options
- A192.168.1.2; mycompany.com
- B192.168.1.5; mycompany.com
- C192.168.1.3; portal.mycompany.com
- D192.168.1.4; portal.mycompany.com
How the community answered
(33 responses)- A12% (4)
- B24% (8)
- C6% (2)
- D58% (19)
Why each option
External users reach the NetScaler Gateway through its Virtual IP (VIP), so the public DNS name must resolve to the Gateway VIP, and the certificate bound to that Gateway vServer must be trusted by StoreFront for the callback URL to succeed.
192.168.1.2 is the NetScaler management IP (NSIP), not the VIP used for client traffic, so DNS should not point to it; mycompany.com is also the wrong certificate subject since the vServer is bound to portal.mycompany.com.
192.168.1.5 is the StoreFront VIP on the load balancer, not the Gateway VIP that external users are directed to, and mycompany.com is not the certificate subject used.
192.168.1.3 is the NetScaler Subnet IP (SNIP) used for back-end server communication, not the VIP exposed to external clients, so DNS must not resolve to it.
The public FQDN portal.mycompany.com must resolve to the NetScaler Gateway VIP (192.168.1.4) because external clients connect to the Gateway as the entry point. StoreFront uses the callback URL https://portal.mycompany.com to verify the Gateway, so the SSL certificate bound to the Gateway vServer for portal.mycompany.com must be trusted by the StoreFront server for that HTTPS callback to succeed.
Concept tested: NetScaler Gateway VIP DNS resolution and StoreFront callback certificate trust
Source: https://docs.citrix.com/en-us/storefront/current-release/configure-manage-stores/integrate-with-netscaler-gateway.html
Topics
Community Discussion
No community discussion yet for this question.