Scenario: A Citrix Architect is asked to design a new external access architecture for CGE. The regional datacenters have NetScaler appliances delivering load-balancing services. Security policy…

"Local NetScaler" is too vague and does not specifically identify the GSLB-managed public FQDN needed for consistent multi-datacenter configuration.

While `https://secure.cge.com` might be the GSLB FQDN, the option is less precise than "external beacon address" in the context of specific NetScaler Gateway configurations and client/server roles, as the external beacon typically refers to this public FQDN.

Configuring the callback URL to the FQDN of only the local NetScaler Gateway, while viable for a single site, might not seamlessly integrate with a GSLB-managed public FQDN for StoreFront consistency across multiple datacenters, where using the external beacon FQDN with split-DNS is a common approach.

In a multi-datacenter GSLB deployment with HA pairs for external access, configuring the callback URL on StoreFront to use the external beacon address (which is typically the public FQDN managed by GSLB) provides architectural consistency. This requires a split-DNS configuration where internal DNS resolves this FQDN to the internal-facing IP of the local NetScaler Gateway for StoreFront to perform STA validation, adhering to the security policy of not directly connecting internal appliances to the DMZ's external interfaces.