To add Duo two-factor authentication to your Citrix Gateway you'll configure two classic Basic RADIUS authentication policies - one that provides Duo's interactive enrollment and authentication prompts to browser-based Access Gateway logins, and a second one that responds to Receiver or Workspace client logins with an automatic authentication request via push notification to a mobile device or a phone call.Ĭitrix Gateway was formerly known as NetScaler Gateway. Learn more about the differences between Duo's Citrix Gateway deployment configurations. If you want the on-premises Duo authentication server to handle both primary and secondary authentication via RADIUS, see the Citrix Gateway Basic Instructions. Primary authentication happens directly between the Citrix Gateway and your Active Directory, LDAP, or other identity store, which enables additional features such as AD password resets. This configuration adds Duo as a secondary RADIUS authentication server to Citrix Gateways with an edition license or Gateway build which does not permit use of nFactor. If you have Citrix Gateway build 12.1-51.16 or later with an 'Advanced' or 'Premium' edition license, or Citrix Gateway build 13.0-67.x or later with 'Standard', 'Advanced', or 'Premium' edition license, try Duo Single Sign-on for Citrix NetScaler, which includes Duo Universal Prompt support.