© 1999-2017 Citrix Systems, Inc. All rights reserved.
p.68
https://docs.citrix.com
Migrating from the Secure Gateway to NetScaler
Gateway
Jul 15, 2013
This topic discusses how to prepare to migrate from the Secure Gateway to NetScaler Gateway, and the two migration
options you can choose: In-place migration or parallel migration.
Preparing to Migrate
Before migrating from the Secure Gateway to NetScaler Gateway, consider the following:
Make sure that user devices meet system requirements. For more information about system requirements, see the
appropriate guide for the Citrix online plug-in.
Make sure port 443, the default security port on the firewall is open between the Internet and NetScaler Gateway. This
requirement is identical in a Secure Gateway deployment.
Install NetScaler Gateway. For details, see the installation instructions for your NetScaler Gateway appliance.
Acquire and install the appropriate certificates on NetScaler Gateway. These include:
Server certificate for NetScaler Gateway
Root certificates for NetScaler Gateway, Secure Ticket Authority (STA), and user devices
Configure the networks that users can connect to through NetScaler Gateway.
Migrating Options
You can choose from the following two options for migrating from the Secure Gateway to NetScaler Gateway:
In-place migration, in which you transfer the certificate and fully qualified domain name (FQDN) on the Secure Gateway
to NetScaler Gateway
Parallel migration, in which you obtain a new signed certificate and FQDN for NetScaler Gateway
Each option is valid; however, the in-place migration has the potential to temporarily disrupt access to internal resources
when compared with a new installation.
After the migration is complete, users can log on with their current credentials and do not have to perform any
configuration to their device. Each option requires minimal user support.
Performing an In-Place Migration
When you choose an in-place migration from the Secure Gateway to NetScaler Gateway, you export the Secure Gateway
certificate, upload it to NetScaler Gateway and bind it to a virtual server.
The certificate must be in PEM format before you can install it on NetScaler Gateway. If you are unfamiliar with the
process of converting certificates, Citrix recommends a new installation of NetScaler Gateway and the use of a new
certificate.
Important: If you are transferring a certificate from the Secure Gateway to Access Gateway Enterprise Edition, the FQDN
of the certificate installed on the virtual server must match the FQDN of the Secure Gateway. With this option, you
cannot take a phased approach because two identical FQDNs cannot reside on the same network.
An in-place migration is identical to a new installation of NetScaler Gateway, except for the following items:
You use the Secure Gateway certificate on NetScaler Gateway
