


Learn more about the differences between Duo's Citrix Gateway deployment configurations. If you want the on-premises Duo authentication server to handle both primary and secondary authentication via RADIUS, see the Citrix Gateway Basic Instructions. Primary authentication happens directly between the Citrix Gateway and your Active Directory, LDAP, or other identity store, which enables additional features such as AD password resets.

This configuration adds Duo as a secondary RADIUS authentication server to Citrix Gateways with an edition license or Gateway build which does not permit use of nFactor. If you have Citrix Gateway build 12.1-51.16 or later with an "Advanced" or "Premium" edition license, or Citrix Gateway build 13.0-67.x or later with "Standard", "Advanced", or "Premium" edition license, try Duo Single Sign-on for Citrix NetScaler, which includes Duo Universal Prompt support.
