When EDT is disabled, ICA fallback communication occurs over TCP rather than UDP.
Remote users connecting through NetScaler Gateway reach internal Citrix resources using ICA over SSL.
Citrix documentation specifies that NetScaler Gateway communicates with clients using:
* TLS/SSL over port 443, regardless of whether EDT is enabled or not.
This port must be opened on the perimeter firewall to allow:
* Secure ICA proxy traffic
* Authentication traffic
* Connection establishment
* STA ticket validation via Gateway
Why the other options are incorrect:
* 1494 - Raw ICA (not used externally when Gateway is in front).
* 2598 - Session Reliability port; also not used by external clients connecting via Gateway.
* 80 - Unencrypted HTTP (never appropriate for secure remote access).
NetScaler Gateway always requires SSL 443 for secure ICA proxy connections.
Documentation References
* Citrix Gateway Deployment Guide # Ports and Protocols
* ICA/HDX Network Port Requirements
* Citrix Virtual Apps and Desktops # EDT and Fallback Behavior