Where should authentication policies be bound to enforce user authentication on the Citrix Gateway?

• A. The AAA virtual server created while configuring the Citrix Gateway virtual server
• B. Citrix Gateway virtual server
• C. The Content Switching virtual server
• D. The Global policy

Answer: (B)

Authentication for Citrix Gateway is enforced at the point where gateway traffic is terminated. Bind the authentication policy to the Citrix Gateway virtual server so every gateway connection must go through the login flow, regardless of how the user is authenticated (local credentials, LDAP, SAML, etc.). This ensures that VPN/session access is gated by the policy for that specific gateway path.

Binding to a Global policy is too broad and would affect all traffic on the appliance, not just gateway logins. A Content Switching virtual server handles routing decisions, not the enforcement of gateway login. An AAA virtual server can participate in authentication, but the gateway session itself is authenticated by the policy bound to the Citrix Gateway virtual server.