Gateway

Enable DTLS 1.2 protocol on NetScaler Gateway

October 9, 2025

Contributed by:

NetScaler Gateway now supports the DTLS 1.2 protocol, the latest security standard, to improve security and protection for back-end connections. Starting from release 14.1 build 47.46, you can configure NetScaler Gateway to use DTLS 1.2 to secure the connection between NetScaler Gateway and VDA.

Configure DTLS 1.2 by using the GUI

Navigate to NetScaler Gateway -> Global Settings -> Change Global Settings.
On the Global NetScaler Gateway Settings page, select ENABLED in the Backend DTLS 1.2 menu and click OK.

Enable DTLS 1.2

Configure DTLS 1.2 by using the CLI

To enable the DTLS 1.2 for the back-end connections, at the command prompt, type:

set vpn parameter -backenddtls12 ENABLED
<!--NeedCopy-->

To disable the DTLS 1.2 for the back-end connections, at the command prompt, type:

set vpn parameter -backenddtls12 DISABLED
unset vpn parameter -backendDtls12
<!--NeedCopy-->

Verify DTLS 1.2 encryption status

Check the status of DTLS 1.2 encryption using the following command:

sh vpn parameter - Backend DTLS 1.2: DISABLED
<!--NeedCopy-->

Troubleshoot DTLS 1.2

Compatibility matrix

The following table provides a compatibility matrix for VDA platforms that support DTLS 1.2 and DTLS 1.2 with HDX Insight, ensuring secure end-to-end connections between NetScaler Gateway and VDA.

Supported platforms	DTLS 1.2	DTLS 1.2 with HDX Insight
Windows	2407 and later	2503 and later
Linux	2411 and later	2411 and later
macOS	2507 and later	2507 and later

Starting from NetScaler Gateway release 14.1 build 56.x, VDA for macOS supports DTLS 1.2 and DTLS 1.2 with HDX Insight provided Secure HDX is configured on Delivery Controller or Citrix Studio. For details about configuring Secure HDX, see Secure HDX™.

Limitations

DTLS 1.2 is not supported in a double-hop topology.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NetScaler Secure Deployment Guide

Enable DTLS 1.2 protocol on NetScaler Gateway

October 9, 2025

Contributed by:

October 9, 2025

Contributed by:

Enable DTLS 1.2 protocol on NetScaler Gateway

Configure DTLS 1.2 by using the GUI

Configure DTLS 1.2 by using the CLI

Verify DTLS 1.2 encryption status

Compatibility matrix

Limitations

In this article