EDT DTLS falls back to TCP instead of UDP intermittently on NetScaler. NetScaler Gateway is configured to access the applications hosted on the StoreFront.- DTLS is enabled on the VPN virtual server.
ICA connection logs on the firewall between the SNIP and the VDI client will use TCP port instead of UDP sometimes.
To resolve this issue upgrade NetScaler to 11.1.57.x or 12.0.56.11.
This is a known issue tracked with issue ID 697771.