1. We asked field engineer and knew that there was not NetScaler in site.
2. We checked VMs status and found they were ready in FusionAccess portal. It indicated that VMs were registered successfully in DDC server.
3. After we login WI server and configured 'direct'connetion mode, users login successfully by internal network. It indicated that VDI environment were normal.
4. We login WI server and opened 'Citrix Web Interface Management', we checked NAT mapping and found they were correct. (Refer to attached picture)
According to above analysis, we thought that NAT mapping were not correct in Firewall. After field engineer and customer checked and modified NAT mapping in Firewall , users login successfully by internet.