On a Netscaler VPX 50 HA-pair we all of sudden lost the certificate binding to the Netscaler Gateway Virtual Server - causing the vserver to be ín a down state. All we had to do was bind the certificate again and the problem was solved. NS version: 11.1 65.12

However, we're struggling to find the root cause. The HA pair has been running for several years, they were not being rebooted or upgraded when the problem occured. Apparently it just happened out of the blue.

Any ideas on what could have caused this issue - which logfiles to look through and events to search for? Thanks!

CoreLogic v10.8 for #CitrixADC is here. Go check it out if you want an efficient configuration framework for your appliances. It is free, it has an #OpenSource license and if you want commercial support you can count on CoreLayer consultants.

We added checks before redirecting from HTTP to SSL. If an entry does not exist, the redirect will no longer happen and an HTTP 404 is returned. For more information head over to https://github.com/CoreLayer/CoreLogic

I don't know that this is really going to change anything, but I figured I'd post something here. It seemed so long. :(

Did all the NetScaler bro's go to /r/Citrix or something? I'm a NetScaler architect/admin here in Dallas who's always looking for other NS brains to pick. I'm basically a team of 1 in my job, so I don't have anyone inside my org with whom I can discuss issues, brainstorm, etc.

If anyone's alive in here, shout out! Maybe we can breathe some life into this. :)

This week’s newsletter is out.

https://netscaler.substack.com

It’s free to subscribe and has a weekly summary of the builds, security updates and webinars you can catch. Let me know what else it should have…

A couple of weeks a go i updated the netscaler from build 13.1 version 21.50 to version 27.59. After the upgrade OTP (push notification) didn't work anymore. I've understood from support that this bug was also in build 13.0 and 12.1, so it seems like they broke something aigen.

So if you do not want this issue to happen to your environment stay on version 21.50 or an earlier version.

I hope it will be fixed in the newer release.

*also posted in r/Network

Morning Guys,

Long time Lurker first time poster.

Question, After excel templates for ideas on documenting a NetScaler.

New job, new to NetScalers no documentation a lot of legacy configurations in current NetScaler, complex setup. Multiple data centres, content switching, load balancing, GSLB, DNS, AAA, citrix etc Multiple services / groups using Policies, rewrites etc.

Would like to record it all to get my head around how things are linked, or if they are in use / pointing at legacy services.

Has anyone ever done this? Have something i can use as a starting point.

The long-term aim, is to create a List of each application our customers use, how that navigates which active/ passive data centre, NetScalers, firewalls, network devices etc. So in the event of an issue/ outage we can quickly check the “path” to make sure its not an network issue or know where to look.

Cheers

Has anyone used a Citrix Gateway in a double Hop scenario with CVAD using UDP Audio properly.

I've got it all enabled as per documentation but when the client tries to establish the UDP Audio stream I can see the first hop ADC trying to hit the VDA on 16500 not the second hop ADC.

Of course the whole point of the second hop is to prevent the Perimeter ADC talking direct to the VDA, so it just gets dropped by the firewall and fails to establish.

Hoping someone here has run into this and has a solution - I'm trying to figure out a way to get pre-authentication checks working for Citrix VPN that are able to check for the existence of registry keys/values that have underscores in their names. Have no problem running checks on keys that don't have underscores but cannot figure out how to denote the underscores as they're used for a marker to differentiate between key name and value name.

eg.

"HKLM\Software\Test\Testing\TestValue = Yes" would be

(CLIENT.REG('HKEY_LOCAL_MACHINE\\\\Software\\\\Test\\\\Testing_TestValue').VALUE == Yes)

"HKLM\Software\Test\Testing_Underscore\TestValue = Yes"

(CLIENT.REG('HKEY_LOCAL_MACHINE\\\\Software\\\\Test\\\\Testing_Underscore_TestValue').VALUE == Yes)

We have tried both single and double backslash before the first underscore but it still won't work. Surely there's a way to check for a reg value that has an underscore in its name?

So I've been using Netscaler for a few years and been struggling with something today so thought I would ask the community.

I have Citrix Gateway vserver and am trying to use two separate ICA Session policies (One allows USB redir and one does not). However despite my expressions I am seeing two hits and the wrong policy become applied, the structure is as below:

- The allow redirect policy is set to a priority of 10, has a GOTO END and uses an expression to filter on the aaa username.

- The no redirect policy has a priority of 100, has a GOTO END and just uses the expression true.

This works fine for the users that aren't specified in the redirect policy expression as I don't get a hit on that policy. However for a user that is, I see a hit in both policies despite the lower priority having a GOTO END Specified, and annoyingly he lower redirect policy does not apply. Am I going crazy or doing something stupid?

Hello,

We are planning a new deployment, following this design pattern:

AWS AZ1 (Subnet1)

• MGMT ENI: 192.168.1.108/24

• Client ENI: 192.168.2.129/24

• Servers ENI: 192.168.3.82/24

--

AWS AZ2 (Subnet2)

• MGMT ENI: 192.168.6.82/24

• Client ENI: 192.168.7.68/24

• Servers ENI: 192.168.8.203/24

Citrix has this documentation that support this scenario: https://docs.citrix.com/en-us/citrix-adc/current-release/deploying-vpx/deploy-aws/vpx-ha-eip-different-aws-zones.html

The step 1 of the procedure it configures the HA in INC mode and,

The step 2 of the procedure it says to add ipset123 on both nodes.

1. On primary vpx, ipset123 has as member, the IP 192.168.7.68.

2. On secondary, ipset123 has as member, the IP 192.168.7.68.

IPSet requires that the IP must be added as VIP in Network > IPs, and it added a route at the first appliance as DIRECT CONNECTED. It breaks the HA communication between the appliances; we are expecting that INC mode works using L3 routing.

Any thought on how can I fix this scenario to config HA in AWS?

Thank you in advance!

I've been tasked with integrating external SAML auth with our existing NetScaler/Citrix farm setup.

We run the following:

• Citrix NetScaler (13.0.58) running a Citrix Xenapp Gateway pointing at our hosted storefront (all Citrix components are 7.15 LTSR)

• Authentication currently handled by our own Domain (Lets use CORP for now)

• Netscaler to Storefront authentication passthrough - users only authenticate on the netscaler once

• Application visibility is bound to groups on CORP that we control per-external-client

A client of ours (lets say CLIENT.COM) would like to integrate their own authentication using SAML. This would be a first for us, and the requirements that I've set myself are below:

• Existing/new authentications to use the same XenApp Gateway on the NetScaler (Same customer-facing URL, one frontend for CORP or CLIENT.COM authentication)

• Authentication workflow (CORP or CLIENT.COM SAML) to be detected by the username entered on the NetScaler - redirecting to the relevant SAML or LDAP/DOMAIN authentication workflow

• Support for multiple clients in the future using External SAML

• Same Netscaler to Storefront authentication passthrough that we currently use

• Same application visibility functionality - so we can keep client apps separate

I've got Azure AD working as a SAML endpoint and authentication using a basic SAML policy. However this is a separate plain Citrix Gateway used purely for testing - trying to add this into our existing "Xenapp Gateway" configured on the NetScaler is proving problematic, as there are no options to select "SAML" as an authentication type within the config of the XenApp Gateway.

Can anyone shed some light on this? This seems to be a minefield of SAML IDP and basic/advanced profiles - just looking for someone to point me in the right direction.

Thanks in advance!

If you were going to configure the two services below, how would you go about it?

1. Virtual Apps and Desktops

2. Reverse proxy (Sharepoint site)

In the past I used the Unified Gateway for reverse proxy configurations (I think this was the only option for content-switching on the gateway). Setup a nonroutable address for the GW-LB-vServer, one public IP, all to many back-end service all routing using content-switching policies to their appropriate LB servers. It's been a while since I've worked with Netscaler and I'm sure licensing has changed (as it always did with Citrix). So I'm not sure if there's a better way to achieve these goals or if the answer is "it depends".

Would you create multiple GW-LB-vServers for their intended purpose?

Would you go with the Unified Gateway and handle traffic based on header requests?

What are your thoughts?

Hey Everyone!

For thin client connections on the LAN, is there any particular reason to point them to the Netscaler too? That way the connection point would be consistent so they only have to be configured once to point to ns.mycompany.com and can work from anywhere. I've always pointed thin clients on the network to the StoreFront server and reserved the Netscaler for WAN connections. But if there is something to be gained on LAN too, I'm game!

Thanks!

I have been trying to find a way to get as verbose a detail about any user that is logged in over the NetScaler. The NetScaler is configured to be a reverse proxy on our network and presents either a login page or for some services, it acts as a passthrough. The NetScaler at this stage is not being used for typical load balancing. I understand that the log information I am wanting is contained within the nslog.log file and we have SYSLOG configured to send this to a SIEM. The problem is I am seeing a connection, but I am trying to get more detail (without smashing the resources available on the box - it is a VPX).

I changed the log level to the following on the NetScaler (I am not interested in the log information for if there is a problem with the device, I am only interested in the user connections)

Log Level = Custom and only NOTICE and INFORMATIONAL.

Log Facility = LOCAL6

TCP Logging = Yes

User Configurable Log Messages = Yes

The remaining options are not turned on. I understand there is some called Subscriber Logging but we have no policies configured for that.

This log configuation will provide me with 3 "tags" if you will being SSLVPN, HTTPCONNECT and I forget the last one. In a HTTPCONN event I will get the source IP, the destination virtual server and the agent string.

My main goal here is to determine protocols such as EWS when connecting to a mail service (so in other words not HTTPCONN). Is there a way to configure the log to send this information or do we use something like the "MAS" which is not yet configured to give us this level of detail. I need to be able to see if a user connects externally to an internal resource but see everything from their IP address down to the user agent and any protocols that be being used.

Any thoughts would be appreciated.

Is this subreddit used at al?

Hi all

We are seeing hundreds of mastools-xxxxx files in /var/core/x/, started appearing in there since lunchtime yesterday, and new ones appear every 2-3 minutes. We have not changed anything and we don't use Citrix MAS. Anyone know what these are/why they might be appearing? I have raised with Citrix, but support has been abysmal lately so not expecting a quick reply! Is this a sign of compromise?

Thanks!

Update: The files appear to have stopped at around 7am on 11th. The mastools files appear to have updated around 1700 on the 10th. Citrix support are being completely useless as usual... I've seen that lots of others are also seeing this issue too: https://discussions.citrix.com/topic/419205-filesystem-filling-up-with-mastools-xxx-files/

Afternoon!

So I was given the responsibility of being primary support for our netscaler environment which consists of two SDX's, and then 3 instances on each setup as HA pairs. Documentation is scarce and gives no justification or reasoning behind any of these configs. At a high level instance 1 was supposed to handle our external vips in the dmz. The second instance supposed to be for internal traffic, and the third instance our dev instance.

Currently 0/1 and 0/2 are on a switch with vlan 3 setup

10/1 and 10/2 are configged as LA1 with VLANs 5 and 6 allowed at the switch (theseare dmz vlans) 10/3 and 10/4 are configged as LA2 with vlans 10 11 and 12
All 3 VPX's are presented with LA/1 and LA/2

For purposes of this discussion . Our SDX's are on vlan 3, our NSIPS are all on vlan 10

Instance 1 NSIP gateway ip is on vlan 5 (not sure why gateway isn't on the same subnet as the ip) Instance 2 NSIP gateway is ip on vlan 11 Instance 3 NSIP gateway is on vlan 10

On top of this the vlans on these instances.. some are set to TAGGED None, while others are tagged. And all the vlans are bound to the correct interfaces, but none of them are bound in IP bindings, when I would have thought they should have been bound to the applicable snip for that subnet.

Everything I have read.. the NSIPS should have been on the same subnet as the SDX's ips. Instead vlan 10 is a "systems admin" subnet that also has some vips setup for instance 2. Again everything is working, so I don't know how big of a deal this config actually is.

Second or third.. I lost track, the fact that all three vpx's also share the same interface channels. Generally instance 1 only uses LA/1 and that's the only snip setup there, and generally instance 2 and 3 only use LA/2 but each instance has it's own snip in some of the same vlans/subnets. So again .. I don't know if I am playing with fire here and just waiting for something to break.. or this is a normal configuration. Should I be able to have a third vpx that shares the same interface and at the same time uses the same subnets/vlans (like for a prod and dev vserver, both ips in the same subnet, but would like the test vserver to be on that 3rd instance, while production was on the second)

Again sorry for the long post.. just looking for some insight..

I'm reading the documentation on the Citrix site, but having a little trouble connecting the dots. It mentioned using the LSN to do it, but really doesn't walk you through a real example if what is what. For example, the Client - what does the IP address(es) entered in that client really represent - the internal IP for the stream source(s), the user endpoint(s) that would use the stream, our DMZ IP? Anyone know of a good guide that I can refer to? Is there a better way to do it?

TIA!!

Hi. We deployed a virtual netscaler on ESXi and despite using the VMXNET3 NIC in the VM, the Netscaler is showing only a 1 Gig link. Our ESXi host has 10 gig NICs in it. Other VMs using the same distributed switch and the VMXNET3 NIC show a 10 Gig link. Is there some sort of limitation on the virtual Netscaler?

Hello,

I have a NetScaler 13.1.42.47 setup and I'm able to access my StoreFront but unable to start a session, no matter what I keep getting slapped with a 'cannot create a secure connection in this browser' error. Chrome console shows the following...

Mixed Content: The page at 'https://webpage...' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://VDA_IP:8008/'. This request has been blocked; this endpoint must be available over WSS.

My virtual servers don't appear to be handling mixed https and insecure WebSockets very well. I have a HTTP profile with Websockets enabled and doesn't matter if I use a GoDaddy cert or AD enrolled certificate.

I'm hitting my head against the wall here, would anyone here have any pointers to help get me to the promised land? Please feel free to let me know if there's any additional information I can provide.

Thank you!

Hey all, new and relatively unexperienced with netscaler as most of the information is not with my team.

However, was wondering if you could help, we have Citrix environment with Netscaler and citrix workspace but the SSO isn't working in chrome (though it is working in internet explorer and the configuration checker shows the SSO is fine)

Any hint or path forward would be great! thanks in advance

How do I check the latency on particular vServer (Content Switching)? I tried to check by right click and statistics but it was show Average TTLB which was also having no data. Is there a way if I can find out for any latency issues from netscaler perspective?

Thanks in advance.

Hey guys,

I set up an Auth VServer with a Ldap integration which was very intuitive :D

Now I want to pass the login data to a webapp.

There are Form SSO Profiles or SAML SSO Profiles to do this.

But I have a web app that uses Basic Authentication.

How do I configure the ADC so that it also works with Basic Auth?

I hope I was able to express myself clearly :D