Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Connection Management

August 1, 2023
Contributed by: 
S

  • What is an admin connection?

    An admin connection establishes a connection to the NSIP address and allows administrators to configure and monitor the NetScaler appliance.

  • What are the types of admin connections?

    There are two types of admin connections:

    • SSH connection – Admin users use an SSH client to log on through the NSIP address.
    • NITRO API connection – Admin users use NITRO APIs to automate the logon process to the NetScaler appliance.

Note

Admin users can also log on through the GUI to log on, by using a browser to connect to the NSIP address. The GUI internally opens a NITRO API connection. Therefore, a GUI session is equivalent to a NITRO API connection, and FAQs related to the NITRO API apply to GUI.

  • How many concurrent admin connections are allowed on a NetScaler appliance?

    The appliance allows up to 20 concurrent admin connections.

  • Which login credentials are required for an admin logon?

    Admin logon requires a user name and a password.

    Note: An authentication key can be used instead of a password.

  • Which external authentication methods does a NetScaler appliance support?

    The appliance supports the following external authentication methods:

    • RADIUS
    • LDAP
    • TACACS

  • What is a client?

    A client is a device (laptop or desktop), used by the admin user to open an admin connection.

  • What is a session token?

    A session token is a unique identifier that the NetScaler appliance issues to a client that sends a NITRO API logon request.

    • API clients can reuse the session token, if it has not expired, for subsequent API requests on new TCP connections
    • GUI clients internally open NITRO API connections and keep the session token active during the GUI session.

  • What is an active session on a NetScaler appliance?

    A CLI session is considered active if the session has not expired and has an open SSH connection with a NetScaler appliance.

    A NITRO API session is considered active if the session token timeout has not expired on the NetScaler appliance.

  • How does NetScaler enforce the concurrent connection limit?

    Every time the NetScaler appliance receives an admin connection request (SSH or NITRO API), it checks the number of admin connections it has open. If the number is lower than 20, a new connection is opened.

  • Which counter reflects the number of admin connections on a NetScaler appliance?

    The connection counter (nsconfigd_cur_clients) reflects the number of active connections. This counter is incremented when a client opens new connection to the appliance, and is decremented when a connection is closed.

  • Which counter reflects the number of active tokens on the NetScaler appliance?

    The configd_cur_tokens counter reflects the number of active tokens on the NetScaler appliance.

  • How does NetScaler appliance handle errors on a connection?

    The NetScaler appliance immediately closes the client (CLI, API, and GUI) connection if it encounters errors on a connection.

  • Does a CLI or GUI session on a connection to the management address count against the admin connection limit?

    Yes, all CLI and GUI connections are TCP based connections, and every TCP connection to the management address counts against the admin connection limit.

  • Does a NITRO session count against the admin connection limit?

    A NITRO session counts against the admin connection limit if there is an open TCP connection using the session token issued by the NetScaler appliance.

  • What is the default timeout period for API, GUI, and CLI sessions on NetScaler appliance?

    The following table lists the default timeout period for API, GUI, and CLI sessions on the NetScaler appliance:

    NetScaler Releases CLI default timeout period (min) API default timeout period (min) GUI default timeout period (min)
    NetScaler 9.3 None 30 Minutes 30 Minutes
    NetScaler 10.1 None 30 Minutes 30 Minutes
    NetScaler 10.5 Onwards 15 Minutes 30 Minutes 15 Minutes

  • How can you set the CLI sessions time out on a NetScaler appliance?

    The CLI session timeout can be configured by running the following command at the CLI prompt:

    set cli mode -timeout \<xx seconds>

  • How do you override the default timeout period when using the NITRO API?

    You can override the default timeout period for a NITRO API by setting the timeout duration in the “timeout” field of the login object. If the session timeout is set to zero, the session token has an infinite timeout.

    Note: An infinite timeout is not advisable, because sessions that do not time out continue to count against the admin connection count.

  • What happens if a user account is deleted from the NetScaler appliance after an admin session is created?

    For internal system users, the NetScaler appliance closes the existing CLI or NITRO API session.

    For external system users, the session remains active until it expires.

  • Can NITRO API clients use a single session token to open multiple admin connections on the NetScaler appliance?

    Yes. Each such connection counts against the admin connection limit.

  • If management access is enabled for a SNIP address, do admin connections to that address count against the limit for the number of admin connections?

    Yes, admin connections to management address (SNIP) count against the admin connection limit on NetScaler.

  • Can a NetScaler admin log on to the NetScaler appliance after the maximum connections limit is reached?

    Yes. One more admin connection is allowed after the maximum connection limit is reached.

  • Can NITRO API endpoints open multiple admin connections on NetScaler the appliance?

    Yes, NITRO API endpoints can open multiple admin connections and exhaust the concurrent admin connection limit on a NetScaler appliance. In such situations, an extra SSH/CLI connection is allowed and the admin can force closure of old API sessions, or reduce the session timeout duration for the existing API sessions.

  • Can same client open multiple API sessions on a NetScaler appliance?

    Yes, a client can open multiple API sessions by repeatedly logging on. For example, the client might log back on after a reboot. Note: Repeated client logons count against the admin connection limit on NetScaler appliance.

  • Can API clients use the entire API session token limit?

    Yes, API clients can use the entire API session token limit, provided by repeatedly logging on without using a previously issued token.

    Note: If a client’s session timeout is zero, the token is valid forever. Repeated logons using new session tokens can count against the limit for API session tokens.

  • Do CLI sessions count against the API session token limit?

    No, CLI sessions are not counted against the API session token limit.

  • Can admin users use telnet to open a CLI session?

    No. Only an SSH client can open a CLI session.

  • What is connection limit and API session limit applicable for various NetScaler releases?

    The following table lists the maximum concurrent admin connection and active API session limits applicable for various NetScaler releases:

    NetScaler Releases 9.3 10.1 (Before 130.x) 10.1 (Before 130.10) 10.1 (From 130.10)
    Maximum number of concurrent admin connections 20 20 20 20
    Maximum number of active API sessions* 1000 20 1000 1000

    Note:

    • API sessions are considered active if they have not timed out. For example, if 500 API sessions were created but 100 have expired, 400 API sessions are active.
    • An API session need not open a TCP connection to the NetScaler appliance.
Connection Management
August 1, 2023
Contributed by: 
S
August 1, 2023
Contributed by: 
S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.