Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Connection Management

September 14, 2021
Contributed by: 
S

  • What is an admin connection?

    An admin connection establishes a connection to the NSIP address and allows administrators to configure and monitor the Citrix ADC appliance.

  • What are the types of admin connections?

    There are two types of admin connections:

    • SSH connection – Admin users use an SSH client to log on through the NSIP address.
    • NITRO API connection – Admin users use NITRO APIs to automate the logon process to the Citrix ADC appliance.

Note

Admin users can also log on through the GUI to log on, by using a browser to connect to the NSIP address. The GUI internally opens a NITRO API connection. Therefore, a GUI session is equivalent to a NITRO API connection, and FAQs related to the NITRO API apply to GUI.

  • How many concurrent admin connections are allowed on a Citrix ADC appliance?

    The appliance allows up to 20 concurrent admin connections.

  • Which login credentials are required for an admin logon?

    Admin logon requires a user name and a password.

    Note: An authentication key can be used instead of a password.

  • Which external authentication methods does a Citrix ADC appliance support?

    The appliance supports the following external authentication methods:

    • RADIUS
    • LDAP
    • TACACS

  • What is a client?

    A client is a device (laptop or desktop), used by the admin user to open an admin connection.

  • What is a session token?

    A session token is a unique identifier that the Citrix ADC appliance issues to a client that sends a NITRO API logon request.

    • API clients can reuse the session token, if it has not expired, for subsequent API requests on new TCP connections
    • GUI clients internally open NITRO API connections and keep the session token active during the GUI session.

  • What is an active session on a Citrix ADC appliance?

    A CLI session is considered active if the session has not expired and has an open SSH connection with a Citrix ADC appliance.

    A NITRO API session is considered active if the session token timeout has not expired on the Citrix ADC appliance.

  • How does Citrix ADC enforce the concurrent connection limit?

    Every time the Citrix ADC appliance receives an admin connection request (SSH or NITRO API), it checks the number of admin connections it has open. If the number is lower than 20, a new connection is opened.

  • Which counter reflects the number of admin connections on a Citrix ADC appliance?

    The connection counter (nsconfigd_cur_clients) reflects the number of active connections. This counter is incremented when a client opens new connection to the appliance, and is decremented when a connection is closed.

  • Which counter reflects the number of active tokens on the Citrix ADC appliance?

    The configd_cur_tokens counter reflects the number of active tokens on the Citrix ADC appliance.

  • How does Citrix ADC appliance handle errors on a connection?

    The Citrix ADC appliance immediately closes the client (CLI, API, and GUI) connection if it encounters errors on a connection.

  • Does a CLI or GUI session on a connection to the management address count against the admin connection limit?

    Yes, all CLI and GUI connections are TCP based connections, and every TCP connection to the management address counts against the admin connection limit.

  • Does a NITRO session count against the admin connection limit?

    A NITRO session counts against the admin connection limit if there is an open TCP connection using the session token issued by the Citrix ADC appliance.

  • What is the default timeout period for API, GUI, and CLI sessions on Citrix ADC appliance?

    The following table lists the default timeout period for API, GUI, and CLI sessions on the Citrix ADC appliance:

    Citrix ADC Releases CLI default timeout period (min) API default timeout period (min) GUI default timeout period (min)
    NetScaler 9.3 None 30 Minutes 30 Minutes
    NetScaler 10.1 None 30 Minutes 30 Minutes
    NetScaler 10.5 Onwards 15 Minutes 30 Minutes 15 Minutes

  • How can you set the CLI sessions time out on a Citrix ADC appliance?

    The CLI session timeout can be configured by running the following command at the CLI prompt:

    set cli mode -timeout \<xx seconds>

  • How do you override the default timeout period when using the NITRO API?

    You can override the default timeout period for a NITRO API by setting the timeout duration in the “timeout” field of the login object. If the session timeout is set to zero, the session token has an infinite timeout.

    Note: An infinite timeout is not advisable, because sessions that do not time out continue to count against the admin connection count.

  • What happens if a user account is deleted from the Citrix ADC appliance after an admin session is created?

    For internal system users, the Citrix ADC appliance closes the existing CLI or NITRO API session.

    For external system users, the session remains active until it expires.

  • Can NITRO API clients use a single session token to open multiple admin connections on the Citrix ADC appliance?

    Yes. Each such connection counts against the admin connection limit.

  • If management access is enabled for a SNIP address, do admin connections to that address count against the limit for the number of admin connections?

    Yes, admin connections to management address (SNIP) count against the admin connection limit on Citrix ADC.

  • Can a Citrix ADC admin log on to the Citrix ADC appliance after the maximum connections limit is reached?

    Yes. One more admin connection is allowed after the maximum connection limit is reached.

  • Can NITRO API endpoints open multiple admin connections on Citrix ADC the appliance?

    Yes, NITRO API endpoints can open multiple admin connections and exhaust the concurrent admin connection limit on a Citrix ADC appliance. In such situations, an extra SSH/CLI connection is allowed and the admin can force closure of old API sessions, or reduce the session timeout duration for the existing API sessions.

  • Can same client open multiple API sessions on a Citrix ADC appliance?

    Yes, a client can open multiple API sessions by repeatedly logging on. For example, the client might log back on after a reboot. Note: Repeated client logons count against the admin connection limit on Citrix ADC appliance.

  • Can API clients use the entire API session token limit?

    Yes, API clients can use the entire API session token limit, provided by repeatedly logging on without using a previously issued token.

    Note: If a client’s session timeout is zero, the token is valid forever. Repeated logons using new session tokens can count against the limit for API session tokens.

  • Do CLI sessions count against the API session token limit?

    No, CLI sessions are not counted against the API session token limit.

  • Can admin users use telnet to open a CLI session?

    No. Only an SSH client can open a CLI session.

  • What is connection limit and API session limit applicable for various Citrix ADC releases?

    The following table lists the maximum concurrent admin connection and active API session limits applicable for various Citrix ADC releases:

    Citrix ADC Releases 9.3 10.1 (Before 130.x) 10.1 (Before 130.10) 10.1 (From 130.10)
    Maximum number of concurrent admin connections 20 20 20 20
    Maximum number of active API sessions* 1000 20 1000 1000

    Note:

    • API sessions are considered active if they have not timed out. For example, if 500 API sessions were created but 100 have expired, 400 API sessions are active.
    • An API session need not open a TCP connection to the Citrix ADC appliance.
Connection Management
September 14, 2021
Contributed by: 
S
September 14, 2021
Contributed by: 
S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.