Product Documentation
ADC
Current Release 13.0 12.1
View PDF

Release Notes for NetScaler 13.1–4.44 Release

May 2, 2023
Contributed by: 
S C

This release notes document describes the enhancements and changes, fixed and known issues that exist for the NetScaler release Build 13.1–4.44.

Notes

  • This release notes document does not include security-related fixes. For a list of security-related fixes and advisories, see the security bulletin.
  • Citrix Secure Access client (formerly known as NetScaler Gateway plug-in for Windows) build 21.9.1.2 and later contains the fix for https://support.citrix.com/article/CTX341455. The NetScaler Gateway plug-in for Windows build 21.9.1.2 is included in the NetScaler build 13.1–4.44.
  • Build 13.1–4.44 and later builds address the security vulnerabilities described in https://support.citrix.com/article/CTX330728.
  • Build 4.44 replaces Build 4.43.
  • This build also includes a fix for the following issue: NSHELP-29519.

What’s New

The enhancements and changes that are available in Build 13.1–4.44.

Authentication, authorization, and auditing

Traversal from Root domain to Tree domain for Kerberos SSO authentication is supported

Traversal from Root domain to Tree domain is now supported during Kerberos SSO authentication for back end server from the NetScaler appliance. For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/aaa-tm/single-sign-on-types/kerberos-single-sign-on/setup-citrix-adc-single-sign-on.html.

[ NSAUTH-9836 ]

Bot Management

Verbose logging for NetScaler bot management

If incoming traffic is identified as a bot, the NetScaler appliance now enables you to configure the bot verbose logging functionality for logging additional HTTP header details, such as domain address, URL, user-agent header, and cookie header. The log details are then sent to the ADM server for monitoring and troubleshooting purpose. The verbose log message is not stored in the ns.log file.

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/bot-management/bot-detection.html

[ NSBOT-273 ]

NetScaler SDX Appliance

Enhancements to the cluster formation page on a NetScaler SDX appliance

The following changes are made in the GUI in the Add Node to Cluster page. The system now prompts the user to add a SNIP address while adding a new node to a cluster. These enhancements address the security issues on strict source IP address check.

  • An optional field for SNIP is now provided.
  • An Add button is also provided to create SNIPs dynamically while adding a node to the cluster IP address (CLIP).

[ NSSVM-4170 ]

A NetScaler SDX admin can now unlock a user before the lockout interval expires. Lockout is not applicable if a user logs in to the Management Service via the console. The lockout interval is also changed from seconds to minutes. Minimum value = 1 minute. Maximum value = 30 minutes.

To unlock a user using the GUI:

  1. Navigate to Configuration > System > User Administration > Users.
  2. Select the user to unlock.
  3. Click Unlock.To unlock a user using the CLI:

At the command prompt, type:

set systemuser id=`<ID>` unlock=true
<!--NeedCopy-->

[ NSSVM-4144 ]

NetScaler Gateway

Additional language support

The NetScaler Gateway user portal is now available in the Russian, Korean, and Chinese (Traditional) languages.

[ CGOP-17095 ]

OAuth-OpenID Connect authentication support for Gateway Insight

The NetScaler Gateway Insight now reports OAuth-OpenID Connect authentication-related events (successful and failure user logons).

For more information, see https://docs.citrix.com/en-us/citrix-application-delivery-management-software/current-release/analytics/gateway-insight.html

[ CGOP-16907 ]

NetScaler Web App Firewall

Client IP address extraction using an advanced policy expression

The NetScaler appliance uses an advanced policy expression to extract the client IP address from an HTTP request header, request body, request URL. The extracted value is then sent to the ADM server for audit logging, security insights, and computing the client geolocation.

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/bot-management/bot-detection.html

[ NSWAF-7260 ]

Enable option for BOT TPS Detection Mechanism

Enable option is now available for each TPS bot detection rule in the bot profile configuration. By default, the value is ON.

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/bot-management/bot-detection.html

[ NSHELP-25777 ]

Load Balancing

Support for HTTP to HTTPS redirection on content switching virtual servers

The content switching virtual servers of service type SSL now support redirection of HTTP traffic. Two new parameters: HttpsRedirectUrl and RedirectFromPort are added to the add cs vserver command. All HTTP traffic arriving at the port specified in the RedirectFromPort parameter is redirected to the URL specified in the HttpsRedirectUrl parameter. If HttpsRedirectUrl is not configured, then the HTTP traffic is redirected to the value of the host header in the incoming HTTP request.

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/ssl/how-to-articles/ssl-config-https-vserver-to-accept-http-traffic.html

[ NSLB-8224 ]

Support to synchronize save config command to remote GSLB sites

You can now synchronize the save ns config command to remote GSLB sites. To enable this functionality, a new parameter GSLBSyncSaveConfigCommand is added to the set gslb parameter command. After you enable the GSLBSyncSaveConfigCommand, the save ns config command is treated as another GSLB command and is synchronized to remote GSLB sites. You must enable the AutomaticConfigSync option to synchronize the save ns config command.

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/global-server-load-balancing/synchronizing-configuration-in-gslb-setup/real-time-synchronization.html

[ NSLB-7831 ]

Support to secure script arguments for user monitors

A new parameter, -secureargs, is added to the add lb monitor command. This parameter stores the script arguments in an encrypted format instead of plain text format. You can secure sensitive data related to the scripts for the user monitor using this parameter, for example, user name and password. Citrix recommends you to use -secureargs parameter instead of the -scriptargs parameter for any sensitive data related to the scripts. If you choose to use both the parameters together, the script specified in -scriptname must accept the arguments in the order: <scriptargs> <secureargs>. That is, you need to specify the first few parameters in <scriptargs> and the rest of the parameters in <secureargs> by maintaining the order defined for the arguments. Secure arguments are applicable only for the internal dispatcher.

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/load-balancing/load-balancing-custom-monitors/configure-user-monitor.html

[ NSLB-6314 ]

Networking

Number type dataset support for extended ACLs

The NetScaler appliance now supports the number type dataset for the extended ACLs. You can use the number type dataset for specifying the source port or the destination port or both for an extended ACL rule.

[ NSNET-20235 ]

RHI support for a VIP address bound to an IP set

A NetScaler appliance advertises a VIP address bound to an IP set as a kernel route if all of the following conditions are met:

  • The VIP address has the host route option enabled.
  • The IPset is bound to a configuration, for example, multi-IP load balancing virtual servers.

[ NSNET-20209 ]

Support for NetScaler CPX registration with ADM using volume mounts

NetScaler CPX now supports registration with NetScaler ADM by using volume mounts through Kubernetes ConfigMaps and Secret. NetScaler CPX initiates registration with the ADM agent with the configuration details derived from the volume mounts which are located in the file system of NetScaler CPX.

[ NSNET-19058 ]

Platform

VMware ESX 7.0 update 2a support on NetScaler VPX instance

The NetScaler VPX instance now supports the VMware ESX version 7.0 update 2a (Build 17867351).

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/deploying-vpx/supported-hypervisors-features-limitations.html

[ NSPLAT-20104 ]

AMD processor support for NetScaler VPX instance on ESXi

The NetScaler VPX instance on the VMware ESXi hypervisor now supports AMD processors. For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/deploying-vpx/install-vpx-on-esx.html

[ NSPLAT-17853 ]

Support for NetScaler VPX 5000 subscription on Azure Marketplace

The NetScaler VPX 5000 subscription plan is now supported on Azure Marketplace. This subscription-based plan offers the following licenses:

  • Standard
  • Advanced
  • Premium

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/deploying-vpx/deploy-vpx-on-azure.html#citrix-adc-vpx-licensing

[ NSPLAT-13663 ]

Policies

Support for IP Header Fields in Advanced Policy Expression

The Advanced policy expression now enables you to fetch the following header fields from an IP packet.

  • DSCP
  • ECN
  • TTL
  • Version
  • Identification
  • Header length
  • Header checksum
  • Options
  • Payload

[ NSPOLICY-2441 ]

Removal of deprecated features from NetScaler version 13.1 onwards

Numerous deprecated features are now removed and are no longer configurable on a NetScaler appliance.

These include:

  • The Filter feature (also known as Content Filtering or CF) - actions, policies, and binding.
  • The SPDY, sure connect (SC), priority queuing (PQ), HTTP Denial of Service (DoS), and HTML Injection features.
  • Classic policies for SSL, content switching, cache redirection, compression, and application firewall.
  • The url and domain parameters in content switching policies.
  • Classic expressions in load balancing persistence rules.
  • The pattern parameter in Rewrite actions.
  • The bypassSafetyCheck parameter in Rewrite actions.
  • SYS.EVAL_CLASSIC_EXPR in Advanced expressions.
  • The patclass configuration entity.
  • The HTTP.REQ.BODY with no argument in Advanced expressions.
  • Q and S prefixes in Advanced expressions.
  • The policyType parameter for the cmp parameter setting. (CLI command set cmp parameter.)

As already documented, you can use the nspepi tool for the conversion. You must run the tool on a NetScaler appliance version 13.0 or 12.1.

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/appexpert/policies-and-expressions/introduction-to-policies-and-exp/classic-policy-deprecation-faq.html

Also, to use the latest version of the tools to migrate from classic to advanced configuration, and from traffic domains to admin partitions, see https://github.com/citrix/ADC-scripts

[ NSPOLICY-186 ]

System

View statistics for QUIC bridge

The QUIC bridge stat command now provides a detailed summary of QUIC bridge statistics.

[ NSBASE-13883 ]

Removal of deprecated features in NetScaler 13.1 onwards

The following deprecated features and their configurations are no longer supported and are removed from the NetScaler appliance:

  • Sure Connect (SC)
  • Priority Queueing (PQ)
  • HTTP DoS Protection (HDOSP)
  • HTMLInjection

As an alternative, Citrix recommends you to use AppQoE for Sure Connect, Priority Queueing, and HTTP DoS Protection and use Client-Side measurements for HTMLInjection.

For more information, see https://docs.citrix.com/en-us/citrix-adc/current-release/appexpert/policies-and-expressions/introduction-to-policies-and-exp/classic-policy-deprecation-faq.html

[ NSBASE-13780 ]

User Interface

Batch API support for NITRO calls

NetScaler appliance now supports batchapi API. The batchapi API can handle multiple NITRO calls in a single request and thereby minimize network traffic. You can perform the following operations using the batchapi:

  • You can use the batch API to create, update, and delete multiple heterogenous resources simultaneously.
  • You can use the batch API to get multiple heterogenous resources.

[ NSCONFIG-4061 ]

Fixed Issues

The issues that are addressed in Build 13.1–4.44.

Authentication, authorization, and auditing

When you bind an LDAP monitor to a service, the monitor goes down because the NetScaler appliance sends an incorrect password to the active directory.

[ NSHELP-27961 ]

In a multiple cascade AD, an account for a user does not get locked, if a user is not found in the last cascade.

[ NSHELP-27948 ]

When a NetScaler appliance is configured for SAML authentication, the appliance dumps core upon using a certificate other than RSA.

[ NSHELP-27813 ]

In some cases, a NetScaler appliance might crash while handling certain user’s authentication request when role-based access is configured.

[ NSHELP-27655 ]

Users are unable to log in through Citrix Workspace app if Azure AD is configured as an OAuth IdP at NetScaler authentication virtual server.

[ NSHELP-27462 ]

In some cases, SAML authentication fails with the Workspace app if the app is accessed using StoreFront.

[ NSHELP-27338 ]

In some cases, an HTTP POST request to an Authentication, authorization, and auditing-TM virtual server is processed incorrectly if the request does not have an authentication cookie. The POST body gets lost during processing.

[ NSHELP-27227 ]

The NetScaler appliance crashes frequently while processing Authentication, authorization, and auditing-TM and 401 LB-based traffic.

[ NSHELP-27094 ]

In some cases, a NetScaler appliance crashes while performing user authentication for NetScaler Gateway and Authentication, authorization, and auditing - traffic managed deployment.

[ NSHELP-26555 ]

Upon entering an incorrect OTP, an error message Email Auth failed. No further action to continue is displayed.

[ NSHELP-26400 ]

In certain scenarios, the Bind Authentication, authorization, and auditing group command might fail if policy name is longer than intranet application name.

[ NSHELP-25971 ]

A NetScaler appliance configured as SAML Identity Provider (IdP) truncates the relay state from the Service Provider (SP) if it contains quotes.

[ NSHELP-20131 ]

Network connectivity test check fails because of a password decryption issue. However, the authentication functionality works fine.

[ NSAUTH-10216 ]

Bot Management

In the Transaction Per Second (TPS) bot detection mechanism, the back-end application server returns a 304 response during the response retrieval post CAPTCHA challenge.

[ NSBOT-626 ]

Caching

In a high availability setup, HA synchronization fails for the memLimit cache parameter setting during an HA failover.

[ NSHELP-28428 ]

In a high availability setup, the primary node crashes after it accesses a NULL pointer instead of a cached object.

[ NSHELP-26967 ]

NetScaler SDX Appliance

On a NetScaler SDX appliance, instance restore might fail if the instance was created with software version 13.0-76.x or earlier.

[ NSHELP-28429 ]

In a NetScaler SDX appliance, the Management Service reports incorrect data usage of ADC instances.

[ NSHELP-28208 ]

On a NetScaler SDX appliance, you cannot change the CLI prompt in the Management Service console.

[ NSHELP-28030 ]

On a NetScaler SDX appliance, the Management Service might report a high memory usage of around 80% due to increased jobs and schedulers running in inventory.

[ NSHELP-27805 ]

On a NetScaler SDX appliance, upgrade might fail if the system files (snmpd.conf and ntp.conf) contain carriage return characters.

[ NSHELP-27713 ]

On a NetScaler SDX appliance, the Management Service might report a high memory usage of around 80% due to increased jobs and schedulers running in inventory.

[ NSHELP-27396 ]

NetScaler Gateway

Users may observe RDP session launch failure when there is an upgrade to the latest version.

[ NSHELP-29519 ]

An error message appears when you try to edit the CSS attributes in a custom theme.

[ NSHELP-28648 ]

The logon to Citrix Workspace fails if responder policies that can get into a blocked state during evaluation are bound to the virtual server.

[ NSHELP-27819 ]

When accessing the NetScaler Gateway appliance using the clientless VPN, a core dump might be generated.

[ NSHELP-27653 ]

The NetScaler Gateway appliance might crash while processing server-initiated UDP traffic.

[ NSHELP-27611 ]

Users can see the mailboxes of other users when they log in to Microsoft Outlook. As a workaround, disable multiplexing.

[ NSHELP-27538 ]

A NetScaler appliance might crash if the EDT related commands, such as clearconfig, kill ica connection, or stop dtls listener are processed by the appliance.

[ NSHELP-27398 ]

The NetScaler Gateway appliance might crash while processing UDP traffic.

[ NSHELP-27317 ]

The NetScaler Gateway appliance crashes when a syslog policy is bound to a virtual server, and the corresponding syslog action is modified.

[ NSHELP-27171 ]

The NetScaler logs might be flooded with the log message GwInsight: Func=ns_sslvpn_send_app_launch_fail_record Appflow policy evaluation has failed when Gateway Insight is enabled.

[ NSHELP-26750 ]

The NetScaler Gateway appliance crashes when you try to clear the configuration if both of the following conditions are met:

  • An SSL profile and certificate-key pair are bound to the default TCP monitor.
  • The same default TCP monitor is bound to a syslog action.

[ NSHELP-26685 ]

When you enter the FQDN as the proxy in the Create NetScaler Gateway Traffic Profile page, the message Invalid Proxy Value appears.

[ NSHELP-26613 ]

While creating an RDP client profile using the NetScaler GUI, an error message appears when the following conditions are met:

  • A default pre-shared key (PSK) is configured.
  • You try to modify the RDP cookie validity timer in the RDP Cookie Validity (seconds) field.

[ NSHELP-25694 ]

The SNMP OID sends an incorrect set of current connections to the VPN virtual server.

[ NSHELP-25596 ]

The Citric ADC appliance crashes when multiple VPN plug-in clients use X.509 certificates of size 1800 bytes or more to set up a tunnel.

[ NSHELP-25195 ]

If you rename a VPN virtual server that is bound to an STA server, the status of the STA server appears DOWN when you run the show command.

[ NSHELP-24714 ]

In rare cases, the NetScaler Gateway appliance might crash if the intranet IP (IIP) address is enabled and there are server-initiated connections to the IIP address.

[ NSHELP-23819 ]

The show tunnel global command output includes advanced policy names. Previously, the output did not display the advanced policy names.

Example:

New output:

> show tunnel global
Policy Name: ns_tunnel_nocmp Priority: 0

Policy Name: ns_adv_tunnel_nocmp Type: Advanced policy
Priority: 1
Global bindpoint: REQ_DEFAULT

Policy Name: ns_adv_tunnel_msdocs Type: Advanced policy
Priority: 100
Global bindpoint: RES_DEFAULT
Done
>
<!--NeedCopy-->

Previous output:

> show tunnel global
Policy Name: ns_tunnel_nocmp Priority: 0 Disabled

Advanced Policies:

Global bindpoint: REQ_DEFAULT
Number of bound policies: 1

Done
<!--NeedCopy-->

[ NSHELP-23496 ]

If you have configured RADIUS accounting for the ICA start/stop event, the session ID in the RADIUS accounting request for ICA start is displayed as all zeroes.

[ NSHELP-22576 ]

NetScaler Web App Firewall

In a NetScaler cluster setup, one of the nodes crashes if one or more nodes are upgraded from NetScaler version 12.0, 12.1, or 13.0 build 52.x or earlier builds. The crash occurs because of an incompatibility in the Web App Firewall cookie format and size.

[ NSWAF-7689 ]

In Web App Firewall, the Cookie-transformation parameter splits the response-side cookie values if it has a comma as the delimiter.

[ NSHELP-28411 ]

A NetScaler appliance might crash if command injection violations are observed in a specific order and if the following conditions are met:

  • Multiple cookies are present in the request
  • URLDecodeRequestCookies feature is turned off

[ NSHELP-28365 ]

A NetScaler appliance might show high memory usage when parsing HTTP responses having the Samesite attribute and Web Application Firewall feature enabled.

[ NSHELP-27722 ]

The cookie hijacking feature has limited support for the Internet Explorer browser because Internet Explorer browsers do not reuse the SSL connections. Because of the limitation, multiple redirects are sent for a request eventually leading to a MAX REDIRECTS EXCEEDED error in the Internet Explorer browser.

[ NSHELP-27193 ]

After an upgrade to NetScaler version 13.0 build 76.29 and with the File Upload feature enabled on the appliance, the following issue is observed:

  • SQL and cross-site scripting protection checks block the file upload process for all web applications.

[ NSHELP-27140 ]

Load Balancing

In a GSLB setup, the status of the remote services is not updated after the stats are cleared on the GSLB site. As a workaround, clear the stats again on the same GSLB site. The status of the remote services is then updated.

[ NSHELP-28169 ]

In a high availability setup, the secondary node might crash if the following conditions are met:

  • The amount of physical memory on both the nodes is different from each other.
  • The data sessions are not synchronized properly.

[ NSHELP-26503 ]

In a cluster setup, the GSLB service IP address is not displayed in the GUI when accessed through GSLB virtual server bindings. This is only a display issue, and there is no impact on the functionality.

[ NSHELP-20406 ]

Miscellaneous

A NetScaler appliance adds extra L2 information when a tunnel or Type of Service (TOS) virtual servers are created.

[ NSHELP-27825 ]

Networking

After a NetScaler BLX appliance (version 13.0 build 82.x) running on a Debian based Linux host is upgraded, SSH does not work as intended in the shared mode.

[ NSNET-23020 ]

After a NetScaler BLX appliance is upgraded to release 13.1 build 4.x, the web application firewall might incorrectly block a request that has no content type header.

[ NSNET-21415 ]

In a NetScaler BLX appliance, NSVLAN bound with tagged non-dpdk interfaces might not work as expected. NSVLAN bound with untagged non-dpdk interfaces works fine.

[ NSNET-18586 ]

In a NetScaler appliance, the internal driver layer might use an incorrect data buffer resulting in data corruption, which in turn causes the appliance to crash.

[ NSHELP-27858 ]

Fixed Issue:

NetScaler CPX deployed as a sidecar and connected with multiple networks was not able to choose the correct source IP address for the destination subnet.

[ NSHELP-27810 ]

In a high availability setup, HA synchronization might fail for WAF profile and location file configurations.

[ NSHELP-27546 ]

Packet loops are observed in a load balancing configuration if all of the following conditions are met:

  • The virtual server is configured to listen on port 80 and the connection failover (connfailover) parameter is set to stateless.

  • The virtual server receives two request packets that have:

    • Source port = 80
    • Destination port = number other than 80
    • Destination IP address = IP address (VIP) of the virtual server

[ NSHELP-22431 ]

Platform

Failed to create target instance error message is seen on the GCP console even when you do not create any target instances. This issue occurs when you do not have the compute.targetInstances.get IAM permission in your GCP service account. From this release, the NetScaler VPX creates target instances only for VMs that use the VIP Scaling feature.

[ NSPLAT-20952 ]

The NetScaler appliance generates false packets per second (PPS) rate-limit alerts even before the NetScaler appliance reaches its PPS limit for the license.

[ NSHELP-26935 ]

Policies

The NS variable with global scope does not work for HTTP/2 traffic.

[ NSHELP-27095 ]

SSL

In a cluster setup, when two installed certificates are issuers of one server certificate that has the OCSP AIA extension, the appliance becomes unreachable if you remove the server certificate.

[ NSHELP-28058 ]

In a high availability setup, CRL auto refresh fails intermittently if both of the following conditions are met:

  • Files are syncing from the primary node to the secondary node.
  • CRL file is downloading from the CRL server at the same time.

[ NSHELP-27435 ]

On a NetScaler appliance, a false certificate expiry notification is logged the next day when a certificate-key pair is added with -expiryMonitor enabled.

[ NSHELP-27348 ]

In a cluster database, the binding is not updated properly if you bind an SSL policy to a virtual server at the client hello bind point multiple times and with different priorities. As a result, an error appears when you remove the policy even after unbinding it from the virtual server.

[ NSHELP-27301 ]

The NetScaler appliance crashes during reboot if you change the name of the built-in certificate (ns-server-certificate) in the configuration file.

[ NSHELP-26858 ]

In a cluster setup, you might observe the following issues:

  • Missing command for the default certificate-key pair binding to the SSL internal services on the CLIP. However, if you upgrade from an older build you might have to bind the default certificate-key pair to the affected SSL internal services on the CLIP.
  • Configuration discrepancy between the CLIP and the nodes for the default set command to the internal services.
  • Missing default cipher bind command to the SSL entities in the output of the show running config command run on a node. The omission is only a display issue and has no functional impact. The binding can be viewed using the show ssl <entity> <name> command.

[ NSHELP-25764 ]

System

A NetScaler appliance might crash with an ICAP OPTIONS response. The issue happens when the allowed header value contains a value other than 204.

[ NSHELP-27879 ]

In the AppFlow, the layer 4 byte count for flow records is not matching the HTTP virtual server transactions. The count value is lower than the layer 7 virtual server byte count value.

[ NSHELP-27495 ]

The tcpCurClientConn counter shows a large value if the NetScaler appliance is registered on the NetScaler ADM.

[ NSHELP-27463 ]

A NetScaler appliance might crash when the AppFlow feature is disabled and enabled back.

[ NSHELP-27236 ]

In a rare case, a NetScaler appliance might send incorrect TCP SACK sequence numbers to the client when forwarding it from the backend server. The issue occurs if the TCP Selective ACK (SACK) option is enabled in a TCP Profile.

[ NSHELP-24875 ]

A NetScaler appliance might crash when a policy with the HTTP.REQ.* expression is bound to the RESPONSE bind point of the HTTP_QUIC virtual server. The issue does not occur if you bind the same policy to an HTTP or SSL type virtual server along with HTTP_QUIC virtual server.

[ NSBASE-14612 ]

User Interface

In the Compression Policy Manager GUI, unable to bind a compression policy to an HTTP protocol by specifying a relevant bind point and connection type.

[ NSUI-17682 ]

When you fetch the content of any file from an ADC instance by using the command show systemfile, a download failure error message appears on the ADC Console. The issue occurs if the file content starts with NULL bytes.

[ NSHELP-28227 ]

The admautoregd SYSLOG flood leads to Customer Resource Definition (CRD) misclassification and misdiagnosis because of an internal system issue (Python binary file missing).

Fix: To stop monitoring the admautoregd process after 30 min if the python binary is still missing.

[ NSHELP-28185 ]

There might be a loss in configuration if a VPX instance on AWS, configured with KEK is upgraded to NetScaler release 13.0 build 76.x or later. All sensitive data encrypted using KEK fails if the configuration is loaded after a reboot.

[ NSHELP-28010 ]

An additional backslash character is incorrectly introduced if special characters are used within arguments in some SSL commands, such as create ssl rsakey and create ssl cert.

[ NSHELP-27378 ]

In a high availability setup, HA synchronization or HA propagation might fail if any of the following conditions is met:

  • The RPC node password has special characters.
  • The RPC node password has 127 characters (maximum characters allowed).

[ NSHELP-27375 ]

The nsconfigaudit tool might crash if the size of the input configuration file is very large.

[ NSHELP-27263 ]

You cannot bind a service or a service group to a priority load balancing virtual server using the NetScaler GUI.

[ NSHELP-27252 ]

The reporting functionality might stop working if the system clock gets updated on a NetScaler appliance.

[ NSHELP-25435 ]

In a NetScaler VPX appliance, a set capacity operation might fail after adding a license server. The issue occurs because the Flexera related components take a longer time to initialize because of the large number of supported licenses of type check-in and check-out (CICO)

[ NSHELP-23310 ]

The botprofile_logexpression_binding NITRO API GET call returns no response if the log expression is bound to a bot profile.

[ NSCONFIG-5490 ]

In a cluster configuration, when you bind a Web App Firewall profile with fine-grained rules and then with non-fine-graned rules to the same URL, the fine-grained rules get removed in the database. As a result, only the non-fine-grained rules are displayed on the Cluster IP address.

[ NSCONFIG-5389 ]

Known Issues

The issues that exist in release 13.1–4.44.

AppFlow

HDX Insight does not report an application launch failure caused by a user trying to launch an application or desktop to which the user does not have access.

[ NSINSIGHT-943 ]

Authentication, authorization, and auditing

An incorrect logout (/cgi/tmlogout) URL is returned when a VPN virtual server is configured as SAML SP. The issue happens because the incorrect logout URL is generated in the SAML metadata.

[ NSHELP-28726 ]

In some cases, memory leak is observed in a NetScaler appliance if the SSO functionality is used with a proxy server.

[ NSHELP-27744 ]

In a rare scenario, the secondary node in a high availability setup might crash if the following condition is met.

  • The aaa groups or aaa users or both are configured on the NetScaler appliance.

[ NSHELP-26732 ]

A NetScaler appliance does not authenticate duplicate password login attempts and prevents account lockouts.

[ NSHELP-563 ]

The DualAuthPushOrOTP.xml LoginSchema is not appearing properly in the login schema editor screen of the NetScaler GUI.

[ NSAUTH-6106 ]

ADFS proxy profile can be configured in a cluster deployment. The status for a proxy profile is incorrectly displayed as blank upon issuing the following command. show adfsproxyprofile <profile name>

Workaround:

Connect to the primary active NetScaler in the cluster and run the show adfsproxyprofile <profile name> command. It would display the proxy profile status.

[ NSAUTH-5916 ]

The Configure Authentication LDAP Server page on the NetScaler GUI becomes unresponsive if you pursue the following steps:

  • The Test LDAP Reachability option is opened.
  • Invalid login credentials are populated and submitted.
  • Valid login credentials are populated and submitted.

Workaround:

Close and open the Test LDAP Reachability option.

[ NSAUTH-2147 ]

Caching

A NetScaler appliance might crash if the Integrated Caching feature is enabled and the appliance is low on memory.

[ NSHELP-22942 ]

NetScaler SDX Appliance

On a NetScaler SDX appliance, creating an ADC instance using software version 12.0 XVA image fails. As a result, the instance is unreachable.

[ NSHELP-28408 ]

NetScaler Gateway

Sometimes, after disconnecting the VPN, the DNS resolver fails to resolve the host names, because the DNS suffixes are removed during VPN disconnection.

[ NSHELP-28848 ]

After you upgrade the NetScaler Gateway appliance to version 13.0, the proxy configuration in session profile does not work as intended. The Proxy connection is bypassed for non-HTTP NS proxy configured.

Example: add vpn sessionAction -proxy NS -httpProxy 192.0.2.0:24 -sslProxy 192.0.2.0:24

In this example, -httpProxy works as intended but -sslProxy does not work.

[ NSHELP-28640 ]

Client certificate authentication fails for Citrix SSO for macOS if there are no client certificates in the macOS Keychain.

[ NSHELP-28551 ]

Sometimes, a user is logged out of NetScaler Gateway within a few seconds when the client idle timeout is set.

[ NSHELP-28404 ]

The Windows plug-in might crash during authentication.

[ NSHELP-28394 ]

The NetScaler appliance crashes if either of the following conditions occur:

  • The syslog action is configured with the domain name and you clear the configuration by using the GUI or the CLI.
  • High availability synchronization happens on the secondary node.

Workaround:

Create syslog action with syslog server’s IP address instead of syslog server’s domain name.

[ NSHELP-25944 ]

The Gateway Insight does not display accurate information on the VPN users.

[ NSHELP-23937 ]

VPN plug-in doesn’t establish tunnel after Windows Logon, if the following conditions are met:

  • NetScaler Gateway appliance is configured for Always On feature
  • The appliance is configured for certificate based authentication with two factor authentication off

[ NSHELP-23584 ]

Sometimes while browsing through schemas, the error message Cannot read property 'type' of undefined appears.

[ NSHELP-21897 ]

Application launch failure due to an invalid STA ticket is not reported in Gateway Insight.

[ CGOP-13621 ]

The Gateway Insight report incorrectly displays the value Local instead of SAML in the Authentication Type field for SAML error failures.

[ CGOP-13584 ]

In a high availability setup, during the NetScaler failover, the SR count increments instead of the failover count in NetScaler ADM.

[ CGOP-13511 ]

While accepting local host connections from the browser, the Accept Connection dialog box for macOS displays content in the English language irrespective of the language selected.

[ CGOP-13050 ]

The text Home Page in the Citrix SSO app > Home page is truncated for some languages.

[ CGOP-13049 ]

An error message appears when you add or edit a session policy from the NetScaler GUI.

[ CGOP-11830 ]

In Outlook Web App (OWA) 2013, clicking Options under the Setting menu displays a Critical error dialog box. Also, the page becomes unresponsive.

[ CGOP-7269 ]

In a cluster deployment, if you run force cluster sync command on a non-CCO node, the ns.log file contains duplicate log entries.

[ CGOP-6794 ]

NetScaler Web App Firewall

The Web App Firewall signature ID 1048 blocks the NetScaler Gateway page from loading.

[ NSHELP-29113 ]

Load Balancing

In a high-availability setup, subscriber sessions of the primary node might not be synchronized to the secondary node. This is a rare case.

[ NSLB-7679 ]

The GSLB service group is unable to handle monitor updates due to a missing ENUM value in failed commands.

[ NSHELP-29050 ]

The NetScaler appliance might fail to respond to a GSLB domain query with an expected GSLB service IP address, if the GSLB virtual server is configured as follows: Persistence type: Source IP address Load balancing algorithm: Static proximity Backup load balancing method: Round trip time (RTT)

[ NSHELP-28668 ]

The VPX primary and secondary sites crashed after configuring the GSLB service group with Autoscale enabled.

Workaround: Do not add the dummy virtual servers, such as the content switching virtual server when you add a GSLB service or bind an IP port to a GSLB service group.

[ NSHELP-28530 ]

A NetScaler appliance in an HA setup loses connectivity because the NSB memory isn’t freed after sending the HTTP response during the HTTP probe monitoring.

[ NSHELP-28466 ]

The serviceGroupName format in the entityofs trap for the service group is as follows: <service(group)name>?<ip/DBS>?<port>

In the trap format, the service group is identified by an IP address or a DBS name and port. The question mark (?) is used as a separator. The NetScaler sends the trap with the question mark (?). The format appears the same in the NetScaler ADM GUI. This is the expected behavior.

[ NSHELP-28080 ]

Miscellaneous

When a forced synchronization takes place in a high availability setup, the appliance runs the set urlfiltering parameter command in the secondary node. As a result, the secondary node skips any scheduled update until the next scheduled time mentioned in the TimeOfDayToUpdateDB parameter.

[ NSSWG-849 ]

The URL set pattern matching fails for IDNA2008 standard domains.

[ NSHELP-28902 ]

When MAC-based forwarding (MBF) is enabled for VXLAN, the stateful TCP session was not getting established.

[ NSHELP-27125 ]

A NetScaler appliance might restart due to management CPU stagnation if a connectivity issue occurs with the URL Filtering third party vendor.

[ NSHELP-22409 ]

Networking

A NetScaler BLX appliance in DPDK mode might crash if a Web Application Firewall profile is configured with advanced security protection checks.

Workaround:

Remove the Advanced security protection configuration for WAF.

[ NSNET-22654 ]

After an upgrade from NetScaler BLX appliance 13.0 61.x build to 13.0 64.x build, settings on the BLX configuration file are lost. The BLX configuration file is then reset to default.

[ NSNET-17625 ]

The following interface operations are not supported for Intel X710 10G (i40e) interfaces on a NetScaler BLX appliance with DPDK:

  • Disable
  • Enable
  • Reset

[ NSNET-16559 ]

On a Debian based Linux host (Ubuntu version 18 and later), a NetScaler BLX appliance is always deployed in shared mode irrespective of the BLX configuration file (/etc/blx/blx.conf) settings. This issue occurs because mawk, which is present by default on Debian based Linux systems, does not run some of the awk commands present in the blx.conf file.

Workaround:

Install gawk before installing a NetScaler BLX appliance. You can run the following command in the Linux host CLI to install gawk:

  • apt-get install gawk

[ NSNET-14603 ]

Installation of a NetScaler BLX appliance might fail on a Debian based Linux host (Ubuntu version 18 and later) with the following dependency error:

The following packages have unmet dependencies: blx-core-libs:i386 : PreDepends: libc6:i386 (>= 2.19) but it is not installable

Workaround:

Run the following commands in the Linux host CLI before installing a NetScaler BLX appliance:

-  dpkg --add-architecture i386
-  apt-get update
-  apt-get dist-upgrade
-  apt-get install libc6:i386
<!--NeedCopy-->

[ NSNET-14602 ]

In some cases of FTP data connections, the NetScaler appliance performs only NAT operation and not TCP processing on the packets for TCP MSS negotiation. As a result, the optimal interface MTU is not set for the connection. This incorrect MTU setting results in fragmentation of packets and impacts CPU performance.

[ NSNET-5233 ]

In a large scale NAT deployment of two NetScaler appliances in a high availability setup, IPsec ALG might not work properly if the high availability configuration has stayprimary or staysecondary option set.

[ NSNET-1646 ]

When an admin partition memory limit is changed in the NetScaler appliance, the TCP buffering memory limit gets automatically set to the admin partition new memory limit.

[ NSHELP-21082 ]

In a high availability (HA) setup, if Gratuitous ARP (GARP) is disabled, the upstream router might not direct the traffic to the new primary after an HA failover.

[ NSHELP-20796 ]

Platform

When you upgrade from 13.0/12.1/11.1 builds to a 13.1 build or downgrade from a 13.1 build to 13.0/12.1/11.1 builds, some python packages are not installed on the NetScaler appliances. This issue is fixed for the following NetScaler versions:

  • 13.1-4.x
  • 13.0–82.31 and later
  • 12.1–62.21 and later

The python packages are not installed, when you downgrade the NetScaler versions from 13.1-4.x to any of the following versions:

  • Any 11.1 build
  • 12.1-62.21 and earlier
  • 13.0-81.x and earlier

[ NSPLAT-21691 ]

Provisioning a VPX instance with version 12.0 XVA fails on a NetScaler SDX appliance running version 13.1.

Only VPX versions 12.1 and later are supported. Upgrade the VPX version before upgrading the SBI to version 13.1.

[ NSPLAT-21442 ]

When you delete an autoscale setting or a VM scale set from an Azure resource group, delete the corresponding cloud profile configuration from the NetScaler instance. Use the rm cloudprofile command to delete the profile.

[ NSPLAT-4520 ]

In a high availability setup on Azure, upon logon to the secondary node through the GUI, the first-time user (FTU) screen for autoscale cloud profile configuration appears. Workaround: Skip the screen, and log on to the primary node to create the cloud profile. The cloud profile should be always configured on the primary node.

[ NSPLAT-4451 ]

The NetScaler VPX instances that use VMXNET3 driver might randomly crash if the instance is running on one of the following NetScaler builds:

  • NetScaler 13.1 build 4.x
  • NetScaler 13.1 build 9.x

[ NSHELP-29120 ]

Policies

Connections might hang if the size of processing data is more than the configured default TCP buffer size.Workaround: Set the TCP buffer size to a maximum size of data that needs to be processed.

[ NSPOLICY-1267 ]

SSL

On a heterogeneous cluster of NetScaler SDX 22000 and NetScaler SDX 26000 appliances, there is a config loss of SSL entities if the SDX 26000 appliance is restarted.

Workaround:

  1. On the CLIP, disable SSLv3 on all the existing and new SSL entities, such as virtual server, service, service group, and internal services. For example, set ssl vserver <name> -SSL3 DISABLED.
  2. Save the configuration.

[ NSSSL-9572 ]

Update command is not available for the following add commands:

-  add azure application
-  add azure keyvault
-  add ssl certkey with hsmkey option
<!--NeedCopy-->

[ NSSSL-6484 ]

You cannot add an Azure Key Vault object if an authentication Azure Key Vault object is already added.

[ NSSSL-6478 ]

You can create multiple Azure Application entities with the same client ID and client secret. The NetScaler appliance does not return an error.

[ NSSSL-6213 ]

The following incorrect error message appears when you remove an HSM key without specifying KEYVAULT as the HSM type. ERROR: crl refresh disabled

[ NSSSL-6106 ]

Session Key Auto Refresh incorrectly appears as disabled on a cluster IP address. (This option cannot be disabled.)

[ NSSSL-4427 ]

An incorrect warning message, Warning: No usable ciphers configured on the SSL vserver/service, appears if you try to change the SSL protocol or cipher in the SSL profile.

[ NSSSL-4001 ]

An expired session ticket is honored on a non-CCO node and on an HA node after an HA failover.

[ NSSSL-3184 ]

A NetScaler appliance crashes while processing an HTTP request if the policy action is set to Forward for a policy that is already bound at the request bind point.

[ NSHELP-29115 ]

System

TCP window leak is observed when a NetScaler appliance processes HTTP/2 header frames.

[ NSHELP-28475 ]

When a client resets a connection with multiple TCP streams, the server-side transaction record is not sent which results in L4 records missing for those data streams.

[ NSHELP-28281 ]

In a cluster setup, the set ratecontrol command works only after restarting the NetScaler appliance.

Workaround:

Use the nsapimgr_wr.sh -ys icmp_rate_threshold=<new value> command.

[ NSHELP-21811 ]

The MAX_CONCURRENT_STREAMS value is set to 100 by default if the appliance does not receive the max_concurrent_stream settings frame from the client.

[ NSHELP-21240 ]

The mptcp_cur_session_without_subflow counters incorrectly decrement to a negative value instead of zero.

[ NSHELP-10972 ]

Client IP and Server IP are inverted in the HDX Insight SkipFlow record when LogStream transport type is configured for Insight.

[ NSBASE-8506 ]

User Interface

In the NetScaler GUI, the Help link present under the Dashboard tab is broken.

[ NSUI-14752 ]

Create/Monitor CloudBridge Connector wizard might become unresponsive or fails to configure a cloudbridge connector.

Workaround:

Configure cloudbridge connectors by adding IPsec profiles, IP tunnels, and PBR rules by using the NetScaler GUI or CLI.

[ NSUI-13024 ]

If you create an ECDSA key by using the GUI, the type of curve is not displayed.

[ NSUI-6838 ]

The following issue is observed if any operation is performed that reads the ns.conf file. For example, show ns saved config.

  • The HTTPD process might freeze causing the GUI and NITRO API to become inaccessible.

[ NSHELP-28249 ]

In a high availability setup, VPN user sessions get disconnected if the following condition is met:

  • If two or more successive manual HA failover operations are performed when HA synchronization is in progress.

Workaround:

Perform successive manual HA failover only after the HA synchronization is completed (Both the nodes are in Sync success state).

[ NSHELP-25598 ]

Uploading and adding a certificate revocation list (CRL) file fails in an admin partition setup.

[ NSHELP-20988 ]

When you downgrade a NetScaler appliance version 13.0-71.x to an earlier build, some NITRO APIs might not work because of the file permission changes.

Workaround:

Change permission for /nsconfig/ns.conf to 644.

[ NSCONFIG-4628 ]

If you (system administrator) perform all the following steps on a NetScaler appliance, the system users might fail to log in to the downgraded NetScaler appliance.

  1. Upgrade the NetScaler appliance to one of the builds:

    • 13.0 52.24 build
    • 12.1 57.18 build
    • 11.1 65.10 build
  2. Add a system user, or change the password of an existing system user, and save the configuration, and
  3. Downgrade the NetScaler appliance to any older build.

To display the list of these system users by using the CLI: At the command prompt, type:

query ns config -changedpassword [-config <full path of the configuration file (ns.conf)>]

Workaround:

To fix this issue, use one of the following independent options:

  • If the NetScaler appliance is not yet downgraded (step 3 in the earlier mentioned steps), downgrade the NetScaler appliance using a previously backed up configuration file (ns.conf) of the same release build.
  • Any system administrator whose password was not changed on the upgraded build, can log in to the downgraded build, and update the passwords for other system users.
  • If none of the above options work, a system administrator can reset the system user passwords.

For more information, see How to reset root administrator password.

[ NSCONFIG-3188 ]

Any of the following NetScaler upgrade operations might cause login failure for local system user accounts:

  • from NetScaler 13.0-83.x build to NetScaler 13.1-4.x build
  • from NetScaler 12.1-63.x build to NetScaler 13.1-4.x build
  • from NetScaler 12.1-63.x build to NetScaler 13.0-82.x build

This issue is observed only for those local system user accounts that meet any of the following conditions:

  • user password was changed for the local system account on the NetScaler build (13.0-83.x or 12.1-63.x) before performing the upgrade operation.
  • the local system user account was added on the NetScaler build (13.0-83.x or 12.1-63.x) before performing the upgrade operation.

Workaround:

A system administrator can reset the password for the local system user accounts facing the login failure issue.

For more information, see How to reset root administrator password.

[ NSCONFIG-5650 ]

Release Notes for NetScaler 13.1–4.44 Release
May 2, 2023
Contributed by: 
S C
May 2, 2023
Contributed by: 
S C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.