Release Notes for Build 52.15 of Citrix ADC 12.1 Release

What's New?

System

• Global control for content inspection logging

  You can now enable the audit log feature to log content inspection events on a Citrix ADC appliance at the global level.
  [# NSBASE-7470]

• View Citrix ADC time zone and NTP server IP address on FTU screen

  You can now configure the time zone and the NTP server IP address required for clock synchronization through the first-time-user (FTU) screen on the Citrix ADC GUI.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/13/system/basic-operations/configuring-clock-sychronization.html.
  [# NSUI-11641]

Fixed Issues

• In a high availability setup with admin partition configuration, the audit logs generated from the secondary node are sent to SYSLOG or NSLOG server only when the SYSLOG or NSLOG server is reachable from the admin partition.
  [# NSHELP-19399]

AppFlow

• In a high availability setup, the secondary appliance might keep on restarting if AppFlow is configured for Gateway Insight.
  [# NSHELP-18469]

• If you configure multiple AppFlow collectors in an AppFlow action there can be a buffer overflow leading to an appliance failure.
  [# NSHELP-18562, NSHELP-18563]

• If an Internet Protocol Flow Information Export (IPFIX) message header is not in a correct sequence, the IPFIX collector drops the AppFlow records.
  [# NSHELP-18903]

• If you enable AppFlow and select logstream as the transport mode, the server processing time and the server network latency values may appear same.
  [# NSHELP-19306]

• The Citrix ADC appliance might crash when a new user logs on. The crash happens if AppFlow logging is enabled on a VPN virtual server and memory allocation fails.
  [# NSHELP-19360]

• The Citrix ADC appliance crashes if you bind a user-defined analytics profile, other than the internally bound profile, to an AppFlow action.
  [# NSHELP-19362]

Authentication, authorization, and auditing

• The probe server command provides an appropriate message when the TACACS server closes the TCP connection with FIN or RST packets without sending an authentication response.
  [# NSHELP-18399]

• In a Citrix ADC appliance with two-factor authentication, the appliance prompts you to change the authentication password if the existing password has expired. During this prompt time, the appliance deletes the authentication, authorization, and auditing information.

  The Citrix ADC appliance might crash when it attempts to access the deleted authentication, authorization, and auditing information.
  [# NSHELP-18474]

• A Citrix ADC appliance might fail when logging in end users to traffic management resources behind Citrix Gateway appliance.
  [# NSHELP-18517]

• A Citrix ADC appliance configured as SAML SP fails if the server sends a large RelayState parameter name along with assertion.
  [# NSHELP-18559]

• If a Citrix ADC appliance is deployed for SAML SP solution, SAML assertions are occasionally rejected.
  [# NSHELP-18574]

• A Citrix ADC appliance might fail if the authentication, authorization, and auditing feature is disabled while accessing Citrix Gateway appliance.
  [# NSHELP-18601]

• If the related policy evaluation fails during an end-point analysis authentication, the Citrix ADC appliance might close the authentication, authorization, and auditing session. This closure of the session might result in the appliance to fail.
  [# NSHELP-18638]

• When a Citrix ADC appliance is configured for SAML IdP, the requests from certain SAML SP containing URL encoded in RelayState parameter might cause an issue after login.
  [# NSHELP-18694]

• A Citrix ADC appliance might crash while parsing an invalid SAML response.
  [# NSHELP-18701]

• The Citrix GUI displays the configured server IP address in the Server Name field for an authentication radius action if all the following conditions are true:

  * If you set the Server IP address parameter after setting the Server Name parameter.

  * If the Server Name Length parameter is not set to zero.
  [# NSHELP-18703]

• If the SAML Service Provider (SP) does not send sessionIndex in the logout request to SAML Identity Provider (IdP), then SAML IdP returns an error instead of completing the logout process.
  [# NSHELP-18722]

• The FormSSO fails if any of the form fields is more than 1365 bytes in length.
  [# NSHELP-18783]

• When you access StepUp load balancing virtual server home page with SelfAuth bookmark, the user name is not prepopulated in the next login screen.
  [# NSHELP-18875]

• In rare cases, a Citrix Gateway appliance redirects the user to SAML Identity Provider (IdP) to log in again if the following conditions are met:

  - SAML with two factors is occupied for user authentication.

  - User fails to validate the second factor on the Citrix Gateway portal.
  [# NSHELP-18912, NSHELP-644]

• A Citrix ADC appliance fails to obtain Kerberos tickets through a constrained delegation, if one of the following conditions are met:

  - The enterprise “realm” parameter is configured for the user.

  - The domain name in the “keytab” parameter is in lower case.
  [# NSHELP-18946]

• The following behavior is observed on the Authentication Virtual Server page of Citrix ADC GUI:

  - Unable to edit the Basic Settings in the non-addressable type of authentication, authorization, and auditing virtual server.

  - The Port field must have a valid Port value.
  [# NSHELP-18980]

• A Citrix ADC appliance configured for SAML Service Provider (SP) does not perform HTML entity decoding of the attributes retrieved from the SAML assertion.
  [# NSHELP-19003]

• Authentication fails if a Citrix ADC proxy is configured with two-factor authentication along with advanced policies.
  [# NSHELP-19020]

• A Citrix ADC appliance does not drop unauthenticated HTTP OPTIONS requests if User-Agent contains one of the patterns mentioned in ns_aaa_activesync_useragents.
  [# NSHELP-19024]

• A Citrix ADC appliance might crash if the following conditions are met:

  - Password change option is enabled in an LDAP action command.

  - LDAP action with authentication, authorization, and auditing session run into session propagation issue.
  [# NSHELP-19053]

• In a Citrix Gateway deployment, if the load balancing virtual server home page is accessed after VPN authentication, the page is not accessible.
  [# NSHELP-19075]

• The memory usage of a Citrix ADC appliance increases when Citrix Gateway or traffic management virtual server uses Kerberos authentication.
  [# NSHELP-19085]

• A Citrix ADC traffic management virtual server occasionally returns 500 error message after the first-time login and in the following conditions:

  - Additional login redirect.

  - An SSL backend service is behind HTTP traffic management virtual server.
  [# NSHELP-19160]

• The Citrix ADC appliance might reply with a 404 error page for client requests, which contains the term ‘Data’ in the URL. For example, http://www.hostname.com/XYZData/ABC.
  [# NSHELP-19169]

• A Citrix ADC appliance might crash if the input to Citrix GUI or NITRO API login request has an invalid username or password value.
  [# NSHELP-19254]

• When a SAML assertion contains attributes with entity encoding, a Citrix ADC appliance does not decode the attributes after parsing them.
  [# NSHELP-19256]

• EPA fails if it is configured after SAML as a passthrough factor.
  [# NSHELP-19285]

• The Citrix appliance might crash if an authentication login schema policy is set to noschema.
  [# NSHELP-19292]

• A Citrix ADC appliance occasionally fails if a defaultAuthenticationGroup parameter is configured in a samlIdPProfile command.
  [# NSHELP-19301]

• System user login from Citrix GUI or NITRO API using role-based access (RBA) authentication fails when the Citrix ADC management is accessed through load balancing virtual server and load balancing service.
  [# NSHELP-19385]

• Active Directory Federation Services (ADFS) fails to import metadata generated by the Citrix ADC SAML Service Provider (SP).
  [# NSHELP-19390]

• A Citrix ADC appliance configured for SAML Identity Provider (IdP) fails to authenticate incoming authentication request for certain applications.
  [# NSHELP-19443]

• A Citrix ADC appliance with authentication, authorization, and auditing feature might crash in a low memory condition.
  [# NSHELP-8498]

• Occasionally, a Citrix Gateway appliance might fail when it receives /vpns/services.html request from a client.
  [# NSHELP-8513]

Citrix ADC CLI

• When logged in as nsrecover user, nscli -U commands are throwing error.
  [# NSCONFIG-1414]

• If you run a command that contains the symbol "@" remotely, the following error message appears:

  "No such argument"
  [# NSHELP-12000]

Citrix ADC GUI

• A time zone setting ("set timezone” command) in a Citrix ADC appliance running release 11.1 might get lost after you upgrade it to a later release.
  [# NSHELP-11550]

• Only the custom reports created in the current viewing partition or in the cluster appear in the Citrix ADC GUI.
  [# NSHELP-18841]

• The following error message appears after you perform steps 1 through 4.

  "Ambiguous argument value []"

  1. Create an SSL profile with default values.

  2. Bind the profile to an SSL virtual server.

  3. Edit SSL parameters, but do not change any values.

  4. Select OK to close the SSL parameters dialog box.
  [# NSHELP-19402]

Citrix ADC MPX Appliance

• In some cases, the 50G NIC on the MPX 15081-50G and MPX 15041 appliances does not restore to normal state after toggling the power control of the interface.
  [# NSHELP-18786]

Citrix ADC SDX appliance

• The maximum number of cores that you can configure now on a VPX instance depends on the available cores on the particular SDX platform. Earlier, you could configure a maximum of only five cores even if more cores were available.

  For information about maximum number of cores you can assign to a VPX instance, see https://docs.citrix.com/en-us/sdx/13/provision-netscaler-instances.html
  [# NSHELP-18632]

• A VPX instance running on a Citrix ADC SDX appliance fails to free the allocated ports after a client connection is closed. This failure might cause the instance to restart continuously.
  [# NSHELP-18729]

• After an SDX appliance is restored, partition MACs from the backup file were not restored on the respective VPX instances running on the SDX appliance.
  [# NSHELP-19008]

• SDX image upgrade to 12.1 52.x might fail during Management Service image upgrade.
  [# NSHELP-19168]

• Upgrade to release 12.1 build 50.x and later, release 12.0 build 60.1 and later, release 11.1 build 60.7 and later might result in one of the following outcomes:

  - VLAN filtering on SDX channels is disabled.

  - The SDX Management Service becomes unresponsive, even though the upgrade is successful, if the channels on the SDX appliance have VLAN filtering enabled and VPX instances have L2 mode enabled
  [# NSSVM-2540]

• When provisioning a Citrix VPX instance by using the Citrix SDX GUI, an error message "IP Address not a proper IP Address" appears if you select IPv6.
  [# NSSVM-2603]

Citrix ADC UI

• A Citrix ADC appliance adds a "\" (backslash) before a " "(space) for organization name, locality name, and other fields in the certificate signing request (CSR) if the following conditions are met:

  - A user without shell access, tries to connect to an upgraded Citrix ADC appliance by using the CLI, GUI, or NITRO.

  - The user creates a CSR.
  [# NSHELP-4521]

Citrix ADC VPX appliance

• Cluster and high availability (same zones and across zones) on AWS do not work.
  [# NSPLAT-9407]

Citrix Gateway

• In some cases, if the Citrix Gateway appliance accesses a null pointer, the appliance dumps core.
  [# CGOP-10756]

• On the user authentication screen for VPN plug-in, you had to click on the password field before entering the password. Now, you do not need to click on the password field before entering the password as the cursor moves to the password field automatically after the username field is auto-filled.
  [# NSHELP-18338]

• After a successful logoff from a Citrix Gateway appliance, the client browser window must be closed and a new browser window must be opened for a new login. This is required if the following authentication methods are selected:

  - SAML with IdP enabled

  - Smartcard
  [# NSHELP-18519, NSHELP-18422]

• In some cases, upon landing on the Citrix Gateway virtual server logon page, the "Cannot complete your request" error message is displayed.
  [# NSHELP-18564, NSHELP-19093]

• In a high availability setup, the secondary node might crash if SAML is configured.
  [# NSHELP-18691]

• If an RDP server profile is set to the same port number and IP address as that of the content switching virtual server, the content switching configuration is lost after reboot.
  [# NSHELP-18818]

• Memory leaks during authorization policy evaluation for DNS resolutions, UDP, and ICMP authorizations when the default authorization action is set to "deny".
  [# NSHELP-18872]

• Citrix Gateway plug-in for Windows fails to detect some captive portals because the RFC guidelines to manage the captive portals are missing.
  [# NSHELP-19005]

• User interface for the Citrix Gateway plug-in for Windows goes out of scale when the screen resolution is greater than 100%.
  [# NSHELP-19083]

• UDP, DNS, and ICMP authorization policies do not get applied for the connections between a client in the internal network and a VPN client (server initiated connections).
  [# NSHELP-19142]

• Advanced End-point Analysis (EPA) scan fails for the macOS devices.
  [# NSHELP-19328]

• In some cases, a Citrix ADC appliance dumps core, if the following conditions are met.

  - Two-factor authentication is enabled for the native VMware horizon client.

  - Radius is configured as the first factor of authentication.

  - Radius server responds with the group names upon successful authentication.
  [# NSHELP-19333]

• In some cases, log out from Windows VPN plug-in takes longer than expected.
  [# NSHELP-19394]

• In CVPN mode, when Workspace Control is enabled for Citrix StoreFront, the app sessions are lost upon disconnecting and logging on again.
  [# NSHELP-6722]

• The global settings for the graphical user interface are not shown correctly.
  [# NSHELP-7740]

• In a multicore environment, the Citrix Gateway appliance dumps core during login transfer when intranet IP address is enabled in VPN.
  [# NSHELP-8164, NSHELP-7078, NSHELP-7082, NSHELP-17438, NSHELP-18156, NSHELP-18368]

• In some cases, users experience application launch failures or frozen sessions for EDT sessions, if Citrix Gateway is configured to generate Insights for EDT.
  [# NSINSIGHT-1791]

• In some cases, a Citrix ADC appliance dumps core if the Citrix Gateway is configured for EDT Proxy and the EDT Insight functionality is enabled.
  [# NSINSIGHT-1948]

Citrix Web App Firewall

• A Citrix ADC application firewall appliance intermittently blocks requests for some URLs under heavy traffic loads when advance application firewall start url check is enabled.
  [# NSHELP-16678]

• A high availability set up might crash when you upgrade the secondary node to version 11.1 build 56.x and the failover becomes the primary node.
  [# NSHELP-17644]

• A Citrix ADC appliance might crash if the WSDL schema includes an "anyAttribute" element.
  [# NSHELP-17943]

• Citrix Web App Firewall resets an incoming request if the following conditions are observed:

  - The SQL comment size is greater than 4k bytes

  - The configured action is log or stats.
  [# NSHELP-18073]

• A Citrix ADC appliance might crash if the Citrix Web App Firewall feature is enabled and there is a memory allocation failure on the appliance.
  [# NSHELP-18161]

• A user cannot send an HTTP request from a website if the Web App Firewall profile has the following options enabled:

  - Streaming.

  - Signature bound with post body rules.
  [# NSHELP-18238]

• Citrix Web App Firewall is unable to import or export firewall profiles on a Citrix ADC appliance. This issue occurs if there are many stale empty directories prefixed "appfwXXXXXX" under "/tmp/" folder and if the auto-update is enabled for signatures.
  [# NSHELP-18472]

• The DHT update failure warnings are logged in the ns.log file if cookie proxy is enabled on the Citrix ADC appliance.
  [# NSHELP-18616]

• If the token size is greater than 128k, the token buffer is reset multiple times leading to the loss of some data.
  [# NSHELP-18741]

• When a command is set to netsvc and if the secondary node takes more than 15 secs to respond, the setsvc command logs or increments the propagation failure counter. If the secondary node takes more than 10 secs to respond, some failure is logged at the secondary configd and the corresponding timer is updated with an SNMP trap.
  [# NSHELP-18834, NSHELP-18568]

• A configuration loss is observed when you reboot a high availability or cluster setup with rfcprofile option enabled in the running configuration.
  [# NSHELP-18856]

• Citrix Web App Firewall is unable to block requests with Wordpress vulnerabilities.
  [# NSWAF-2521]

Clustering

• In a cluster setup, the ‘show cluster node’ command displays the interfaces on which the heartbeat is turned off in a "Interfaces on which heartbeats are not seen" parameter.
  [# NSHELP-16123]

• In a cluster setup, version mismatch issue is observed even if there are two cluster nodes of the same version. However, the version mismatch does not cause any functional issues but generates an SNMP trap which you can ignore.
  [# NSHELP-18292]

• The following behavior is observed in a clustered setup:

  - The node addition or deletion commands are not sent to ZebOS daemons when there is no cluster view change.

  - The node mismatch information is observed in ZebOS daemon and packet engine.

  - Errors are seen while configuring vtysh command.

  - ZebOS configuration is not cleared when a node is deleted.
  [# NSHELP-18494]

• In a cluster setup, a VIP address in disabled state might automatically become enabled after a reboot.
  [# NSHELP-18589]

• The following behavior is observed in a cluster setup:

  - There is a configuration mismatch if you execute enable/disable servicegroupmember, service group, and server command.

  - The unset command does not reset the netprofile for service/service group.
  [# NSNET-9599]

DNS

• When an AAAA response is delayed and an A request is sent to the same domain, the query ID in both AAAA and A records remain the same. On processing the delayed AAAA response from the server, the Citrix ADC appliance might crash.
  [# NSHELP-18742]

• When sending a DNS query for domain based service, the Citrix ADC appliance inserts an OPT record in the query. This record can have incorrect values if the fields are not cleared before inserting the record in the query.
  [# NSHELP-18819]

GSLB

• In a GSLB deployment, GSLB full sync operation might fail after a backup GSLB virtual server is removed.
  [# NSHELP-11946]

• A Citrix ADC appliance might crash if both of the following conditions are met:

  - IPv6 protocol translation feature is disabled on any of the sites participating in GSLB.

  - RTT method is configured as the GSLB method.
  [# NSHELP-18181]

• In admin partitions, the GSLB global parameters are not saved in the configuration (ns.conf) file. As a result, the settings are lost when you restart the appliance.
  [# NSHELP-18621]

• Sometimes, the "show gslb runningConfig" command does not display the newly added name server. The new server is not displayed if the IP address of the GSLB service is changed to a new server and in this scenario the GSLB service flag does not get set.
  [# NSHELP-18956]

HDX Insight

• On the Citrix ADM user interface, retransmission stats values are incorrectly displayed. The values displayed are cumulative values because the Citrix ADC appliance does not reinitialize these values after reporting it once.
  [# NSHELP-18851]

ICA

• In some cases, when the Citrix Gateway virtual server is configured for EDT, the ICA sessions become unresponsive.
  [# NSHELP-18191]

• A Citrix ADC appliance dumps core for a particular traffic pattern if AppFlow for ICA is enabled.
  [# NSHELP-18288]

• In rare cases, in a high availability setup with session reliability feature enabled (SR+HA), the secondary Citrix ADC appliance experiences memory leak. The leak is caused because the HDX session allocations in the secondary Citrix ADC appliance are not released as expected.
  [# NSHELP-18549]

Load Balancing

• When you modify a server name or its IP address, the service group entity binding table is not updated. As a result, there might be cluster configuration inconsistency between CLIP and NSIP for service group member.
  [# NSHELP-10142]

• In some cases, monitor binding for a service group with autoscaling enabled might be missing in the running configuration.
  [# NSHELP-10168]

• A Citrix ADC appliance might crash if a stream selector with rate limiting objects gets deleted and added again with overlapping selectlets.
  [# NSHELP-11131]

• In a rare condition, the Citrix ADC appliance might fail if SYS.VSERVER("").THROUGHPUT expression is used in a policy.
  [# NSHELP-18330]

• The inactive services number for a load balancing virtual server might return a large value for few seconds after some services or service group members are unbound from the load balancing virtual server. This is a display issue and does not impact any functionality.
  [# NSHELP-19400]

• If a service group member is assigned a wildcard port (port *), the monitor details for that service group member can be viewed from the Monitor Details page.
  [# NSHELP-9409]

• In a high availability setup, the running config displays unwanted port information for service group monitor bindings when you execute the show ns runningConfig command.

  This results in loss of service group monitor binding after a reboot or a failover. The service group member bindings are unaffected.
  [# NSLB-4418]

Logging

• Citrix ADC CPX or VPX stops archiving newnslog files after it reaches 200 files.
  [# NSNET-8749]

NITRO

• Retrieving a specific system file using the systemfile Java SDK is not supported.
  [# NSHELP-18645]

• In Python NITRO SDK, UPDATE operation fails with an error message if a GET method response object is used in the UPDATE operation.
  [# NSHELP-19111]

Networking

• For a default-originate routing setting, the Citrix ADC appliance sends a learned default route instead of a self-originated default route to the neighbor device. The learned default routes are dropped in the network because of the route map.
  [# NSHELP-18431]

• The IS-IS dynamic routing module in a Citrix ADC appliance might incorrectly mark the default route as an invalid prefix during the shortest-path-first (SPF) calculation. Because of this reason, the route is not installed.
  [# NSHELP-18498]

• In a high availability setup with OSPF dynamic routing configured, the new primary node does not generate the OSPF MD5 sequence number in an increasing order after a failover.

  This issue has been fixed. For the fix to work properly, you must synchronize the time between the primary and secondary nodes either manually or by using NTP.
  [# NSHELP-18958]

• If a high availability setup is upgraded to release 12.1 build 51.16, the high availability nodes might not advertise OSPF VIP routes after a failover.
  [# NSHELP-19056]

• A Citrix ADC appliance might create an SYN+ACK packet loop, which in turn cause high CPU usage, when all the following conditions are true:

  * If an outstanding RNAT probe connection to an IP address, which is not currently Citrix ADC owned IP address, is present in the ADC appliance.

  * If you make this IP address as ADC owned IP address as part of the ADC configuration. For example, adding a load balancing virtual server with this IP address.
  [# NSHELP-19376]

• The Citrix ADC appliance might drop IPv6 traffic intermittently.
  [# NSHELP-19397]

• On the Citrix ADC GUI, when you go to Configuration > Network > Interfaces, and click Interface Statistics, the Interface Summary is not displayed and the “Invalid value [arg]” error message appears.
  [# NSUI-13043]

Platform

• Bandwidth settings configured using the “set interface” command are overwritten when the ring buffer size is changed.
  [# NSHELP-18929]

SSL

• The ADC appliance might occasionally send extra data to the client if both of the following conditions are met:

  - The appliance is connected to the backend server through SSL.

  - The size of the data received from the server exceeds 9k.
  [# NSHELP-11183]

• Incorrect values appear in the output of "stat ssl vserver" for total session hits rate/sec.
  [# NSHELP-13228]

• You might see heartbeat failures eventually leading to a high availability failover. The issue is seen when secure monitors are enabled on a Citrix ADC VPX appliance and the appliance performs DH-key exchange with the backend servers. The failures happen because some CPU intensive DH operations are performed inline.
  [# NSHELP-13321]

• In a high availability configuration, the cipher binding to a service group might be lost if you force a node to failover.
  [# NSHELP-13329]

• In a cluster setup, an OCSP responder is not unbound from the SSL certificate-key pair on the CLIP if the CA option is specified. However, the OCSP responder is unbound from the SSL certificate-key pair on the other nodes of the cluster.

  After you upgrade to this build, you must explicitly unbind the OCSP responder on the CLIP again.
  [# NSHELP-13359]

• In a cluster setup, if you bind a custom certificate to the internal services, and then run the "clear config basic" command, the default certificate (ns-server-certificate) is no longer bound to the internal services on the cluster IP (CLIP) node.

  On the other nodes, the default certificate is bound to the internal services.
  [# NSHELP-18187]

• In a cluster setup, the running configuration on the CLIP address and the nodes differs if the following conditions are met:

  - You add a certificate-key pair with a password.

  - Update this certificate-key pair with another certificate and a key without a password.

  The running configuration on the CLIP address shows a password for the updated certificate even though there is no password. However, it does not show a password for the updated certificate on the nodes.
  [# NSHELP-18189]

• When a Citrix ADC appliance receives a TLS Close Notify alert message from a TLS peer, the appliance does not treat the message as the end of incoming application data.
  [# NSHELP-18291]

• Backend SSL service monitors fail because SSL handshakes take longer than expected. The delay is because the SSL handshake waits for the configured response timeout when the OCSP response received is not valid.
  [# NSHELP-18319]

• A Citrix ADC appliance might crash if a partition is configured and session ticket is enabled. The crash occurs in one of the following scenarios:

  - Force failover is done in an HA setup and the primary node crashes.

  - A partition is removed, or the extended configuration is cleared (clear config -f extended) in an nCore setup.
  [# NSHELP-18622, NSHELP-13516]

• The Citrix ADC appliance crashes if you link a certificate back to itself. For example, you link certificate C1 to certificate C2, certificate C2 to certificate C3, and certificate C3 to certificate C1. That is, any certificate link that creates a loop causes the appliance to crash.
  [# NSHELP-18627]

• The Citrix ADC appliance might crash if a certificate with a null DNS (SAN) entry is bound to an SSL virtual server.
  [# NSHELP-18672]

• The Citrix ADC appliance might crash and dump core if certificates with a large number of SAN entries are bound to an SSL virtual server.
  [# NSHELP-18905]

• A Citrix ADC appliance might crash when you execute an audit log message action based on the expression "ssl.origin.server_cert”. The log action is bound to a responder policy.
  [# NSHELP-19014]

• A Citrix ADC appliance might crash while executing the SSL action "clientcertFingerprint" to insert the client certificate’s fingerprint into the HTTP header of the request to be sent to the server, if both of the following conditions are met:

  - Session ticket is enabled.

  - SSL policy is bound at request bind point.
  [# NSHELP-19331]

• An SSL virtual server may reset the connection with reset code 9820 instead of fragmenting the record into multiple TCP packets as expected, if the following conditions are met:

  - A TLSv1.3 enabled virtual server encrypts application data from the backend application server to send to a TLSv1.3 client.

  - The resulting encrypted record length is exactly one byte larger than the TCP maximum segment size.
  [# NSHELP-19466]

• In a cluster setup, the 'set ssl service' command on any internal service throws an error and does not set any parameter for the internal service.
  [# NSSSL-5834]

• A TLS 1.3-enabled browser that implements the TLS 1.3 anti-downgrade mechanism described in RFC 8446 might fail to connect to the management GUI over HTTPS if you enable TLS 1.3 in the default frontend profile.
  [# NSSSL-6359]

SWG URL Filtering

• During content filtering, a rare race condition occurs between policy evaluation and obfuscation of a private URL set. This issue generates an AppFlow record that contains the URL as a clear text and not as "ILLEGAL".
  [# NSSWG-890]

• When you import an IWG JSON-based list, a trailing slash is incorrectly added to URLs that include file names. Adding of trailing slash leads to incorrect URL matching.
  [# NSSWG-911]

• A Citrix ADC appliance might crash if the URL_CATEGORIZE expression is used in a responder policy when the nstrace command is running.
  [# NSSWG-915]

System

• In Citrix ADC 11.1 build 58.13, when you create a Certificate Signed Request (CSR), the appliance adds a backslash before space for organization name, locality name text fields.
  [# NSCONFIG-1087]

• A Citrix ADC appliance might crash if HTTP callout uses the IP address and port of an SSL virtual server.
  [# NSHELP-13508, NSHELP-14166]

• The ipFreePorts counter value is always zero.
  [# NSHELP-16587]

• A connection request to Citrix ADC appliance for ignoring content-length fails.
  [# NSHELP-18294]

• After an upgrade, the system log time on the Citrix ADC GUI dashboard is not the same as the configured timezone on the appliance.
  [# NSHELP-18613]

• A Citrix ADC appliance might crash if the following conditions are observed:

  - A packet trace is started and if an LACP packet is received at the same time.

  - The appliance uses advanced policy expressions as nstrace filter expressions.
  [# NSHELP-18811]

• If the primary node wrongly updates the secondary node's engine boot value, then the following conditions are observed:

  - The SNMP manager gets the wrong engine boot value from the secondary node.

  - The Citrix ADC appliance rejects all SNMP v3 traps from the secondary node and displays a “timewindow” error message.
  [# NSHELP-18992]

• In a high availability setup, SNMP engine ID setting is lost on the secondary node after a restart.
  [# NSHELP-19027]

• A Citrix ADC appliance performance is affected if you use the initial timestamp value for a new request on the same TCP connection.
  [# NSHELP-8883]

Telco

• The Citrix ADC appliance might take more time than usual to delete idle large scale NAT sessions. The delay occurs because of a poor hash distribution when an RSS symmetric key is used for hashing. This poor distribution causes internal hash collisions and build-up of idle LSN sessions, which in turn cause memory allocation errors to large scale NAT resources.
  [# NSHELP-18728]

• A Citrix ADC appliance might crash if both of the following conditions are met:

  • The appliance receives two HTTP requests when retrieving subscriber information.

  • There is an incorrect operation to resume normal traffic flow.
  [# NSHELP-18955]

Video Optimization

• In a rare scenario, a Citrix ADC appliance might crash, if Video Optimization releases the allocated memory in the event of a double free error.
  [# NSVIDEOOPT-770]

• A Citrix ADC appliance might crash because of memory corruption, if:

  - Video optimization is enabled.

  - Video pacing is applied.
  [# NSVIDEOOPT-778]

Known Issues

Admin Partition

• A partitioned Citrix ADC appliance might crash if you enable Video Optimization on a partition and later remove the partition on the appliance.
  [# NSNET-10199]

Analytics

• In Citrix ADM, the Analytics > Gateway Insight page reports the terminated VPN sessions incorrectly.
  [# NSHELP-19037]

Appflow

• Client IP and Server IP is inverted in HDX Insight SkipFlow record when LogStream transport type is configured for Insight.
  [# NSBASE-8506]

Authentication, authorization, and auditing

• The DualAuthPushOrOTP.xml LoginSchema is not appearing properly in the login schema editor screen of Citrix ADC GUI.
  [# NSAUTH-6106]

• The Configure Authentication LDAP Server page on the Citrix ADC GUI becomes unresponsive if you pursue the following steps:

  - The Test LDAP Reachability option is opened.

  - Invalid login credentials are populated and submitted.

  - Valid login credentials are populated and submitted.

  Workaround: Close and open the Test LDAP Reachability option.
  [# NSAUTH-2147]

• A Citrix ADC appliance configured for Citrix ADC AAA might become unresponsive if the following conditions are met:

  • The samlAction parameter is configured.

  • The back-end server is unreachable.
  [# NSHELP-8220]

• Admin login to Citrix ADC MPX 14000 FIPS hardware fails intermittently.
  [# NSHELP-18844]

• The base64 decoding fails if a digital signature has HTML entity encoded characters.
  [# NSHELP-19410]

• A Citrix ADC appliance does not authenticate duplicate password login attempts and prevents account lockouts.
  [# NSHELP-563]

• A Citrix authentication, authorization, and auditing logout message occasionally display incorrect virtual server name.
  [# NSHELP-18751]

Citrix ADC CLI

• Some Citrix ADC commands fail intermittently with an error message, "Name conflicts with an existing service or service group member name". This issue occurs when the Citrix ADC appliance restarts because of an internal error.
  [# NSHELP-18339]

Citrix ADC SDX Appliance

• In a VPX HA setup running on SDX appliances, when one of the switches in the virtual port channel (VPC) goes down, all the interfaces that are part of the LACP flap. This triggers HA failover.
  [# NSHELP-19095]

• After you have configured a VLAN from the allowed VLAN list (AVL) on a VPX instance running on an SDX appliance, the instance fails to restart automatically. As a result, communication between the VPX instance and AVL stops.
  [# NSSVM-135]

Citrix ADC SDX appliance

• The following error messages might appear if you configure more than 100 VLANs in the trunkallowedVlan list on an interface in the Citrix ADC instance:

  ERROR: Operation timed out

  ERROR: Communication error with the packet engine
  [# NSNET-4312]

• After a reset operation, the transmit rate drops.

  Workaround: Stop all traffic, reset the interface, and resume traffic.
  [# NSPLAT-7792]

Citrix ADC VPX Appliance

• Support for VMware vMotion

  From this release, you can migrate a Citrix ADC VPX instance by using VMware vMotion. The vMotion feature does not support Citrix ADC VPX instances configured to use SR-IOV and PCI passthrough interfaces. Supported interfaces are E1000 and VMXNET3.

  For more information, see Install a Citrix ADC VPX instance on VMware ESX topic: https://docs.citrix.com/en-us/netscaler/12-1/deploying-vpx/install-vpx-on-esx.html
  [# NSHELP-15343]

• In a Citrix ADC cluster, the configuration coordinator (CCO) node does not support the set ns vpxparam -cpuyield command for controlling CPU-usage behavior.

  Workaround:

  Set the -cpuyield parameter on individual nodes by logging on to each node and adding one of the following commands to the /nsconfig/nsbefore.sh file:

  sysctl netscaler.ns_vpx_halt sysctl netscaler.ns_vpx_halt_method=0

  By default, this command specifies method=1, which reserves all CPU resources for the VM to which they have been allocated. To allow allocated but unused CPU resources to be used by another VM, specify method=0.
  [# NSPLAT-2156]

Citrix ADC VPX appliance

• Error messages appear when an SR-IOV-enabled Citrix ADC VPX instance configured with Intel X710 10G and XL710 40G NICs, running on KVM hypervisor, restarts. The error messages are harmless and can be safely ignored.
  [# NSPLAT-3883]

• In a high availability setup on Azure, upon logon to the secondary node through GUI, the first-time user (FTU) screen for autoscale cloud profile configuration appears.

  Workaround: Skip the screen, and log on to the primary node to create the cloud profile. The cloud profile should be always configured on the primary node.
  [# NSPLAT-4451]

• When you delete an autoscale setting or a VM scale set from an Azure resource group, delete the corresponding cloud profile configuration from the Citrix ADC instance. Use the "rm cloudprofile" command to delete the profile.
  [# NSPLAT-4520]

Citrix Gateway

• In Outlook Web App (OWA) 2013, clicking "Options" under the Setting menu displays a “Critical error” dialog box. Also, the page becomes unresponsive.
  [# CGOP-7269]

• For iOS devices, RDP cookie timeout is not honored. During the app launch if the cookie timeout exceeds the connection timeout, the app launch fails.

  Workaround: Increase the RDP cookie timeout.
  [# NSHELP-18496]

• In some cases, in a high availability setup, the secondary appliance reboots if there is a CLI sync mismatch during the PCOIP session sync process.
  [# NSHELP-18740]

• SOCKS Proxy CR virtual server configuration for a Citrix Gateway appliance fails if you use a Fully Qualified Domain Name (FQDN) for Virtual Delivery Agent (VDA).

  Workaround: Use an IP address for VDA.
  [# NSHELP-8549]

Citrix Web App Firewall

• The Citrix Web Citrix Web App Firewall GUI interface slows down when you optimize default signatures.
  [# NSHELP-17975]

• Citrix Web App Firewall AppFw Field Format learned Data is different from the Export Learned Data. When aslearn configured learned data is deployed and the field types reaches aslearn supported limit, the get learnt data will not able to display total learnt data.
  [# NSHELP-18077]

• A Citrix ADC appliance might crash when processing large form bodies and if the field consistency parameter is enabled on the Citrix Web App Firewall profile.
  [# NSHELP-19299]

Clustering

• A high CPU usage is observed on a Citrix ADC appliance or in a cluster setup if “show ns ip” command displays many IP addresses.
  [# NSHELP-11193]

Gateway Insight

• The ICA connection results in a skip parse during ICA parsing if users are using MAC receiver along with version 6.5 of Citrix Virtual App and Desktops (formerly Citrix XenApp and XenDesktop).

  Workaround: Upgrade the receiver to the latest version of Citrix Workspace app.
  [# NSINSIGHT-924]

HDX Insight

• HDX Insight does not report an application launch failure caused by a user trying to launch an application or desktop to which the user does not have access.
  [# NSINSIGHT-943]

ICA

• In an HA setup, during Citrix ADC failover, SR count increments instead of the failover count in Citrix ADM.
  [# NSINSIGHT-2059]

• For MSI icaconnection HDX insight is not available if the transport type is Logstream.
  [# NSINSIGHT-2198]

Licensing

• When Citrix ADC licenses hosted on Citrix ADC Citrix ADM expires, the Citrix ADC appliance moves into a grace period of 30 days. If valid licenses are updated during the grace period, the Citrix ADC appliance continues to function as usual. If not, licenses are revoked and the appliance ceases to function.
  [# NSPLAT-6417]

Networking

• On the Citrix ADC GUI, when you go to Configuration > Network > Interfaces, and click Interface Statistics, the Interface Summary is not displayed and the “Invalid value [arg]” error message appears.
  [# NSHELP-19575, NSUI-13284]

• In some cases of FTP data connections, the Citrix ADC appliance performs only NAT operation and not TCP processing on the packets for TCP MSS negotiation. As a result, the optimal interface MTU is not set for the connection. This incorrect MTU setting results in fragmentation of packets and impacts CPU performance.
  [# NSNET-5233]

Optimization

• A Citrix ADC appliance restarts by itself if the following conditions are observed:

  - Front end optimization feature is enabled.

  - Cached objects are re-optimized.
  [# NSHELP-19428]

Platform

• Ifhighspeed SNMP OID for a 50G interface shows a value of zero if the speed of the interface is set to AUTO.
  [# NSHELP-18707]

SSL

• An expired session ticket is honored on a non-CCO node and on an HA node after an HA failover.
  [# NSSSL-3184, NSSSL-1379, NSSSL-1394]

• In a cluster setup, some cluster nodes might not honor the reuse request of a session ticket, but the SSL full handshake succeeds.
  [# NSSSL-3161, NSSSL-1258, NSSSL-1264]

• The HTTPS-ECV monitor fails during an SSL handshake if all of the following conditions are met:

  - The monitor is bound to an SSL profile.

  - Session reuse is enabled on the SSL profile.

  - The monitor is bound to two or more back-end servers.

  - Different protocol versions (for example, TLS1.0 & TLS1.2) are running on the servers.
  [# NSHELP-18384]

• If you create an ECDSA key by using the GUI, the type of curve is not displayed.
  [# NSUI-6838]

• An incorrect warning message, "Warning: No usable ciphers configured on the SSL vserver/service," appears if you try to change the SSL protocol or cipher in the SSL profile.
  [# NSSSL-4001]

• Session Key Auto Refresh incorrectly appears as disabled on a cluster IP address. (This option cannot be disabled.)
  [# NSSSL-4427]

• In a cluster setup, SSL log profile is not displayed on the CLIP address even though it is set in the SSL profile.
  [# NSSSL-3402]

SWG URL Filtering

• When a forced synchronization takes place in a high availability setup, the appliance executes the "set urlfiltering parameter" command in the secondary node.

  As a result, the secondary node skips any scheduled update until the next scheduled time mentioned in the "TimeOfDayToUpdateDB" parameter.
  [# NSSWG-849]

Security

• ICAP support for Citrix ADC

  A Citrix ADC appliance now supports Internet Content Adaptation Protocol (ICAP) for content transformation service on HTTP and HTTPS traffic. The appliance acts as an ICAP client and interoperates with third-party ICAP servers, such as antimalware and Data Leak Prevention (DLP). The ICAP servers perform a content transformation on the HTTP and HTTPS messages and respond back to the appliance as modified messages. The adapted messages are either an HTTP or an HTTPS response or request.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/security/icap-for-remote-content-inspection.html
  [# NSBASE-825]

System

• A transaction on HTTP/2 stream does not get terminated correctly if the client sends a "te: traielrs" header in the request to a virtual server with Transform policy bound to it.
  [# NSHELP-18805, NSHELP-19832]

• A Citrix ADC appliance might generate a false SNMP SYN flood entity trap if some internal connections cause a mismatch between the number of TCP SYN received and the number of TCP connections established.
  [# NSHELP-18671]

• In a cluster deployment, if you run "force cluster sync" command on a non-CCO node, the ns.log file contains duplicate log entries.
  [# CGOP-6794, NSGI-1293]

• A TCP transaction delay is observed if a Citrix ADC appliance is unable to use the TCP connection to connect to the back-end server. In this case, the appliance opens a new connection to forward the client requests to the back-end server after some waiting period. The waiting period ranges from 400 ms to 600 ms.
  [# NSHELP-9118]

• In a large scale NAT deployment of two Citrix ADC appliances in a high availability setup, IPSec ALG might not work properly if the high availability configuration has "stayprimary" or “staysecondary” option set.
  [# NSNET-1646]

• The Citrix ADC appliance may display messages that are a result of file system compatibility checks that are performed when booting up. These messages are informational only, and do not have any adverse impact on the functioning of the Citrix ADC.
  [# NSPLAT-4384, NSPLAT-3243, NSPLAT-3417]

• Connections might hang if the size of processing data is more than the configured default TCP buffer size.

  Workaround: Set the TCP buffer size to maximum size of data that needs to be processed.
  [# NSPOLICY-1267]

What's New in Previous Citrix ADC 12.1 Releases

• Custom attributes support on OpenID Connect

  A Citrix ADC appliance configured as an IdP can now send extra attributes in the OpenID Connect id_token using expressions. Advanced policy expressions are used to send the custom attributes as per the requirement. The Citrix IdP evaluates the expressions corresponding to the attributes and then computes the final token with resulting values.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/aaa-tm/configuring-openid-connect-protocol.html#custom-attributes-support-on-openid-connect
  [From Build 51.19]
  [# NSAUTH-22]

• Hardware token support for Native OTP

  A Citrix ADC appliance with Native OTP now supports hardware token along with third-party solutions that conform to the RFC 6238 time-based one-time password (TOTP) standards. The Citrix ADC uses a time slice of 30 seconds and HMAC-SHA1 algorithm.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/aaa-tm/native-otp-authentication.html
  [From Build 51.19]
  [# NSAUTH-4]

• Metadata reading and generation support for SAML SP and IdP configuration

  Citrix ADC appliance now supports metadata files as means of configuration entities for both SAML Service Provider (SP) and Identity Provider (IdP). The metadata file is a structured XML file that describes the configuration of an entity. The metadata files for SP and IdP are separate. Based on deployment, and at times, one SP or IdP entity can have multiple metadata files.

  As an administrator, you can export and import (SAML SP and IdP) metadata files on Citrix ADC.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/aaa-tm/saml-authentication.html#metadata-reading-and-generation-support-for-saml-sp-and-idp-configuration
  [From Build 50.31]
  [# NSAUTH-4008, NSHELP-595, ENH0689985]

• Encrypted tokens support on OpenID Connect

  Citrix ADC appliance with OpenID Connect mechanism now supports sending of encrypted tokens along with signed tokens. The Citrix ADC appliance uses JSON web encryption specifications to compute the encrypted tokens and supports only compact serialization of encrypted tokens. To encrypt OpenID token, Citrix ADC appliance needs the public key of the relying party (RP). The public key is obtained dynamically by polling the relying party’s well-known configuration endpoint.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/aaa-tm/configuring-openid-connect-protocol.html#encrypted-tokens-support-on-openid-connect
  [From Build 51.19]
  [# NSAUTH-4167, NSAUTH-620, NSAUTH-1820]

• Support for self-service password reset

  Citrix ADC appliance now supports self-service password reset. Self-service password reset is a web-based password management solution that eliminates the user dependency for administrator(s) assistance to change or reset the password. It is available on both in Citrix ADC as an authentication, authorization, and auditing feature and in Citrix Gateway.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/aaa-tm/sspr-support.html.
  [From Build 50.31]
  [# NSAUTH-4204, ENH0703743]

• Support for noAuth authentication

  Citrix ADC appliance now supports noAuth authentication capability that enables the customer to configure a defaultAuthenticationGroup parameter in noAuthAction command, when a user handles this policy. The administrator can verify for the presence of this group in a users group to determine user’s navigation through noAuth policy.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/aaa-tm/authentication-virtual-server/ns-aaa-setup-auth-vserver-tsk.html.
  [From Build 50.31]
  [# NSAUTH-540, BUG0711009]

• Setting NSC_TCitrix ADM cookie for HTTPS

  Citrix ADC appliance sets only secure cookie (NSC_TCitrix ADM) for secure or HTTPS traffic management servers.
  [From Build 50.31]
  [# NSHELP-8493]

Citrix ADC SDX Appliance

• Support for Citrix SD-WAN VPX instance

  You can deploy a Citrix SD-WAN VPX instance on Citrix ADC SDX 14XXX and SDX 115XX appliances.

  For more information, see https://docs.citrix.com/en-us/sdx/12-1/deploy-sd-wan-vpx.
  [From Build 49.37]
  [# NSSVM-2111]

• Severity column for SNMP alarms

  You can now view severity level for SNMP alarms. To view, log on to the Citrix ADC user interface and navigate to System Alarms. Check the levels under the Severity column.
  [From Build 50.31]
  [# NSHELP-12401]

• Support for new SNMP traps

  The following new SNMP traps are now supported:

  deviceBooted

  deviceRebooted

  inventoryPassed

  logicalDrivePassed

  For more information about how to configure SNMP traps, see https://docs.citrix.com/en-us/sdx/12-1/manage-monitor-appliance-network-configuration/configuring-snmp-trap-destination.html.
  [From Build 50.31]
  [# NSHELP-13543]

Citrix ADC VPX Appliance

• Support for vCPU-based perpetual licensing

  Virtual CPU (vCPU)-based perpetual licensing is now supported for Citrix ADC VPX instances. This licensing provides the computing power requirement of VPX on-prem and cloud customers. For each VPX model, existing Citrix ADC licensing editions apply: Citrix ADC Standard Edition, Enterprise Edition, Platinum Edition.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/licensing/netscaler-licensing-overview.html.
  [From Build 49.37]
  [# NSPLAT-6155]

• Support for Azure Availability Zones in a high availability deployment

  You can deploy a pair of Citrix ADC VPX appliances with multiple NICs in an active-passive high availability setup across Azure Availability Zones. For more information about Azure Availability Zones and what they offer, see Azure documentation: https://docs.microsoft.com/en-us/azure/availability-zones/az-overview

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/deploying-vpx/deploy-vpx-on-azure/configure-vpx-pair-ha-inc.html.
  [From Build 49.37]
  [# NSPLAT-1776, 712503]

• Support for VMware ESXi 6.7 server

  Citrix ADC VPX instances now support VMware ESXi 6.7 server.

  For more information, see table 2 in this page: https://docs.citrix.com/en-us/netscaler/12-1/deploying-vpx/supported-hypervisors-features-limitations.html.
  [From Build 49.37]
  [# NSPLAT-3716]

• Support for VMware vMotion

  From this release, you can migrate a Citrix ADC VPX instance by using VMware vMotion. The vMotion feature does not support Citrix ADC VPX instances configured to use SR-IOV and PCI passthrough interfaces. Supported interfaces are E1000 and VMXNET3.

  For more information, see Install a Citrix ADC VPX instance on VMware ESX topic: https://docs.citrix.com/en-us/netscaler/12-1/deploying-vpx/install-vpx-on-esx.html
  [From Build 51.19]
  [# NSHELP-15343]

• Support for Citrix ADC VPX instance on Google Cloud Platform

  You can deploy a Citrix ADC VPX instance on Google Cloud Platform (GCP). A VPX instance in GCP enables you to leverage cloud computing capabilities of GCP and use Citrix load balancing and traffic management features for your business needs. You can deploy VPX instances in GCP as standalone instances. Both single NIC and multi NIC configurations are supported.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/deploying-vpx/deploy-vpx-google-cloud.html.
  [From Build 50.31]
  [# NSPLAT-2006, ENH0709691]

• Citrix ADC VPX support for AWS China region

  Now Citrix ADC VPX deployment (both standalone and high availability) is supported in AWS China region.
  [From Build 50.31]
  [# NSPLAT-2237, ENH0518744]

• Support for RHEL 7.5

  Now RHEL version 7.5 is supported for Citrix ADC VPX instance deployment on Linux KVM. For more information, see https://docs.citrix.com/en-us/netscaler/12-1/deploying-vpx/supported-hypervisors-features-limitations.html.
  [From Build 50.31]
  [# NSPLAT-3755, ENH0714623]

Citrix Gateway

• nFactor authentication support using Windows VPN plug-in.

  nFactor authentication is now supported using a Windows VPN plug-in.
  [From Build 49.37]
  [# CGOP-1163]

• Support for USB redirection in Citrix Gateway Enabled PCoIP proxy

  USB devices connected to the client machine can be accessed from the virtual desktops and apps.

  For more information, see https://docs.citrix.com/en-us/netscaler-gateway/12-1/netscaler-gateway-enabled-pcoip-proxy-support-for-vmware-horizon-view/configuring-netscaler-gateway-enabled-pcoip-proxy-for-vmware-horizon-view.html
  [From Build 49.37]
  [# CGOP-1950]

• GUI enhancements aiding STA server troubleshoot and seamless app launch

  The following GUI enhancements are made:

  - In the XA-XD wizard under StoreFront setting Test STA Connectivity button is added to test STA servers connectivity.

  - In the XA-XD dashboard page, Gateway entry list shows STA server and StoreFront server status.

  - In the Citrix Gateway Virtual Server page, you can view STA server status bound to a VPN virtual server.
  [From Build 49.37]
  [# NSHELP-12979]

• AlwaysON service establishes a VPN tunnel before user login

  Citrix Gateway can now establish a VPN tunnel even before users log in to a Windows system. This enhanced capability enables the following:

  - Windows machine becomes a part of corporate intranet even before users log in, allowing IT administrators to access the client machine from the corporate network for debugging purposes.

  - Windows machine can verify user's login credential using corporate Active Directory (AD). Hence the caching of Windows credentials on the machine is avoided, allowing new corporate AD users to login to the same machine.

  - Windows machine remains connected with corporate network even when different users log in.

  For more information, see https://docs.citrix.com/en-us/citrix-gateway/12-1/vpn-user-config/alwayson-service-for-windows.html.
  [From Build 51.19]
  [# CGOP-5585]

• Device Certificate in nFactor as an EPA component

  You can configure Device Certificate in nFactor as an EPA component.

  For more information, see https://docs.citrix.com/en-us/netscaler-gateway/12-1/device-certificate-in-nfactor-as-an-epa-component.html
  [From Build 50.31]
  [# CGOP-5758, ENH0701170]

• Advanced Clientless VPN access

  Outlook Web Access 2016 and SharePoint 2016 are supported for Clientless access. SharePoint no longer needs to use the default folder for rewriting URLs.

  For more information, see https://docs.citrix.com/en-us/netscaler-gateway/12-1/vpn-user-config/cvpn-overview/ng-connect-cvpn-policies-how-work-con/advanced-clientless-access.html.
  [From Build 50.31]
  [# CGOP-6174, ENH0671584]

• New virtual adapter for Windows VPN plugin

  Microsoft recommends using type "Other" for a virtual network adapter. Based on this recommendation, Citrix virtual adapter type is changed from "Ethernet" to "other".
  [From Build 51.19]
  [# CGOP-9519]

Citrix Secure Web Gateway

• Support for new SWG platforms

  Citrix Secure Web Gateway (SWG) is supported on Citrix SWG MPX 5900/8900 and Citrix SWG SDX 8900 platforms.

  For more information, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12-1/supported-hardware-software-platforms.html.
  [From Build 49.37]
  [# NSSSL-1603]

• Integration with IPS or NGFW as inline devices

  A Citrix Secure Web Gateway (SWG) appliance can now integrate with inline security devices, such as Intrusion Prevention System (IPS) and Next Generation Firewall (NGFW). This integration helps in protecting servers and users from web bound threats hidden in encrypted packets.

  The Citrix SWG appliance offloads TLS/SSL processing from inline devices. If there are multiple inline devices, the appliance also load balances the traffic to these devices.

  For more information, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12-1/security-configuration/integration-with-ips-or-ngfw-as-inline-devices.html.
  [From Build 50.31]
  [# NSBASE-2703, ENH0659611]

• Configuring seed database path and cloud server name

  You can now manually configure the seed database path and cloud lookup server name details. To do this, two new parameters, “CloudHost” and “SeedDBPath”, are added to the URL filtering parameter command.

  For more information, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12-1/url-filtering/url-categorization.html
  [From Build 50.31]
  [# NSSWG-399, NSSWG-475, ENH0713975]

• Performing an explicit subdomain match

  You can now perform an explicit subdomain match for an imported URL set. To do this, a new parameter, "subdomainExactMatch" is added to the “import policy URLset” command. When you enable the parameter, the URL Filtering algorithm performs an explicit subdomain match. For example, if the incoming URL is "news.example.com" and if the entry in the URL set is "example.com", the algorithm does not match the URLs.

  For more information, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12-1/url-filtering/url-list.html
  [From Build 50.31]
  [# NSSWG-686, ENH0711662]

• Displaying imported URL sets

  You can now display imported URL sets in addition to added URL sets. To do this, a new parameter “imported” is added to the “show urlset” command. If you enable this option, the appliance displays all imported URL sets and distinguishes the imported URL sets from the added URL sets.

  For more information, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12-1/url-filtering/url-list.html
  [From Build 50.31]
  [# NSUI-1191, ENH0714076]

• Configuring seed database path and cloud server name

  You can now configure the seed database path and cloud lookup server name for manually setting of the cloud lookup server name and the seed database path. To do this, two new parameters, “CloudHost” and “SeedDBPath”, are added to the URL filtering parameter command.

  For more information, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12-1/url-filtering/url-categorization.html
  [From Build 50.31]
  [# NSUI-1210, ENH0715434]

Citrix Web App Firewall

• Web Citrix Web App Firewall (WAF) support on CPX platform

  Citrix Web Citrix Web App Firewall (WAF) feature is now supported on CPX platform. For more information, see Citrix Web App Firewall topic.

  url: https://docs.citrix.com/en-us/netscaler/12-1/application-firewall.html
  [From Build 49.37]
  [# NSWAF-331, 622337, 622388, 625083]

• Securing web traffic with HTTP RFC compliance

  You can now secure your web traffic with HTTP RFC compliance by setting the RFC profile in “Block” or “Bypass” mode. By doing this, any invalid traffic (request or response) that matches the Citrix Web App Firewall profile is implicitly blocked or bypassed accordingly.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/application-firewall/profiles/enforce-http-rfc-compliance.html
  [From Build 49.37]
  [# NSHELP-2857]

• Rebranding Citrix ADC App Firewall to Citrix Web App Firewall

  According to Citrix rebranding guidelines, the Citrix ADC App Firewall feature is now renamed as Citrix Web App Firewall in Citrix ADC GUI.
  [From Build 50.31]
  [# NSUI-1219, ENH0715820]

• Bypass or block non-RFC compliance HTTP requests

  A new parameter, “malformedReqAction” is now added to the application firewall global setting. You can configure this parameter to bypass or block non-RFC compliant requests. Previously, there was no option to block or bypass invalid HTTP requests and they were dropped.

  For example, if there is an incoming request that has a host header missing, the appliance can block or bypass such invalid requests by using the “malformedReqAction” parameter.

  Warning: If you disable the "block" option in the "malformedReqAction" parameter, the appliance bypasses the app firewall processing for all non-RFC compliance requests and forwards the requests to the next module.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/application-firewall/profiles/enforce-http-rfc-compliance.html
  [From Build 51.19]
  [# NSWAF-605]

Clustering

• Cluster support for ANY type of virtual server

  The Citrix ADC appliance can now support "ANY" type of virtual server while gracefully handling of nodes in a cluster deployment.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/clustering/cluster-managing/graceful-shutdown-of-nodes.html.
  [From Build 49.37]
  [# NSNET-3039]

• GRE tunnel based steering support for L2 cluster deployments

  The Citrix ADC appliance now supports GRE tunnel based packet steering in an L2 cluster deployment.
  [From Build 49.37]
  [# NSNET-3045]

DNS

• Jumbo frame support for DNS to handle UDP responses of large sizes

  DNS now supports jumbo frames for handling UDP responses greater than 1,280 bytes. You can set the maximum UDP packet size that the appliance can handle in proxy, ADNS, and forwarder modes by configuring the Maximum UDP Packet Size parameter value.

  The maximum UDP packet size is 16,384 bytes.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/dns/jumbo-frames-support-for-dns-to-handle-responses-of-large-sizes.html.
  [From Build 49.37]
  [# NSHELP-12560]

• Service discovery using DNS SRV records

  You can use the DNS SRV records to discover the service endpoints. Citrix ADC is configured to periodically query the DNS servers with the SRV record associated with a service. On receiving the SRV record, each of the target host published in the SRV record is bound to a service group associated with the service. Each of the bindings inherits the port, priority, and weight from the SRV record. For each service deployment the user has to configure the Citrix ADC once during bring up, making it a single touch deployment for applications.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/dns/service-discovery-using-dns-srv-records.html.
  [From Build 51.19]
  [# NSHELP-18130]

GSLB

• Support for generation of SNMP traps for GSLB configuration synchronization

  A Citrix ADC appliance now generates SNMP traps for both local and remote sites when you synchronize the GSLB configuration. SNMP traps are generated for both manual synchronization and real-time synchronization.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/global-server-load-balancing/synchronizing-configuration-in-gslb-setup/snmp-traps-for-gslb-configuration-synchronization.html.
  [From Build 49.37]
  [# NSHELP-3963]

• Support for GSLB parent-child topology in Citrix ADC clusters

  The GSLB parent-child topology is now supported in Citrix ADC clusters.

  For parent and child sites to exchange aggregated statistics in metric-based load balancing methods, you must add local GSLB services on the child site.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/clustering/cluster-usage-scenarios/cluster-gslb-deploy.html.
  [From Build 49.37]
  [# NSHELP-11684]

• GSLB supports multi-IP virtual servers

  GSLB now supports multi-IP virtual servers. In cloud deployments, for autoscaling of Citrix ADC instances, you can use IPset if Citrix ADC is used for GSLB as well as autoscaling load balancing end points.

  The statistics and the state of the virtual server are collected irrespective of the IP address provided to the GSLB service.

  Parent child topology is supported with IPset. Communication between the parent and the child sites is always using public IP address and the public port of the GSLB service. Also, site persistence works irrespective of the IP addresses associated with the GSLB service.

  Only one IP address is associated with a GSLB service. You cannot associate an IPset with a GSLB service.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/load-balancing/load-balancing-customizing/multi-ip-virtual-servers.html.
  [From Build 50.31]
  [# NSLB-424, ENH0710454]

• Gracefully aborting the GSLB configuration synchronization when the master and slave nodes are on different Citrix ADC versions

  The Citrix ADC appliance now checks for the firmware version on master and slave nodes before initiating synchronization. If the master and the slave nodes run different versions, the synchronization is aborted for that remote site to avoid pushing any incompatible changes across the versions. Also, an error message displaying the site details on which the synchronization aborted appears.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/global-server-load-balancing/synchronizing-configuration-in-gslb-setup.html.
  [From Build 50.31]
  [# NSLB-780, BUG0711371]

HDX Insight

• View HDX Insight reports for EDT traffic.

  HDX Insight reports can be viewed for the EDT traffic. By default, HDX Insight and EDT feature are disabled.
  [From Build 49.37]
  [# NSINSIGHT-141]

Load Balancing

• Support for graceful shutdown of services in Citrix ADC clusters

  The Citrix ADC clusters now support graceful shutdown of services.

  To gracefully shutdown the services, you can perform one of the following tasks.

  - Explicitly disable the service, and set a delay (in seconds) or enable graceful shutdown.

  - Add a TROFS code or string to the monitor.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/clustering/cluster-managing/graceful-shutdown-of-services.html.
  [From Build 49.37]
  [# NSHELP-12258]

• Detect transport failures over established Gx connections

  A Citrix ADC appliance can now be configured to detect transport failures over established Gx connections by using device watchdog request (DWR) and device watchdog answer (DWA) messages.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/citrix-adc-support-for-telecom-service-providers/lsn-telco-subscriber-management.html.
  [From Build 51.19]
  [# NSBASE-6545]

• Clear subscriber database when Gx interface fails

  The purgeSDBonGxFailure parameter can now be used to clear all subscriber sessions if the Gx interface fails. Gx interface failure includes both DWR monitoring (if enabled) and network healthCheck (if enabled).

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/citrix-adc-support-for-telecom-service-providers/lsn-telco-subscriber-management.html.
  [From Build 51.19]
  [# NSBASE-6546]

• Increase in Citrix ADC system limit for unique load balancing monitors

  The Citrix ADC system limit for unique load balancing monitors is now increased to 16360.
  [From Build 50.31]
  [# NSHELP-18135]

• Getting location details from user IP address using geo database

  Citrix ADC appliance performs geo location (policy-based) user authorization. When there is a user request from a particular location, the appliance uses the IP address to retrieve the user’s location details from a geo database. The appliance evaluates the location details using geo location (responder and rewrite) policies. The appliance also logs the location details (optional) using the audit logging mechanism.

  After policy evaluation, based on Citrix ADC configuration, the appliance or the back-end server sends a suitable response.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/load-balancing/load-balancing-advanced-settings/retrieve-location-details-using-ip-address-from-geolocation-database.html.
  [From Build 50.31]
  [# NSLB-325, NSHELP-3740, ENH0688198]

• Creating negative session when PCRF is down

  If the PCRF server is down, the Citrix ADC appliance creates negative sessions for the pending or incoming Gx subscriber requests.

  When the PCRF server is back up again, the Citrix ADC appliance prevents a storm of requests by waiting for the negative sessions to expire before performing the specific subscriber requests.
  [From Build 50.31]
  [# NSLB-519, BUG0713709]

NITRO

• Retrieving LOM Port firmware version

  The nshardware NITRO API resource now supports retrieving the LOM port’s firmware version of a Citrix ADC appliance.

  For more information, see https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/latest/configuration/ns/nshardware/nshardware/
  [From Build 50.31]
  [# NSHELP-4797, ENH0695712]

Networking

• USIP support on a v4-to-v6 load balancing configuration

  Earlier, in a v4-to-v6 load balancing configuration, the Citrix ADC used to include one of the configured IPv6 SNIP address as the source IP address in the translated IPv6 requests packet to the servers. The Citrix ADC used to include an IPv6 SNIP address even when the USIP option is enabled for the related load balancing services.

  Now, USIP NAT prefix parameter has been introduced for making the servers aware of the client’s IP address of the request packets. USIP NAT prefix is a global IPv6 prefix of length 96 bits (128-32=96) configured on Citrix ADC.

  For a load balancing service that has USIP enabled, the ADC translates the IPv4 request packet to an IPv6 packet and sets the source IP address of the translated IPv6 packet to a concatenation of the USIP NAT prefix [32/40/48/56/64/96 bits] and the IPv4 source address [32 bits] that was received in the request packet.

  On receiving an IPv6 response packet from the server, the ADC translates the IPv6 packet to an IPv4 packet and sets the destination IP address of the translated IPv4 packet to the last 32 bits of the destination IP address of the IPv6 packet.

  Note: This feature is not supported for gateway configuration and, content switching and cache redirection load balancing configurations.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/load-balancing/load-balancing-advanced-settings/usip-lb-v4v6.html.
  [From Build 49.37]
  [# NSHELP-15478]

• Clear traps for HA-LICENSE-MISMATCH and HA-STICKY-PRIMARY SNMP alarms

  The Citrix ADC now sends SNMP clear traps to the configured trap destinations for HA-LICENSE-MISMATCH and HA-STICKY-PRIMARY SNMP alarms.
  [From Build 51.19]
  [# NSHELP-286]

• Dynamic routing support on shared VLANs

  In a partitioned Citrix ADC appliance, dynamic routing now supports both dedicated and shared VLAN configuration. The dynamic routing is supported on both IPv4 and IPv6 addresses.
  [From Build 51.19]
  [# NSHELP-300, NSNET-5662]

• BGP ECMP support for route paths in multiple autonomous systems

  The BGP protocol in a Citrix ADC appliance now supports load balancing route traffic across equal-cost BGP neighbors in different autonomous systems.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/networking/ip-routing/configuring-dynamic-routes/configuring-bgp.html.
  [From Build 50.31]
  [# NSHELP-329, ENH0710330]

• Support to configure HTTP and HTTPS management ports

  In a single-IP mode deployment of a Citrix ADC appliance, a single IP address is used as NSIP, SNIP, and VIP addresses. This single IP address uses different port numbers to function as NSIP, SNIP, and VIP addresses.

  Port numbers 80 and 443 are well-known ports for HTTP and HTTPS services. Earlier, port 80 and 443 of Citrix ADC IP address (NSIP) were dedicated ports for internal HTTP and HTTPS management services. Because these ports were reserved for internal services, you cannot use these well-known ports for providing HTTP and HTTPS data services from a VIP address, which has the same address as the NSIP address in a single-IP mode deployment.

  To address this requirement, you can now configure ports for internal HTTP and HTTPS management services (of the NSIP address) other than port 80 and 443.

  The following lists the default port numbers for internal HTTP and HTTPS management services in Citrix ADC MPX, VPX, and CPX appliances:

  - Citrix ADC MPX and VPX appliances: 80 (HTTP) and 443 (HTTPS)

  - Citrix ADC CPX appliances: 9080 (HTTP) and 9443 (HTTPS)

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/system/basic-operations/configure-http-https-management-ports.html.
  [From Build 50.31]
  [# NSNET-1630, BUG0708735]

• Display reason for high availability sync failure

  In a high availability setup, the Citrix ADC GUI and CLI now display the reason for HA sync failure.
  [From Build 51.19]
  [# NSNET-2859]

• Support for IPv4 VIP route health injection and BGP dynamic routing protocol in a Citrix ADC CPX appliance

  The Citrix ADC CPX appliance now supports route health injection of IPv4 VIP addresses to its routing table and advertisement of these VIP routes to neighbor routers/networking devices using BGP dynamic routing protocol.
  [From Build 50.31]
  [# NSNET-2897, ENH0709944]

Platform

• Support for Citrix ADC MPX 15000-50G platform

  This release supports the Citrix ADC MPX 15000-50G platform. It includes MPX 15020-50G, MPX15030-50G, MPX 15040-50G, MPX 15060-50G, MPX 15080-50G, and MPX 15100-50G models.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-15000-50g.html.
  [From Build 50.31]
  [# NSPLAT-4724]

• Support for Citrix ADC MPX 26000 platform

  This release supports the Citrix ADC MPX 26000 platform. It includes MPX 26100, MPX 26160, and MPX 26200 models.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000.html.
  [From Build 50.31]
  [# NSPLAT-4909, NSPLAT-3127, NSPLAT-4087, TSK0637172]

• Support for Citrix ADC MPX 26000-100G platform

  This release now supports the Citrix ADC MPX 26000-100G and Citrix ADC MPX 26000T-100G platforms. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000-100g-26000T-100g.html.
  [From Build 50.31]
  [# NSPLAT-6288, NSPLAT-3076, ENH0648922]

• Support for Citrix ADC MPX 15000 platform

  This release supports the Citrix ADC MPX 15000 platform. It includes MPX 15020, MPX 15030, MPX 15040, MPX 15060, MPX 15080, and MPX 15100 models.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-15000.html.
  [From Build 50.31]
  [# NSPLAT-7566, ENH0688399]

• Support for Citrix ADC MPX 26000-50S Platform

  This release supports the MPX 26000-50S platform.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000-50s.html.
  [From Build 50.31]
  [# NSPLAT-7606, NSPLAT-4122, NSPLAT-3133, NSPLAT-4047]

• Support for Citrix ADC MPX 26000-50S platform

  This release supports the Citrix ADC MPX 26000-50S platform. It includes MPX 26100-50S, MPX 26160-50S, MPX 26200-50S models. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000-50s.html.
  [From Build 50.31]
  [# NSSSL-1855, NSSSL-2056, ENH0682991]

Policies

• New API support for reusing a server connection for other client connections in the server context

  A Citrix ADC API support is now added for reusing a server connection for other client connections in the server context. This API can be used only if an EOM event is used (in ns.send() API) to send for sending the data in the client context.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/netscaler-extensions/api-reference.html and https://docs.citrix.com/en-us/netscaler/12-1/netscaler-extensions/netscaler-protocol-extensions.html.
  [From Build 49.37]
  [# NSEXT-285]

• RSA encryption with no padding policy function

  Policy-based RSA encryption now supports EY_ENCRYPT_PEM_NO_PADDING() policy function for no padding operation. The policy function works similar to the PKEY_ENCRYPT_PEM() function, except it uses the RSA_NO_PADDING method instead of RSA_PKCS1_PADDING. The pkey parameter is a text string with a PEM-encoded RSA public key. Similar to PKEY_ENCRYPT_PEM(), you can use a policy expression for the key.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/appexpert/rewrite/rewrite-action-policy-examples/example-11-policy-based-rsa-encryption-no-padding-operation.html
  [From Build 49.37]
  [# NSPOLICY-623]

• API support to fetch TCP or SSL related info in the extension

  Citrix ADC appliance now supports API-based protocol extension for fetching TCP or SSL-related data in the extension.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/netscaler-extensions/api-reference.html#ssl-context.
  [From Build 50.31]
  [# NSEXT-280, ENH0715744]

• API support for modifying traffic

  Citrix ADC appliance now supports API-based protocol extensions for modifying TCP stream data.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/netscaler-extensions/netscaler-protocol-extensions/use-cases.html#modify-traffic.
  [From Build 50.31]
  [# NSEXT-281, ENH0715180]

• API support in protocol extension to send data to the client and server

  Citrix ADC appliance now supports a ns.send() API to send data from extension code to client and origin server. To send or receive data directly with the client, from client context, you must use ctxt.client as the target. To send or receive data directly with the server from server context, you must use ctxt.server as the target. The data in the payload can be a TCP stream or a Lua string.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/netscaler-extensions/netscaler-protocol-extensions/use-cases.html#originate-traffic-to-client-or-server.
  [From Build 50.31]
  [# NSEXT-283, ENH0715743]

• API support to fetch client or server IP address in the extension

  Citrix ADC appliance now supports API-based protocol extension for fetching client or server IP address in the extension.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/citrix-adc-extensions/api-reference.html.
  [From Build 51.19]
  [# NSEXT-287]

• String literals for expressions

  The 255 byte limit for string literals in Advanced policy expressions has been removed and can now be as long as the policy expression. The expression is allowed to be 1499 or 8191 bytes long. Previously, the string literal was limited to 255 bytes within quotes.

  For more information, see https://docs.citrix.com/en-us/netscaler/11-1/appexpert/policies-and-expressions/ns-pi-config-adv-expr-start-wrapper/ns-pi-charsets-con.html
  [From Build 51.19]
  [# NSHELP-16014]

• Adding milliseconds to system time format

  Advanced policy expressions can now provide granular level system time format in microseconds or milliseconds. Previously, the time format was an unsigned long number in Nano format.

  Example: "Fri, 26 Aug 2016 12:22:01:<milliseconds>"
  [From Build 51.19]
  [# NSHELP-16081]

• NSPEPI tool enhancement

  The NSPEPI conversion tool has been enhanced to perform the following:

  1. Convert Classic policy expressions to Advanced policy expressions.

  2. Convert certain Classic policies and their entity bindings to Advanced policies and bindings.

  3. Convert a few additional deprecated features to their corresponding non-deprecated features.

  4. Log information in an improved manner.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/appexpert/policies-and-expressions/ns-pi-intro-pol-exp-wrapper-con/ns-pi-pe-to-pi-conversion-tool-wrapper-con.html
  [From Build 51.19]
  [# NSPOLICY-507]

SSL

• Support for AES-based PEM encoding

  You can now use AES256 algorithm with PEM key format to encrypt a private key on the Citrix ADC appliance. AES with 256-bit key is mathematically efficient and secure compared to the 56-bit key of DES. Select ‘aes256’ in the following CLI command.

  create ssl rsakey <keyFile> <bits> [-exponent ( 3 | F4 )] [-keyform (

  DER | PEM )] [-des | -des3 | -aes256] {-password }

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ssl-certificates/obtain-cert-frm-cert-auth.html#create-a-private-key.
  [From Build 49.37]
  [# NSHELP-13341, 710620]

• Support for DTLS protocol on the Citrix ADC MPX FIPS platform

  The MPX 14000 FIPS platform now supports the DTLS protocol end-to-end. That is, the protocol is supported on the client side and the server side. The following cipher suites are supported.

  - TLS1-AES-256-CBC-SHA

  - TLS1-AES-128-CBC-SHA

  - TLS1-ECDHE-RSA-AES256-SHA

  - TLS1-ECDHE-RSA-AES128-SHA

  - TLS1-ECDHE-RSA-DES-CBC3-SHA

  Note: Enlightened Data Support (EDT) is supported on the FIPS platform if all of the following conditions are met:

  - UDT MSS value set on StoreFront is 900.

  - Windows client version is 4.12 or later.

  - DTLS enabled VDA version is 7.17 or later.

  - Non-DTLS VDA version is 7.15 LTSR CU3 or later.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/support-for-dtls-protocol.html.
  [From Build 49.37]
  [# NSHELP-14588]

• Support for TLSv1.3 protocol on the front end of Citrix ADC VPX and select MPX appliances

  The Citrix ADC VPX and N3 chip based MPX appliances now support the TLSv1.3 protocol as specified in RFC 8446. For N3 chip based MPX appliances, the support is currently only in software. That is the processing is not offloaded to the hardware (SSL acceleration chip.) To use TLS1.3, you must use a client that conforms to the RFC 8446 specification. The following ciphers are supported on the frontend:

  - TLS1.3-AES256-GCM-SHA384 (0x1302)

  - TLS1.3_CHACHA20_POLY1305_SHA256 (0x1303)

  - TLS1.3-AES128_GCM-SHA256 (0x1301)

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/tls13-protocol-support.html.
  [From Build 49.37]
  [# NSSSL-4241, 664161]

• Support for wildcard in the subject alternative name in a certificate signing request

  You can now use wildcards in the subject alternative name (SAN) entry in the certificate signing request. For example, *.example.com.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ssl-certificates/obtain-cert-frm-cert-auth.html#support-for-subject-alternative-name-in-a-certificate-signing-request.
  [From Build 49.37]
  [# NSHELP-14922]

• Support for client-hello based expressions and a new bind point

  A new bind point ‘CLIENTHELLO_REQ’ is now available to evaluate SSL policies when a client hello message is received. That is, the policy is evaluated after parsing the client hello message. A ‘FORWARD’ action is added to forward the client traffic to a target load balancing virtual server. The target load balancing virtual server can be of type SSL, SSL_BRIDGE or TCP.

  In this release, only the forward and reset actions are supported for CLIENTHELLO_REQ bind point. The following expression prefixes are available:

  - CLIENT.SSL.CLIENT_HELLO.CIPHERS.HAS_HEXCODE

  - CLIENT.SSL.CLIENT_HELLO.CLIENT_VERSION

  - CLIENT.SSL.CLIENT_HELLO.IS_RENEGOTIATE

  - CLIENT.SSL.CLIENT_HELLO.IS_REUSE

  - CLIENT.SSL.CLIENT_HELLO.IS_SCSV

  - CLIENT.SSL.CLIENT_HELLO.IS_SESSION_TICKET

  - CLIENT.SSL.CLIENT_HELLO.LENGTH

  - CLIENT.SSL.CLIENT_HELLO.SNI

  For more information about the new bind point, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ssl-actions-and-policies/bind-ssl-policies-vserver.html.

  For more information about the new expression prefixes, see https://docs.citrix.com/en-us/netscaler/12-1/appexpert/policies-and-expressions/ns-pi-ae-parse-ssl-certs-wrapper-con.html#parse-ssl-client-hello.
  [From Build 49.37]
  [# NSSSL-169]

• Increase in the OCSP cache timeout limit

  The cache timeout limit is now increased to a maximum of 43,200 minutes (30 days). Earlier the limit was 1,440 minutes (one day). The increased limit helps reduce the lookups on the OCSP server and avoids any SSL/TLS connection failures in case the OCSP server is not reachable due to network or other problems.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/monitor-cert-status-with-ocsp.html#ocsp-response-caching.
  [From Build 49.37]
  [# NSHELP-14947]

• Support for non-secure renegotiation on a DTLS service

  Non-secure renegotiation is now supported on a DTLS service (backend) on Citrix ADC MPX and VPX appliances.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/support-for-dtls-protocol.html.
  [From Build 49.37]
  [# NSSSL-1291]

• Support for a new SSL action to forward traffic to another virtual server

  You can now forward the traffic received on an SSL virtual server to a load balancing virtual server to avoid SSL offloading or terminating the connection on the ADC appliance. For example, if the appliance does not have a certificate or it does not support a specific cipher, instead of terminating the connection, admins can choose to forward the request to a load balancing virtual server for further action. This virtual server can be of type: SSL, TCP, or SSL_BRIDGE.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ssl-actions-and-policies/config-built-in-ssl-actions.html#configure-an-ssl-action-to-forward-client-traffic-to-another-virtual-server.
  [From Build 49.37]
  [# NSSSL-341]

• Support for PFS on a DTLS virtual server

  The following cipher suites are now supported on a DTLS virtual server (frontend). These ciphers help achieve PFS (Perfect Forward Secrecy).

  - SSL3-EDH-RSA-DES-CBC3-SHA

  - SSL3-EDH-RSA-DES-CBC-SHA

  - TLS1-ECDHE-RSA-AES256-SHA

  - TLS1-ECDHE-RSA-AES128-SHA

  - TLS1-ECDHE-RSA-DES-CBC3-SHA

  - TLS1-DHE-RSA-AES-128-CBC-SHA

  - TLS1-DHE-RSA-AES-256-CBC-SHA

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/support-for-dtls-protocol.html.
  [From Build 49.37]
  [# NSSSL-1347, 711810]

• Support for PFS on a DTLS service

  The following cipher suites are now supported on a DTLS service (backend). These ciphers help achieve PFS (Perfect Forward Secrecy).

  - TLS1-ECDHE-RSA-AES256-SHA

  - TLS1-ECDHE-RSA-AES128-SHA

  - TLS1-DHE-RSA-AES-128-CBC-SHA

  - TLS1-DHE-RSA-AES-256-CBC-SHA

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/support-for-dtls-protocol.html.
  [From Build 49.37]
  [# NSSSL-1388]

• Clear the OCSP stapling cached response of server certificate

  You can now clear the cached response of the server certificate from the OCSP responder even before the timeout expires. Earlier, you had to wait until the configured timeout was over to clear the cached response.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ssl-11-1-ocsp-stapling-solution.html#ocsp-response-caching-of-server-certificates.
  [From Build 49.37]
  [# NSSSL-489]

• Support for SNI on a DTLS virtual server

  SNI (Server Name Indication) is now supported on a DTLS virtual server (frontend) on Citrix ADC MPX and VPX appliances. You can bind multiple SNI certificates to a DTLS virtual server.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/support-for-dtls-protocol.html.
  [From Build 49.37]
  [# NSSSL-1457, 363547]

• Support for HSTS preload

  The Citrix ADC appliance supports adding an HSTS preload in the HTTP response header. To include the preload, you must set the "preload" parameter to YES in the SSL virtual server or the SSL profile. The appliance then includes the preload in the HTTP response header to the client.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/ssl/how-to-articles/ssl-support-for-hsts.html#support-for-hsts-preload.
  [From Build 51.19]
  [# NSHELP-13355]

• Support for KEK encryption in private key

  The password of the private key used while adding an SSL certificate-key pair is now saved using a unique encryption key for each Citrix ADC appliance.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/config-ssloffloading.html#add-or-update-a-certificate-key-pair.

  Important: Certificate keys are lost if you downgrade to a build earlier than release 12.1 build 50.x.
  [From Build 50.31]
  [# NSHELP-14911]

• Support for PKCS#8 format in RSA, DSA, and ECDSA keys

  You can now create an RSA, DSA, or ECDSA key in PKCS#8 format. Earlier, the Citrix ADC appliance did not support this format, and you had to convert the key to a supported format, such as PKCS#12, before using it on the appliance. Also, you can now create certificate signing requests and add certificate-key pairs with PKCS#8 keys.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ssl-certificates/obtain-cert-frm-cert-auth.html and https://docs.citrix.com/en-us/netscaler/12-1/ssl/ciphers-available-on-the-citrix-ADC-appliances/ecdsa-cipher-suite-support-on-mpx-appliances.html.
  [From Build 50.31]
  [# NSHELP-4891, ENH0673657]

• Support for DTLSv1.0 protocol on additional Citrix ADC MPX appliances

  DTLSv1.0 protocol is now supported on the following additional MPX appliances.

  - MPX 5900

  - MPX/SDX 8900

  - MPX/SDX 26000-100G

  - MPX/SDX 15000-50G

  Note: Enlightened Data Transport (EDT) is not supported on these platforms.
  [From Build 50.31]
  [# NSSSL-1943, ENH0705163]

• Support for Enlightened Data Transport (EDT) on DTLSv1.0 protocol

  DTLSv1.0 protocol is now supported with EDT on the following Citrix ADC appliances:

  - MPX 5900

  - MPX/SDX 8900

  - MPX/SDX 26000-100G

  - MPX/SDX 15000-50G
  [From Build 51.19]
  [# NSSSL-1949]

• Software-only support for TLSv1.3 protocol on additional Citrix ADC MPX appliances

  TLSv1.3 protocol (RFC 8446) is now supported on SSL virtual servers configured on the following additional Citrix ADC MPX appliances:

  - MPX 5900

  - MPX/SDX 8900

  - MPX/SDX 26000-100G

  - MPX/SDX 15000-50G

  This release includes software-only implementation of TLSv1.3 and does not support hardware acceleration for cryptographic operations.
  [From Build 50.31]
  [# NSSSL-1966, ENH0715273]

• SSL action to select the list of CAs based on SNI for client authentication

  Typically, multiple CA certificates are bound to SSL virtual servers. These CA certificates are used to verify the client certificate during client authentication. Earlier, the list of all the CAs bound to an SSL virtual server were sent in the client certificate request from the Citrix ADC appliance to the client. With this enhancement, only the list of CA certificates is sent based on SNI (domain) in the client certificate request.

  Note: This feature is not supported on TLSv1.3 and DTLS connections.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ssl-actions-and-policies/config-built-in-ssl-actions.html#ssl-action-to-selectively-pick-cas-based-on-sni-for-client-authentication.
  [From Build 50.31]
  [# NSSSL-504, ENH0709142]

Security

• ICAP support for Citrix ADC

  A Citrix ADC appliance now supports Internet Content Adaptation Protocol (ICAP) for content transformation service on HTTP and HTTPS traffic. The appliance acts as an ICAP client and interoperates with third-party ICAP servers, such as antimalware and Data Leak Prevention (DLP). The ICAP servers perform a content transformation on the HTTP and HTTPS messages and send back responses to the appliance as modified messages. The adapted messages are either an HTTP or HTTPS response or request.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/security/icap-for-remote-content-inspection.html
  [From Build 50.31]
  [# NSBASE-825]

System

• Telemetry Support in CallHome

  CallHome is now enhanced to send Citrix ADC usage metrics to Citrix Insight Services (CIS) periodically. Citrix collects the data to understand how the appliance works and how to improve the product. By default, CallHome sends the metrics once in every 7 days.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/system/configuring-call-home.html
  [From Build 49.37]
  [# NSCALLHOME-14]

• Two factor authentication for Citrix ADC management access

  Citrix ADC appliance now supports two-factor authentication for enhanced security. There is an additional layer of security added to the authentication process. As a result, the user identity is verified at two authentication levels. Only if passwords at both authentication levels are correct, the user is allowed to access the Citrix ADC appliance.

  Previously, in single-factor authentication process, the appliance authenticated the system user only at one level of authentication.

  For more information, see https://docs.citrix.com/en-us/citrix-adc/12-1/system/ns-ag-aa-intro-wrapper-con/two-factor-authentication.html
  [From Build 51.19]
  [# NSAUTH-12]

• Inline device integration with Citrix ADC

  You can now integrate a Citrix ADC appliance with inline security devices such as Intrusion Prevention System (IPS) and Next Generation Firewall (NGFW). This integration prevents security threats and provides advanced security protection.

  The Citrix ADC appliance performs TLS/SSL processing and offloads the data to the inline device for high volume content inspection. If there are multiple inline devices, the appliance load balances the devices for traffic distribution.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/security/inline-device-integration-with-citrix-adc.html
  [From Build 50.31]
  [# NSBASE-4049, BUG0713041]

• Enabling TCP timestamp option

  In certain scenarios, transactions might be slow or incomplete, if you enable the TCP timestamp option on a Citrix ADC appliance.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/system/TCP_Congestion_Control_and_Optimization_General.html
  [From Build 50.31]
  [# NSBASE-843, BUG0710224]

• Maximum limit for name attribute is set to 64 characters

  In rate limiting, the maximum limit for name attribute is now increased to 64 characters.
  [From Build 50.31]
  [# NSHELP-11115]

Telco

• Support for triggering negative TTL for partial success response code 2002

  You can use the following command for triggering negative TTL for partial success response code 2002.

  set subscriber gxinterface -negativeTTLLimitedSuccess YES
  [From Build 49.37]
  [# NSLB-576, 699466]

• IP prefix NAT support for TCP and HTTP load balancing configurations

  IP Prefix NAT feature is now supported for TCP and HTTP load balancing configurations. IP prefix NAT translates a part of the source IP address instead of the complete address of packets received on the Citrix ADC. IP prefix NAT includes changing one or more octets or bits of the source IP address.

  For more information about IP prefix NAT, see https://docs.citrix.com/en-us/netscaler/12-1/networking/ip-addressing/configuring-network-address-translation/partial-nat.html.
  [From Build 49.37]
  [# NSBASE-1710]

• AppFlow support for Gx messages

  The Citrix ADC appliance now supports Gx message reporting capability that enables the customer to maintain a log of subscriber session status. All received Credit-Control and Re-Auth Request diameter messages are logged through Appflow/Logstream infrastructure.

  The reported records include:

  - diameter message information, for example, type and response code.

  - essential pre-selected Attribute-Value Pairs (AVPs), for example, session-id and MSISDN

  - information up to five customers defined AVPs
  [From Build 50.31]
  [# NSBASE-1752, ENH0699467]

• Support of Gx session information in subscriber awareness AppFlow records

  The Citrix ADC subscriber awareness functionality for L4 and L7 Appflow records have been extended to include subscriber session id along with the last Gx/diameter message time stamp information. This allows easier correlation of data-plane logs with the newly introduced Gx reporting records.
  [From Build 50.31]
  [# NSBASE-2154, ENH0697881]

URL Filtering

• Display URL Categorisation result from CLI on demand (CLI implementation)

  URL Filtering Command Interface enables you to enter an URL and get the categorization result (category, group, and reputation score) as returned by the NetSTAR SDK database.

  For more information, see https://docs.citrix.com/en-us/citrix-secure-web-gateway/12-1/url-filtering/url-categorization.html
  [From Build 51.19]
  [# NSSWG-887]

Fixed Issues in Previous Citrix ADC 12.1 Releases

Analytics

• In some cases, the Citrix Gateway appliance dumps core during the authentication if the following conditions are met:

  - The Citrix ADC appliance is configured for nFactor authentication.

  - The Gateway Insight feature is enabled for the appliance.
  [From Build 50.31]
  [# NSHELP-5271, TSK0713011]

AppFlow

• The Citrix ADC appliance might crash if SSO is configured along with AppFlow, because the appliance might try to look up HTTP headers that are not present in the request or response.
  [From Build 51.19]
  [# NSHELP-18128]

• In a high availability setup, the secondary appliance might keep on restarting if AppFlow is configured for Gateway Insight.
  [From Build 51.19]
  [# NSHELP-18469]

Authentication, authorization, and auditing

• A Citrix ADC appliance is unable to evaluate an advanced policy expression if you either bind the policy to a virtual server or to an authentication, authorization, and auditing group.
  [From Build 49.37]
  [# NSHELP-968]

• A Citrix ADC appliance becomes unresponsive because of memory corruption when it handles jumbo frames.
  [From Build 49.37]
  [# NSHELP-445, 712490, 711718, 698974, 714419, 712489]

• The Citrix ADC appliance might fail to establish an SSO connection to a back-end server, if the form-SSO has a hidden value containing special characters such as &, <, >, and ‘.
  [From Build 49.37]
  [# NSHELP-939]

• In case of nFactor authentication, the extracted authentication, authorization, and auditing group name from certificate-factor are concatenated with the first extracted group from LDAP-factor without any delimiter.
  [From Build 49.37]
  [# NSHELP-538]

• The authentication, authorization, and auditing feature does not evaluate the advanced authorization policies that are bound to authentication, authorization, and auditing user and group entities.
  [From Build 49.37]
  [# NSAUTH-2218]

• The Citrix ADC appliance might become unresponsive if both of the following conditions are met:

  • Login schema policy with reset action provokes the reset function to send reset packet, and then free it later.

  • The same packet is freed again, resulting in a duplicate packet free condition.
  [From Build 49.37]
  [# NSHELP-8346]

• The request to the back-end server fails if the following conditions are met:

  • Request URL to the back-end server is encoded prior to establishing authentication, authorization, and auditing session.

  • Citrix ADC appliance decodes the URL after log on.
  [From Build 49.37]
  [# NSHELP-963, 711806, 713423]

• If you configure "add kcdaccount xxx -keytab yyy" on release 12.1 build 49.x, the Citrix ADC appliance might become unresponsive.
  [From Build 49.37]
  [# NSHELP-618, 713603, 713300]

• A Citrix ADC appliance with two factor SAML authentication might eternally cause authentication loop.
  [From Build 49.37]
  [# NSHELP-644, 714736]

• The self-service password reset knowledge-based question and answer validation might fail if the size of the certificate bound to VPN global is greater than 1024 bytes.
  [From Build 51.19]
  [# NSAUTH-5342]

• You might fail to access a Citrix ADC appliance if you attempt to reach the protected resources through a POST request without valid authentication, authorization, and auditing cookie.
  [From Build 51.19]
  [# NSAUTH-81]

• A gradual memory leak is observed on a Citrix ADC appliance for the following occurrences:

  - nFactor authentication is used.

  - There are no default or true authentication policies used.
  [From Build 50.31]
  [# NSHELP-1642, TSK0717322]

• XML parsing fails if Citrix ADC appliance adds an extra character to the SAML assertion.
  [From Build 51.19]
  [# NSHELP-18158]

• A Citrix ADC appliance might crash if clear config command is invoked when authentication, authorization, and auditing actions are handled.
  [From Build 51.19]
  [# NSHELP-18165]

• The title page from the Portal customization page of Citrix GUI does not update the title for authentication, authorization, and auditing portal.
  [From Build 51.19]
  [# NSHELP-18168]

• The AAAD daemon might crash because of a memory corruption if the following conditions are met:

  - The nested group extraction is enabled on an active directory.

  - The extracted group length is between 52-56 bytes.
  [From Build 50.31]
  [# NSHELP-18239, NSHELP-18258, NSHELP-18306]

• The AAAD daemon might crash because of a memory corruption if the following conditions are met:

  - The nested group extraction is enabled on an active directory.

  - The extracted group length is between 52-56 bytes.
  [From Build 51.19]
  [# NSHELP-18239, NSHELP-18258, NSHELP-18306]

• A Citrix ADC appliance configured as SAML Service Provider (SP) with artifact bindings occasionally return assertion replay when there is no replay.
  [From Build 50.31]
  [# NSHELP-2132, TSK0714920]

• A Citrix ADC appliance becomes unresponsive because of memory corruption when it handles jumbo frames.
  [From Build 50.31]
  [# NSHELP-445, NSHELP-515, NSHELP-579, TSK0705972]

• In a rare case, a Citrix ADC appliance restarts if it tries to access a memory that was previously freed.
  [From Build 50.31]
  [# NSHELP-449, NSHELP-432, NSHELP-587, NSHELP-589, TSK0714441]

• A Citrix ADC appliance configured for SAML IdP might not perform Cross-site scripting (XSS) checks on an incoming RelayState parameter.
  [From Build 50.31]
  [# NSHELP-453, BUG0714801]

• An SSO to Office 365 fails if objectGUID of a user contains a NULL character.
  [From Build 50.31]
  [# NSHELP-455, TSK0717549]

• If you configure "add kcdaccount xxx -keytab yyy" on release 12.1 build 49.x, the Citrix ADC appliance might become unresponsive.
  [From Build 50.31]
  [# NSHELP-618, NSAUTH-1854, NSHELP-2276, NSHELP-2306, TSK0712411]

• A Citrix ADC appliance with two factor SAML authentication might eternally cause authentication loop.
  [From Build 50.31]
  [# NSHELP-644, NSHELP-575, TSK0714523]

• A Syslog message reports the client IP and server IP in a reverse hexadecimal format.
  [From Build 50.31]
  [# NSHELP-663, TSK0715098]

• A Citrix ADC appliance might become unresponsive if there is a high CPU usage.
  [From Build 51.19]
  [# NSHELP-8356]

• CPU utilization increases and the DNS data packet keeps looping if Citrix ADC AAA uses port 3000 to send a DNS query to an LDAP or a RADIUS server. With this fix, Citrix ADC AAA uses source port 10000 and above to send DNS queries to LDAP or RADIUS servers.
  [From Build 50.31]
  [# NSHELP-8416]

• A Citrix ADC appliance might become unresponsive if the function specifies a wrong async handler.
  [From Build 50.31]
  [# NSHELP-8440]

• In a SAML de-serialize function, the Citrix ADC appliance might crash due to invalid memory access.
  [From Build 51.19]
  [# NSHELP-8464]

• A Citrix ADC appliance might crash if the following conditions are met:

  - Changes in metadata URL.

  - The existing user session is disconnected.
  [From Build 50.31]
  [# NSHELP-8504]

• A Citrix ADC appliance might crash if the following conditions are met:

  - Changes in metadata URL.

  - The existing user session is disconnected.
  [From Build 51.19]
  [# NSHELP-8504]

• A Citrix ADC appliance might crash if there is a memory corruption due to a buffer overflow.
  [From Build 50.31]
  [# NSHELP-8537]

• The Citrix ADC appliance might fail to establish an SSO connection to a back-end server, if the form-SSO has a hidden value containing special characters such as &, <, >, and ‘.
  [From Build 50.31]
  [# NSHELP-939, TSK0707018]

• A Citrix ADC AAA session observes an accounting error on the logout method.
  [From Build 50.31]
  [# NSHELP-979, BUG0712813]

• A Citrix ADC appliance might crash if a replay packet is received after authentication has generated a response.
  [From Build 50.31]
  [# NSHELP-982, NSHELP-676, TSK0714057]

• When a Citrix ADC appliance configured for SAML SP sends a request to SAML IdP, the following issues are identified:

  - URL is decoded sent from the traffic management virtual server.

  - Incorrect URL is displayed when authentication is complete.
  [From Build 50.31]
  [# NSHELP-995, TSK0716958]

Base

• ABR video connections are throttled in nature and thus can negatively impact the correctness of Connection Quality Analytics (CQA).

  So, CQA metrics produced for ABR video transactions should be discarded.
  [From Build 51.19]
  [# NSBASE-1116]

CLI

• If a user tries to log on to a Citrix ADC appliance through any console, the system displays a log message with an incorrect client type. For example, if the user logs on to the appliance through the XenServer console, the system displays the log message as follows:

  "Apr 9 12:27:02 <local0.info> 10.102.201.11 04/09/2018:06:57:02 GMT 0-PPE-0 : d

  efault UI CMD_EXECUTED 502 0 : User nsroot - Remote_ip 127.0.0.1 - Command "log

  in nsroot "********"" - Status "Success"
  [From Build 49.37]
  [# NSHELP-4864]

• If a user tries to log on to a Citrix ADC appliance through any console, the system displays a log message with an incorrect client type. For example, if the user logs on to the appliance through the XenServer console, the system displays the log message as follows:

  "Apr 9 12:27:02 <local0.info> 10.102.201.11 04/09/2018:06:57:02 GMT 0-PPE-0 : d

  efault UI CMD_EXECUTED 502 0 : User nsroot - Remote_ip 127.0.0.1 - Command "log

  in nsroot "********"" - Status "Success"
  [From Build 50.31]
  [# NSHELP-4864, TSK0701582]

Cache

• A Citrix ADC appliance crashes if the following conditions are met:

  - The cache contentgroup's memory limit exceeds the threshold.

  - The PINNED option is enabled on the cache contentgroup.
  [From Build 50.31]
  [# NSHELP-3629, TSK0714583]

Citrix ADC GUI

• After an upgrade from Citrix ADC 11.1 build 56.x to Citrix ADC 12.1 build 49.x, the login to Citrix ADC GUI fails. The issue occurs if the password contains an escape sequence, such as "

  " or " ".
  [From Build 51.19]
  [# NSHELP-18178]

• File download option does not work on the Citrix ADC GUI.
  [From Build 51.19]
  [# NSUI-11341]

• In rare cases, a Citrix ADC appliance displays an ‘Error in retrieving Certificate-key pair. Unable to get property match of undefined or null reference’ error message if you update certkey from the Certificates tab.
  [From Build 50.31]
  [# NSUI-6885, NSHELP-5180, BUG0706444]

Citrix ADC MPX Appliance

• In a Citrix ADC MPX appliance, the GUI and command interface is unable to distinguish between Mellanox 100G and 50G interfaces. As a result, the interfaces allow you to set 50G on 100G interface.
  [From Build 50.31]
  [# NSHELP-14761]

Citrix ADC SDX Appliance

• When you create or delete a 10G LACP or static channel, transmission stalls on the member interfaces of the channel, and therefore those interfaces stop processing traffic.
  [From Build 49.37]
  [# NSHELP-2398, 697276, 704954]

• On Citrix ADC SDX 26000 and SDX 15000-50G platforms, the virtual router ID (VRID) configuration on a static or a link aggregation control protocol (LACP) channel does not work if any one of the following conditions is met:

  - The VPX instance configured with the VRID restarts.

  - The SDX appliance on which the VPX instance is running restarts.
  [From Build 49.37]
  [# NSPLAT-4076]

• The message "Appliance license expired" appears when you log on to the Citrix ADC SDX GUI, after upgrading from any previous Citrix ADC version to 12.1 48.13/12.0-58.15. This is a harmless message and can be ignored safely.
  [From Build 49.37]
  [# NSHELP-11980]

• The VPX instance restarts by itself in the following case.

  - You change the admin profile associated with a Citrix ADC VPX instance with channel configuration; and

  - The Citrix ADC VPX instance is running on Citrix ADC SDX 26XXX and 15XXX appliances.
  [From Build 49.37]
  [# NSHELP-12377]

• The VPX instance restarts by itself in the following case.

  - You change the admin profile associated with a Citrix ADC VPX instance with channel configuration; and

  - The Citrix ADC VPX instance is running on Citrix ADC SDX 26XXX and 15XXX appliances.
  [From Build 50.31]
  [# NSHELP-12377]

• The management IP (NSIP) of a Citrix ADC VPX instance running on SDX 14000 platform becomes unreachable when the following conditions are met:

  - An LACP channel comprising 10G or 40G interfaces is assigned as VPX management NIC.

  - One of the member interfaces in the LACP channel goes down.
  [From Build 50.31]
  [# NSHELP-13895]

• On Citrix ADC SDX 26000 and SDX 15000-50G platforms, the virtual router ID (VRID) configuration on a static or a link aggregation control protocol (LACP) channel does not work if any one of the following conditions is met:

  - The VPX instance configured with the VRID restarts.

  - The SDX appliance on which the VPX instance is running restarts.
  [From Build 50.31]
  [# NSPLAT-4076, BUG0710320]

• The virtual router ID (VRID) configuration on a static or a link aggregation control protocol (LACP) channel does not work on SDX 26000 and SDX 15000-50G platforms.
  [From Build 50.31]
  [# NSPLAT-7364, BUG0709182]

• Upgrade to release 12.1 build 50.x and later, release 12.0 build 60.1 and later, release 11.1 build 60.7 and later might result in one of the following outcomes:

  - VLAN filtering on SDX channels is disabled.

  - The SDX Management Service becomes unresponsive, even though the upgrade is successful, if the channels on the SDX appliance have VLAN filtering enabled and VPX instances have L2 mode enabled
  [From Build 51.19]
  [# NSSVM-2540]

• After upgrading an SDX appliance to 12.1 or 12.0 (any build) from any previous version, Management Service becomes unreachable if the CPU assigned to Management Service is used by another instance on the SDX appliance. The issue occurs in platforms SDX 15XXX, 26XXX, 14XXX 40S, 14XXX FIPS, and 89XX.
  [From Build 51.19]
  [# NSSVM-311]

• In an SDX appliance, after a clean installation from any older version to 12.1 50.x, you might be unable to recover the network configuration and fail to access to SDX appliance (Dom0 and Management Service).
  [From Build 50.31]
  [# NSSVM-452]

• In an SDX appliance, after a clean installation from any older version to 12.1 50.x, you might be unable to recover the network configuration and fail to access to SDX appliance (Dom0 and Management Service).
  [From Build 51.19]
  [# NSSVM-452]

Citrix ADC VPX Appliance

• A Citrix ADC VPX instance configured with VMXNET3 interfaces and running on VMware ESX server might crash if the ESX server sends a zero-length packet through these interfaces.
  [From Build 49.37]
  [# NSHELP-2647, 706660, 707542]

• If vCPUs are more than 12, password-based authentication does not work in Citrix ADC VPX instances running in Azure and AWS. However, you can log on by using ssh private key.
  [From Build 49.37]
  [# NSPLAT-4781, 714490]

• The SNS topic required for AWS back-end auto scale feature to work is not updated automatically.
  [From Build 49.37]
  [# NSPLAT-1818]

• The VPX instance removes two servers instead of one when the following conditions are met:

  - The remove 1 server parameter is set in the scale down policy of the EC2 auto scaling group.

  - Back-end auto scale feature is configured on the VPX instance.
  [From Build 49.37]
  [# NSPLAT-1554]

• The Citrix ADC VPX instance, configured with AWS back- end auto scaling feature, removes the EC2 auto scale group alarm.
  [From Build 49.37]
  [# NSPLAT-1587]

• In a multizone cluster deployment, the Citrix ADC VPX instance configured with AWS back-end auto scaling fails to create multiple SNS topics.
  [From Build 49.37]
  [# NSPLAT-1622]

• The Citrix ADC VPX instance configured with AWS back-end auto scaling does not detect the back-end servers bound to the EC2 auto scaling group, and the following error message appears.

  "Your AutoScaling Group:<autoscalegroup> can't have more than 10 topics"
  [From Build 49.37]
  [# NSPLAT-1652]

• The first-time user screen appears even on subsequent logons or every time the logon page is refreshed. By design, the first-time user screen should appear only when the user logs on to the VPX instance for the first time.
  [From Build 49.37]
  [# NSPLAT-1710]

• In a hypervised environment, the management CPU usages could appear high if the hypervisor schedules the management CPUs incorrectly.
  [From Build 50.31]
  [# NSHELP-18184]

• A Citrix ADC VPX instance configured with VMXNET3 interfaces and running on VMware ESX server might crash if the ESX server sends a zero-length packet through these interfaces.
  [From Build 50.31]
  [# NSHELP-2647, NSHELP-2393, NSHELP-2394, TSK0695358]

• The VPX instance removes two servers instead of one when the following conditions are met:

  - The remove 1 server parameter is set in the scale down policy of the EC2 auto scaling group.

  - Back-end auto scale feature is configured on the VPX instance.
  [From Build 50.31]
  [# NSPLAT-1554, BUG0716006]

• The Citrix ADC VPX instance, configured with AWS back- end auto scaling feature, removes the EC2 auto scale group alarm.
  [From Build 50.31]
  [# NSPLAT-1587, BUG0716030]

• In a multizone cluster deployment, the Citrix ADC VPX instance configured with AWS back-end auto-scaling fails to create multiple SNS topics.
  [From Build 50.31]
  [# NSPLAT-1622, BUG0716031]

• The Citrix ADC VPX instance configured with AWS back-end auto scaling does not detect the back-end servers bound to the EC2 auto scaling group, and the following error message appears.

  "Your AutoScaling Group:<autoscalegroup> can't have more than 10 topics"
  [From Build 50.31]
  [# NSPLAT-1652, BUG0716101]

• The first-time user screen appears even on subsequent logons or every time the logon page is refreshed. By design, the first-time user screen should appear only when the user logs on to the VPX instance for the first time.
  [From Build 50.31]
  [# NSPLAT-1710, BUG0716714]

• The SNS topic required for AWS back-end auto scale feature to work is not updated automatically.
  [From Build 50.31]
  [# NSPLAT-1818, BUG0715919]

• Support for Citrix ADC VPX instance on Google Cloud Platform

  You can deploy a Citrix ADC VPX instance on Google Cloud Platform (GCP). A VPX instance in GCP enables you to leverage cloud computing capabilities of GCP and use Citrix load balancing and traffic management features for your business needs. You can deploy VPX instances in GCP as standalone instances. Both single NIC and multi NIC configurations are supported.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/deploying-vpx/deploy-vpx-google-cloud.html.
  [From Build 51.19]
  [# NSPLAT-2006]

• The cloud profile configuration for Azure autoscale shows the load balancing protocol as HTTP irrespective of the protocol selected while configuring the cloud profile. This issue appears both in GUI and CLI.
  [From Build 50.31]
  [# NSPLAT-4343, NSPLAT-4216, BUG0705295]

• If vCPUs are more than 12, password-based authentication does not work in Citrix ADC VPX instances running in Azure and AWS. However, you can log on by using ssh private key.
  [From Build 50.31]
  [# NSPLAT-4781, BUG0712146]

• Tagged VLAN traffic might fail after upgrading a VPX instance to release 12.1 50.28, running on the following Citrix ADC SDX platforms:

  11500,13500, 14500, 16500, 18500, 20500, 11515, 11520, 11530, 11540, 11542,

  17500, 19500, 21500, 17550, 19550, 20550, 21550, 8400, 8600, 8010, 8015, 22040, 22060, 22080, 22100, 22120, 22040, 22060, 22080, 22100, 22120, 24100, 24150, 14020, 14030, 14040, 14060, 14080, 14100, 14020 FIPS, 14030 FIPS, 14060 FIPS, 14080 FIPS
  [From Build 50.31]
  [# NSPLAT-7863]

• When a Citrix ADC VPX instance running on KVM hypervisor is provisioned with one or more ntel XL710 40G NICs, the 40G interface does not initialize correctly inside the VPX instance. Also, the interface name or MAC address appears incorrectly.
  [From Build 51.19]
  [# NSPLAT-8533]

Citrix ADC VPX appliance

• Cluster and high availability (same zones and across zones) on AWS do not work.
  [From Build 51.20]
  [# NSPLAT-9407]

Citrix Gateway

• Citrix Gateway appliance dumps core upon freeing the NSB memory twice.
  [From Build 49.37]
  [# NSHELP-1790]

• In rare cases, a Citrix Gateway appliance configured for EDT becomes unresponsive because of memory corruption.
  [From Build 49.37]
  [# NSHELP-1685, 709305, 709349, 706229, 705896, 710041, 710117, 707924, 709493, 709911, 710415, 710907, 710891, 711509, 711523, 710808, 712343, 715140, 715145]

• A Citrix Gateway appliance does not fallback to the LDAP policy if the following conditions are met:

  - Certificate authentication and LDAP are configured as the first factor and LDAP checks data from login Schema.

  - The certificate authentication fails.
  [From Build 49.37]
  [# NSHELP-1853]

• In a Citrix Gateway deployment, the log out operation for Outlook Web Access (OWA) application intermittently fails.
  [From Build 49.37]
  [# NSHELP-1054, 710636, 709652, 710570]

• In rare cases, the Citrix Gateway appliance dumps core when DTLS is enabled on a VPN virtual server.
  [From Build 49.37]
  [# NSHELP-1971, 709315, 711421, 710131]

• POST request has some non-required fields.
  [From Build 49.37]
  [# NSHELP-428]

• Connectionlist corruption occurs if VMware horizon client reuses the same SPI for UDP connections, resulting in eventual crashes when show or kill command is executed.
  [From Build 49.37]
  [# NSHELP-6905]

• In case of network errors, cached client certificates were removed, prompting user to select the certificate from the drop-down menu manually.
  [From Build 49.37]
  [# NSHELP-423]

• In rare cases, the VPN plug-in crashes.
  [From Build 49.37]
  [# NSHELP-1454]

• When IPv6 is disabled globally, the connection reset is mandated, if the IPv6 packet arrives on MUX channel.
  [From Build 49.37]
  [# NSHELP-1606]

• A Citrix Gateway appliance dumps core if a Regex in a patset takes a long time to execute.
  [From Build 49.37]
  [# NSHELP-6706, 710642]

• In rare cases, the Citrix Gateway appliance dumps core when a client machine tries to open more than one DTLS connection.
  [From Build 49.37]
  [# NSHELP-1135]

• The session through a Citrix Gateway appliance using RfWebUI goes to unresponsive mode after you click cancel on the "Change Password" error window.
  [From Build 49.37]
  [# NSHELP-569]

• The Citrix Gateway appliance does not display the right logon form when the user clicks the "Go Back" button in the following case:

  The session initialization fails because the user does not belong to any of the groups configured on the Citrix ADC appliance.
  [From Build 49.37]
  [# NSHELP-583]

• If StoreFront is load balanced using an internal load balanced virtual server, IPv6 clients is not evenly load balanced.
  [From Build 49.37]
  [# NSHELP-8597]

• Authentication fails when Citrix Gateway is configured with advanced policies, that is nFactor, and the client is configured only for certificate authentication.
  [From Build 49.37]
  [# NSHELP-598]

• Accessing a Citrix Gateway appliance results in 404 error, if the Citrix Gateway and Authentication, authorization, and auditing are deployed on the same Citrix ADC appliance in the same domain but outside of Citrix Gateway domain.
  [From Build 49.37]
  [# NSHELP-8636]

• The VPN plug-in for Citrix Gateway becomes unresponsive once the client machine moves to active mode from standby mode.
  [From Build 49.37]
  [# NSHELP-8015, 710161, 716058]

• Upon using the Citrix Gateway plug-in to logon to VPN, the RADIUS challenge message is displayed on Citrix Receiver instead of the Citrix Gateway plug-in.
  [From Build 49.37]
  [# NSHELP-8024]

• Pre-authentication EPA check fails when total length of single EPA expression (not separated by any logical operators) is greater than 1024 characters.
  [From Build 49.37]
  [# NSHELP-6835]

• Windows Gateway Plugin displays incorrect message on the user interface when the VPN virtual server with Citrix Gateway is in disabled or in out of order state.
  [From Build 49.37]
  [# NSHELP-6760]

• In some cases, the Citrix Gateway appliance with multiple core crashes if the HDX Insight feature is enabled.
  [From Build 49.37]
  [# NSHELP-15792, 712124, 712553, 714141, 714351, 714721]

• Allowed login groups parameters in session action do not take effect with advanced session policies.
  [From Build 49.37]
  [# NSHELP-1728]

• A Citrix Gateway appliance does not allow post body expressions for relaystateRule parameter when sending SAML assertions.
  [From Build 49.37]
  [# NSHELP-628]

• While repairing the Citrix Gateway plug-in, a re-installation for the plug-in is initiated without checking if the plug-in is already installed. This creates a new virtual adapter instance.
  [From Build 49.37]
  [# NSHELP-1473]

• EPA fails when Citrix Gateway is configured for nFactor authentication.
  [From Build 49.37]
  [# NSHELP-8642]

• User initiated password change request using the Citrix Gateway user interface fails.
  [From Build 49.37]
  [# NSAUTH-4502]

• In a multi-core environment, device certificate failed intermittently due to syncing issues.
  [From Build 50.31]
  [# CGOP-3666, BUG0711654]

• Citrix Gateway does not support WebView or V3 Auth protocol for iOS devices. V3 Auth protocol is used for SAML or a similar advanced authentication mechanism.
  [From Build 51.19]
  [# CGOP-3800, NSHELP-1359, NSHELP-7943]

• If VDA protocol is set to BLAST on a VMware connection server, upon launching apps or desktops, the Citrix ADC appliance crashes.
  [From Build 51.19]
  [# CGOP-6145, NSHELP-19551]

• The users connected to the Citrix Gateway appliance are unable to ping each other using the Intranet IP (IIP).
  [From Build 50.31]
  [# CGOP-878, BUG0470679]

• Citrix Gateway now supports a new version of NetworkAccessControl (NAC) checks using Microsoft Enterprise Mobility (Microsoft Intune) suite. This variant uses a signed device information of the end client for validation. To use this feature, you need a compatible version of the Citrix SSO app.
  [From Build 50.31]
  [# NSAUTH-4239, BUG0716353]

• User initiated password change request using the Citrix Gateway user interface fails .
  [From Build 50.31]
  [# NSAUTH-4502]

• In a Citrix Gateway deployment, the log out operation for Outlook Web Access (OWA) application intermittently fails.
  [From Build 50.31]
  [# NSHELP-1054, NSHELP-1429, NSHELP-3235, NSHELP-559, TSK0708643]

• All admin UI calls are now allowed.

  Earlier, some of these calls were blocked because of a deny rule in the httpd.conf file.
  [From Build 50.31]
  [# NSHELP-1478]

• Admin UI calls from all IP addresses are now allowed.

  Earlier, some of these calls were blocked because of a deny rule in the httpd.conf file.
  [From Build 51.19]
  [# NSHELP-1478]

• Windows can add a best route for any On-link interface to route traffic. The addition of a new route for the internal network address on the virtual adapter's interface results in connectivity issues over VPN connection.
  [From Build 50.31]
  [# NSHELP-1479, TSK0715217]

• In some cases, the Citrix Gateway appliance with multiple cores crashes if the HDX Insight feature is enabled, during a session reconnect.
  [From Build 50.31]
  [# NSHELP-15792, NSHELP-15687, NSHELP-15689, NSHELP-17901]

• When IPv6 is disabled globally, the connection reset is mandated, if the IPv6 packet arrives on MUX channel.
  [From Build 50.31]
  [# NSHELP-1606, TSK0709903]

• In rare cases, the Citrix Gateway appliance dumps core when a proxy server is configured.
  [From Build 50.31]
  [# NSHELP-1616, TSK0713474]

• In some cases, the Citrix Gateway appliance dumps core if the following conditions are met:

  - The Citrix Gateway appliance hosts connections to Citrix XenDesktop 7.16 and above the supports UDT.

  - A DTLS service with the same IP:PORT as the VDA is added.
  [From Build 50.31]
  [# NSHELP-1692, TSK0708188]

• The Citrix Gateway appliance displays incorrect http content for STA ticket refresh request.
  [From Build 50.31]
  [# NSHELP-1721, TSK0713473]

• Allowed login groups parameters in session action do not take effect with advanced session policies.
  [From Build 50.31]
  [# NSHELP-1728, TSK0712705]

• Citrix Gateway appliance dumps core upon freeing the NSB memory twice.
  [From Build 50.31]
  [# NSHELP-1790, TSK0701843]

• Files and folders hosted under the following SharePoint default folder cannot be accessed.

  - SitesPages

  - Shared Documents
  [From Build 51.19]
  [# NSHELP-18114]

• Files and folders hosted under the SharePoint default folder "PublishingImages" cannot be accessed.
  [From Build 51.19]
  [# NSHELP-18116]

• A Citrix ADC appliance might become unresponsive if the following conditions are met.

  - The appliance is configured for EDT proxy.

  - Audit log for TCP is enabled.
  [From Build 51.19]
  [# NSHELP-18120]

• A Citrix ADC appliance might crash if the following conditions are met:

  - The appliance is configured for Citrix Gateway with EDT proxy functionality enabled.

  - The appliance is running low on memory.
  [From Build 51.19]
  [# NSHELP-18121]

• In a Citrix Gateway appliance configured for nFactor authentication, the secondary factor of authentication is ignored if the following conditions are met:

  - Primary factor of authentication is certificate policy.

  - Secondary factor of authentication is group extraction.
  [From Build 51.19]
  [# NSHELP-18139]

• If you click an RDP bookmark, a .rdp file is downloaded.

  Earlier, when the RDP bookmark was clicked, it opened in a new tab.
  [From Build 50.31]
  [# NSHELP-18140]

• If you click an RDP bookmark, a .rdp file is downloaded.

  Earlier, when the RDP bookmark was clicked, it opened in a new tab.
  [From Build 51.19]
  [# NSHELP-18140]

• Citrix Gateway appliance dumps core when STA server closes the connection abruptly.
  [From Build 51.19]
  [# NSHELP-18141]

• In some cases, logging out from Citrix Gateway is not supported.
  [From Build 51.19]
  [# NSHELP-18144]

• On the user authentication screen for VPN plug-in, you had to click on the password field before entering the password. Now, you do not need to click on the password field before entering the password as the cursor moves to the password field automatically after the username field is auto-filled.
  [From Build 51.19]
  [# NSHELP-18338]

• The VPN homepage appears blank after you log in to your company VPN using Citrix Gateway plugin through macOS Safari browser.
  [From Build 51.19]
  [# NSHELP-18400]

• After a successful logoff from a Citrix Gateway appliance, the client browser window must be closed and a new browser window must be opened for a new login.This is required, if the following authentication methods are selected:

  - SAML with IdP enabled

  - Smartcard
  [From Build 51.19]
  [# NSHELP-18519, NSHELP-18422]

• VPN tunneling is ceased because Windows firewall on Citrix virtual adapter drops the packets. The packet drop is caused because of cross firewall profile switch (profile switch from domain to public) for any inbound connection.
  [From Build 50.31]
  [# NSHELP-1975, NSHELP-1138, NSHELP-1398, NSHELP-2089, TSK0710165]

• For a non-admin user, Citrix Gateway service is not able to get the admin privileges.
  [From Build 50.31]
  [# NSHELP-2040, BUG0714332]

• In some cases, the Citrix Gateway appliance dumps core based on a particular sequence of events, if the appliance is configured for EDT proxy.
  [From Build 50.31]
  [# NSHELP-2134, TSK0715713]

• A Citrix Gateway appliance configured for nFactor authentication becomes unresponsive when the following conditions are met.

  - SAML is configured as the first factor of authentication.

  - EPA is configured as the last factor of authentication.
  [From Build 50.31]
  [# NSHELP-2137, TSK0715167]

• In some cases, applications accessed using Citrix Gateway become unresponsive because excessive logon redirects causes memory build up in the appliance.
  [From Build 50.31]
  [# NSHELP-2138, TSK0717351]

• In case of network errors, cached client certificates were removed, prompting user to select the certificate from the drop-down menu manually.
  [From Build 50.31]
  [# NSHELP-423, TSK0709689]

• POST request has some non-required fields.
  [From Build 50.31]
  [# NSHELP-428, TSK0709243]

• The Citrix Gateway appliance dumps core if the following conditions are met:

  • HTTP websites are accessed.

  • Memory allocation is low.

  • Memory allocation for code compression feature fails.
  [From Build 50.31]
  [# NSHELP-5747, TSK0706402]

• In some cases, performing certificate related operations after changing the RDP listeners by setting and unsetting RDP ServerProfile result in a crash.
  [From Build 50.31]
  [# NSHELP-5756, TSK0714720]

• Authentication fails when Citrix Gateway is configured with advanced policies, that is nFactor, and the client is configured only for certificate authentication.
  [From Build 50.31]
  [# NSHELP-598, BUG0710801]

• After an upgrade to version 11.1, the Citrix Gateway logon page does not appear on the Citrix ADC GUI.
  [From Build 50.31]
  [# NSHELP-6458]

• When a user enters an incorrect password for logon, "Bad Pass" error message is displayed. This happens when "enhancedAuthenticationFeedback" feature is enabled.
  [From Build 51.19]
  [# NSHELP-6508]

• jQuery version 1.12.4 used for the RfWebUI portal has security concerns.
  [From Build 51.19]
  [# NSHELP-6662]

• A client machine that has Chrome or Firefox set as default browser does not fall back to ICA proxy mode after the post authentication EPA scan fails.
  [From Build 50.31]
  [# NSHELP-6692]

• A Citrix Gateway appliance fails to process a SAML response on an existing connection.
  [From Build 50.31]
  [# NSHELP-670, BUG0715920]

• URLs are not rewritten if SharePoint is configured with IT folder. Also, URLs with Unicode encoding for the following special character “\” are broken and hence are not rewritten.
  [From Build 50.31]
  [# NSHELP-6709]

• Citrix Gateway server invariably downloads the plug-in configuration files from the Citrix downloads page, ignoring the settings pushed from the Citrix StoreFront server.
  [From Build 51.19]
  [# NSHELP-6724]

• Pre-authentication EPA check fails when total length of single EPA expression (not separated by any logical operators) is greater than 1024 characters.
  [From Build 50.31]
  [# NSHELP-6835]

• Chrome does not trigger EPA plug-in when multiple EPA factors configured.
  [From Build 51.19]
  [# NSHELP-6840]

• In some cases, when Citrix Gateway is configured for nFactor authentication, quarantine group is not evaluated during post authentication EPA.
  [From Build 50.31]
  [# NSHELP-6843]

• In Citrix ADC GUI, the options under file upload browse button incorrectly displays "object" and not the option name.
  [From Build 51.19]
  [# NSHELP-7191]

• The VPN plug-in for Citrix Gateway becomes unresponsive once the client machine moves to active mode from standby mode.
  [From Build 49.37]
  [# NSHELP-8015]

• The VPN plug-in for Citrix Gateway becomes unresponsive once the client machine moves to active mode from standby mode.
  [From Build 50.31]
  [# NSHELP-8015]

• In a multicore environment, the Citrix Gateway appliance dumps core during login transfer when intranet IP address is enabled in VPN.
  [From Build 51.19]
  [# NSHELP-8164, NSHELP-7078, NSHELP-7082, NSHELP-17438, NSHELP-18156, NSHELP-18368]

• If StoreFront is load balanced using an internal load balanced virtual server, IPv6 clients is not evenly load balanced.
  [From Build 50.31]
  [# NSHELP-8597]

• EPA fails when Citrix Gateway is configured for nFactor authentication.
  [From Build 50.31]
  [# NSHELP-8642]

• In some cases, Citrix Gateway appliance dumps core during freeing up the VPN session.
  [From Build 50.31]
  [# NSHELP-8664]

• Upon attempting to bind a previously bound VPN virtual server to a CS virtual server, the following error message is displayed, "ERROR: Only one VPN vserver can be bound to a CS vserver."
  [From Build 51.19]
  [# NSHELP-8672]

• In some cases, users experience application launch failures or frozen sessions for EDT sessions, if Citrix Gateway is configured to generate Insights for EDT.
  [From Build 51.19]
  [# NSINSIGHT-1791]

• In some cases, a Citrix ADC appliance dumps core if the Citrix Gateway is configured for EDT Proxy and the EDT Insight functionality is enabled.
  [From Build 51.19]
  [# NSINSIGHT-1948]

Citrix Web App Firewall

• When you deploy CSRF learned rules from the application firewall GUI, the rules do not get deleted and the following error "The CrossSiteRequestForgery check is already in use" is displayed if you try to redeploy the rules.
  [From Build 49.37]
  [# NSHELP-2817]

• The cluster upgrade to a 12.1 build with Citrix Web App Firewall enabled on a Citrix ADC appliance is not supported.
  [From Build 49.37]
  [# NSWAF-262]

• The leading TCP window size is rounded off when the post body limit is set to 4294967295(2^32-1). The fix ensures that the limit max TCP window set by Citrix Web App Firewall is 100 MB in non-streaming data and 20 MB for streaming data.

  As a workaround, please add the post body limit on profile to values <=512MB, preferably to value 100MB. Also when requests are of larger sizes, please ensure that the profile has streaming enabled. Enable streaming only if backend server is able to accept chunked requests.
  [From Build 49.37]
  [# NSHELP-17873, 708678, 707955, 708851, 711014]

• When you use special characters in AppFW SessionCookieName, the AppFirewall policy resets website URLs. The issue is resolved, if you remove special characters and use alphabets in the cookie name.
  [From Build 49.37]
  [# NSHELP-16795]

• After an upgrade to Citrix ADC 11.1 build 57.13, the URL transformation policy for cookie domains is not applied to application secure cookies.
  [From Build 49.37]
  [# NSHELP-2771]

• A Citrix ADC appliance crashes if you canonicalize (percent-decoding & other normalizations) header names and values only once instead of multiple times before running Citrix Web App Firewall signature protections.
  [From Build 49.37]
  [# NSHELP-2851, 710841]

• Citrix Web App Firewall Cookie proxying feature is not working in Cluster 12.1 deployment.
  [From Build 49.37]
  [# NSWAF-628]

• After a software upgrade, the Citrix ADC appliance crashes with AppFW violation data record when the AppFlow feature is disabled.
  [From Build 49.37]
  [# NSHELP-18106]

• A Citrix ADC appliance crashes if you canonicalize (percent-decoding & other normalizations) header names and values only once instead of multiple times before running Citrix Web App Firewall signature protections.
  [From Build 49.37]
  [# NSHELP-2820]

• After an upgrade, if Applicable Firewall is enabled on a Citrix ADC appliance, it causes memory leak leading to a high memory usage.
  [From Build 49.37]
  [# NSHELP-17915, 711993]

• A high availability setup that has an application firewall profile with starurl closure enabled, experiences high CPU usage and system failover. The issue occurs if response pages contain many URLs.
  [From Build 50.31]
  [# NSHELP-16694]

• The functionality for importing Citrix Web App Firewall profile configuration fails, if the profile contains user-defined field types and if the field types are used in multiple relaxation rules.
  [From Build 50.31]
  [# NSHELP-17851]

• A Citrix ADC appliance might crash if there is a Cross-Site Request Forgery (CSRF) tag failure.
  [From Build 51.19]
  [# NSHELP-17940]

• Memory leak is observed in a Citrix ADC appliance, if the Integrated Cache and the Web Citrix Web App Firewall features are enabled.
  [From Build 51.19]
  [# NSHELP-17969, NSHELP-17158]

• In a rare case, when Citrix Web App Firewall Learning option is enabled, the resulting aslearn.log file can consume a high amount of hard disk space, starving other disk users.
  [From Build 50.31]
  [# NSHELP-18083]

• After a software upgrade, the Citrix ADC appliance crashes with AppFW violation data record when the AppFlow feature is disabled.
  [From Build 49.37]
  [# NSHELP-18106]

• A user cannot send an HTTP request from a website if the Web App Firewall profile has the following options enabled:

  - Streaming

  - signature bound with post body rules.
  [From Build 51.19]
  [# NSHELP-18238]

• A Citrix ADC appliance crashes if you canonicalize (percent-decoding & other normalizations) header names and values only once instead of multiple times before running Citrix Web App Firewall signature protections.
  [From Build 50.31]
  [# NSHELP-2820, BUG0710596]

• A Citrix ADC appliance crashes if you canonicalize (percent-decoding & other normalizations) header names and values only once instead of multiple times before running Citrix Web App Firewall signature protections.
  [From Build 50.31]
  [# NSHELP-2851, NSHELP-2760, NSHELP-2770, NSWAF-446, TSK0709465]

• Citrix Web App Firewall Cookie proxying feature is not working in Cluster 12.1 deployment.
  [From Build 50.31]
  [# NSWAF-628, BUG0710139]

Clustering

• In a layer 3 cluster deployment, fragmented traffic steered through a GRE tunnel might cause packet loops, which result in high traffic load.
  [From Build 49.37]
  [# NSHELP-3447]

• In a Citrix ADC cluster setup, you might find some inconsistencies in the server state in the database and in the packet engine, if you perform the following tasks in a sequence:

  1. Add a server in DISABLED state.

  2. Enable the server.

  If you use this server when executing the “bind servicegroup” command, the servicegroup members are added in OUT OF SERVICE state.
  [From Build 50.31]
  [# NSHELP-10943]

DNS

• A Citrix ADC appliance crashes when negative responses for root domain are cached.
  [From Build 50.31]
  [# NSHELP-12589]

• The Citrix ADC appliance might fail for proactive update DNS queries if there is an ICMP error.
  [From Build 50.31]
  [# NSHELP-18132]

GSLB

• In a GSLB cluster setup, when a parent site is removed, the corresponding child site and its services are also removed.
  [From Build 49.37]
  [# NSLB-880]

• You might find GSLB service state inconsistencies among the cores when the MEP connection goes DOWN and the connection is back UP within a short time.
  [From Build 50.31]
  [# NSHELP-11872]

• The Citrix ADC appliance might stop responding in the following case:

  - There are cached DNS records

  - The show gslb domain command is executed
  [From Build 50.31]
  [# NSHELP-18131]

• GSLB configuration synchronization failed because the "set ssl servicegroup"command was also synchronized. With this fix, the command is not synchronized. As a result, the GSLB configuration is synchronized successfully.
  [From Build 50.31]
  [# NSHELP-4058, NSHELP-3090, TSK0709722]

• In a GSLB cluster setup, when a parent site is removed, the corresponding child site and its services are also removed.
  [From Build 50.31]
  [# NSLB-880, BUG0713908]

GUI

• A Citrix ADC appliance might crash if some entity names in the database have quotations and if a closing quotation is found missing. The issue is resolved if you upgrade your appliance to the latest version.
  [From Build 49.37]
  [# NSHELP-11933]

• A time zone setting ("set timezone” command) in a Citrix ADC appliance running release 11.1 might get lost after you upgrade it to a later release.
  [From Build 50.31]
  [# NSHELP-11550]

• After you upgrade a Citric ADC appliance when a non-shell access user creates a certificate signing request (CSR), the appliance adds a "\" (backslash) appears before a " "(space) for organization name, locality name, etc.
  [From Build 50.31]
  [# NSHELP-4521, BUG0713382]

Gateway Insight

• Receivers which are not white-listed fail to launch apps using Citrix Gateway with HDX Insight feature enabled.
  [From Build 49.37]
  [# NSHELP-5260, 712929]

• Receivers which are not white-listed fail to launch apps using Citrix Gateway with HDX Insight feature enabled.
  [From Build 50.31]
  [# NSHELP-5260, TSK0710678]

HDX Insight

• When Citrix Gateway appliance is used with NSAP enabled for VDAs (7.16 and above) and if HDX Insight is configured, the Citrix Gateway might fail.
  [From Build 50.31]
  [# NSHELP-5259, NSINSIGHT-1192, TSK0710363]

ICA

• In a certain scenario, the Citrix ADC appliance might become unresponsive if ICA AppFlow or SmartControl feature is enabled.
  [From Build 51.19]
  [# NSHELP-15475]

• In certain scenarios, if SR-HA feature is enabled for ICA AppFlow, the secondary Citrix ADC appliance in the high-availability deployment might fail.
  [From Build 50.31]
  [# NSHELP-15811]

• A Citrix ADC appliance might become unresponsive in a multi-core environment if ICA AppFlow or SmartControl feature is enabled.
  [From Build 50.31]
  [# NSHELP-15834]

• A Citrix ADC appliance might become unresponsive in certain traffic patterns if AppFlow feature is enabled for ICA traffic.
  [From Build 51.19]
  [# NSHELP-15858]

• In some cases, when the Citrix Gateway virtual server is configured for EDT, the ICA sessions become unresponsive.
  [From Build 51.19]
  [# NSHELP-18191]

• A Citrix ADC appliance dumps core for a particular traffic pattern if AppFlow for ICA is enabled.
  [From Build 51.19]
  [# NSHELP-18288]

• In a high availability setup, the secondary Citrix ADC appliance might crash if session reliability on a high availability setup is enabled.
  [From Build 49.37]
  [# NSHELP-5257, NSINSIGHT-1208, NSHELP-3807, NSHELP-3808, NSHELP-5414, NSHELP-5417, NSHELP-5428, NSHELP-17883, NSHELP-17894, NSHELP-17904]

• if SR-HA feature is enabled, the output throughput on the primary Citrix ADC appliance is comparatively higher than the input throughput of the appliance.
  [From Build 50.31]
  [# NSHELP-5261, BUG0714250]

Licensing

• When the connection between a Citrix ADC appliance (MPX, SDX, or VPX) and the Citrix ADC Citrix ADM licensing server is lost, the Citrix ADC appliance revokes the licensing capacity immediately. As a result, the throughput drops.

  After the connection with the Citrix ADM licensing server is established, you must manually reconfigure the license to restore.
  [From Build 49.37]
  [# NSHELP-4804]

• When the connection between a Citrix ADC appliance (MPX, SDX, or VPX) and the Citrix ADC Citrix ADM licensing server is lost, the Citrix ADC appliance revokes the licensing capacity immediately. As a result, the throughput drops.

  After the connection with the Citrix ADM licensing server is established, you must manually reconfigure the license to restore.
  [From Build 50.31]
  [# NSHELP-4804, TSK0712434]

Load Balancing

• A Citrix ADC appliance crashes if you add a Rate-Limiting expression to a DNS responder policy.
  [From Build 49.37]
  [# NSHELP-3884]

• Traffic disruptions might occur if the encoded redirect URL is greater than 2048 bytes.
  [From Build 49.37]
  [# NSHELP-9843]

• If the REGISTER request processing for a specific service fails during the Session Initiation Protocol (SIP) call, the memory usage of the Citrix ADC appliance starts building up.
  [From Build 49.37]
  [# NSHELP-4147]

• The “Operation not permitted” error appears when you try to execute the set operation on domain name based service group member.
  [From Build 49.37]
  [# NSHELP-18134]

• After an upgrade to 12.1 build 51.x from any 12.1 previous build and after the appliance is rebooted, the argument -vlan is not applicable in the static subscriber profile commands.

  As a result, you must execute the add, remove, show subscriber profile commands without the argument "-vlan."

  Example commands:

  - Adding subscriber with IP address 1.1.1.1 and VLAN 22: add subscriber profile 1.1.1.1 22

  - Adding subscriber with IP address 1.1.1.1 and no defined VLAN: add subscriber profile 1.1.1.1

  - Removing subscriber with IP address 1.1.1.1 and no defined VLAN: rm subscriber profile 1.1.1.1

  If your running configuration includes subscriber profile commands with the "-vlan," argument, after the upgrade, you must define these subscriber profiles according to the new format.
  [From Build 51.19]
  [# NSBASE-6561]

• If a wildcard TCP-based virtual server is moved to a wildcard HTTP-based virtual server or vice versa, there might be a possibility of linking TCP and HTTP sessions resulting in an unexpected behavior.
  [From Build 50.31]
  [# NSHELP-10014]

• Memory can build up on a Citrix ADC appliance, if the following conditions are met:

  - You have added a UDP nameserver (but no TCP nameserver).

  - You have configured a DNS autoscale servicegroup.

  - The truncated bit is set in the DNS response.

  Because the truncated bit and there is no TCP nameserver configured, the DNS resolution is tried over UDP and some memory is allocated for each IP address sent as part of UDP responses. The cycle continues and results in memory buildup.
  [From Build 50.31]
  [# NSHELP-10053]

• In a rare case, a Citrix ADC appliance might fail if the following conditions are observed:

  - Health monitor is set to OFF for a DBS service or a service group.

  - A DBS IPv6 server is bound to the DBS service or a service group for which health monitor is set to OFF.

  - SourceIP, SSL session ID, or rule based persistence is configured on a load balancing virtual server bound to the DBS service or a service group for which health monitor is set to OFF.

  - Failover is executed or if secondary becomes primary.
  [From Build 51.19]
  [# NSHELP-10148]

• If the command for configuring load balancing virtual server with listen policy fails, the Citrix ADC appliance might stop responding while freeing the allocated memory.
  [From Build 51.19]
  [# NSHELP-10186]

• A Citrix ADC appliance might crash in the following case:

  A new HTTP request is received when changing the persistence type from COOKIEINSERT to other type.
  [From Build 50.31]
  [# NSHELP-10921]

• In a Citrix ADC GSLB parent-site topology setup, the appliance might crash, if the following conditions are observed:

  1. A child site has requested some information from a parent site because of site persistence.

  2. A client connection is terminated at the child site before the parent sends the response.

  3. An MEP connection is terminated after step 2.
  [From Build 50.31]
  [# NSHELP-18129]

• For a monitor bound to an SSL profile and certificate, the number of characters allowed in the monitor name is limited to 31.
  [From Build 51.19]
  [# NSHELP-18148]

• In a high availability setup, the running config displays unwanted port information for service group monitor bindings when you execute the show ns runningConfig command.

  This results in loss of service group monitor binding after a reboot or a failover. The service group member bindings are unaffected.
  [From Build 51.19]
  [# NSLB-4418]

NITRO

• System login API fails with "Invalid username or password" error if the login account password has ‘=‘ character.
  [From Build 50.31]
  [# NSHELP-4801, TSK0714487]

• Firing curl command "curl -u nsroot:nsroot http://<IP_Address>/nitro/v1/config/" causing httpd to crash.
  [From Build 50.31]
  [# NSUI-7739, BUG0714963]

Networking

• In some deployments, ICMP error packets, sourced from the NSIP address and destined to 127.0.0.2 address, might go in loops within the Citrix ADC appliance causing high CPU usage in the appliance.
  [From Build 49.37]
  [# NSHELP-167]

• In a high availability configuration in INC mode, dynamic routing parameters might not get set properly because of the conversion errors.
  [From Build 49.37]
  [# NSHELP-253]

• In a Citrix ADC appliance, BGP daemon fails when a routemap, which includes a 'match ip peer' command entry, is applied to the kernel routes.
  [From Build 49.37]
  [# NSHELP-224]

• In a cluster setup, a node has the following entities in the same traffic domain:

  - a VIP address and,

  - a load balancing virtual server with the same VIP address.

  When the traffic domain is removed, virtual server configuration is removed but the VIP address is not removed. The node crashes when it sends out a GARP message for this VIP address.
  [From Build 49.37]
  [# NSHELP-81, 711605]

• HTTPS access to a SNIP address in a traffic domain fails because the appliance performs port allocation in non-default traffic domain when accessing the NSIP address internally from underlying FreeBSD operating system.
  [From Build 49.37]
  [# NSHELP-83]

• BGP IPv6 address family configuration might not get saved in a cluster setup.
  [From Build 49.37]
  [# NSHELP-225]

• In a high availability setup, the Citrix ADC appliance does not send jumbo frames on interfaces that are Jumbo enabled. This issue cause the state of the LACP channels and interfaces to flap, which in turn results in repetitive HA failover in the setup.
  [From Build 50.31]
  [# NSHELP-16172]

• In a Citrix Gateway appliance, responder and rewrite policies bound to VPN virtual servers might not process the packets that matched the policy rules.
  [From Build 51.19]
  [# NSHELP-18311]

• In a Citrix Gateway appliance, responder and rewrite policies bound to VPN virtual servers might not process the packets that matched the policy rules.
  [From Build 50.31]
  [# NSHELP-18311]

• Enabling secure access (secureonly) to Citrix ADC GUI on the NSIP or SNIP addresses fails to disable HTTP (insecure) GUI access.
  [From Build 51.19]
  [# NSHELP-18353]

• Enabling secure access (secureonly) to Citrix ADC GUI on the NSIP or SNIP addresses fails to disable HTTP (insecure) GUI access.
  [From Build 50.31]
  [# NSHELP-18353]

• If a high availability setup is upgraded to release 12.1 build 51.16, the high availability nodes might not advertise OSPF VIP routes after a failover.
  [From Build 51.19]
  [# NSHELP-19056]

• In a high availability configuration in INC mode, dynamic routing parameters might not get set properly because of the conversion errors.
  [From Build 50.31]
  [# NSHELP-253, BUG0708496]

• If a Citrix ADC appliance has data sessions from a client, and if you add a virtual server with the same IP address as that of the client, flushing the client's sessions might result in the appliance to become unresponsive.
  [From Build 51.19]
  [# NSHELP-255]

• The Citrix ADC appliance might not remove monitors, which have a netprofile bound to a route, during a clear config extended+ operation. These monitors point to the associated netprofile, which was removed during the during a clear config extended+ operation, causing the Citrix ADC appliance to crash.
  [From Build 50.31]
  [# NSHELP-80, BUG0710015]

• In a cluster setup, a node has the following entities in the same traffic domain:

  - a VIP address and,

  - a load balancing virtual server with the same VIP address.

  When the traffic domain is removed, virtual server configuration is removed but the VIP address is not removed. The node crashes when it sends out a GARP message for this VIP address.
  [From Build 50.31]
  [# NSHELP-81, NSNET-553, TSK0710326]

• Trivial File Transfer Protocol (TFTP) might not work in Citrix VPX instances running on VMware ESX server with VMXNET3 network interfaces.
  [From Build 50.31]
  [# NSHELP-85, NSHELP-107, NSHELP-3633, NSHELP-452, TSK0711445]

• The Citrix ADC appliance might not completely remove the RNAT global configuration during a clear config operation.
  [From Build 50.31]
  [# NSHELP-86, TSK0712215]

• The appliance might fail in unbinding NAT rules, with 32-bit netmask, from a netprofile.
  [From Build 50.31]
  [# NSHELP-93, TSK0715128]

• A Citrix ADC appliance does not allow traffic domain configuration inside admin partition context.
  [From Build 50.31]
  [# NSNET-4562, BUG0647744]

Platform

• You might see a Tx stall issue on MPX platforms that contain Intel XL710 NICs.
  [From Build 50.31]
  [# NSHELP-14786]

• In some cases, packets can be corrupted on the MPX-26000-100G and MPX-26000T-100G appliances.
  [From Build 50.31]
  [# NSHELP-14823]

• You cannot configure two MPX 26xxx appliances in a high availability setup if you do not have the correct licenses for the two models.
  [From Build 51.19]
  [# NSHELP-14880]

• On some MPX 115xx, 11500, 17550, 17550T and T1100 appliances, the power supply labels on the back panel are reversed to what is shown in software.
  [From Build 51.19]
  [# NSPLAT-1639]

Policies

• An error is encountered when you convert a classic policy expression with domain option to advanced policy expression using NSPEPI tool.
  [From Build 49.37]
  [# NSHELP-467]

• In a cluster setup, if the same key has multiple values bound to a string-map, then output for “show policy stringmap <name>” command is different for CLIP and NSIP addresses.
  [From Build 51.19]
  [# NSHELP-15386, NSPOLICY-2002]

Rewrite

• Policy Bindings for LB VServer of types TCP, SIP UDP, MYSQL, MSSQL, ORACLE, NAT, DIAMETER, RADIUS, SIP TCP, DNS, and SSL do not contain the REQUEST or RESPONSE type within saved configuration. A workaround is to manually issue the bind command with proper REQUEST or RESPONSE binding type. Another workaround is to place the corrected bind commands in file /nsconfig/nsafter.sh. However, those commands need to be updated if any change is made to the policy bindings as well. Those commands must be removed once the system is upgraded to a build containing the fix.
  [From Build 50.31]
  [# NSHELP-471, TSK0715617]

SNMP

• When configuring entity-Down and entity-Up traps, the entity state alarms do not work as expected. This issue is observed if an extra suffix (_UP or _DOWN) is added to the entity name "varbind" for configuring the UP and DOWN traps.
  [From Build 50.31]
  [# NSHELP-16607]

• SNMP code was setting some device flags wrongly from the beginning, recent fixes from NS-aggregator exposed this gaps which turned into this problem scenario.
  [From Build 50.31]
  [# NSHELP-359, NSHELP-400, TSK0713612]

SSL

• A Citrix ADC MPX/SDX 14000 FIPS appliance becomes unresponsive if it receives a packet of size > 18 KB from the backend server.
  [From Build 49.37]
  [# NSHELP-14133]

• The symmetric operations fail because the SSL card becomes unresponsive.
  [From Build 49.37]
  [# NSHELP-14855, 709406, 708978, 708923, 711264, 711404, 712257]

• A Citrix ADC appliance might crash if an OCSP responder is configured with nonce disabled and the integrated caching feature is enabled so that OCSP objects are cached.
  [From Build 49.37]
  [# NSHELP-5093, 707452, 710458, 707610]

• The “No Certificates present in the certificate bundle file" error appears when you try to add a PFX file using the Citrix ADC GUI.
  [From Build 49.37]
  [# NSSSL-139]

• GSLB virtual servers are not accessible if you make any changes to the enabled default SSL profile.

  With this fix, any change to the SSL profile does not affect the state of the GSLB virtual servers.
  [From Build 49.37]
  [# NSHELP-5077, 710428]

• Ciphers bound to an SSL service group are not included in the running config if the following commands are run in a sequence:

  1. set ssl servicegroup <servicegroup name> -sslprofile <profile name>

  2. bind ssl servicegroup <servicegroup name> -ciphername <profile name>

  As a result, after you save the config and restart your appliance, the ciphers are not bound to the service group.

  With this fix, the commands are included in the running config. However, you must run the bind command once after upgrading your appliance to include the command in the running and saved configuration files.
  [From Build 49.37]
  [# NSHELP-5052]

• In rare cases, an attempt to install a new certificate on an MPX 9700/10500/12500/15500 appliance might fail with the “bad pkcs error” counter incremented if the private key “CRT Params” size is not equal to the maximum size allowed.
  [From Build 49.37]
  [# NSHELP-14157, 706981]

• ECC curve bindings to a DTLS virtual server are not saved in the configuration (ns.conf) after you enable the SSL default profile in the the global SSL parameter.
  [From Build 49.37]
  [# NSSSL-283]

• On a Citrix ADC VPX appliance, memory leak is observed when policy-based renegotiation happens.
  [From Build 50.31]
  [# NSHELP-13294, NSHELP-17903]

• You can directly upgrade from build 11.1-48.x or earlier to build 11.1-60.x and to build 12.1-50.x without losing the PFX certificate-key pairs.

  For earlier builds, you must upgrade incrementally as follows:

  11.1-48.10 --> 11.1-50.10 --> 11.1-59.10

  OR

  11.1-48.10 --> 11.1-50.10 --> 12.1-49.23
  [From Build 50.31]
  [# NSHELP-13337]

• In rare cases, an attempt to install a new certificate on an MPX 9700/10500/12500/15500 appliance might fail with the “bad pkcs error” counter incremented if the private key “CRT Params” size is not equal to the maximum size allowed.
  [From Build 50.31]
  [# NSHELP-14157]

• Memory allocation might fail leading to memory leak in a heavy traffic scenario.
  [From Build 50.31]
  [# NSHELP-14606]

• If the appliance receives the "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" cipher more than once in a client hello message, the message is no longer blocked. Earlier, such client hello messages were blocked.
  [From Build 51.19]
  [# NSHELP-18190, NSUAT-212]

• Ciphers bound to an SSL service group are not included in the running config if the following commands are run in a sequence:

  1. set ssl servicegroup <servicegroup name> -sslprofile <profile name>

  2. bind ssl servicegroup <servicegroup name> -ciphername <profile name>

  As a result, after you save the config and restart your appliance, the ciphers are not bound to the service group.

  With this fix, the commands are included in the running config. However, you must run the bind command once after upgrading your appliance to include the command in the running and saved configuration files.
  [From Build 50.31]
  [# NSHELP-5052, TSK0710573]

• In a cluster setup, cipher suites bound to a custom cipher group are lost from the CLIP node after you upgrade the setup.
  [From Build 50.31]
  [# NSHELP-5056, NSSSL-1679, BUG0707738]

• GSLB virtual servers are not accessible if you make any changes to the enabled default SSL profile.

  With this fix, any change to the SSL profile does not affect the state of the GSLB virtual servers.
  [From Build 50.31]
  [# NSHELP-5077, NSHELP-3801, TSK0710207]

• On an SDX 14000 FIPS appliance, the FIPS card resets if all of the following conditions are met:

  - You created a partition in release 11.x.

  - The partition name is greater than 12 characters.

  - You upgrade the appliance to release 12.x.
  [From Build 50.31]
  [# NSHELP-5101, BUG0714338]

• An application using the DTLS protocol might become unresponsive if one of the following conditions are met:

  - You bind an unsupported DTLS cipher to a virtual server.

  - You bind a cipher group that does not contain even one DTLS supported cipher to a virtual server.
  [From Build 51.19]
  [# NSHELP-8634]

• A memory leak is observed if all of the following conditions are met:

  - TLS 1.3 protocol and certificate-based client authentication are enabled on the same virtual server.

  - TLS 1.3 is negotiated for a connection.

  - Client sends a `CertificateVerify` message.
  [From Build 50.31]
  [# NSSSL-1152, BUG0715127]

• The server now aborts the handshake by sending a fatal 'inappropriate_fallback' alert if the following conditions are met:

  - Both TLSv1.2 and TLSv1.3 are enabled on an SSL virtual server

  - The client sends a TLSv1.2 ClientHello with TLS_FALLBACK_SCSV

  Earlier, the server proceeded with a TLSv1.2 handshake. This issue caused the maximum possible SSL Labs rating for a TLSv1.3 virtual server to drop from A+ to A, since the scanner detected that the server did not appear to support TLS_FALLBACK_SCSV in all cases.
  [From Build 50.31]
  [# NSSSL-1226, BUG0715561]

• If you configure an MPX/SDX 14000 FIPS appliance for the first time, the appliance restarts after you run the "reset fips" command.
  [From Build 50.31]
  [# NSSSL-2433, BUG0713370]

• ECC curve bindings to a DTLS virtual server are not saved in the configuration (ns.conf) after you enable the SSL default profile in the the global SSL parameter.
  [From Build 50.31]
  [# NSSSL-283, BUG0713913]

• The MPX 5900/8900/15000-50G/26100-100G (Intel Coleto SSL chip based) platforms might crash if you configure SSL3 or RC2 based ciphers. These platforms do not support hardware offload of these ciphers. As a result, these ciphers are processed in software causing the appliance to occasionally crash.
  [From Build 51.19]
  [# NSSSL-5813]

• You cannot remove an SSL log profile if it is attached to the SSL default profile and client authentication is enabled on the SSL default profile.
  [From Build 51.19]
  [# NSSSL-885]

• Key file installation fails if you are using the GUI to install the bundle containing the certificates and the key file.
  [From Build 51.19]
  [# NSUI-11392]

• The SSL parameters do no appear correctly in the service view.
  [From Build 51.19]
  [# NSUI-11414]

• The SSL parameters do no appear correctly in the service view.
  [From Build 50.31]
  [# NSUI-11414]

• Installing a certificate bundle from the GUI installs only the certificates and not the private key included in the bundle.
  [From Build 51.19]
  [# NSUI-7463]

System

• For HTTP 2 streams, the stat counters does not increment correctly. For example, when a new stream of data arrives, the counts fails to increment, but decrements correctly, when the stream is closed. This incorrect operation leads to a wrong count of action performed on the HTTP2 streams.
  [From Build 49.37]
  [# NSBASE-4196, 683374, 694695, 678994]

• A Citrix ADC appliance might crash if it sends messages from one processor to another processor, for deleting a steering session in some error cases.
  [From Build 49.37]
  [# NSHELP-10930]

• A Citrix ADC appliance crashes because of a timer issue. The issue occurs if the stats are collected after the SYSLOGUDP connection is deleted, but before the appliance deletes the SYSLOGUDP service.
  [From Build 49.37]
  [# NSHELP-5733]

• If you configure an HTTP type load balancing virtual server with HTTP/2 option enabled on the HTTP profile, the appliance fails to load balance gRPC traffic.
  [From Build 49.37]
  [# NSHELP-3501]

• If the trace aggregator processor leak opens a file descriptors every time you execute the nstrace command, the Citrix ADC appliance might display the following error message: "kern.maxfiles limit exceeded".
  [From Build 49.37]
  [# NSHELP-3520, 712687, 712970]

• A Citrix ADC appliance might crash if an external authentication server takes more than 20 seconds to respond.
  [From Build 49.37]
  [# NSHELP-12016]

• If flash cache option is enabled on a Citrix ADC appliance and also receives client requests to the same resource, the appliance resets the connection before it sends the response to the client.
  [From Build 49.37]
  [# NSHELP-3503]

• Market specific violation is caused, if you have CallHome enabled by default on a Citrix ADC 12.1 appliance. The feature should be configured as an user's opt-in feature.
  [From Build 49.37]
  [# NSCALLHOME-82]

• Service state synchronization is not happening in a cluster node deployment, if the following conditions are observed:

  - Cluster setup is upgraded from 11.1 builds.

  - Audit log action (SYSLOG or NSLOG) is configured with SYSLOG or NSLOG server's domain name.
  [From Build 50.31]
  [# CGOP-6813, BUG0711841]

• At a given time, you can configure the domain name of the server only for one SYSLOG action or NSLOG action. If you try to add another action (either an SYSLOG action or NSLOG action) with the server's domain name, the system displays an error message.

  Example:

  > add syslogaction act1 syslog.server.com -loglevel all

  Done

  > add nslogaction act2 nslog.server.com -loglevel all

  ERROR: Name conflicts with an existing service or service group member name

  > add syslogaction act3 syslog2.server.com -loglevel all

  ERROR: Name conflicts with an existing service or service group member name
  [From Build 50.31]
  [# CGOP-6838, BUG0715341]

• Market specific violation is caused, if you have CallHome enabled by default on a Citrix ADC 12.1 appliance. The feature should be configured as an user's opt-in feature.
  [From Build 51.19]
  [# NSCALLHOME-82]

• A weblogging client crashes, if a clustered setup on a VMware ESX platform with VMXNET3 interfaces encounters time synchronization issues.
  [From Build 50.31]
  [# NSHELP-10850]

• A Citrix ADC appliance crashes if invalid MP_JOIN options of MP_JOIN SYN packet are sent in an MP_CAPABLE subflow.
  [From Build 50.31]
  [# NSHELP-10986]

• When a client sends an HTTP2 request to a Citrix ADC appliance and if the MSS value is lesser than the response generated by the appliance, an internal parsing issue occurs.
  [From Build 50.31]
  [# NSHELP-11542]

• A Citrix ADC appliance might crash if several memory dumps are generated on the appliance. This occurs when you upgrade the appliance from version 12.0 build 58.15 to version 12.0 build 57.11.
  [From Build 51.19]
  [# NSHELP-11554]

• A Citrix ADC appliance might crash if you observe the following conditions:

  - Fail to respond to the client with reset stream.

  - Drop request body when more packets arrive from the client.
  [From Build 51.19]
  [# NSHELP-11614]

• The timezone is inconsistent in Citrix ADC GUI and CLI.
  [From Build 51.19]
  [# NSHELP-11971]

• If the “Stale Cache Group Table” devices reside in the SNMP AVL tree, the SNMP walk operation fails. As a result, the SNMP walk operation does not return an error message for the subsequent SNMP table counters.
  [From Build 50.31]
  [# NSHELP-15094]

• In a Citrix ADC appliance, an issue occurs when both classic auditlog policy and advanced authentication policy are globally bound to the system. As a result, the "bind system global" command is not applied successfully and if either of the following conditions is observed:

  - If you upgrade the appliance.

  - If a secondary node is added to a high availability setup.
  [From Build 51.19]
  [# NSHELP-18119]

• In a Citrix ADC appliance, an issue occurs when a Classic auditlog policy and an Advanced authentication policy are globally bound to the system. As a result, the "bind system global" command is not applied successfully and if any of the following conditions are observed:

  - If you upgrade the appliance.

  - If a secondary node is added to a high availability setup.
  [From Build 51.19]
  [# NSHELP-18127]

• When you enable the Strong Password option in the system parameters, the appliance does not allow you to set the encryption key and hmac key.
  [From Build 51.19]
  [# NSHELP-18182]

• If flash cache option is enabled on a Citrix ADC appliance and also receives client requests to the same resource, the appliance resets the connection before it sends the response to the client.
  [From Build 50.31]
  [# NSHELP-3503, TSK0711508]

• The "sh audit messages" command does not display log messages in the following case:

  If you configure the log facility parameter with a value other than LOCAL0 in the "syslogparams" or "syslogaction" command.
  [From Build 50.31]
  [# NSHELP-5736, TSK0709464]

• A Citrix ADC appliance might crash if the following two conditions are observed:

  - An auditlog SYSLOG policy is bound to an authentication virtual server.

  - An internal issue is observed in the auditlog module.
  [From Build 51.19]
  [# NSHELP-6906]

• In a high availability setup, when the secondary node becomes the primary node, the BGP route update might fail on the new primary node because of a TCP timestamp overflow.
  [From Build 50.31]
  [# NSHELP-8844]

• gPRC transactions fail under the following conditions:

  - If the initial client request goes to an HTTP/2 enabled virtual server and service but a response is not received.

  - If the server sends a trailer header with multiple header entries.
  [From Build 50.31]
  [# NSHELP-9308]

• In a clustered setup, a latency issue is observed, if:

  - Client reuses the TCP port number to send requests

  - Citrix ADC appliance takes a longer time to respond.
  [From Build 51.19]
  [# NSHELP-9497]

TCP

• During a TCP handshake, if the server responds with a TCP window size of 0 bytes, the appliance keeps the connection in TCP persist mode. Later, if the server opens the TCP window, the connection remains in persist mode and is not removed. As a result, the persist and keep-alive lists get mixed up and the appliance crashes when it tries to free the connection.
  [From Build 50.31]
  [# NSHELP-5706, TSK0711131]

Telco GUI

• The libqos actions are displayed in the QOS action page of the Citrix ADC T-series platform GUI.
  [From Build 49.37]
  [# NSUI-6339]

Telco Networking

• The data connection to the back-end server uses the client IP if the following conditions are met:

  - Global use source IP (USIP) is enabled.

  - Origin USIP on cache redirection (CR) virtual server is disabled.
  [From Build 50.31]
  [# NSNET-4155, BUG0627692]

Telco Traffic Management

• GUI settings are missing in the Traffic Management page of the Citrix ADC T-series platform i.e the following ones:

  - Cache redirection

  - Subscriber

  - Service chaining

  - User

  As a workaround, one can visit Citrix ADM and configure a configuration job to run the relevant commands for the missing configuration. Please refer to the citrix documentation for exact details.
  [From Build 49.37]
  [# NSUI-7265]

• GUI settings are missing in the Traffic Management page of the Citrix ADC T-series platform i.e the following ones:

  - Cache redirection

  - Subscriber

  - Service chaining

  - User

  As a workaround, one can visit Citrix ADM and configure a configuration job to run the relevant commands for the missing configuration. Please refer to the citrix documentation for exact details.
  [From Build 50.31]
  [# NSUI-7265, BUG0712839]

Telco Video Optimization

• Memory leak is observed in the SSL detected domain extraction algorithm. The issue occurs if the SSL detected domain is extracted by the server certificate. The memory leak eventually causes the Citrix ADC appliance to become unresponsive.
  [From Build 50.31]
  [# NSHELP-5780, NSHELP-5787, BUG0714470]

• The Citrix ADC appliance might crash when it runs body detection algorithm on chunked content. This issue is fixed now. As part of the fix, boundary checks were added.
  [From Build 50.31]
  [# NSVIDEOOPT-167, BUG0714058]

URL Categorization

• If you execute the command "show urlset <urlset_name>", the Citrix ADC appliance returns information for the requested urlset and any other urlsets added after it.
  [From Build 49.37]
  [# NSSWG-615]

• When a cloud categorization lookup failure is observed, a Citrix ADC appliance displays a generic error for level 4 logs.
  [From Build 51.19]
  [# NSSWG-397]

URL Filtering

• During long policy evaluation, a Citrix ADC appliance might crash when obfuscating URL filtering domain. The issue occurs when a TCP connection is closed.
  [From Build 51.19]
  [# NSHELP-18365, NSSWG-538]

• The “show urlset” command displays only url sets that are imported and not that are added
  [From Build 50.31]
  [# NSSWG-670, NSSWG-747, NSSWG-788, BUG0667361]

Video Optimization

• The Citrix ADC TCP/IP processing module (also known as, Packet Processing Engine (PPE)) crashes when a TCP connection attached to a non-master TCP processing module stays open for more than 3,276 seconds.
  [From Build 51.19]
  [# NSHELP-8799]

• In a corner case, a Citrix ADC appliance reboots when an internal function performs Server Name Indication (SNI) extraction from server certificate. This happens because server side certificate is invalid with a zero-length DNS name.
  [From Build 51.19]
  [# NSHELP-8803]

• The Video Optimization burst period implementation is not working properly in a Citrix ADC appliance.
  [From Build 51.19]
  [# NSVIDEOOPT-215]

• The ABR video detection algorithm is unable to detect videos from xvideos.com domain (vid-egc.xvideos-cdn.com)
  [From Build 51.19]
  [# NSVIDEOOPT-424]

• When handling QUIC ABR video traffic, a Citrix ADC appliance might crash during a video optimization policy evaluation.
  [From Build 51.19]
  [# NSVIDEOOPT-649, NSHELP-5781]

• During video optimization, buffering occurs because of a conflict between the Nile congestion handler and the pacing scheduler.
  [From Build 51.19]
  [# NSVIDEOOPT-758]

• The Application Flags field in AppFlow records are not correctly populated for video-paced connections. As a result, the ADM TCP Insight reports for Download Speed might display lower values. Also, external AppFlow consumers always report connections as unoptimized.
  [From Build 51.19]
  [# NSVIDEOOPT-771]

Web App Firewall

• A Citrix ADC appliance crashes when it attempts to access the return address of a stack frame which is not present in an XML payload.
  [From Build 49.37]
  [# NSWAF-112, 712938, 714297]

• In a content switching deployment, the load balancing virtual server details are not captured in the AppFlow records. As a result, the Security Insight reports are generated at the content switching virtual server level and not at the load balancing virtual server level.
  [From Build 50.31]
  [# NSHELP-17152]

• In a cluster setup, when you deploy a Learned Rule for HTML Cross-Site Scripting check, the Citrix ADC appliance displays an error, "The CrossSiteScripting Check is already in use".
  [From Build 50.31]
  [# NSHELP-18085]

• The Web App Firewall profile import fails under the following conditions:

  - The WSDL file is configured in the XML message validation check under Relaxation Rules, and

  - The end-point check is set as RELATIVE.
  [From Build 50.31]
  [# NSHELP-2876, TSK0713580]

• A Citrix ADC appliance crashes when it attempts to access the return address of a stack frame which is not present in an XML payload.
  [From Build 50.31]
  [# NSWAF-112, NSHELP-2757, NSHELP-2762, BUG0703461]

Web Citrix Web App Firewall

• Memory leak is observed in a Citrix ADC appliance, if the Integrated Cache and the Web Citrix Web App Firewall features are enabled.
  [From Build 50.31]
  [# NSHELP-17969, NSHELP-17158]

Release history