Citrix SD-WAN

Release Notes for Citrix SD-WAN 11.4.1 Release

This release notes document describes the enhancements and changes, fixed and known issues that exist for the Citrix SD-WAN release 11.4.1.


This release notes document does not include security related fixes. For a list of security related fixes and advisories, see the Citrix security bulletin.

What’s New

The enhancements and changes that are available in release 11.4.1.

Configuration and Management

DHCP server

One Relay Agent is spawned per Virtual Interface and a total of 16 DHCP servers can be configured per Relay Agent. A maximum of 16 Relay Agents can be configured on a site.

[ NSSDW-34083 ]

Host name used as Option 12 in DHCP client messages

From Citrix SD-WAN release 11.4.1 onwards, the host name is the same as the site name. When the management interface is acting as the DHCP client, the host name is used in DHCP client messages as option 12. From Citrix SD-WAN release 11.2.3 onwards and up to release 11.4.1, the host name was set as sdwan.

[ NSSDW-32523 ]

Platform and systems

AT commands

Citrix SD-WAN platform models that support LTE support running AT commands. AT commands help in monitoring and troubleshooting LTE modem configuration and status.

[ NSSDW-35671 ]

Accessing the shell command

You can run the shell command directly, on an SD-WAN CLI console, without being prompted for the login credentials of the CBVWSSH static account. This feature enhances the security of your SD-WAN appliance as it removes the hard coded password of the CBVWSSH account and replaces it using a more secure method. This feature is supported only for Admin account users.

[ NSSDW-34942 ]

Reference material - application signature library

The DPI application signature library has been updated.

[ NSSDW-34527 ]

Fixed Issues

The issues that are addressed in release 11.4.1.

Configuration and Management

In Citrix SD-WAN Center, reporting APIs for paths and virtual paths fail when all attributes are fetched and the selected time interval is greater than one hour.

[ SDWANHELP-2231 ]

In some rare scenarios, Citrix SD-WAN appliances might lose management access due to an internal process issue.

[ SDWANHELP-2179 ]

On cloning a site with an LTE interface, the UI mandates to enter the static IP address for the LTE WAN Link Access Interface. Upon auditing, the configuration is considered incorrect and the following audit errors are displayed:

EC601, EC343, and EC346

[ SDWANHELP-2177 ]

After every configuration export from Citrix SD-WAN Center, the temporary files in the tmpfolder were not getting cleaned up.

[ SDWANHELP-2057 ]

Citrix SD-WAN UI does not display the path configuration completely under Configuration > Virtual WAN > View Configuration > Paths. Only some paths are displayed and the others are hidden.

[ SDWANHELP-2050 ]

When TCP options are added in an HDX setup having AppFlow enabled, TCP connection does not get established.

[ SDWANHELP-1741 ]

When the appliance management port is configured with DHCPv4, switching to a static IPv4 address fails.

[ NSSDW-35630 ]

The issue occurs when the user has disabled the modem and wants to re-enable it before the Operating Mode has switched to Lower Power. The fix is to warn the user and show the current Operating Mode before performing the enable/disable operation.

[ NSSDW-25067 ]

Install and upgrade

When MPLS WAN links are configured to use a WAN link template and enabled for the Intranet/Internet service, an unexpected audit error EC14203 occurs while compiling the configuration.

Citrix SD-WAN 11.3.1 and older releases might not throw an error when the WAN link permitted rates are set to a value lower than the minimum reserved bandwidth required for all services using the WAN link while configuring MPLS WAN Links with WAN link templates. When upgraded to Citrix SD-WAN 11.3.2 or later releases, the error is displayed. Set the correct WAN link permitted rates and activate the configuration before performing the upgrade.

[ SDWANHELP-2134 ]


Citrix SD-WAN Center monitoring REST API does not work when WAN link statistics are queried.

[ SDWANHELP-2274 ]

When a new configuration is imported in Citrix SD-WAN Center, the Zscaler configuration does not get imported.

[ SDWANHELP-2137 ]

When the internal license of Edge Security antivirus and anti-malware components expires, Citrix SD-WAN stops detecting the virus and malware.

[ NSSDW-35596 ]


When a GRE flow has an IPv4 Source IP address and an IPv6 Destination IP address, the IPv4 GRE tunnel traffic can get misclassified as an IPv6 tunnel under the Monitoring > Flows and get blocked.

[ SDWANHELP-2214 ]

After upgrading to Citrix SD-WAN 11.3.1, MSS (Maximum Segment Size) clamping fails with PPPoE when the Maximum Transmission Unit (MTU) size is set to 1492 bytes.

[ SDWANHELP-2048 ]

Frequent route table changes in an SD-WAN site along with configuration update or dynamic routes purge might cause route synchronization issues in the remote site.

[ SDWANHELP-2043 ]

The WAN link path state transitions to DEAD when a Citrix SD-WAN appliance fails to detect a new port.

[ SDWANHELP-1998 ]

In rare cases, when there is a route change in the routing table, the Citrix SD-WAN service gets reloaded.

[ NSSDW-36289 ]

When CRL processing is enabled, a memory issue in the third-party cryptography library can cause a core dump.

[ NSSDW-35679 ]

When the Citrix SD-WAN configuration with summary routes is loaded, the appliance might reload continuously.

[ NSSDW-34670 ]

In the following scenarios, when a static virtual path between two sites is removed, the routes learned over the deleted static virtual paths are not removed:

  • Static virtual path is removed as part of a configuration change.
  • When a new Geo-MCN is made a client, the static virtual paths between the old Geo MCN and branches are removed.

[ NSSDW-34655 ]

Platform and systems

Citrix Virtual WAN service might restart when the STS bundle is generated while the Dynamic Virtual Paths (DVPs) are up.

[ SDWANHELP-2123 ]

When a Citrix SD-WAN 4000 appliance is upgraded to 11.3.0, 11.3.1, or 11.4.0, the SD-WAN service might fail due to race condition.

[ SDWANHELP-2106 ]

The System Status section on the Legacy UI dashboard displays the following error message when the site name contains the Done string.

Unable to obtain system data because the system is busy. Click Refresh to retry.

[ SDWANHELP-2098 ]

A filter policy rule validation is performed during config update to distinguish between newly created vs modified rules. Due to a missing comparison check for match_type, most of the connections to the internet are being blocked by the firewall as O_DENIED.

[ SDWANHELP-2078 ]

When real time statistics for application routes are fetched either from the SD-WAN Orchestrator or from the SD-WAN Branch device, the device loses connectivity and crash is observed. This happens only when the number of application routes is more than 16 (including auto-generated application routes).

[ SDWANHELP-2066 ]

Known Issues

The issues that exist in release 11.4.1.

Configuration and Management

The option to toggle the columns displayed under the Monitoring > Flows page is not functioning as expected. Despite selecting or filtering the columns, the following message is displayed:

Please select at least one column.

[ SDWANHELP-2272 ]


Zscaler configuration change management process has a timeout period of two hours. When there is a configuration error, the entire process stalls for two hours.

[ SDWANHELP-2249 ]

WPA3 failed authentications are not reported under site-level alerts.

[ NSSDW-32053 ]


In rare conditions, if a branch site has one of the WAN links with a static public IP address, then the formation of the dynamic virtual path fails.

Workaround: Restart the Virtual WAN Service at the branch site with the static Public IP address.

[ NSSDW-36429 ]

In the Citrix SD-WAN BGP configuration, when the router ID for a routing domain is changed, the SD-WAN dynamic routing protocol might restart.

[ NSSDW-35657 ]

A configuration change made to a firewall dynamic NAT policy or a port forwarding rule might result in a core dump.

[ NSSDW-34603 ]

Platform and systems

LTE modem reboots continuously when the QMI proxy process stays in a defunct state.

Workaround: Reboot the appliance.

[ SDWANHELP-2270 ]

Release Notes for Citrix SD-WAN 11.4.1 Release