NetScaler® Console service

NetScaler agent behavior

September 10, 2025

Contributed by:

Important:

File-based licensing system (also referred to as manually managed entitlements), traditionally used for activating various on-premises components, will be End of Life (EOL) on April 15, 2026. License Activation Service (LAS) is the next generation technology for product activations across the suite of Citrix products. LAS will be the only way to activate and license NetScaler instances after April 15, 2026, supporting NetScaler Flexed licenses (CPL/UHMC), legacy NetScaler Pooled licenses, and NetScaler Fixed term Bandwidth licenses. To remain supported, your NetScaler and NetScaler Console deployments must be on a LAS compatible version.

The minimum required NetScaler versions that are LAS compatible are:

NetScaler ADCs: 14.1-51.x, 13.1-60.x, 13.1-37.x (FIPS)

NetScaler SVM: 14.1-51.x, 13.1-60.x

NetScaler Console Service: Supported from early September 2025.

All the other forms of legacy NetScaler licenses such as Pooled vCPU, CICO, perpetual will not be supported with LAS. NetScaler instances leveraging perpetual licenses without an active maintenance will become unlicensed upon upgrade to the above mentioned software versions.

LAS based licenses may not be available to customers where prohibited by law or regulations.

If you have questions or concerns, contact Customer Care. Citrix may limit or suspend your Citrix Maintenance for non-compliance with these requirements without liability in addition to any other remedies Citrix may have at law or equity. These requirements don’t apply where prohibited by law or regulation.

The NetScaler agent works as an intermediary between NetScaler Console and the discovered instances across different data centers and public clouds. NetScaler Console service requires a minimum of one agent per tenant for Flexed or Pooled licensing to work. Multiple NetScaler agents can be deployed per site or multi-site, but only one agent can have the License Server Agent (LSA) role for the entire tenant deployment.

LAS-based licensing

When using LAS-based licensing, a built-in agent within NetScaler handles license communication. An external agent is an optional component that you can deploy within your architecture to serve as a proxy for licensing communication.

To configure the NetScaler built-in agent for LAS, see Configure the built-in agent to manage instances.

To enable agent failover, configure the agent cluster support feature. For more information, see Configure agent cluster support.

Note:

If you are using a built-in agent, you can only transition to LAS-based licensing through the NetScaler Console GUI.

Manually managed entitlement (file-based licensing)

An LSA is an agent that works as a license server in NetScaler Console service based pooled licensing deployment. If the LSA goes down, the service waits for 24 hours to elect a new LSA.

Until then, the NetScaler instances using pooled or flexed license go in grace period. As an administrator, you can also manually elect an LSA.

The following example shows two agents deployed and one of them has the LSA role:

Agent designated as LSA

The following sections are applicable for manually managed entitlement (file-based licensing).

Manually select a NetScaler Console agent as LSA

Admins can manually select a NetScaler Console agent as the LSA for NetScaler Pooled licensing or NetScaler Flexed licensing. When the LSA is down, the NetScaler Console service waits for 24 hours before auto-electing the next LSA. The admin can manually elect the new LSA in the interim by using this feature. However, the admin must ensure that the status of the new LSA being elected is UP and its diagnostic status is OK.

When the admin manually selects a new LSA, it might take up to 5 minutes for the licensing functionality to work correctly. During this time, the NetScaler instances are in grace and any fresh checkout for a license fails.

To select an LSA:

Navigate to Infrastructure > Instances Dashboard > Agents and select an agent.
In the Select Action list, select Set as LSA.
Click Yes to confirm. The selected agent assumes the LSA role.

Multiple NetScaler agents behavior

In a deployment with a combination of multiple agents and multiple sites, the NetScaler agents follow the client/server architecture.

The first or oldest agent registered in an UP state is assigned the LSA role. Any other agents added later act as a proxy and communicate with the agent hosting the main LSA role for license allocation. Each agent hosting the proxy role communicates to the agent with the current LSA role through the NetScaler Console service.

Note:

There is no direct communication between the agent holding the LSA role and the other (non-LSA) agents. All the connections go through the NetScaler Console service only.

NetScaler agent failover behavior

The agent failover works in a multi-agent deployment in the following way.

Assume that there are two agents, AG1 and AG2, in the same data center.

AG1 is configured to use ADC11, ADC12, ADC13 as the remote license host or LSA.
AG2 is configured to use ADC21, ADC22, ADC23 as the remote license host or LSA.
AG2 is acting as the license server.
- If AG1 fails, ADC11, ADC12, and ADC13 automatically connect through AG2 for license reconciliation.
  - ADC11, ADC12, and ADC13 might still notice a small period of grace if a few heartbeats are missed, while this reconnection happens.
- If AG2 fails, all ADCs continue to stay in grace until:
  - Either AG2 comes back up/is brought back up, or AG1 is selected as the new LSA either automatically after 24 hours by NetScaler Console service or manually by admin.
  - Or AG2 is deleted from the NetScaler Console service. Once deregistered, the NetScaler Console service designates AG1 as the agent with the LSA role.
  - After the election has completed, AG1 starts allocating and reconciling resources to the configured instances.

For questions related to LSA, see FAQs on License Server Agent.

Configure license server through NetScaler built-in agent

If you have a License Server Agent (LSA) configured in one site and want to use the same LSA from other sites, you can use a NetScaler built-in agent. While using the built-in agent, you must configure the license server using the following command on the NetScaler instance.

add licenseserver 127.0.0.1 -port 27000

In this configuration, NetScaler can reach the License Server Agent (LSA) through Console service.

Note:

NetScaler built-in agent cannot be assigned the LSA role.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NetScaler Secure Deployment Guide

NetScaler agent behavior

September 10, 2025

Contributed by:

September 10, 2025

Contributed by:

NetScaler agent behavior

LAS-based licensing

Manually managed entitlement (file-based licensing)

Manually select a NetScaler Console agent as LSA

Multiple NetScaler agents behavior

NetScaler agent failover behavior

Configure license server through NetScaler built-in agent

In this article