NetScaler MPX 9200 FIPS

Welcome to the next-generation NetScaler MPX 9200 FIPS platform. This section provides comprehensive instructions on how to deploy your appliance efficiently and configure it for optimal performance.

The MPX 9200 FIPS is a 1U FIPS 140-3 Level 2 application delivery platform. It represents the latest advancement in NetScaler technology, featuring enhanced processing power, improved connectivity options, and robust management capabilities.

Note:

For certification information and FIPS-specific software information, see MPX FIPS appliances.

Key specifications

• Processor: Intel Xeon 5th-generation processor architecture

• Memory: 128 GB DDR5 ECC RDIMM memory for enhanced performance

• Data ports: Dual 4 x 50G high-speed ports with PCIe 4.0 support

• Power: Redundant CRPS power supplies for high availability

• Management: Dedicated BMC with IPMI 2.0 and Redfish for full out-of-band control

• Security: FIPS 140-3 Level 2 compliance with tamper-evident seals on the chassis

Prepare for installation

Carefully inspect your shipment to ensure that all components are present and undamaged. The following items are included with your NetScaler 1U appliance:

Before installing your new appliance, carefully unpack the unit and verify that all the components are present. The only tools required for installing the appliance are a Phillips screwdriver, a flathead screwdriver, and a cage nut insertion tool (if installing into square-hole racks). Your NetScaler 1U package should include the following items:

Hardware components:

• 1x NetScaler MPX 9200 FIPS appliance, with the front ear and handle assemblies pre-installed on the chassis
• 1x standard 4-post rail kit (19-inch rack compatible), which includes:
  • Left rail (x1)
  • Right rail (x1)
  • Mounting screw kit (includes M4x4L, M4x6L, and M5x20L screws)

The included accessory kit contains essential connectivity hardware, including two power cords to support redundant power supply operation.

Notes:

• Rail kit compatibility varies by rack manufacturer and configuration. If the provided rail kit does not fit your specific rack infrastructure, contact your NetScaler sales representative immediately to obtain an appropriate alternative mounting solution.

• Before proceeding, examine all components for shipping damage. Report any damaged items to your carrier and NetScaler support before beginning the installation process.

Infrastructure requirements

• Compatible 19-inch rack with adequate depth clearance (minimum 550 mm)

• Proper airflow management with front-to-rear cooling path

• Available rack units (1U height requirement)

• Adequate weight support (system weight: 25.2 lbs)

Network infrastructure:

• Administrative LAN with available switch ports

• Dedicated out-of-band management network

• Appropriate network cables (Cat5e/Cat6 for management, fiber/DAC for data)

• A 50 GbE capable switch for the SFP56 data ports

Power requirements:

• Dual power sources (recommended for redundancy)
• Frequency operating range: 47 Hz – 63 Hz
• Adequate power capacity (full load 110 V: 406 W/240 V: 394.57 W)
• PSU input connector: IEC320-C14 (Male)
• Required power cord: IEC320-C13 to NEMA 5-15P (or regional equivalent)
• Rating: Minimum 10 A / 250 V

Detailed AC input voltage specifications:

Maximum input current requirements:

Management station requirements

• Workstation or laptop (Windows or macOS) with network connectivity

• Web browser with JavaScript and HTML5 support (Chrome, Firefox, Safari, or Edge)

• Terminal emulator software for CLI access

• Administrative privileges for network configuration

Hardware platform

The MPX 9200 FIPS integrates management, console, and high-speed data interfaces on the front panel, and power, cooling, and identification components on the rear panel. Identify each component before you cable the appliance.

Front panel components

The front panel groups the console and management ports, the storage bay, the data ports, and the FIPS tamper seals.

The following figure shows the front panel of the MPX 9200 FIPS appliance.

Rear panel components

The rear panel houses dual CRPS power supplies, the cooling fans, the rear UID LED, the PSU alarm-mute button, and the rear power button.

The following figure shows the back panel of the MPX 9200 FIPS appliance.

Note:

FIPS 140-3 Level 2 tamper evidence. Tamper-evident seals are applied across the top cover at the front and rear of the chassis (spanning fans 1–5). The seals form the physical security boundary. Inspect them on receipt and periodically during operation. If any seal is cut, lifted, or missing, treat the unit as potentially compromised and contact NetScaler Support. Confirm the seal count and placement against the platform Security Policy.

Install the hardware

Rack-mount the appliance

Install the appliance into a 19-inch rack in four stages: attach the inner rails, install the outer rails, mount the appliance, and secure it to the rack. The left and right rails are symmetrical. Repeat each rail step on both sides.

Note:

The front ears are pre-installed. The modified handle is set inward from the mounting flange, exposing the M5 rack-mount hole in the ear. The ear and handle assemblies are shipped pre-installed on the chassis, and the packing foam is shaped to hold them in place. You do not attach the ears during installation. Do not remove them.

Attach the inner slide rails

1. Pull the white disconnect tab to release and detach the inner rail member from each slide rail.

2. With the stamped text facing outward, align the inner rail with the chassis mount points, using the black reference markers on both sides of the chassis.

3. Slide the rail toward the rear until it clicks firmly into the locked position.

4. Fasten each inner rail using the provided M4x4L screws, as shown in the diagram.

5. Repeat this process for both the left and right sides of the chassis.

Install the outer slide rails

1. Hold the outer rail assembly against the rack frame.
2. Align the mounting brackets with the rack post holes at the selected U-height.
3. Insert the rail mounting mechanism into the rack posts until it engages.
4. Listen for an audible “click” to confirm that the rail is properly seated and locked.
5. Ensure both the front and rear mounting points are securely attached to the posts.
6. Verify that the rails are level and parallel using the numbered rack post markings.
7. Repeat this process for both the left and right outer rail assemblies.

Mount the unit onto the rails

1. Carefully align the chassis-mounted inner rails with the rack-mounted outer rails.
2. Smoothly slide the system into the rack until the locking mechanism engages.
3. If necessary, apply light, even pressure to ensure the unit locks securely into place.

Step 4: Secure the appliance to the rack

1. Slide the appliance fully into the rack until the front ears are flush against the rack posts.
2. Align the mounting holes in the front ears with the corresponding holes in the rack posts.
3. Insert a standard M5 rack screw through each ear and into the rack post.
4. Tighten the screws evenly to secure the appliance to the rack. Do not overtighten.

Note: Front ears secured to the rack posts. The red arrows mark the M5 rack-mount holes on the left and right ears.

1. Verify that the appliance is level and securely fastened to the rack.

Safety considerations

For safety and equipment durability, ensure that the following requirements are met:

1. Maintain a minimum of 2 inches of clearance at the front and rear of the chassis to ensure proper ventilation.

2. Verify the rack’s weight capacity before installation and ensure that the rack is stable and properly secured to the floor.

3. Use proper lifting techniques. The system weight is approximately 25.2 lbs.

4. Strictly follow electrical safety procedures when connecting the appliance to a power source.

Note:

The MPX-9200-FIPS 1U platform requires unobstructed front-to-rear airflow for optimal cooling. Restricted airflow results in overheating and trigger system protection mechanisms.

Network and power connections

Connection sequence

Follow this specific connection order to ensure proper system initialization and to avoid configuration conflicts.

1. Management network connectivity

   1. Connect the MGMT 0/1 port to your administrative LAN, using Cat5e/Cat6.

   2. Verify that the network switch port configuration supports auto-negotiation.

   3. Confirm network connectivity and VLAN configuration, if applicable.

   4. Document the assigned IP address and network parameters.

2. Out-of-band management setup

   1. Connect the LOM port to a dedicated OOB management network.

   2. Use network infrastructure that is separate from production traffic.

   3. Leave the LOM port in dedicated mode operation (factory default).

3. Data port configuration

   1. Install SFP56 (or compatible SFP28/SFP+) transceiver modules in data ports 50/1–50/8.

   2. Match each transceiver type to the switch port capability. Use NetScaler-qualified transceiver MPNs for guaranteed interoperability.

   3. Connect the fiber or DAC cables to the data ports as required.

   4. Confirm that the cable rating matches the 50GbE port speed.

4. Power system connection

   1. Connect the first power cord to the PSU1 input receptacle.

   2. Connect the second power cord to the PSU2 input receptacle.

   3. Use independent AC feeds where possible for N+1 redundancy.

   4. Verify that the input voltage is 100–240 VAC, 50–60 Hz, before applying power.

5. System startup

   1. Press the front-panel PWR button to initiate the boot sequence.

   2. Observe the front-panel LEDs. The PWR LED must illuminate solid green.

   3. Verify that both PSU LEDs are solid green within 10 seconds of power-on.

   4. Allow the full boot cycle to complete (about 4–5 minutes) before accessing the system.

Note:

Use NetScaler-qualified transceiver and cable part numbers for guaranteed interoperability and support coverage.

Power supply status indicators

The CRPS power supplies provide comprehensive status information through integrated LED indicators located on each power supply faceplate.

System access and configuration

Configure the appliance through the NetScaler GUI or the CLI. Both methods provide full access to the initial setup. Use the default addresses and credentials below for first access, and then change them during setup.

Note:

The default password is the device serial number. Enter it exactly as printed on the chassis label. All credentials are case-sensitive. Change the default password during the initial setup.

Console connection setup by using the GUI

The web management interface provides complete configuration through a browser. The appliance is managed through the MGMT 0/1 port at the default NSIP.

1. Network preparation

   1. Connect the management workstation to the MGMT 0/1 port or to the same VLAN.

   2. Set a static IP on the workstation in the 192.168.100.X/16 range (for example, 192.168.100.50).

   3. Verify network connectivity by performing a ping test to the default NSIP address: 192.168.100.1.

   4. Ensure that firewall settings allow HTTPS traffic (TCP 443).

2. Browser configuration

   1. Open a Web browser (Chrome, Firefox, Safari, or Edge).

   2. Enter https://192.168.100.1.

   3. Accept the self-signed certificate warning to continue.

3. Initial authentication

   1. In the Username field, enter nsroot.

   2. In the Password field, enter the device serial number exactly as printed on the chassis label.

   3. Click Login. The system redirects to the initial setup wizard.

4. Complete the setup wizard

   The setup wizard guides you through the following essential configuration parameters:

   1. Management Service IP (NSIP): Assign a static IP for management access.

   2. Subnet mask and default gateway: Configure these for your network segment.

   3. DNS server: Enter the primary DNS IP address.

   4. Hostname: Assign a meaningful system identifier.

   5. Administrative password: Set a strong password to replace the serial number default.

Console connection setup by using the CLI

The command-line interface provides direct system access for advanced configuration and troubleshooting through the front-panel console port.

1. Physical connection

   1. Connect an RJ-45 serial cable to the CONSOLE port on the front panel.

   2. Connect the other end to the workstation serial port or to a USB-to-serial adapter.

2. Terminal emulator configuration

   Open your terminal emulation software (such as PuTTY, Tera Term, or SecureCRT) and configure the following settings:

   Setting	Value
   Baud Rate	9600 bps
   Data Bits	8
   Parity	None
   Stop Bits	1
   Flow Control	None (disabled)
   Terminal Type	ANSI
   PuTTY Keypad Mode	VT100

3. Session establishment

   1. Open the terminal emulator application.

   2. Establish a connection, using the configured settings.

   3. Press Enter if no prompt appears.

Wait for the login prompt to display.

1. Authentication process

   1. At the login prompt, enter nsroot.

   2. At the password prompt, enter the device serial number.

      On successful authentication, the system displays the NetScaler command prompt. All credentials are case-sensitive.

2. Verify the software and platform identity

   After you log in, run show version and show hardware to confirm the firmware build and the platform identity before you configure the appliance. The following example shows the expected output for the first GA release of the MPX 9200 FIPS.

   > show version
   NetScaler NS14.1: Build 43.142.fips.nc, Date: May 22 2026, 20:07:37   (64-bit) (NS14.1-FIPS)
    Done
   > show hardware
   Platform: NSMPX-9200-FIPS-Z 20*CPU+128GB+8*MLX(50)+2*E1K+2*RAPIDS 36010
   Manufactured on: 12/19/2025
   CPU: 2200MHZ
   Host Id: 161644678
   Serial no: 749FWDTM6K
   Encoded serial no: 749FWDTM6K
   Netscaler UUID: 14e3330a-e709-11f0-a8ec-08357136584d
   BMC Revision: 4.01
    Done
   <!--NeedCopy-->
   

   Confirm the following two items in this output:

   • The build string ends in .fips and the release tag reads (NS14.1-FIPS). Both confirm that the FIPS firmware is running.
   • The Platform line reports the model descriptor and the platform system ID: 36010, which uniquely identifies the MPX 9200 FIPS.

MPX configuration examples

Run the following commands from the NetScaler CLI to establish basic connectivity.

Basic network configuration:

# Configure the NetScaler IP address and subnet mask
set ns config -ipaddress 10.0.0.10 -netmask 255.255.255.0

# Add a subnet IP address for client communication
add ns ip 10.0.0.11 255.255.255.0 -type snip

# Configure the default route for external connectivity
add route 0.0.0.0 0.0.0.0 10.0.0.1

# Configure the system hostname
set ns hostname NS9200-1

# Change the administrative password for security
set system user nsroot -password <yourpassword>
Enter password: *****
Confirm password: *****

# Save the configuration to persistent storage
save ns config

# Restart the system to apply changes
reboot
<!--NeedCopy-->

Note:

Changing the NSIP and rebooting interrupts management connectivity. Reconnect at the new NSIP after the appliance restarts. Always run save ns config before you reboot.

Basic verification commands:

# Check the system software version
show version

# Check the system hardware information
show hardware

# Display the current IP configuration
show ip

# Show the status of all network interfaces
show interface

# Display the routing table
show route

# Verify the configuration save status
show config
<!--NeedCopy-->

LOM port management

Initial LOM configuration

The Lights Out Management (LOM) port provides critical out-of-band access for system monitoring and remote management, independent of the main software operation. Configure the LOM through the web GUI (Method 1) or the CLI with ipmitool (Method 2).

Method 1: LOM web GUI

1. Initial network connection

   1. Set a static IP on the management workstation: 192.168.1.10/255.255.255.0.

   2. Connect directly to the LOM port using a crossover cable, or connect both to the same switch.

   3. Open a browser and navigate to https://192.168.1.3. The LOM login page appears.

2. Default authentication

   1. In the Username field, enter nsroot.

   2. In the Password field, enter the device serial number (case-sensitive).

   3. On the first login, the system forces a LOM password change before granting access.

3. Change the default password

   1. Enter the current password (device serial number).

   2. Enter a new password that meets the complexity requirements shown on the LOM login page.

   3. Confirm the new password and click Submit. The system logs out automatically. Log in again with the new password.

4. Configure the LOM network

   1. Navigate to Settings > Network IP Settings.

   2. Select the LAN interface (Default:eth0).

   3. IPv4 address configuration: Enter the desired LOM IPv4 address.

   4. Subnet mask definition: Set the appropriate subnet mask.

   5. Gateway configuration: Enter the default gateway IP address for routing.

   6. Click Save to apply.

5. Validate connectivity

   1. Verify that the new configuration takes effect.

   2. Test connectivity by performing a ping test from the management workstation.

   3. Attempt to log in using the new IP address to confirm accessibility.

   4. Document the final LOM configuration for operational procedures.

Note:

Insufficient privilege due to system lockdown. If the LOM GUI shows “Insufficient Privilege (code 8000)” or “You do not have permission to view this content”, System Lockdown is enabled. While lockdown is active, all out-of-band interfaces (LOM web UI, IPMI, and Redfish) are read-only. You cannot change Network Settings, User Management, or other LOM settings until lockdown is disabled. See System lockdown mode.

Method 2: LOM CLI initial configuration (ipmitool)

Access the NetScaler shell through the console, and then use ipmitool to configure the LOM. If System Lockdown is enabled, disable it first.

System lockdown mode

When system lockdown is enabled in-band from the host OS, the BMC enforces out-of-band configuration protection. All platform configuration interfaces, including LOM firmware update, network settings, user management, FRU data, and general LOM configuration, are restricted to read-only access through the LOM web UI and IPMI/Redfish interfaces. No persistent configuration or firmware changes can be performed while lockdown is active.

# Check the system lockdown mode status (return 00 = disabled, 01 = enabled)
ipmitool raw 0x34 0x81

# Unlock or disable system lockdown mode (allow OOB write access based on user privilege)
ipmitool raw 0x34 0x81 0x0

# Lock or enable system lockdown mode (restrict OOB to read-only mode)
ipmitool raw 0x34 0x81 0x1
<!--NeedCopy-->

Configure a static LOM IP address:

# Set LOM to use static IP addressing
ipmitool lan set 1 ipsrc static

# Configure the static IP address
ipmitool lan set 1 ipaddr <new_LOM_IP_address>

# Set the subnet mask
ipmitool lan set 1 netmask <new_netmask_IP_address>

# Configure the default gateway
ipmitool lan set 1 defgw ipaddr <new_gateway_IP_address>

# Cold reboot the BMC (Baseboard Management Controller)
ipmitool mc reset cold
<!--NeedCopy-->

Restore the BMC to factory defaults:

# Restore the BMC to factory default configuration
ipmitool raw 0x32 0x66
<!--NeedCopy-->

Note:

If the IPMI or Network Preserve Configuration option is not enabled in the Maintenance section of the LOM GUI, this operation resets all settings, including LOM network configuration, user accounts, and IPMI web settings, to LOM factory defaults.

Allow approximately 120 seconds for the BMC reboot and network initialization. Test connectivity by performing a ping test after the 120-second initialization period, and verify LOM accessibility using the new IP address before proceeding.

Verify the LOM configuration:

# Display the current LOM network configuration
ipmitool lan print 1

# Test LOM connectivity from an external system
ping <new_LOM_IP_address>
<!--NeedCopy-->

Manage the LOM password from the host. For enhanced security, change the LOM password from the NetScaler shell.

# List the current LOM users to identify the user ID
ipmitool user list 1

# Change the password for a specific user ID (typically user ID 2 for the nsroot admin)
ipmitool user set password <user_ID> <new_LOM_password>
<!--NeedCopy-->

LOM security considerations:

• Change the default password immediately after initial access.
• Implement network-level access controls for the LOM segment.
• Place the LOM on an isolated management VLAN for enhanced security.
• Enable audit logging for administrative actions.
• Re-enable System Lockdown after configuration to protect the OOB interfaces.

Remote power control operations

The LOM interface provides comprehensive remote power management capabilities, enabling administrators to control system power states without physical access to the appliance.

System startup procedure:

1. Pre-startup verification

   1. Confirm that both PSU LEDs show solid or blinking green.

   2. Verify that the network infrastructure is available.

   3. Check for existing hardware alerts in the LOM event log.

2. Remote power-on execution

   1. Navigate to the Power Control menu in the LOM web UI.

   2. Select Power On and click Perform Action.

   3. Monitor the front-panel PWR LED for solid green confirmation.

3. Startup monitoring

   1. Watch for POST completion in the LOM remote console.

   2. Confirm that the network interfaces initialize (the MGMT 0/1 interface is accessible at 192.168.100.1).

System shutdown procedure:

1. Initiate shutdown

   1. Verify that no critical operations are in progress before shutting down.

   2. Navigate to Power Control, select ACPI Shutdown, and click Perform Action.

2. Confirm verification

   1. Monitor the front-panel PWR LED. It extinguishes when the power-off is complete.

   2. Wait for full power-off before initiating a subsequent power-on sequence.

Note:

Always use ACPI Shutdown for a graceful OS-level shutdown. Use Power Off (immediate) only when the system is unresponsive. Document all remote power events for audit and troubleshooting purposes.

System specifications

Hardware configuration

The MPX 9200 FIPS platform incorporates enterprise-grade components designed for high-performance application delivery and reliability.

Core system architecture

Power and environmental specifications

Environmental specifications

Physical specifications

System LED status

The system provides comprehensive status indication through various LED indicators located on the front and rear panels.

Front panel LED status

Power supply LED status

NVMe storage LED status

Each NVMe drive carrier has an activity LED indicator.

Additional resources

Primary documentation resources:

• NetScaler hardware platforms documentation: Complete hardware documentation, including detailed specifications, configuration guides, and troubleshooting procedures.
• System upgrade and downgrade guide: Step-by-step procedures for upgrading or downgrading software while maintaining system availability and configuration integrity.
• High availability configuration guide: Detailed instructions for implementing high availability configurations using multiple NetScaler appliances for enhanced system resilience.

Support information

When contacting NetScaler Support, prepare the following information:

• Hardware serial number: Located on the chassis label (required for all support cases).
• Software version: Current software builds and version information.
• Problem description: Detailed description of the issue, including error messages.
• System configuration: Network topology and relevant configuration details.
• Log files: System logs and diagnostic information, if available.