This document describes the changes, fixed issues, and known issues provided in the maintenance releases of the Citrix® NetScaler®, Citrix® NetScaler® SDX, and Citrix® Access Gateway® software.
Release version: Citrix® NetScaler®, version 9.3 build 58.5
Replaces build: None
Release date: August 2012
Readme version: 1.0
Language supported: English (US)
show tm sessionaction <profileName>
You can fix the persistency settings for any AAA-TM profile that is affected by this issue by typing the following command at the NetScaler command line:
set tm sessionAction <profileName> -persistentCookie ENABLED -persistentCookieValidity <positive_integer>
For <positive_integer>, substitute the number of minutes that the persistency cookie is to remain valid. Then, use the 'show tm sessionaction' command to verify your changes.
When a failover occurs, the failover of some services might be delayed by a few seconds while monitors learn the actual states of those services. Until the monitors learn and correct the states, new connections to those services might be rejected. Consequently, you might also observe a brief period of outage following a failover.
sysctl netscaler.ns_vpx_halt.method=2
Perform a warm reboot for the above change to take effect.
In addition, if you configure double-source authentication that requires authentication with LDAP plus RSA authentication, you need to also add the following as REG_SZ:
Workaround: Check for configuration inconsistency by using the 'show configstatus' command and reconfigure the appliance under low traffic conditions or during a maintenance period. If that does not resolve the issue, restart the appliance.
Workaround: In the browser, refresh or minimize the page to release the memory.
Workaround: Turn off the Tx flow control globally on the interfaces from the management Service VM user interface. On the Configuration tab, in the navigation pane, click System, and then click Interfaces.
Workaround: Reduce the memory allocated for caching.
Workaround: Defragment the disk. For consistent virtual hard disk (VHD) performance, change a dynamic disk to a static disk.
ipmi0: KCS error: 01 ipmi0: KCS: Reply address mismatch
Workaround: First, decrypt the key, and then import it. To decrypt the key, at the shell prompt, type: openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Initiate steering to CPU1. At the shell prompt, type: sysctl netscaler.ticks_on_cpu1=1 To change the interrupt steering option back to CPU0 (the default), at the shell prompt, type: sysctl netscaler.ticks_on_cpu1=0 To make the workaround persistent, add the first command to the initialization script /nsconfig/rc.netscaler or its equivalent.
Workaround: Replace the 'any' type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The 'any' type is rarely used.)
Release version: Citrix® NetScaler®, version 9.3 build 57.5
Replaces build: None
Release date: June 2012
Release notes version: 2.0
Language supported: English (US)
For example, the second command provided below might not succeed if there exists some request for which the evaluation of rule in cs_example is in progress.
-> add cs policy cs_example -rule 'HTTP.REQ.BODY(1000).CONTAINS("MyLengthIs12")
-> add cs policy cs_example_break -rule 'HTTP.REQ.BODY(1000).CONTAINS("MyLengthIsBIG15")
show tm sessionaction <profileName>
You can fix the persistency settings for any AAA-TM profile that is affected by this issue by typing the following command at the NetScaler command line:
set tm sessionAction <profileName> -persistentCookie ENABLED -persistentCookieValidity <positive_integer>
For <positive_integer>, substitute the number of minutes that the persistency cookie is to remain valid. Then, use the "show tm sessionaction" command to verify your changes.
Workaround: Check for configuration inconsistency by using the "show configstatus" command and reconfigure the appliance under low traffic conditions or during a maintenance period. If that does not resolve the issue, restart the appliance.
Workaround: Delete the time zone from the configuration (ns.conf), upgrade to the target build or release, and then reconfigure the time zone.
Workaround: In the browser, refresh or minimize the page to release the memory.
Workaround: Turn off the Tx flow control globally on the interfaces from the management Service VM user interface. On the Configuration tab, in the navigation pane, click System, and then click Interfaces.
"ps -ax | grep svm_migration"If you see some processes running, then migration is in progress and you must not restart the Management Service.
Workaround: First, upgrade the Management Service from build 48.6 to build 55.6, and then upgrade it from build 55.6 to build 56.5 or 57.5.
Workaround: Reduce the memory allocated for caching.
Workaround: Defragment the disk. For consistent virtual hard disk (VHD) performance, change a dynamic disk to a static disk.
Workaround: Reset the LOM firmware. The following error messages might appear on the console during LOM reset, because the LOM module does not respond to the appliance. ipmi0: KCS error: 01 ipmi0: KCS: Reply address mismatch
Workaround: First, decrypt the key, and then import it. To decrypt the key, at the shell prompt, type: openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Initiate steering to CPU1. At the shell prompt, type: sysctl netscaler.ticks_on_cpu1=1 To change the interrupt steering option back to CPU0 (the default), at the shell prompt, type: sysctl netscaler.ticks_on_cpu1=0 To make the workaround persistent, add the first command to the initialization script /nsconfig/rc.netscaler or its equivalent.
Workaround: Replace the "any" type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The "any" type is rarely used.)
Release version: Citrix® NetScaler® release 9.3 build 56.5
Replaces build: None
Release date: May 2012
Release notes version: 2.0
Language supported: English (US)
Workaround: Check for configuration inconsistency by using the "show configstatus" command and reconfigure the appliance under low traffic conditions or during a maintenance period. If that does not resolve the issue, restart the appliance.
Workaround: Delete the time zone from the configuration (ns.conf), upgrade to the target build or release, and then reconfigure the time zone.
Workaround: Turn off the Tx flow control globally on the interfaces from the management Service VM user interface. On the Configuration tab, in the navigation pane, click System, and then click Interfaces.
Workaround: In the browser, refresh or minimize the page to release the memory.
"ps -ax | grep svm_migration"If you see some processes running, then migration is in progress and you must not restart the Management Service.
Workaround: First, upgrade the Management Service from build 48.6 to build 55.6, and then upgrade it from build 55.6 to build 56.5 or 57.5.
Workaround: Reduce the memory allocated for caching.
Workaround: Defragment the disk. For consistent virtual hard disk (VHD) performance, change a dynamic disk to a static disk.
Workaround: Reset the LOM firmware. The following error messages might appear on the console during LOM reset, because the LOM module does not respond to the appliance. ipmi0: KCS error: 01 ipmi0: KCS: Reply address mismatch.
Workaround: First, decrypt the key, and then import it. To decrypt the key, at the shell prompt, type: openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Initiate steering to CPU1. At the shell prompt, type: sysctl netscaler.ticks_on_cpu1=1 To change the interrupt steering option back to CPU0 (the default), at the shell prompt, type: sysctl netscaler.ticks_on_cpu1=0 To make the workaround persistent, add the first command to the initialization script /nsconfig/rc.netscaler or its equivalent.
Workaround: Replace the "any" type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The "any" type is rarely used.)
Release version: Citrix® NetScaler® release 9.3 build 55.6
Replaces build: None
Release date: February 2012
Release notes version: 2.0
Language supported: English (US)
Workaround: Check for configuration inconsistency by using the show configstatus command and reconfigure the appliance under low traffic conditions or during a maintenance period. If that does not resolve the issue, restart the appliance.
Workaround: Run Internet Explorer version 9.0 in compatibility mode.
Workaround: Turn off the Tx flow control globally on the interfaces from the management Service VM user interface. On the Configuration tab, in the navigation pane, click System, and then click Interfaces.
Workaround: To correct the parameter values, log on to the NetScaler instance through the Xen Console. You also need to correct the values for this instance in the XenStore. After correcting the values in the both the places, rediscover the NetScaler instances from the Management Service VM user interface without selecting any specific instance, by clicking Rediscovery in the NetScaler Instance pane.
Workaround: In the browser, refresh or minimize the page to release the memory.
Workaround: Reduce the memory allocated for caching.
Workaround: Reset the LOM firmware. The following error messages might appear on the console during LOM reset, because the LOM module does not respond to the appliance--ipmi0: KCS error: 01 ipmi0: KCS: Reply address mismatch.
Workaround: First, decrypt the key, and then import it. To decrypt the key, at the shell prompt, type: openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Replace the "any" type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The "any" type is rarely used.)
Release version: Citrix® NetScaler® release 9.3 build 54.4
Replaces build: None
Release date: December 2011
Release notes version: 1.0
Language supported: English (US)
Workaround: Check for configuration inconsistency by using the "show configstatus" command and reconfigure the appliance under low traffic conditions or during a maintenance period. If this does not resolve the issue, restart the appliance.
add monitor wi CITRIX-WI-EXTENDED -sitepath "/Citrix/DesktopWeb" -username aaa -password bbb -domain ccc
Workaround: Turn off the Tx flow control globally on the interfaces from the management Service VM user interface. On the Configuration tab, in the navigation pane, click System, and then click Interfaces.
Workaround: Run Internet Explorer version 9.0 in compatibility mode.
Workaround: To correct the parameter values, log on to the NetScaler instance through the Xen Console. You also need to correct the values for this instance in the XenStore. After correcting the values in the both the places, rediscover the NetScaler instances from the Management Service VM user interface without selecting any specific instance, by clicking Rediscovery in the NetScaler Instance pane.
Workaround:In the browser, refresh or minimize the page to release the memory.
Workaround: Assign a 0/x interface to the VPX instance.
workaround: Assign a 0/x interface to the VPX instance.
Workaround: Reduce the memory allocated for caching.
Workaround: Reset the LOM firmware. The following error messages might appear on the console during LOM reset, because the LOM module does not respond to the appliance. ipmi0: KCS error: 01 ipmi0: KCS: Reply address mismatch
openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Replace the "any" type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The "any" type is rarely used.)
Release version: Citrix® NetScaler® release 9.3 build 53.5
Replaces build: None
Release date: November 2011
Release notes version: 1.0
Language supported: English (US)
Before: unset dns mxRec <domain> -TTL
After: unset dns mxRec <domain> -mx <string> -TTL
Workaround: Check for configuration inconsistency by using the "show configstatus" command and reconfigure the appliance under low traffic conditions or during a maintenance period. If this does not resolve the issue, restart the appliance.
Workaround: Run Internet Explorer version 9.0 in compatibility mode.
Workaround: To correct the parameter values, log on to the NetScaler instance through the Xen Console. You also need to correct the values for this instance in the XenStore. After correcting the values in the both the places, rediscover the NetScaler instances from the Management Service VM user interface without selecting any specific instance, by clicking Rediscovery in the NetScaler Instance pane.
Workaround: In the browser, refresh or minimize the page to release the memory.
Workaround: Turn off the Tx flow control globally on the interfaces from the management Service VM user interface. On the Configuration tab, in the navigation pane, click System, and then click Interfaces.
Workaround: First, add an interface to the NetScaler VPX instance. After the instance restarts, remove the interfaces that are not required.
Workaround: Reset the LOM firmware. The following error messages might appear on the console during LOM reset, because the LOM module does not respond to the appliance. ipmi0: KCS error: 01 ipmi0: KCS: Reply address mismatch
Workaround: First, decrypt the key, and then import it. To decrypt the key, at the shell prompt, type:
openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Do the following:
Workaround: Replace the "any" type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The "any" type is rarely used.)
Workaround: Convert XML schema or WSDL files to ASCII before importing them.
Release version: Citrix® NetScaler® release 9.3 build 52.3
Replaces build: None
Release date: October 2011
Release notes version: 2.0
Language supported: English (US)
Workaround: Check for configuration inconsistency by using the "show configstatus" command and reconfigure the appliance under low traffic conditions or during a maintenance period. If this does not resolve the issue, restart the appliance.
Workaround: Run Internet Explorer version 9.0 in compatibility mode.
Workaround: To correct the parameter values, log on to the NetScaler instance through the Xen Console. You also need to correct the values for this instance in the XenStore. After correcting the values in the both the places, rediscover the NetScaler instances from the Management Service VM user interface without selecting any specific instance, by clicking Rediscovery in the NetScaler Instance pane.
Workaround: First, decrypt the key, and then import it. To decrypt the key, at the shell prompt, type: openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Replace the "any" type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The "any" type is rarely used.)
Workaround: Convert XML schema or WSDL files to ASCII before importing them.
Release version: Citrix® NetScaler® release 9.3 build 51.5
Replaces build: None
Release date: August 2011
Release notes version: 1.0
Language supported: English (US)
1. Disable split tunneling
2. Configure Access Gateway so user connections do not receive an intranet IP address.
3. Configure the wireless device to use an Ethernet connection instead of a mobile broadband connection. For example:
1. Create a clientless access Outlook Web Access Profile and enable persistent cookies.
2. Bind the Outlook Web Outlook regular expression to this profile.
3. Bind the profile so that is assumes the highest priority.
Workaround: Check for configuration inconsistency by using the "show configstatus" command and reconfigure the appliance under low traffic conditions or during a maintenance period. If this does not resolve the issue, restart the appliance.
For example:
add monitor wi CITRIX-WI-EXTENDED -sitepath "/Citrix/DesktopWeb" -username aaa
-password bbb -domain ccc
In some situations, (where multiple persons use same user-login credentials) session cookie persistence may not be helpful and IP-based persistence methods will be necessary. In some other situations, load balancing of the RDP services without persistence may be necessary. That is, each new connection to an RDP virtual server needs to be load balanced irrespective of a user's disconnected session existing on a terminal server.
Workaround: To rectify the parameter values, log on to the NetScaler instance through the Xen Console. You also need to rectify the values for this instance in the XenStore.
After correcting in the both the places, rediscover the NetScaler instances from the Management Service VM user interface without selecting any specific instance by clicking Rediscovery in the NetScaler Instance pane.
Workaround: Reset the LOM firmware. Note that the appliance may become unresponsive for approximately 60 seconds when you reset the LOM firmware.
Warning: You should reset the LOM firmware only when one of the following conditions apply:
This message is not the intended message. However, on the subsequent attempt to delete the certificate key-pair object, the correct message, "ERROR: Certificate is referenced by a CRL, OCSP responder, virtual server, service, or another certificate," is displayed.
Workaround: First, decrypt the key, and then import it. To decrypt the key, at the shell prompt, type:
openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Replace the "any" type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The "any" type is rarely used.)
Workaround: Convert XML schema or WSDL files to ASCII before importing them.
Release version: Citrix® NetScaler® release 9.3 build 50.3
Replaces build: None
Release date: July 2011
Release notes version: 1.0
Language supported: English (US)
add ip 1.1.1.1 255.255.255.0 [configured as SNIP]
add service adns 1.1.1.1 adnS 53 [configuring the same IP as ADNS]
set server 1.1.1.1 -ipaddress 1.1.1.2 [changing the adns server IP to new IP]
rm ip 1.1.1.1 [Removing old IP returns error]
set lb parameter -consolidatedLConn ( YES | NO )
By default, the option is set to 'Yes'. If and only if there is uneven least connection load balancing in low-traffic scenarios, you can set the "consolidatedLConn" to 'No' to make the load balancing even.
Model Maximum throughput (in Gbps)
11500 8
13500 12
14500 18
16500 24
18500 36
Workaround: Check for configuration inconsistency by using the "show configstatus" command and reconfigure the appliance under low traffic conditions or during a maintenance period. If this does not resolve the issue, restart the appliance.
For example:
add monitor wi CITRIX-WI-EXTENDED -sitepath "/Citrix/DesktopWeb" -username aaa -password bbb -domain ccc
Workaround: To rectify the parameter values, log on to the NetScaler instance through the Xen Console. You also need to rectify the values for this instance in the XenStore. After correcting in the both the places, rediscover the NetScaler instances from the Management Service VM user interface without selecting any specific instance by clicking Rediscovery in the NetScaler Instance pane.
Workaround: First, decrypt the key, and then import it. To decrypt the key, at the shell prompt, type:
openssl rsa -in <EncryptedKey.key> > DecryptedKey.out
Workaround: Replace the "any" type definitions in the XML schemas with definitions of the actual elements that occur in the XML message. (The "any" type is rarely used.)
Workaround: Convert XML schema or WSDL files to ASCII before importing them.