Release Notes for Build 64.11 of NetScaler 11.1 Release

What's New?

NetScaler Gateway

• Support for SameSite attribute

  For NetScaler Gateway and NetScaler AAA deployments, support is now added to configure the SameSite cookie attribute. This attribute helps prevent issues that might occur because of certain browsers upgrade, such as Google Chrome 80. The SameSite attribute can now be set to None, Lax or Strict, as per the requirement.

  For details, see https://docs.citrix.com/en-us/netscaler/11-1/aaa-tm/configure-samesite-for-aaa-deployments.html

  https://docs.citrix.com/en-us/netscaler-gateway/11-1/authentication-authorization/configure-samesite-attribute-for-citrix-gateway.html
  [# NSAUTH-7531]

Licensing

• New values for SDX minimum bandwidth and minimum instances

  The minimum bandwidth and minimum instances values for SDX appliances that support NetScaler pooled capacity have changed. For more information, see:

  https://docs.citrix.com/en-us/citrix-application-delivery-management-software/13/license-server/adc-pooled-capacity.html
  [# NSSVM-2770]

System

• Changing default RPC node passwords

  In HA, cluster, and GSLB deployments, a warning message appears for the nsroot and superuser login if the default RPC node password is not changed.
  [# NSCONFIG-2224]

Fixed Issues

• During the “set partition” operation, the maximum memory of the partition is now increased up to NS_SYS_MEM_FREE() only. Earlier, it was increased up to the maximum memory available so that the configured partition is not lost after rebooting the NetScaler appliance.
  [# NSHELP-21159]

Auditlog

• Feature: NetScaler Gateway In a NetScaler Gateway high availability setup, the secondary node crashes during high availability synchronization if logging is enabled on NetScaler Application Firewall global.
  [# NSHELP-21254]

AAA-TM

• If a dialogue cookie in the client request is processed before checking for any existing sessions, a NetScaler appliance sends a change password page to the client.
  [# NSHELP-19528]

• An FQDN in the SSL certificate might crash in a NetScaler appliance because of a buffer overflow.
  [# NSHELP-20476]

• The NetScaler appliance crashes after an upgrade to version 13.0 because of a buffer overflow condition.
  [# NSHELP-20416, NSAUTH-6770]

• In some cases, a NetScaler appliance dumps core when "show aaa group -loggedIn" command is issued.
  [# NSHELP-19793]

NetScaler GUI

• You cannot retrieve a backup file using the NetScaler GUI if the file name is from 61 to 63 characters long even though the maximum limit is 63 characters.
  [# NSHELP-11667]

NetScaler SDX Appliance

• After upgrading NetScaler SDX 8900 and SDX 15000 50G appliances to version 11.1 63.9, 10G NICs do not appear on the appliances. This issue prevents the VPX instances from booting up. As a result, the instances become unreachable.
  [# NSPLAT-12093]

NetScaler SDX Platform

• In some cases, the SDX 14000 appliance might become unresponsive and reboot.
  [# NSHELP-21017]

• The SDX 14000 FIPS driver might crash if you make changes to the HSM partition.
  [# NSHELP-21408]

NetScaler SDX appliance

• A VPX instance running on a NetScaler SDX appliance fails to free the allocated ports after a client connection is closed. This failure might cause the instance to restart continuously.
  [# NSHELP-18729]

NetScaler VPX appliance

• In the VPX deployment on Cisco CSP 2100 platform, occasionally packets might get dropped when more than one virtual function (VF) is created out of the physical network interface card (pNIC).
  [# NSHELP-20991]

NetScaler Gateway

• A client machine fails to reconnect to a NetScaler Gateway appliance because the appliance sends an incorrect STA ticket upon STA refresh.
  [# NSHELP-20285]

• The Web Interface feature might not work as intended after upgrading the NetScaler appliance.
  [# NSHELP-21899]

• In a NetScaler Gateway high availability setup, the secondary node crashes if a syslog policy is bound globally to NetScaler Application Firewall and one of the following conditions is met:

  - You perform a force failover.

  - You clear the configuration.
  [# NSHELP-21167]

• The NetScaler Gateway logon page becomes unresponsive if RfWebUI based custom themes or nFactor with custom themes are used.
  [# NSHELP-21763]

• In rare cases, the NetScaler Gateway appliance crashes if AAA user session is transferred and Intranet IP is enabled.
  [# NSHELP-20680]

NetScaler Application Firewall

• In a high availability setup, enabling IP reputation feature might result in high availability command propagation failures.
  [# NSHELP-20010]

• After an upgrade, if you bind a signature to the Web App Firewall profile, the appliance silently drops an incoming request.
  [# NSHELP-20201, NSWAF-3427, NSHELP-20599]

• A NetScaler appliance might crash if the following conditions are observed:

  - IP reputation policy expression is used in a load balancing virtual server of type TCP.

  - Security Insight is enabled.
  [# NSHELP-20410]

• After an upgrade from build 12.0-58.15 to 12.0-62.8, the URL transformation feature is not working for some URLs. The issue is caused by incorrect canonicalization when rewriting URLs.
  [# NSHELP-20460]

• A NetScaler appliance resets the connection if an incoming GWT request has a query string in the URL.
  [# NSHELP-20564]

• After an upgrade, a NetScaler appliance might crash because of high memory usage.
  [# NSHELP-21410]

• A NetScaler appliance might crash because of memory allocation failure.
  [# NSHELP-21071]

• A NetScaler appliance might crash if the signature feature is enabled and a specific request pattern is detected.
  [# NSHELP-20884, NSHELP-19583]

Citrix Web NetScaler Application Firewall

• The NetScaler appliance blocks Closure URLs after two minutes if URL closure protection is enabled.
  [# NSWAF-3292]

DNS

• Feature: DNS A NetScaler appliance might crash If DNS logging is enabled and the appliance receives a large DNS response.?
  [# NSHELP-18926]

Licensing

• The NetScaler pooled capacity licensing might fail if latency is high between ADC and ADM. This issue occurs if latency is greater than 200 ms.

  The NetScaler licensing client attempts repeatedly to check out the licenses from ADM. In a high availability and cluster setup, licensing configurations are unnecessarily reapplied whenever synchronization is triggered. Propagation and synchronization of the pooled licensing commands are disabled. Each node must be licensed independently by logging in to the NSIP of the node. You can execute only show commands on the Cluster IP.
  [# NSUI-14868, NSHELP-22045]

• After upgrading to build 12.1-55.x, the appliance might boot up unlicensed if pool licensing is configured. As a result, all the features are disabled and any configuration that is license dependent is missing in the running configuration. Perform a warm reboot to restore the pool license and the configuration.

  Caution: Do not run “save config” or force an HA failover on an unlicensed appliance.
  [# NSUI-7869]

Load Balancing

• The NetScaler appliance might crash when both the following conditions are met:

  • Rule-based persistence is configured on the appliance.

  • Multiple IPv6 servers respond with the same values for the parameters configured in the rule-based persistence.
  [# NSHELP-20490]

Networking

• On restarting the NetScaler appliance, default route is originated before the IP address of the interface is populated. Because of this issue, the next hop of a route is set to NULL leading to a martian error.
  [# NSHELP-16407]

• When a PBR rule with next hop parameter set to NULL is added for a load balancing service or a monitor, the NetScaler appliance might become unresponsive.
  [# NSHELP-19245]

• The ADC appliance might not update the ECMP routes in an optimised way when an associated interface is disabled, or an associated IP address is deleted.
  [# NSHELP-19891]

• 32-bit ASN values appear as negative values in the “sh ip bgp summary” command output.
  [# NSHELP-20540]

• The NetScaler appliance might skip Policy-based routes (PBR) rules for outgoing monitor packets of type UDP and ICMP.
  [# NSHELP-20545]

• A NetScaler appliance might crash if it receives IPv6 traffic that matches both of the following conditions:

  * Source MAC address of IPv6 traffic matches the MAC address of a service bound to a virtual server with type ANY and redirection mode set to MAC based forwarding (-m MAC)

  * The IPv6 traffic matches an RNAT6 rule with TCP proxy option enabled
  [# NSHELP-20548]

• The NetScaler appliance might not update ECMP routes properly when multiple BGP

  sessions go to "DOWN" state simultaneously.
  [# NSHELP-20664]

• In a high availability setup in INC mode, after a failover, the new secondary node might not withdraw the default route (learned from other BGP peers) that it advertised when it was functioning as primary. Because of this issue, the data traffic can arrive on the new secondary node as well.
  [# NSHELP-21720]

• The BGP daemon might display duplicate warning messages for a route removed from the NetScaler routing table.
  [# NSHELP-20906]

• “sh IP BGP summary” command on the VTYSH command line incorrectly displays the 32 bit ASN values as negative values.
  [# NSHELP-21234]

• In a high availability setup, by function, the node state immediately changes to UP from DOWN after a partial failure when both of the following conditions are true:

  - if the state of the critical interface that caused the partial failure changes to UP from DOWN

  - if the critical interface received a non-multicast packet

  The state of the node might not immediately change to UP if the critical interface is part of an LACP channel.
  [# NSHELP-21711]

• After a system restart, the NetScaler appliance advertises routes with a reduced metric for 180 seconds.
  [# NSHELP-20842]

Platform

• The SDX 14000 FIPS appliance might crash and restart while configuring a FIPS HSM partition.
  [# NSHELP-18503]

• Config wipe scripts fail on some NetScaler platforms. With this fix, the date code of the scripts is updated to 01/14/20 and all platforms are supported.
  [# NSPLAT-13498]

• On SDX platforms with Fortville interfaces, the 10G & 40G Fortville interfaces can run into TX stalls when Jumbo is enabled on them.
  [# NSHELP-20605]

• On a NetScaler SDX appliance, the virtual interface status shows UP even though the corresponding physical link is DOWN.
  [# NSHELP-20452]

Policies

• A NetScaler appliance might crash if there are few network buffers when rewriting chunked data.
  [# NSHELP-20847]

Portal

• Feature: NetScaler Gateway Users are incorrectly prompted to enter the user name and password when nFactor Logon form is customized to display the dynamic Logon Type menu and OAuth is selected from the list.
  [# NSHELP-20300]

SSL

• If the SSL default profile is enabled and bound to an SSL service group, a warning message appears when you unbind a cipher from the SSL profile and bind a service to this service group. The service is also not bound to the service group.
  [# NSHELP-20332]

• The internal SSL service state appears UP even after you unbind the certificate from the service.
  [# NSHELP-19752]

• A NetScaler appliance might crash and dump core if the memory allocation for client and server process control blocks fails.
  [# NSHELP-20961]

• In a cluster setup, the 'set ssl service' command on any internal service throws an error and does not set any parameter for the internal service.
  [# NSSSL-5834]

• In some cases, the following appliances might crash while running SSL traffic:

  - MPX 59xx

  - MPX/SDX 89xx

  - MPX/SDX MPX 26xxx

  -MPX/SDX 26xxx-50S

  - MPX/SDX 26xxx-100G

  - MPX/SDX 15xxx-50G
  [# NSSSL-7606]

System

• In rare cases, the Call Home process might crash resulting in the appliance to restart. The issue occurs if a Call Home sub process uses the same internal process id (PID) of the previous sub process.
  [# NSHELP-20334]

• A NetScaler appliance might crash if one SYN buffers are properly freed while the other buffer is removed and not freed in the retransmission queue.
  [# NSHELP-20424]

• A NetScaler appliance resets MPTCP subflows if a subflow is alive and active for more than the idle timeout period.
  [# NSHELP-20648]

• A NetScaler appliance resets an MPTCP subflow if it receives a plain acknowledgment before the subflow is confirmed as MTPCP.
  [# NSHELP-20649]

• On a NetScaler appliance, management connections to IPv6 Subnet IP addresses might get reset when you perform the clear config basic operation.
  [# NSHELP-21206]

Known Issues

Analytics

• Geo location does not resolve from Maxmind GeoCity.dat database file.
  [# NSHELP-9187]

AppFlow

• If multiple AppFlow policies are bound to the same bind point, only the last policy is chosen.
  [# NSBASE-4140]

AAA-TM

• The AAA parameter configurations related to "set aaa parameter" command is lost if you execute the “force cluster sync” command manually.

  Workaround: Do not execute the “force cluster sync” command.
  [# NSAUTH-6274]

• If you have to set a domain wide cookie for an authentication domain, you must enable authentication profile on a load balancing virtual server.
  [# NSHELP-15356]

• In the SAML LogoutRequest parameter, the attributes SPNameQualifier and NameQualifier are missing from the NameID element when a SAML Service Provider (SP) receives an assertion from SAML Identity Provider (IdP).
  [# NSHELP-8018]

NetScaler GUI

• If the feature "Force password change for nsroot user when default nsroot password is being used" is enabled and the nsroot password is changed at the first logon to the NetScaler appliance, the nsroot password change is not propagated to non-CCO nodes. Therefore, when an nsroot user logs on to non-CCO nodes, the appliance asks for password change again.
  [# NSCONFIG-2370]

• The Actions tab is missing from "Unknown Certificates" page in the GUI.
  [# NSHELP-12948]

• The following error message appears when you import an SJIS file from AppExpert>Responder>HTML Page Imports.

  "URL malformed"

  Workaround: Save the SJIS file in UTF-8 format, and then import it.
  [# NSHELP-20711]

NetScaler SDX Appliance

• On NetScaler SDX 15XXX and SDX 26XXX platforms, you cannot provision multiple VPX instances in L2 mode.
  [# NSHELP-21367]

NetScaler SDX appliance

• The following error messages might appear if you configure more than 100 VLANs in the trunkallowedVlan list on an interface in the NetScaler instance:

  ERROR: Operation timed out

  ERROR: Communication error with the packet engine
  [# NSNET-4312]

NetScaler VPX Appliance

• Enabling trunk mode with tagged VLAN settings on an SR-IOV interface fails with the following error message:

  "ERROR: Maximum number of tagged VLANs bound to the interface exceeded or the binding of this VLAN is not allowed on the interface."

  However, trunk mode with tagged VLAN settings is shown as enabled in the output of the following command:

  show interface summary
  [# NSPLAT-3614]

NetScaler Gateway

• You cannot configure the portal theme for AAA authentication unless the SSLVPN is also enabled for portal theme configuration.
  [# CGOP-1365]

• If nfactor policies are bound to the AAA virtual server, the logon page of the virtual server is not displayed correctly by an Internet Explorer browser on a Windows mobile device.
  [# CGOP-1425]

• If a VPN session profile and RfWebUI portal theme are in use, end users cannot log on if the following are set to OFF:

  - ICA Proxy

  - Clientless VPN Mode

  - Transparent Interception and Client Choices
  [# CGOP-1575]

• If the Home Page Text labels are lengthy when you customize an RfWebUI based theme, the home-page user interface does not function properly. The following lengthy text labels can cause this problem:

  Apps Tab Label

  Desktop Tab Label

  Favorite Tab Label
  [# CGOP-1622]

• If a VPN virtual server is bound as the default virtual server to a content switching (CS) virtual server, the "show VPN virtual server" command does not display the details of the CS virtual server to which the VPN virtual server is bound.
  [# CGOP-1725]

• If a Windows user name has non-ASCII characters, the user is unable to collect logfiles by using the Collect Log button.
  [# CGOP-3359]

• In a cluster setup, the "show bindings" command does not display Negotiate type authentication policies.
  [# CGOP-4162]

• After the preauthentication EPA scan completes, the cursor does not return to the index page.
  [# CGOP-4386]

• If you use CVPN to edit the home page through CVPN, the embed code becomes corrupt.
  [# CGOP-4505]

• In some cases, a NetScaler appliance with the HDX Insight feature enabled dumps core during the reconnect of an ICA session. This happens because the appliance accesses the already freed ICA CTX structures.
  [# NSHELP-15805]

• After upgrading the NetScaler Gateway appliance to release 11.x or later, users might see a blank page upon log on. The blank page appears because the browser serves some of the files from its own cache, instead of requesting all the files from the upgraded appliance.

  Workaround: Clear the browser cache.
  [# NSHELP-6807]

• An authentication, authorization, and auditing virtual server login page displays an error code number instead of a meaningful error message.
  [# NSHELP-7872]

• For command "add vpn intranetApplication", description for "protocol" parameter is incorrectly displayed in man page. The description has "BOTH" as a possible value instead of "ANY". However, the man page correctly displays the possible values required for configuration.
  [# NSHELP-8392]

• In an outbound ICA proxy deployment, the NetScaler appliance closes the client connection if the following conditions are met:

  - A TCP service has the same IP address as the destination server.

  - The TCP service also has the same IP port as the destination server.

  The appliance closes the connection because it fails to establish a connection with the destination server.
  [# NSHELP-8469]

• SOCKS Proxy CR virtual server configuration for a NetScaler Gateway appliance fails if you use a Fully Qualified Domain Name (FQDN) for Virtual Delivery Agent (VDA).

  Workaround: Use an IP address for VDA.
  [# NSHELP-8549]

NetScaler Application Firewall

• The NetScaler Application Firewall policy for HTTP requests (HTTP.REQ.HEADER) does not detect a content type with multiple lines.
  [# NSHELP-11092]

• The NetScaler application firewall should bypass requests from application firewall processing after the system reaches a specified CPU/memory usage limit, but there is currently no policy for reviewing CPU and memory capacity and bypassing the application firewall.
  [# NSHELP-17352]

• If you have multiple application firewall policies configured on a load balancing virtual server, and a policy has a GotoPriority Expression of NEXT, the NetScaler AppFirewall policy order bypasses all security checks in that policy's profile and moves to the next policy.
  [# NSHELP-17461]

• When using IE, an RFC violation occurs when submitting a form with Form Field Name and value triggering the request as malformed multipart request. This issue does not occur in Chrome or Firefox.

  The correct format of the request should be; Content-Disposition: form-data; name="<fld_name>".
  [# NSHELP-17547]

• On a NetScaler appliance, traffic is impacted due to high bandwidth utilization when binding AppFW policy to the load balancing virtual server.
  [# NSHELP-17768]

• On a NetScaler Application Firewall appliance, the Analytics security insight support for content switching target load balancing virtual server is not available.
  [# NSHELP-17865]

• Memory leak is observed in a NetScaler appliance, if the Integrated Cache and the Web NetScaler Application Firewall features are enabled.
  [# NSHELP-17969, NSHELP-17158]

• In an HA environment, a NetScaler appliance running release 11.0 does not learn new rules when the application firewall feature is enabled.
  [# NSHELP-18068]

• If you set the AppFW profile post body limit to a value greater than 2 GB, client requests get dropped. The issue occurs because of TCP overflow for a window size variable.
  [# NSHELP-8860]

• In the Visualizer, some buttons might not work if you use Mozilla Firefox or Internet Explorer.

  Workaround: Use the Google Chrome browser.
  [# NSUI-8412]

• If you upgrade a NetScaler appliance in a high availability (HA) setup from version 10.5.56.15 to version 11.1.51.1901 and skip 250 rules with active traffic, the GUI or CLI displays a "failed to skip some rules" error message and an operation time-out error message.

  Workaround: Turn off the Learning feature when skipping learned rules.
  [# NSWAF-1184]

• The information that the GUI displays for the application firewall web services interoperability (WSI) check does not say that it is a prerequisite and cannot be disabled.
  [# NSWAF-679, NSHELP-17084, NSHELP-17498]

Clustering

• In a cluster setup, after a reboot, tagged VLAN configuration is lost on the vlan 1 interface.
  [# NSNET-4162]

DNS

• In a deployment with heavy DNS traffic and many DNS cache entries, some entries in the cache might not get updated or deleted, even after the TTL expires.
  [# NSHELP-12499, NSHELP-11515]

GSLB

• The show gslb domain command does not populate the correct MIR and ECS values between the GSLB virtual server and the GSLB domain bound to the same virtual server.
  [# NSHELP-11729]

• A NetScaler appliance might crash when all of the following conditions are met:

  - A backend server is DOWN.

  - An ADC appliance collects information on server, such as RTT and proximity, for selecting a new backend.
  [# NSHELP-11969]

• Sometimes, the "show gslb runningConfig" command does not display the newly added name server. The new server is not displayed if the IP address of the GSLB service is changed to a new server and in this scenario the GSLB service flag does not get set.
  [# NSHELP-18956]

Licensing

• If the SDX appliance is in grace period for pooled licensing, the remaining grace period shows zero instead of 30 days.
  [# NSHELP-19615]

Load Balancing

• The NetScaler appliance is unable to reuse an existing probe connection if an HTTP wildcard load balancing virtual server is configured in MAC mode with use source IP (USIP) mode enabled and the Use Proxy Port option turned off. As a result, the connection fails and client the receives a TCP reset.
  [# NSBASE-2785]

• The NetScaler appliance might crash intermittently if device watchdog request

  (DWR) probing is enabled for Policy and Charging Rules Function (PCRF), and the PCRF becomes unreachable.

  Workaround: Disable DWR monitoring for the PCRF.
  [# NSHELP-20827]

• If a service group member is assigned a wildcard port (port *), the monitor details for that service group member can be viewed from the Monitor Details page.
  [# NSHELP-9409]

NITRO

• The .NET NITRO SDK get call for snmpmib resource (snmpmib.get()) fails with JSON derserialization errors.
  [# NSHELP-9032]

Networking

• When the NetScaler appliance is cleaning up large number of server connections as part of remove command, the Pitboss process might restart. This Pitboss restart might cause the ADC appliance to crash.
  [# NSHELP-136]

• The NetScaler appliance allows configuration through NITRO APIs even before the protocol modules are not completely initialised. Because of this reason, the write memory command fail with the following error message:

  “save config denied – modules not ready”
  [# NSHELP-19431]

• In some cases of FTP data connections, the NetScaler appliance performs only NAT operation and not TCP processing on the packets for TCP MSS negotiation. As a result, the optimal interface MTU is not set for the connection. This incorrect MTU setting results in fragmentation of packets and impacts CPU performance.
  [# NSNET-5233]

• When a NetScaler appliance processes traffic at line rate, management CPU spike is observed on the appliance while configuring allowed VLAN list.
  [# NSNET-5689]

Platform

• If you add an NTP time server by specifying the server name (host name), and the ns.conf file is very large, the result is a race condition in which the NTP daemon (NTPD) is started before host name services are ready.

  Workaround: Do one of the following:

  -Restart the NTP daemon after starting the NetScaler appliance.

  -Add the NTP server by specifying the IP address of the server instead of specifying the host name.
  [# NSCONFIG-2980]

• On the following NetScaler SDX platforms, connectivity to a VPX instance might fail if it receives heavy multicast traffic when a management port is not assigned to a VPX instance and instance management is done through the data ports.

  - SDX 8900

  - SDX 14000-40G

  - SDX 14000-40S

  - SDX 15000-50G

  - SDX 25000-40G

  - SDX 25000T

  - SDX 25000T-40G
  [# NSHELP-19861]

• On the NetScaler SDX 26000-100G platform, the interface might not come up after you restart the appliance.

  Workaround: Ensure auto negotiation is set to ON. To check and edit the auto negotiation status, navigate to SDX GUI > System > Interfaces.
  [# NSPLAT-11985]

• In an Openstack Environment, if a custom flavor with an Ephemeral Disk of size of less than 8GB is used to a start a NetScaler VPX or Cisco Nexus 1000v instance, the config drive is not attached to the instance.
  [# NSPLAT-7395]

Policies

• When you import an UTF-8/S-JIS based HTML file type by using the NetScaler GUI, the following error message appears:

  "URL malformed"

  Workaround: Before importing, save the file in UTF-8 format.
  [# NSHELP-19512]

• The binary (ASCII) character set now allows all string and character literals, which includes binary characters. The UTF-8 character set still requires string and character literals to be valid UTF-8. Earlier we allowed only valid UTF-8 string and character literals. This was true for both UTF-8 and binary (ASCII) character sets.
  [# NSPOLICY-2362]

SSL

• In a cluster setup, the running configuration on the cluster IP (CLIP) address shows the DEFAULT_BACKEND cipher group bound to entities, whereas it is missing on nodes. This is a display issue.
  [# NSHELP-13466]

• The NetScaler appliance might crash if the following conditions are met:

  1. Two OCSP responders are configured with the same host name.

  2. Both responders are bound to same root certificate-key pair.

  3. The request fails with the first responder.

  4. The appliance attempts to send the request to the second responder and the host name is unresolved.
  [# NSHELP-21278]

• In a cluster setup, if a client certificate is bound to a back-end SSL service or service group, it appears as a "Server Certificate" instead of a "Client Certificate" when you run the "show ssl service" or the "show ssl servicegroup" command on the CLIP address.
  [# NSSSL-1223]

• The SSL entities to which an SSL profile is bound do not appear when you run the show ssl profile <Default-Profile> command on a cluster IP (CLIP) address.

  Workaround: You can view the bound entities from the NetScaler IP (NSIP) address.
  [# NSSSL-2481, NSHELP-4421]

• In a cluster setup, some cluster nodes might not honor the reuse request of a session ticket, but the SSL full handshake succeeds.
  [# NSSSL-3161, NSSSL-1258, NSSSL-1264]

• An expired session ticket is honored on a non-CCO node and on an HA node after an HA failover.
  [# NSSSL-3184, NSSSL-1379, NSSSL-1394]

• SSL profile details are not displayed when you run the "show ssl profile <Profile Name>" command on the cluster IP (CLIP).

  Workaround: Run the "sh ssl profile" command without specifying a profile name. Details of all the existing SSL profiles are displayed.
  [# NSSSL-3469]

• Session Key Auto Refresh incorrectly appears as disabled on a cluster IP address. (This option cannot be disabled.)
  [# NSSSL-4427]

• If you create a custom cipher group and bind it to an SSL entity, the profile name "SSL_EMBEDDED_PROFILE" incorrectly appears in the output of the "show ciphergroup" command. This error does not occur if you enable the Default profile before creating the custom cipher group and binding it to the SSL entity.
  [# NSSSL-4486]

• ECDHE support with SSLv3 protocol on the NetScaler appliance is not compatible with RFC 4492, because SSLv3 does not support extensions and ECDHE needs extension support.
  [# NSSSL-4724]

• An incorrect error message is displayed in both the following cases:

  1. Client authentication is enabled, root CA certificate is not bound to the SSL virtual server, and a request with a valid client certificate is sent to the virtual server.

  2. Client authentication is enabled, root CA certificate is bound to the SSL virtual server, and a request with a wrong certificate is sent to the virtual server.

  The error message that appears is "Handshake failure-Internal Error" instead of "No client certificate received."
  [# NSSSL-851]

System

• A NetScaler appliance in a clustered setup displays a "Cannot allocate memory" error message if you use the set command to set the server domain name in a SYSLOG action.

  Workaround: Delete the SYSLOG action in which you set the domain name, and add a new SYSLOG action that specifies the server domain name instead of the server IP address.

  rm syslogaction

  add syslogaction -loglevel [-options ...]
  [# CGOP-6745]

• The initial probe connection that a NetScaler appliance makes with the back-end internet server to check for server availability is now reusable for actual server connection with the internet server.
  [# NSBASE-1185]

• In client IP header insertion (for example, -X-Forwarded-for) if the IP address to be inserted is not as long as the buffer, the header pads spaces at the end of the client IP address.
  [# NSHELP-10079]

• Random packets on loopback interface are found missing if you capture nstrace on a NetScaler appliance.
  [# NSHELP-10166]

• A NetScaler appliance might not honor persistence for a load balancing virtual server with a wildcard configuration if information about the back-end server is not available.
  [# NSHELP-10559]

• If you access a NetScaler appliance from the GUI, the TCP/IP Connection page supports only a set of classic and advanced policy expressions as a filter. If you use an unsupported expression as a filter, the NetScaler GUI does not display a warning message, and using the unsupported expression leads to an appliance failure.

  Note: You can type the show connectiontable command to view the list of supportable expressions.
  [# NSHELP-10809]

• A NetScaler appliance sends a TCP fast open cookie instead of an MPTCP MP_CAPABLE option for MPTCP traffic.
  [# NSHELP-10909]

• The mptcp_cur_session_without_subflow counters incorrectly decrement to a negative value instead of zero.
  [# NSHELP-10972]

• A NetScaler appliance silently truncates and drops HTTP request body packets greater than the maximum HTTP header size configured in the HTTP profile. The request body is truncated only if the appliance receives an HTTP request after an incomplete header assembly (request header spanning more than one packet) and the request body is received when the appliance awaits a TCP acknowledgment for the request header sent to the server. The truncation results in TCP retransmission and latency issues.
  [# NSHELP-11096]

• When you run the set command on a NetScaler appliance, the ns.log file stores the command with all parameter values, including customer provided values.
  [# NSHELP-11291]

• In a high availability setup, the following command-propagation warning message appears when a backup is created for a large configuration file on the primary node: "Warning: There is no response from secondary. Propagation Timed out” However, creation of the backup file succeeds in both the nodes after some time.
  [# NSHELP-11383]

• After a restart, VM login failure logs occur. This happens after you execute the "show ns hardware" command.
  [# NSHELP-18548]

• A NetScaler appliance becomes unstable if you use the -outfilename parameter in diffnsconfig command. As a result, the diffnsconfig output is large to completely fill the root disk.
  [# NSHELP-19345]

• For synflood trap generation, if you do not reset the varbinding values, the appliance uses the old trap varbinding values instead of the current and threshold values.
  [# NSHELP-20653]

• By default, a NetScaler appliance ignores the non-standard and obsolete "Proxy-Connection" HTTP header. To change this behavior, use the nsamimgr command to set the proxyConnection parameter to 1. This setting prioritizes the Proxy-Connection header over the Connection header.

  For example, nsapimgr -ys proxyconnection=1
  [# NSHELP-8842]

• Compression policies of classic policy type do not work as expected. NetScaler recommends you to use the advanced policy infrastructure.
  [# NSHELP-9108]

• A TCP transaction delay is observed if a NetScaler appliance is unable to use the TCP connection to connect to the back-end server. In this case, the appliance opens a new connection to forward the client requests to the back-end server after some waiting period. The waiting period ranges from 400 ms to 600 ms.
  [# NSHELP-9118]

• The NetScaler GUI displays few pages incorrectly. The issue occurs, if HTTP1.1 chunk headers are not removed when forwarding data on front-end HTTP/2.0 connection.
  [# NSHELP-9424]

• When you reboot your appliance, a mismatch between default TCP profiles and built-in profiles causes the Forward RTO-recovery (FRTO) option to be enabled on a TCP profile other of a node.
  [# NSHELP-9453]

• The HTML page rendering might fail if you insert a prebody script before the header tag. The HTML specification requires the character-encoding declaration to be serialized within the first 1024 bytes of the document, and the script might push the meta tag past the 1024-byte limit.
  [# NSHELP-9703]

• No Error or Warning is announced if a user tries to set trunk mode on the loopback interface.
  [# NSNET-4405]

• Connections might hang if the size of processing data is more than the configured default TCP buffer size.

  Workaround: Set the TCP buffer size to maximum size of data that needs to be processed.
  [# NSPOLICY-1267]

Web NetScaler Application Firewall

• A NetScaler appliance might crash if an error case was handled incorrectly for the credit card verification process.
  [# NSHELP-20562]

What's New in Previous NetScaler 11.1 Releases

• Shared VLAN Support

  On a partitioned NetScaler appliance, you can now bind a VLAN as a dedicated VLAN for a particular partition or as a shared VLAN across multiple partitions.
  [From Build 47.14]
  [# 581671]

• Role-based Access in an Administrative Partition

  As the root administrator of a partitioned NetScaler appliance, you can now designate partition administrators to control user access to entities within specific partitions. A partition administrator can provide granular, role-based access for a partition user and specify a set of permissions and allowed operations. The authorization is specific to the partition. The partition administrator and the users authorized by the partition administrator access the partition through a SNIP address.
  [From Build 51.21]
  [# NSHELP-10742]

• A group user associated with a superuser command policy is unable to switch partitions through the NetScaler GUI.
  [From Build 51.21]
  [# NSHELP-12065]

• Role-based access (RBA) for System Groups

  Admin partitions now provide role based authentication for system groups. With this access control mechanism, a NetScaler appliance supports the following actions:

  1. Bind an existing partition or all partitions to a system group.

  2. Authenticate a user (bound to a system group), using local or external authentication, and allow the user to switch to a partition that is bound to the system group.

  3. Bind the system group to a custom command policy.
  [From Build 51.21]
  [# NSHELP-9412]

• Instant Visibility of the HA Status of Partitions

  On a partitioned NetScaler appliance in a high availability configuration, the top pane of the NetScaler GUI displays the high availability status of the partitions. This instant visibility helps you monitor the HA configuration efficiently.
  [From Build 51.21]
  [# NSHELP-4673]

• Binding System Group to Administrative Partition

  In a partitioned NetScaler appliance, you can now bind a system group to a specific administrative partition by using the bind system group <grpname>-partitioname <partitioname> command.
  [From Build 51.21]
  [# 629434]

• Support for sending SNMP traps of all partitions through NetScaler GUI

  On a partitioned NetScaler appliance, you can now use the NetScaler GUI to enable sending SNMP trap messages of all partitions to the configured trap destination. In the default partition, enable the allPartitions option for the traps that you want to send. Previously, you had to use the NetScaler command line to enable this option.

  Navigate to System > SNMP > Traps, select a trap, click Edit, and select or clear the Send Traps of All Partitions check box.
  [From Build 53.13]
  [# NSHELP-12669]

AppExpert

• Rate Limiting at the Packet Level

  You can configure a stream selector and a responder policy to collect statistics at the packet level and identify defective or attack-prone packets flowing through all the connections identified by the selector. If, at any point, the percentage of defective or attack-prone packets exceeds the configured threshold, the policy applies a corrective action (RESET or DROP).
  [From Build 51.21]
  [# NSHELP-3964]

AppFlow

• If a NetScaler high-availability failover occurs when ICA AppFlow is enabled, the session reliability feature now restores the session. This capability is currently disabled by default and configurable through CLI. The CLI command to enable/disable the feature is:

  set ica parameter EnableSRonHAFailover YES/NO

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/ns-ag-appflow-intro-wrapper-con/session-reliablility-on-netscaler-ha-pair.html
  [From Build 49.16]
  [# NSHELP-15838, 438710, 547601, 620411]

AAA-TM

• At present, customization of the Portal pages is only offered for Gateway virtual server. Admins often have the same branding requirements for the Login page that is presented on the Authentication virtual server page - for example, tmindex.html. This enhancement supports Portal Theme binding for the Authentication virtual server.
  [From Build 47.14]
  [# NSHELP-7580, 475585, 552072, 606858, 619869]

• OAuth Support for Multi-Factor Authentication

  The NetScaler appliance now supports OAuth in a multifactor deployment and for cascading authentication. That is, OAuth can be now be used anywhere in a cascade, in first factor or in any of the factors, and as a fallback authentication policy.

  In earlier releases, OAuth could be used only for the first factor.

  Note: To use OAuth in a factor other than the first, you must register an authentication FQDN with the application because OAuth must start and end on the same virtual server.
  [From Build 41.26]
  [# 611735]

• OAuth Support for Multi-Factor Authentication

  The NetScaler appliance now supports OAuth in a multifactor deployment and for cascading authentication. That is, OAuth can be now be used anywhere in a cascade, in first factor or in any of the factors, and as a fallback authentication policy.

  In earlier releases, OAuth could be used only for the first factor.

  Note: To use OAuth in a factor other than the first, you must register an authentication FQDN with the application because OAuth must start and end on the same virtual server.
  [From Build 47.14]
  [# 611735, 572701, 572705]

• This enhancement allows the user to Preview the custom portal themes by binding it to an Authentication virtual server. Earlier this support was only present for Gateway virtual servers.
  [From Build 47.14]
  [# 620908]

• You can now change the credential default behavior by defining the loginschema so that the desired credentials (username and password) are used for SSO. To use the first factor for the SSO, you configure the loginschema to store the first factor credential at the specified indexes and use attribute expressions for the traffic policies.

  Previously, multiple sets of login credentials were required for nFactor authentication. By default, the credentials used for the final factor were the default single sign-on (SSO) user name and password. If the first factor was LDAP (Lightweight Directory Access Protocol) but the second factor OTP (One Time Password) on a non-Active Directory password, the default credentials became OTP. This procedure was complex and affected usability.

  Configuration:

  > set authentication loginSchema ls1 -SSOCredentials YES Done

  > set authentication loginSchema ls1 -SSOCredentials NO Done
  [From Build 49.16]
  [# 647382]

• Maximum relayState size accepted by NetScaler SAMLIdP is increased to 2500 bytes

  With this enhancement, maximum relayState size accepted by NetScaler SAMLIdP is increased to 2500 bytes as compared to existing 1024 bytes.
  [From Build 53.13]
  [# NSHELP-1375]

• Transitive and forest trust support between multiple domains

  The NetScaler appliance with KCD authentication is now enabled to work with transitive, forest-level trust through multiple domains.
  [From Build 59.10]
  [# NSHELP-908, 710106]

• Setting NSC_TMAS cookie for HTTPS

  NetScaler appliance sets only secure cookie (NSC_TMAS) for secure or HTTPS traffic management servers.
  [From Build 62.8]
  [# NSHELP-8493]

AAA-TM/NetScaler Gateway

• With this enhancement, NetScaler now supports GET requests from SAML SPs.
  [From Build 47.14]
  [# NSHELP-8035, 590768]

• This enhancement provides NetScaler, which acts as a SAML IDP, to pass the SPID value to the SP in an IDP initiated connection.
  [From Build 47.14]
  [# NSHELP-8112]

NetScaler CLI

• Force Password Change

  The default root credentials for a NetScaler appliance is "nsroot". However, for security reasons, you might enforce a password change to ensure the credentials are changed to a new value other than the default value. To implement this, a new parameter, "forcePasswordChange" is introduced.

  If you, as a root administrator log on with default credentials and set forcePasswordChange to ENABLED, on your next subsequent logon attempt, you will be prompted to change the password, and will not be allowed to log on without doing so. After the password is changed, the prompt no longer appears.

  Note: You are prompted to change the current password to a new one only if the ForcePasswordChange parameter is enabled. Otherwise, you can access the appliance with the default login credentials (user name: NSROOT, password: NSROOT).
  [From Build 51.21]
  [# NSHELP-4371, 638504]

• 1) A new system parameter was added. "totalAuthTimeout" - the default value is 20 seconds, minimum value 5 seconds and maximum 120 seconds. set system parameter - totalAuthTimeout <positive_integer>

  2) A new aaa radius param was added. authservRetry - the default value is 3 retries, minimum 1 and maximum 10 retries can be configured.

  set aaa radiusParams - authservRetry <positive_integer>
  [From Build 47.14]
  [# NSHELP-10182]

NetScaler CPX

• Container-Based Application Delivery Controller

  Citrix NetScaler CPX is a container-based application delivery controller that can be provisioned on a Docker host. NetScaler CPX enables customers to leverage Docker engine capabilities and use NetScaler load balancing and traffic management features for container-based applications. You can deploy one or more NetScaler CPX instances as standalone instances on a Docker host. For more information, see About NetScaler CPX: http://docs.citrix.com/en-us/netscaler-cpx/11-1/about-netscaler-cpx.html.
  [From Build 47.14]
  [# 627953, 632576]

• Open Source packages are now available in NetScaler CPX

  All the open source packages that are used in NetScaler CPX are available in the contrib/cpx/ folder.
  [From Build 49.16]
  [# 652842]

• New End User License Agreement (EULA) for NetScaler CPX Express

  You now need to accept an End User License Agreement (EULA) to install and use the NetScaler CPX Express.

  The End User Licensing Agreement is available at: https://www.microloadbalancer.com/eula.

  For more information, see http://docs.citrix.com/en-us/netscaler-cpx/11-1.html.
  [From Build 51.21]
  [# 656632]

NetScaler GUI

• High Availability Status Information in the Top Pane

  The top pane of the NetScaler GUI now displays the High Availability status of the node. This instant visibility of HA status helps you monitor the HA configuration efficiently.
  [From Build 47.14]
  [# 423777, 466239, 582803]

• Diagnostic of Start New Trace and Support Stop Running Trace

  Starting and stopping nstrace are now separate options in the NetScaler GUI. As a result, it is easier to stop a running trace and download the results.

  Navigate to System > Diagnostics and select "Start New Trace" or "Stop Running Trace."
  [From Build 47.14]
  [# 564499, 565594]

• Tabular, One-page NetScaler Application Firewall Wizard

  The new, tabular, NetScaler Application Firewall wizard improves flexibility and accelerates the completion of tasks. You can go back to any page and edit any details about profiles, policies, and signatures, and skip screens that are not mandatory. In addition, all resource-consuming tasks, such as submission and binding, are completed after you click Finish.

  For more information about the wizard, see http://docs.citrix.com/en-us/netscaler/11-1/application-firewall/configuring-application-firewall/using-wizard.html
  [From Build 47.14]
  [# 587433, 557185, 619712]

• To test connectivity from a subnet IP (SNIP) address to another IP address, you can now select the source address from a list of SNIP addresses instead of typing the SNIP address. If the SNIP address is not in the list, you can add it. To use this feature, navigate to System > Diagnostics. In Utilities, select ping or ping6, and then select "SNIP."
  [From Build 47.14]
  [# NSHELP-11680]

• The NetScaler appliance was enhanced so Negotiate Authentication is available for VPN Virtual Servers. The GUI reflects this under the NSG > Policies > Authentication node.
  [From Build 47.14]
  [# 600708]

• GUI Wizard for CloudBridge Tunnel Configuration

  The NetScaler GUI now provides a wizard for easy configuration of a CloudBridge Connector tunnel between the NetScaler appliance and a Virtual Private Gateway on Amazon AWS.
  [From Build 47.14]
  [# 602678]

• Improved IPv4 Address Fields

  IPv4 address fields now do not have dot separators, which improve the usability of these fields.
  [From Build 47.14]
  [# 610522]

• SSL Certificate Management GUI Enhancements and Changes

  1) Links to the following pages have been removed from the SSL overview page:

  - Create RSA Key

  - Create DSA Key

  - Create CSR

  - Create Certificate

  To access these pages, navigate to Traffic Management > SSL > SSL Files.

  2) Server, client, and CA certificates are now segregated. When you bind a certificate to an SSL end point, only the list of appropriate certificates appears. For example, when you bind a server certificate to an SSL virtual server, only the server certificates are listed. In earlier releases, all the certificates, including client and CA certificates, were listed.

  3) You can configure an SNMP trap from the "Install Certificate" page to send a notification when the certificate is about to expire. For a valid certificate in the notification period, status changes to yellow. For an expired certificate, status changes to red.

  4) "Certificate format" field has been removed, because the format (PEM/DER/PFX/Bundle) is automatically detected by the software during certificate installation. Also, if the file is not password protected, you are not prompted for a password.

  5) The key files, CSR files, and certificate files are segregated onto different tabs for ease of use.

  6) The SSL certificate overview page now explains the end-to-end flow of managing certificates on your appliance.
  [From Build 47.14]
  [# 612894]

• Usability Support to Upload Technical Support Collector Archive

  You can now automatically upload the technical support collector archive to Citrix Support servers.

  Navigate to System > Diagnostics > Technical Support Tools > Generate support file, and select Upload the Collector Archive. Type your user credentials and click Run.
  [From Build 47.14]
  [# 614285, 620953]

• Icons for Action and Information Menus

  Two new icons in the NetScaler GUI display action menus and information menus. If you are in a window with detail-view rows, and the rows have actions, you can now display the action menu by clicking the action icon in that row, rather than right-clicking the row.

  Similarly, you can display the info menu by clicking the info icon.
  [From Build 47.14]
  [# 614868]

• In the load balancing visualizer, you can now seamlessly migrate the configuration of a service to all the services bound to the virtual server. To copy the settings of one service to all the other services, in the visualizer, click "Configuration Sets," select a service, and then click "Migrate Config."
  [From Build 47.14]
  [# 619498]

• Support for High Availability Configuration for a Secure Access Only Remote node

  The NetScaler GUI now supports configuration of a node in High Availability (HA) mode even if the Secure Access Only option is enabled for the NetScaler IP (NSIP) address of the other node in the HA pair.
  [From Build 47.14]
  [# 624858]

• FIPS-140-2 level compliance

  After you successfully enable FIPS mode on a NetScaler 14000 FIPS appliance, existing configurations that use SNMP versions 1, version 2, and the "noPrivacy" security levels of SNMP version 3, are removed from the appliance and you are not allowed to reconfigure them. This is required for FIPS-140-2 level compliance.
  [From Build 51.21]
  [# NSHELP-3002]

• What is added?

  The XenApp and XenDesktop wizards provide a new authentication configuration flow, and a new configuration download option to automatically import the NetScaler Gateway configuration required for StoreFront. In addition, all sections in the wizard have been refined to make overall deployment configuration much simpler. The following new configuration options are provided:

  1. You can use a FQDN to connect to a virtual server, instead of using the IP address. A Gateway FQDN virtual server can forward traffic to a NetScaler Gateway virtual server IP address.

  2. StoreFront FQDN is changed to StoreFront URL ( HTTP / HTTPS ).

  3. The Authentication section now supports the following authentication types for StoreFront: Domain, RSA, SMS, Smart Card and RSA+ Domain.

  4. XenApp and XenDesktop wizard dashboards provide a button that downloads the configuration file. This file only contains the first NetScaler Gateway successfully created configuration.

  The following items have been removed from the XenApp and XenDesktop wizards:

  1. Load Balancing configuration section under the StoreFront settings

  2. Load Balancing configuration section under the Authentication section

  3. XenApp Farm section

  4. Advanced configuration options for deploying StoreFront

  What is expected in case of an upgrade?

  When a NetScaler appliance is upgraded to a build with a new XenApp and XenDesktop wizard, any deployments created in the previous version retain the old wizard view and functionality. New NetScaler Gateway deployment for StoreFront will use the new flow.
  [From Build 48.10]
  [# NSUI-916]

NetScaler Insight Center

• You can now use NetScaler Insight Center to monitor NetScaler integrated caching. Cache Insight enables you to see and monitor the various actions performed by the NetScaler cache.
  [From Build 47.14]
  [# 498439]

• You can now enable, edit, or clear AppFlow on multiple virtual servers simultaneously. To perform these actions, navigate to Configuration > Inventory and open your NetScaler Instance. Select the virtual servers and click Enable AppFlow, Edit AppFlow Settings, or Clear AppFlow Configuration, respectively.
  [From Build 47.14]
  [# NSHELP-5791]

• NetScaler Insight Center can now use the X-Forwarded-For header to display the actual client IP address instead of the IP address of the proxy that forwarded the request.
  [From Build 47.14]
  [# NSHELP-13116]

• You can now view USB event reports of a user's active sessions on HDX Insight. You can view details such as USB Status, Number of USB Instances Accepted, Number of USB Instances Rejected, and Number of USB Instances Stopped.
  [From Build 47.14]
  [# NSHELP-16001]

• You can now assign IPv4, IPv6, or both IP addresses to your NetScaler Insight Center server. To assign a new IP address, navigate to Configuration > System > Network Configuration, and select IPv4, IPv6, and/or both and specify the network parameters.

  If you specify both IPv4 and IPv6 addresses, you can access the NetScaler Insight Center by using any one of the IP addresses.
  [From Build 47.14]
  [# 582943]

• You can now search for a specific application, client, or server by using the Search option in Web Insight.
  [From Build 47.14]
  [# NSHELP-15938]

• You can now view the client's machine name for any user session in HDX Insight.
  [From Build 47.14]
  [# NSHELP-8932]

• You can now view the current session details from the Geomaps section in HDX Insight.
  [From Build 47.14]
  [# NSHELP-8939]

• In HDX Insight, you can view a diagrammatic representation of a client's current session details.

  Navigate to HDX insight > Users, and in the Current Sessions section, click the Diagram button to display details such as Client IP address, NetScaler IP address, Origin Server IP address, Country, Region, Session ID, and Client Version.
  [From Build 47.14]
  [# NSHELP-8945]

• The following thin clients now support HDX Insight:

  -WYSE Windows based thin clients

  -WYSE Linux based thin clients

  -WYSE ThinOS based thin clients

  -10Zig Ubuntu based thin clients
  [From Build 47.14]
  [# 614892, 550997, 604388, 620422, 632370]

• 1)You can now use NetScaler Insight Center to monitor and manage your incoming traffic's IP Reputation.

  2)You can now enable/disable AppFlow for Security insight separately from the Enable AppFlow option. To Enable or Disable AppFlow, navigate to Configuration > Inventory and open your NetScaler Instance. Select the virtual servers and click Enable AppFlow and select the Security Insight option.
  [From Build 47.14]
  [# 635528]

• You can only enable or disable the X-Forwarded-For feature using the NetScaler appliance's CLI. To enable this feature, at the command prompt, type: "set appflow param httpXForwardedFor ENABLED".
  [From Build 51.21]
  [# NSADM-29888]

NetScaler SDX Appliance

• Support to display the details for Out of Service state

  Management Service now displays the reason for Out Of Service state of the NetScaler instances when you mouse over on them in the dashboard.
  [From Build 47.14]
  [# 393721]

• Support to send selective system notification through email or SMS

  You can now send notifications to communicate with selected groups of users for a number of system-related functions.
  [From Build 47.14]
  [# 434771]

• Static Routes Support for Management Service

  You can now specify an IP address as a static route when provisioning a NetScaler instance. The instance then uses this address, instead of the default route, to connect to the Management Service.
  [From Build 47.14]
  [# NSHELP-10915]

• Option to Set CLI Prompt

  You can now customize the CLI prompt of the Management Service.
  [From Build 47.14]
  [# 526292]

• Ability to configure SSL Ciphers to Securely Access the Management Service

  You can select SSL cipher suites from a list of SSL ciphers supported by SDX appliances, and bind any combination of the SSL ciphers to access the Management Service securely through HTTPS
  [From Build 47.14]
  [# NSHELP-11033]

• IPv6 Support

  SDX Appliances now support IPv6 addresses in the following configurations:

  - SDX Network Configuration

  - Server Configuration

  - Authentication Server

  - Syslog Server

  - SNMP Server

  - Notification Server

  - SNMP Interface Configuration

  - NetScaler Configuration (If provisioning uses IPv6 address.)
  [From Build 47.14]
  [# 531419, 251566]

• Scaling the Throughput of NetScaler Instances

  You can now allocate up to 16 CPU cores to each NetScaler instance on an SDX 25xxx appliance and up to 10 CPU cores to each NetScaler instance on an SDX 14xxx 40G appliance to scale the throughput of these instances.
  [From Build 52.13]
  [# NSPLAT-5228, 615198]

• Ability to generate partition MAC addresses

  You can now generate partition MAC addresses on a NetScaler SDX appliance and use them to configure admin partitions on a NetScaler instance on the appliance.

  For more information, see http://docs.citrix.com/en-us/sdx/11-1/configuring-managing-netscaler-instance/generate-partition-MAC-addresses.html.
  [From Build 47.14]
  [# NSSVM-2130]

• Option to Disable nsrecover Login Account

  Using the Management Service interface, you can now disable the nsrecover login account. To disable the nsrecover login account, navigate to "Configuration > System > Configure System Settings" and clear the "Enable nsrecover Login" check box.
  [From Build 47.14]
  [# NSSVM-2089]

• Updated Encryption Method

  The management service now uses the SHA512 encryption method to encrypt the nsrecover passwords stored on the SDX appliance.
  [From Build 47.14]
  [# NSHELP-11238, 578112]

• Support to Encrypt Backup Files

  The Management Service now provides an option to encrypt the backup files.

  For more information, see http://docs.citrix.com/en-us/sdx/11-1/configuring-management-service/backup-restore.html.
  [From Build 47.14]
  [# NSHELP-4527]

• Disable physical interface on the NetScaler SDX appliance

  If you are not using any of the physical interfaces on a NetScaler SDX appliance, you can now disable them by using Management Service.

  For more information, see http://docs.citrix.com/en-us/sdx/11-1/manage-monitor-appliance-network-configuration/managing-interfaces.html.
  [From Build 47.14]
  [# NSHELP-11319]

• For any operations that require NetScaler SDX appliance reboot, Management Service now detects the unsaved configurations on the NetScaler instances and prompts you to save them.
  [From Build 47.14]
  [# 581603]

• Support to transfer backup files to an external backup server

  You can now configure a NetScaler SDX appliance to transfer the backup files to an external backup server by using FTP, SFTP, and SCP.

  For more information, see http://docs.citrix.com/en-us/sdx/11-1/configuring-management-service/backup-restore.html.
  [From Build 47.14]
  [# 581604, 576259]

• Clean Install is Supported on all the NetScaler SDX Platforms

  Using the Management Service, you can now do a clean install of any NetScaler SDX appliance, regardless of the platform.

  Note: Before initiating the clean install, make sure that the factory partition on the appliance has enough space for the extracted single-bundle image.

  For more information, see http://docs.citrix.com/en-us/sdx/11-1/configuring-management-service/performing-a-factory-reset.html.
  [From Build 51.21]
  [# 605703]

• Cascade Authentication for System Users

  You can now cascade external authentication servers to have a continuous, reliable authentication process in place to authenticate and authorize external users. If authentication fails on the first authentication server, the NetScaler SDX Management Service attempts to authenticate the user by using the second external authentication server, and so on.

  You can cascade up to 32 external authentication servers.

  For more information, see http://docs.citrix.com/en-us/sdx/11-1/configuring-management-service/cascading_external_authentication_servers.html.
  [From Build 47.14]
  [# NSHELP-11543, 612186]

• Option to select the protocol for NetScaler and Management Service communication

  Using the Admin profile, you can now specify whether the Management Service and the NetScaler VPX instance should communicate with each other only over a secure channel or by using HTTP.
  [From Build 47.14]
  [# 616436, 621482]

• Option to add Network Subnet instead of specific IP address or hostname of the SNMP Manager.

  You can now add the network subnet of the SNMP manager instead of specifying the SNMP Manager's IP address or host name. If you do not configure at least one SNMP manager, the appliance accepts and responds to SNMP queries from all IP addresses on the network. If you configure one or more SNMP managers, the appliance accepts and responds only to SNMP queries from those specific IP addresses or IP addresses from that subnet.

  For more information, see http://docs.citrix.com/en-us/sdx/11-1/manage-monitor-appliance-network-configuration/configuring-snmp-trap-destination.html.
  [From Build 47.14]
  [# NSHELP-11718, 440103]

• Support for NetScaler SDX 25000A Platform

  This release includes the support for new NetScaler SDX platform, SDX-25000A.
  [From Build 51.21]
  [# NSPLAT-2524]

• Support for NetScaler SDX 25000A Platform

  This release includes the support for new NetScaler SDX platform, SDX-25000A.
  [From Build 50.10]
  [# NSPLAT-2524]

• Support for SNMP MIB-2 Table Interfaces

  NetScaler SDX Appliances now support SNMP MIB-2 table interfaces, using which you can get the details of all the interfaces and channels on the NetScaler SDX Appliance.
  [From Build 51.21]
  [# NSHELP-14500]

• Support for Alarm Threshold and Timeout Value

  When configuring SNMP in the Management Service, you can now define the alarm threshold and timeout values.
  [From Build 51.21]
  [# NSHELP-2496]

• Support to add Additional DNS Servers

  In the Management Service, you can now add up to two additional DNS servers to the network configuration. The additional DNS servers can have either IPv4 or IPv6 addresses.

  Note: Make sure that you:

  * Add a DNS server IP address or two DNS server IP address as additional DNS server.

  * Do not use the same DNS server IP address for the primary DNS server and additional DNS servers.

  For more information, see http://docs.citrix.com/en-us/sdx/11-1/hardware-installation/sdx-initial-configuration.html.
  [From Build 51.21]
  [# NSHELP-4530]

• Support for NetScaler SDX 8900 Appliance

  This release supports the NetScaler SDX 8900 appliance.

  For more information see the following documentations:

  NetScaler SDX Hardware-Software Compatibility Matrix

  https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/supported-versions.html

  Citrix NetScaler SDX 8900

  https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/hardware-platforms/8900.html

  Citrix Downloads page

  https://www.citrix.com/downloads/netscaler-adc/components/netscaler-firmware-59xx-89xx.html
  [From Build 57.13]
  [# NSPLAT-4412, 636909]

• Not Mandatory to Provide the NetScaler VPX Admin Account Details

  Providing the NetScaler VPX admin account details is now optional when you use the Management Service to provision a NetScaler VPX instance on a NetScaler SDX appliance.
  [From Build 51.21]
  [# 658380]

• 2048-bit default certificate

  A NetScaler appliance now uses a 2048-bit default certificate.

  Note: Before installing a 2048-bit certificate, you must delete the 1024-bit default certificate and its keys, and then restart the Management Service.

  On a NetScaler SDX Appliance, the existing default certificate and keys are at the following locations:

  * Default certificate: /var/mps/ssl_certs/

  * Default key: /var/mps/ssl_keys
  [From Build 51.21]
  [# 658381]

• Support for Events and Alarms for SDX Backup

  Alarms and events are generated if any VPX instance running on an SDX appliance is either out of service or unreachable at the time of SDX backup. To view the alarms and events about any discrepancy in the backup file, from the NetScaler SDX GUI navigate to Configuration > System > Events/Alarms.
  [From Build 57.13]
  [# NSSVM-210]

• Support for VPX Instance on SDX 8900 Appliance

  This release supports NetScaler VPX instance on a NetScaler SDX 8900 appliance. Note that the NetScaler SDX 8900 appliance is available only on release 11.0 build 70.109, but the VPX instances are supported on 11.0 builds 70.109 and 70.112 and 11.1 build 56.15. For more information see:

  https://docs.citrix.com/en-us/sdx/11/hardware-installation/sdx-hardware-platforms/sdx-8900.html

  https://docs.citrix.com/en-us/sdx/11-1/sdx-ag-supported-versions-ref.html
  [From Build 56.19]
  [# NSOTHER-98]

• Support for SDX 26000-100G Platform

  This release supports the SDX 26000-100G platform. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/hardware-platforms/sdx-26xxx100g.html
  [From Build 58.13]
  [# NSPLAT-4920]

• Support for SDX 15000-50G Platform

  This release supports the SDX 15000-50G platform. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/hardware-platforms/sdx-15xxx50g.html
  [From Build 59.10]
  [# NSPLAT-4935]

NetScaler SDX appliance

• Support for pooled licensing on SDX platforms

  Now you use the NetScaler MAS pooled licensing option with all on all SDX platforms. Previously, pooled licensing was support only a few platforms. For more information, see: https://docs.citrix.com/en-us/netscaler-mas/12/netscaler-pooled-capacity.html.
  [From Build 62.8]
  [# NSSVM-2108, NSSVM-532]

NetScaler VPX Appliance

• New license for NetScaler VPX on ESX and KVM platforms

  40G license is now available for NetScaler VPX appliance on ESX and KVM platforms

  For more information about recommended interfaces and performance details, refer to the latest VPX datasheet.
  [From Build 47.14]
  [# 623179]

• The number of unique IPv6 addresses that you can add to a NetScaler virtual appliance configured with SR-IOV interfaces is limited to 30 on the following platforms:

  * XenServer

  * Linux-KVM

  * VMware ESX
  [From Build 49.16]
  [# 639229]

• MAS as a Centralized License Management Server

  With the NetScaler Check-In/Check-Out (CICO) Licensing feature, when you provision NetScaler VPX instances you can now assign licenses from NetScaler MAS, which acts as a centralized license management server. When a VPX instance is retired or removed, the license is released back to the MAS licensing server so that you can assign it to another instance if required.

  For more information, see http://docs.citrix.com/en-us/netscaler-mas/12/NetScaler-CICO0.html.
  [From Build 54.16]
  [# NSUI-629]

• Support for Jumbo Frames on NetScaler VPX Appliances Running on AWS

  Jumbo frames are now supported on NetScaler virtual appliances running on Amazon Web Services (AWS).

  You can send larger data payload through each frame, which makes data transmission more efficient. To enable Jumbo Frames, use NetScaler CLI, GUI, or NITRO API.
  [From Build 51.21]
  [# NSHELP-3063]

• New license for NetScaler VPX on XenServer and KVM platforms

  The following licenses are now available for NetScaler VPX appliances on a XenServer platform:

  * 25MB

  * 5G

  * 8G

  * 10G

  * 15G

  * 25G

  Also, a 100G license is now available for NetScaler VPX appliances on a KVM platform.

  For more information about recommended interfaces and performance details, see the latest VPX datasheet.
  [From Build 49.16]
  [# 660256]

• Support for PCI Passthrough Interfaces on NetScaler VPX Appliances Installed on VMware ESX Server

  You can now configure a NetScaler VPX instance deployed on VMware ESX Server to use PCI passthrough interfaces.

  For performance information about PCI passthrough interfaces on ESX Server, see the latest VPX datasheet.
  [From Build 51.21]
  [# NSPLAT-2941]

• Support for NetScaler VPX Appliances on Cisco CSP 2100

  You can now deploy an SR-IOV enabled NetScaler VPX instance on Cisco Cloud Services Platform (CSP) 2100 to enable network functions virtualization (NFV) for your environment. CSP 2100 is an open, x86 Linux Kernel-based virtual machine (KVM) software and hardware platform designed for data center NFV. For more information, see https://docs.citrix.com/en-us/netscaler/11-1/deploying-vpx/vpx-instance-enabled-with-sriov-on-cisco-csp.html
  [From Build 56.19]
  [# NSPLAT-3443]

NetScaler Gateway

• You can now extract attributes from Access Control Server (ACS) and Terminal Access Controller Access-Control System (TACACS). The extracted attributes allow the admin to use the NetScaler Group Attribute command to authorize usage.
  [From Build 49.16]
  [# NSHELP-509, 625415]

• This enhancement provides NetScaler the ability to use the FIPS SSL key to perform SAML signing. For all customers looking for FIPS compliant devices and SAML based user identity, this enhancement is very useful.
  [From Build 47.14]
  [# NSAUTH-1140, 457851, 553143]

• VPN License Counter for SNM

  A new VPN license counter for SNMP monitors license issues, and you can add or remove licenses as needed.
  [From Build 51.21]
  [# NSHELP-7028]

• This enhancement provides the ability to a clear config basic command so it will not erase the TACACS related configuration.
  [From Build 47.14]
  [# NSHELP-9336]

• This enhancement provides the ability for the end-user to specify the RDP destination instead of the administrator pre-configuring it. The Gateway portal provides the option to provide a field where the user can enter the RDP destination. The user can launch the RDP connection by entering the destination info. This option is administrator-controlled, so that only a specific group of users can be provided with this capability.
  [From Build 47.14]
  [# NSHELP-1733]

• This enhancement supports SAML SP Artifact Binding flows for nfactor.
  [From Build 47.14]
  [# 554999]

• The STA and nextHop VPN parameters can now be configured using FQDN instead of just the IP address. The STA server is used for authorizing ICA connections and NextHop is used for specifying the second-hop in a "double-hop" Gateway deployment.
  [From Build 47.14]
  [# NSHELP-7418, 566511]

• The NetScaler Gateway wizard now provides an option to retrieve LDAP attributes when creating an LDAP Action. Also, you can choose an extracted LDAP attribute as an LDAP Login name, and you can evaluate LDAP bind credentials.
  [From Build 49.16]
  [# CGOP-1673]

• This enhancement introduces support for a new key transport algorithm(RSA-V1_5). The RSA-V1_5 can used to encrypt SAML assertions along with RSA-OAEP.
  [From Build 47.14]
  [# NSHELP-8052]

• The AlwaysOn feature enables Gateway plugins to detect the location of the user (intranet/corporate vs. Internet/extranet) and establish the VPN connection automatically. The Administrator controls the plugin behavior to establish the connections to all locations or only from internet. Also, controls are provided to enable/disable the user's ability to logoff from the Gateway and network behavior when the VPN connection has not been established.

  This feature is very useful for enhancing the end-user experience by eliminating the manual step of establishing/terminating the VPN connection. It is also very helpful for customers looking to maintain strict security controls on remote access users by tunneling all traffic through the Gateway. The feature is supported on the Windows platform.
  [From Build 47.14]
  [# NSHELP-7779]

• Multi-factor authentication enhances the security of an application by requiring users to provide multiple proofs of identification to gain access. The NetScaler appliance provides an extensible and flexible approach to configuring multi-factor authentication. This approach is called nFactor authentication.

  This multi-factor authentication capability is now available for all Gateway use cases as well
  [From Build 47.14]
  [# 597011]

• This enhancement allows the binding of DNS-based Rewrite or Responder policies to Gateway VPN virtual servers. This enhancement can filter-in or filter-out DNS traffic going through the SSL VPN.
  [From Build 47.14]
  [# NSHELP-7726]

• In this release, RDP Proxy connections use the same IP and port as that of the Gateway vserver. Hence, there is no need to open any new IP or port on the uplink firewalls.
  [From Build 47.14]
  [# CGOP-1562]

• Framehawk technology is used to provide the best end-user experience on Citrix virtual apps/desktops (ICA/HDX connections) on any type of network. NetScaler Gateway now supports ICA/HDX connections based on Framehawk with double STA tickets. This helps to maintain fault tolerance from STA servers.
  [From Build 47.14]
  [# 603904, 615718]

• In this release, the UI experience for Windows plugin has been improved. New capabilities like the drop-down list of connected Gateway servers has been added. Also, more status information, like progressive bars during download or VPN connection establishment, has been added.
  [From Build 47.14]
  [# CGOP-5389]

• The RfWeb UI Gateway feature provides users a consistent portal experience when accessing corporate apps and resources from inside corporate network or remotely from Internet. The StoreFront Receiver for the Web User Interface (RfWeb UI) is now available from NetScaler Gateway natively. This UI is provided as a portal theme that can be bound to Gateway virtual server/global to get the exact same UI experience as that of StoreFront.

  By using the RfWeb UI theme, customers can consolidate all types of applications - Citrix virtual apps/desktops, Enterprise webapps, SaaS/cloud apps, RDP resources and SSL VPN apps - on the Gateway portal with the same experience as that of StoreFront.

  This feature supported from StoreFront 3.6 onwards.
  [From Build 47.14]
  [# 604419, 522033]

• Non-Blocking LDAP SSL/TLS authentication support added. This enhancement reduces the authentication bottleneck to prevent delayed/denied user logons.
  [From Build 47.14]
  [# NSHELP-7656]

• The DNS resolution through NetScaler Gateway or the NetScaler G ateway Plug-in if IPv6 is enabled on the client's adapter and the ISP provides the IPv6 DNS address on the IPv6 stack.
  [From Build 51.21]
  [# NSHELP-1210]

• The NetScaler appliance inserts an NS_ESNS cookie for page tracking (for showing a waterfall chart) when AppFlow is enabled. Cookie insertion was controlled by the clientSideMeasurements option in the appflow action in release 10.5, but in release 11.0 the default became to always insert the cookie when appflow is enabled. Android receiver (HTTP client) was not able to handle this cookie. This fix adds the Enable/Disable page tracking (cookie insertion) option to the appflow action.

  You can now enable or disable Page tracking feature from NetScaler Insight Center.

  To perform this action, navigate to Configuration > System > Appflow > Actions. Edit an AppFlow action name, and select the Page Tracking check box.
  [From Build 47.14]
  [# NSHELP-3470, 598478, 608448]

• This enhancement allows an admin to view the different LoginSchemas present in NetScaler. This is done from the NetScaler admin GUI under LoginSchema Profiles configuration. Use the following path to see the LoginSchemas: Configuration>Security>AAA -Application Traffic>Login Schema>Profiles.
  [From Build 47.14]
  [# 617921]

• You can now use advanced (PI) expressions for external authentication. PE expressions are also supported.
  [From Build 51.21]
  [# 620070]

• This enhancement provides NetScaler, which is acting as SAML IDP, the capability to sign the entire SAML response along with the assertion.
  [From Build 47.14]
  [# NSHELP-8282]

• The global AAA parameter "set aaa param -maxaAAUser <value>" has been enhanced to automatically increase or decrease when new concurrent user (CCU) licenses are added or removed. Previously, adjusting the MaxAAAUser count was a manual adjustment that needed to be done after extra licenses were added. This value represents the maximum number of global AAA sessions that can exist. If you want to restrict the number of AAA sessions to a value lower than the licensed limit, you can set the maxaAAUser parameter on the gateway virtual server.
  [From Build 49.16]
  [# 624773]

• The NetScaler Gateway Visualizer provides an easy visual representation of the configurations done using the NetScaler Gateway Wizard. It shows the pre-authentication and authentication policies, Content Switching, NetScaler Gateway and Load Balancing virtual servers, XA/XD apps, Web and SaaS apps.

  Along with the visual representation, admins can use this Visualizer for below purposes:

  1. Edit the NetScaler Gateway configuration

  2. View various policies, like Session Policy, Rewrite and Responder Policy etc.

  3. Add new configuration, like policies, Web apps, SaaS apps.

  4. View the state of the Load Balancing, vservers and services, NetScaler Gateway vserver and Content Switching vserver
  [From Build 47.14]
  [# 625465]

• You can now terminate specified RDP proxy connections.

  kill rdpConnection [-userName <string>] [-all]

  - userName: Terminates RDP Proxy connections that belong to the specified user.

  - all: terminates all active rdp proxy connections.
  [From Build 49.16]
  [# NSHELP-8734]

• New CCU packaging and pricing have changed in the following ways:

  1. MaxAAA is automatically set to the maximum licensed number.

  2. Licenses now use the following scheme:

  a. Platinum: Unlimited (formerly 100)

  b. Enterprise: 1000 (formerly 5)

  c. Standard: 500 (formerly 5)

  d. Any other license: 5

  e. If additional CCU licenses are present on the system, you add those to the above values

  (for example, standard is 500 + any additional CCU licenses).

  f. Disregard additional CCUs for the platinum case, since platinum is already unlimited.
  [From Build 49.16]
  [# NSHELP-8050]

• During certificate authentication, if only one certificate is present on a client's computer, it is now chosen by default. The user is no longer prompted to select a certificate. However, if two or more certificates are present, the user is prompted to select a certificate. Additionally, if the certificate is successfully authenticated, the certificate preference is automatically saved. The preference is removed if the certificate authentication later fails, or if the user manually clears the saved certificate option by setting NetScaler Gateway Plugin preferences.
  [From Build 48.10]
  [# NSHELP-6844]

• Other Opswat EPA scans, such as version match checking, can be configured to verify HP drive encryption.
  [From Build 49.16]
  [# NSHELP-6759]

• NetScaler Gateway now supports Microsoft InTune.
  [From Build 51.21]
  [# NSAUTH-3112]

• In the XenApp/XenDesktpo configuration wizard, the StoreFront Settings Download option is now hidden if StoreFront is not deployed.
  [From Build 49.16]
  [# 651852, 642556]

• The NetScaler appliance now allows you to choose an existing domain-server configuration, if available, instead of having to configure a new domain server when the appliance is updated.

  Previously, if you configured a domain server, you would not be able to use the existing configuration when the NetScaler appliance was updated, because there was no provision to choose an existing configuration for the XA-XD Wizard.
  [From Build 49.16]
  [# 655923]

• New StoreFront features are incorporated in the NetScaler Gateway Wizard.
  [From Build 51.21]
  [# 656840]

• The NetScaler Gateway appliance now supports the HDX Enlightened Data Transport (EDT) as a data transmission path. EDT provides a high definition in-session user experience of virtual desktops for users running a Citrix Receiver.
  [From Build 51.21]
  [# CGOP-1288, 666135]

• The SAML attribute limit has been increased from 256 bytes to 10 KB.
  [From Build 51.21]
  [# NSHELP-803]

• The XenApp & XenDesktop Wizard now supports exporting multiple Gateway deployments to supported StoreFront servers. In previous versions, only the first Gateway deployment was exportable. Now up to 32 deployments can be exported. All exported Gateway deployments are included in a single GatewayConfig.zip file.
  [From Build 51.21]
  [# CGOP-5509]

• Support for SAML ForceAuthn Parameter and Artifact Binding (when NetScaler is SP) using GET HTTP Method

  NetScaler SAML SP (Service Provider) module now sends additional attribute called 'ForceAuth' in the authentication request to external IdP (Identity Provider). By default, the ForceAuthn carries a value of 'false'. It can be set to 'true' to provide a hint to IdP to force authentication despite existing authentication context.

  Additionally, NetScaler SP does authentication request in query parameter when configured with artifact binding.
  [From Build 53.13]
  [# NSHELP-760]

• With this enhancement, Storefront server can be used to validate user credentials instead of Active Directory server. This simplifies Gateway configuration in XA/XD deployments where StoreFront server is mandatory.

  This is applicable only for end user login with password. This feature cannot be used for group extraction without user password. Please check documentation for details.
  [From Build 54.16]
  [# NSAUTH-3968]

• Support for FTP over TLS

  The NetScaler Gateway appliance now supports FTP over TLS.
  [From Build 57.13]
  [# NSHELP-8438]

Cluster

• PBR Support for Cluster

  Partially striped and spotted policy based routes (PBR) are now supported on a Layer 3 NetScaler cluster.
  [From Build 41.26]
  [# 611938]

Clustering

• LLDP Support in a Cluster Setup

  LLDP is a layer 2 protocol that enables a NetScaler appliance to advertise its identity and capabilities to the directly connected (neighbor) devices, and to learn the identity and capabilities of these neighbor devices. In a cluster setup, the NetScaler GUI and NetScaler CLI now display the LLDP neighbour configuration of all or specific cluster nodes when the GUI or CLI is accessed through the Cluster IP address (CLIP). Any change made to the global level LLDP mode is applied to the global level LLDP mode on each of the cluster nodes.

  For more information, see https://docs.citrix.com/en-us/netscaler/11-1/networking/interfaces/configuring-link-layer-discovery-protocol.html.
  [From Build 51.21]
  [# NSNET-5867]

• PBR Support for Cluster

  Partially striped and spotted policy based routes (PBR) are now supported on a Layer 3 NetScaler cluster.
  [From Build 47.14]
  [# 611938]

• SNMP MIB Support for Cluster Nodes

  In a cluster setup, you can now configure the SNMP MIB in any node by including the ownerNode parameter in the set snmp mib command. Without this parameter, the set snmp mib command applies only to the cluster coordinator node.

  To display the MIB configuration for an individual node other than the cluster coordinator node, include the ownerNode parameter in the show snmp mib command.
  [From Build 49.16]
  [# NSHELP-15944, 623888]

• You can now avoid closing a node's connections when you add the node to or remove it from a cluster. Before adding or removing a node, log on to the cluster IP (CLIP) address and set the "retain connections on cluster" option. Then log on to the node's NSIP address and specify a timeout interval for graceful shutdown.
  [From Build 51.21]
  [# NSHELP-15980, 634785]

• Audit-Log Support in Cluster

  A cluster setup of NetScaler appliances now supports the audit-log feature with SYSLOG-TCP, Load Balancing (LB) of SYSLOG servers, SNIP support, and FQDN support for SYSLOG configurations.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/clustering/cluster-features-supported.html
  [From Build 54.16]
  [# CGOP-6546]

DNS

• Dropping a DNS Query When the Query is Split into Multiple Packets

  New option '-splitPktQueryProcessing' is added to 'dns parameter' list. This option can be disabled to prevent processing of requests split across multiple packets.
  [From Build 53.13]
  [# NSHELP-12487]

• Preserving NetScaler Memory by Limiting the Memory Consumed by DNS Cache

  You can now limit the amount of memory consumed by the DNS cache. You can specify the maximum cache size (in MB), and also the cache size (in MB) for storing negative responses. When either limit is reached, no more entries are added to the cache. Also, SNMP traps are generated and syslog messages are logged.

  The maximum cache size is set using the maxCacheSize parameter and the cache size for negative responses is set using the maxNegativeCacheSize parameter.

  This limitation is added per packet engine. For example, if the maxCacheSize is set to 5 MB and the appliance has 3 packet engines, then the total configured cache size is 15 MB.
  [From Build 52.13]
  [# NSHELP-12495]

• Retaining DNS Records in Cache

  You can now retain the cache that is built so far and prevent it from being aged out. You can do so by using the cacheNoExpire parameter. When this parameter is enabled, the entries in the DNS cache is retained. When this parameter is disabled, the records are flushed out when the TTL expires.

  This option can be used only when the maximum cache size (maxCacheSize parameter) is specified.
  [From Build 52.13]
  [# NSHELP-12530]

• Enabling DNS Cache Bypass

  You can now configure the cacheHitBypass parameter so that the cache is built but not used. When this parameter is enabled, the requests bypass the DNS cache and are sent to the back-end servers. When this parameter is disabled, the NetScaler appliance starts responding from the cache that has been built so far.
  [From Build 52.13]
  [# NSHELP-12552]

• Collecting Statistics of the DNS Responses Served from the Cache

  You can now collect statistics of the DNS responses served from cache and use these statistics to create a threshold beyond which additional DNS traffic is dropped. You can enforce the threshold with a bandwidth based policy. Previously, bandwidth calculation for a DNS load balancing virtual server was not accurate, because the number of cache hits was not reported. In proxy mode, the statistics for Request bytes, Response bytes, Total Packets rcvd, and Total Packets sent statistics are continuously updated. Previously, these statistics were not always updated, particularly for a DNS load balancing virtual server.
  [From Build 53.13]
  [# NSHELP-12582]

• Flushing Negative Records

  Negative records (NXDOMAIN records and NODATA records) cannot be deleted from the NetScaler appliance's DNS cache. With this fix, you can use the flush dns proxyrecords command to flush negative DNS records from the DNS cache.
  [From Build 53.13]
  [# NSHELP-12611]

• Restricting TTL of Negative Records

  You cannot set an appropriate time to live (TTL) value for the negative records.With this fix, you can use the new maxnegcacheTTL option in the set DNS parameter list to set a TTL for negative records.
  [From Build 53.13]
  [# NSHELP-12617]

• Generating SNMP Traps and Syslog Messages When the Memory Consumed by DNS Cache Reaches the Limits Set for Caching DNS Records and Negative Responses

  You can now limit the amount of memory consumed by the DNS cache. You can specify the maximum cache size (in MB), and also the cache size (in MB) for storing negative responses. When either limit is reached, no more entries are added to the cache. Also, SNMP traps are generated and syslog messages are logged.
  [From Build 52.13]
  [# NSHELP-12631]

GSLB

• Support for EDNS0 Client Subnet

  The NetScaler appliance now supports the EDNS0 client subnet (ECS) option in deployments that include the NetScaler appliance configured as an ADNS server authoritative for a GSLB domain. In the deployment, if you use static proximity as the load balancing method, you can now use the IP subnet in the ECS option, instead of using the LDNS IP address, to determine the geographical proximity of the client. In the case of proxy mode deployment, the appliance forwards a DNS query with the ECS option as-is to the back-end servers and does not cache the DNS responses that include ECS option.

  Note: The EDNS0 client subnet (ECS) option is not applicable for some other deployment modes, such as ADNS mode for non-GSLB domains, resolver mode, and forwarder mode. In such modes, the ECS option is ignored by the NetScaler appliance.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/gslb/configure-EDNS0-client-subnet.html.
  [From Build 47.14]
  [# NSHELP-12332]

• Support for EDNS0 Client Subnet

  The NetScaler appliance now supports the EDNS0 client subnet (ECS) option in deployments that include the NetScaler appliance configured as an ADNS server authoritative for a GSLB domain. In the deployment, if you use static proximity as the load balancing method, you can now use the IP subnet in the ECS option, instead of using the LDNS IP address, to determine the geographical proximity of the client. In the case of proxy mode deployment, the appliance forwards a DNS query with the ECS option as-is to the back-end servers and does not cache DNS responses that include the ECS option.

  Note: The EDNS0 client subnet (ECS) option is not applicable for some other deployment modes, such as ADNS mode for non-GSLB domains, resolver mode, and forwarder mode. In such modes, the ECS option is ignored by the NetScaler appliance.
  [From Build 41.26]
  [# NSHELP-12332]

• Real-time Synchronization of the GSLB Configuration

  When you create or change the GSLB configuration on a master site, you can use the new AutomaticConfigSync option to automatically synchronize the slave sites.

  When AutomaticConfigSync option is enabled, you do not have to manually trigger the AutoSync option.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/gslb/configure-gslb/sync-configuration-gslb-setup.html.
  [From Build 51.21]
  [# NSHELP-3879]

• Backing UP a Parent Site in a Parent-Child Deployment

  The backup parent site topology is useful in scenarios wherein a large number of child sites are associated with a parent site. If this parent site goes DOWN, all of its child sites become unavailable. To prevent this, you can now configure a backup parent site to which the child sites can connect if the original parent site is DOWN.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/gslb/gslb-deployment-types/parent-child-topology-deployment.html.
  [From Build 51.21]
  [# NSHELP-10797]

• Time Delay for Setting a Site as DOWN When Metrics Exchange Protocol Connection to a Remote Site is DOWN

  In a GSLB high availability setup, if the status of a Metrics Exchange Protocol (MEP) connection to a remote site changes to DOWN, you can set a delay to allow some time for reestablishment of the MEP connection before the site is marked as DOWN. If the MEP connection is back UP before the delay expires, the services are not affected.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/gslb/configure-metrics-exchange-protocol.html.
  [From Build 51.21]
  [# NSHELP-10960]

• You can test the GSLB setup to make sure that the ADNS services or the DNS servers are responding with the correct IP address for the domain name that is configured in the GSLB setup.

  This is supported in NetScaler GUI only.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/gslb/testing-the-gslb-setup.html.
  [From Build 51.21]
  [# NSUI-953]

Load Balancing

• Secure FTP Monitoring Support

  The NetScaler appliance now supports secure FTP monitoring. That is, you can now configure the appliance to send secure FTP probes to your FTP services.

  For more information about secure FTP monitoring support, see http://docs.citrix.com/en-us/netscaler/11-1/load-balancing/load-balancing-builtin-monitors/lb-built-in-monitors-secure-monitoring-using-sftp.html.
  [From Build 47.14]
  [# NSHELP-11306]

• Required Unbind Operation Prevents Accidentally Disabling a Virtual Server

  Accidentally deleting a service or service group that is bound to a virtual server can result in the virtual server going DOWN. With this release, you cannot delete a service or service group that is bound to a virtual server until you first unbind it from the virtual server.
  [From Build 47.14]
  [# 258327]

• Support for Load Balancing Profile

  A load balancing configuration has a large number of parameters, so setting the same parameters on a number of virtual servers can become tedious. You can now set load balancing parameters in a profile and associate this profile with virtual servers, instead of setting these parameters on each virtual server.

  For more information about load balancing profiles, see http://docs.citrix.com/en-us/netscaler/11-1/load-balancing/lb-support-for-load-balancing-profile.html.
  [From Build 47.14]
  [# 353669]

• Setting SSL Parameters on a Secure Monitor

  A monitor inherits either the global settings or the settings of the service to which it is bound. If a monitor is bound to a non-SSL or non-SSL_TCP service, such as SSL_BRIDGE, you cannot configure it with SSL settings such as the protocol version or the ciphers to be used. Therefore, in such deployments, SSL-based monitoring of the back-end servers is ineffective.

  This enhancement gives you more control over SSL-based monitoring of back-end servers, by enabling you to bind an SSL profile to a monitor. An SSL profile contains SSL parameters, cipher bindings, and ECC bindings. For example, you can set server authentication, ciphers, and protocol version in an SSL profile and bind the profile to a monitor. Note that to perform server authentication, you must also bind a CA certificate to a monitor. To perform client authentication, you must bind a client certificate to the monitor. New parameters for the "bind lb monitor" command enable you to do so.

  Note: The SSL settings take effect only if you add a secure monitor. Also, the SSL profile type must be BackEnd.

  SSL profiles can be bound to the following monitor types:

  - HTTP

  - HTTP-ECV

  - TCP

  - TCP-ECV

  - HTTP-INLINE

  To specify an SSL profile while adding a monitor by using the command line

  At the command prompt, type:

  add lb monitor <monitorName> <type> -secure YES -sslprofile <string>

  set lb monitor <monitorName> <type> -secure YES -sslprofile <string>

  Example:

  add ssl profile prof1 -sslProfileType BackEnd

  add lb monitor mon1 HTTP -secure YES -sslprofile prof1

  To bind a certificate-key pair to a monitor by using the command line

  At the command prompt, type:

  bind monitor <monitor name> -certkeyName <string> [(-CA [-crlCheck ( Mandatory | Optional ) | -ocspCheck ( Mandatory | Optional )]
  [From Build 47.14]
  [# NSHELP-12235]

• Configuring an HTTPS Virtual Server to accept HTTP Traffic

  You can now configure an HTTPS virtual server to also process all HTTP traffic. That is, if HTTP traffic is received on the HTTPS virtual server, the appliance internally prepends "https://" to the incoming URL or redirects the traffic to another HTTPS URL, depending on the option configured.

  For more information about configuring an HTTPS virtual server to accept HTTP traffic, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/config-ssloffloading/ssl-config-https-vserver-to-accept-http-traffic.html.
  [From Build 47.14]
  [# NSHELP-12637]

• Improved Support for Persistency

  In certain cases, cores of a NetScaler appliance might not be synchronized, because a core-to-core monitoring or service update has not reached one of the cores. For example, if the core that owns persistency has not received notification that a service is DOWN, that service remains in the persistency table. If a traffic-owner core that has been notified that the service is DOWN finds it in the persistency table, it requests a different service from the persistency-owner core, so that it can redirect the request. Before this enhancement, if the persistency owner returned the same service, the traffic-owner core dropped the user's request. Now, instead of immediately dropping the request, the traffic owner queries the persistency owner a second time. Sending the second query usually gives the persistency owner enough time to have received the update, in which case it returns a different service.
  [From Build 47.14]
  [# NSLB-1939]

• Closing Monitor Connections at the Service Level

  A parameter named monConnectionClose has been added at the service level. If this parameter is not set, the monitor connection is closed by using the value set in the global load balancing parameters. If this parameter is set at the service level, the monitor connection is closed by sending a connection termination message, with the FIN or RESET bit set, to the service.

  For more information about closing monitor connections at the service level, see http://docs.citrix.com/en-us/netscaler/11-1/load-balancing/load-balancing-configure-monitors/close-monitor-connection.html.
  [From Build 47.14]
  [# 607661]

• Closing Monitor Connections at Service and Service Group Level

  A parameter named monConnectionClose has been added at the service and service group levels. If this parameter is not set, the monitor connection is closed by using the value set in the global load balancing parameters. If this parameter is set at the service or service group level, the monitor connection is closed by sending a connection termination message, with the FIN or RESET bit set, to the service or service group.
  [From Build 41.26]
  [# 607661]

• Cluster Support for Secure Monitoring

  Enhanced secure monitors are now supported in cluster environments.
  [From Build 54.16]
  [# NSLB-827, 669899]

• Closing Monitor Connections at the Service Group Level

  A parameter named monConnectionClose has been added at the service group level. If this parameter is not set, the monitor connection is closed by using the value set in the global load balancing parameters. If this parameter is set at the service group level, the monitor connection is closed by sending a connection termination message, with the FIN or RESET bit set, to the service group.

  For more information about closing monitor connections at the service group level, see http://docs.citrix.com/en-us/netscaler/11-1/load-balancing/load-balancing-configure-monitors/close-monitor-connection.html.
  [From Build 47.14]
  [# 628111]

• Support for Reverse TCP Monitors

  The NetScaler appliance now supports reverse TCP monitors. A reverse monitor marks the service as DOWN if the probe criteria are satisfied and UP if they are not satisfied.

  A direct TCP monitor marks the service as DOWN if it receives a RESET in response to the monitor probe. However, a reverse TCP monitor treats RESET as a successful response and marks the service as UP.

  To configure a reverse TCP monitor by using the NetScaler command line

  At the command prompt, type:

  add lb monitor <monitor-name> tcp -reverse yes -destip <primary-service ip> -destport <primary-service port>

  bind service <svc-name> -monitorname <monitor-name>

  To configure a reverse TCP monitor by using the NetScaler GUI

  1. Navigate to Traffic Management > Load Balancing > Monitors.

  2. Create a TCP monitor and select Reverse.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/load-balancing/load-balancing-custom-monitors/lb_custom_monitor_configuring_reverse_monitoring_for_a_service.html.
  [From Build 49.16]
  [# NSHELP-12413]

• FIX Protocol Support

  NetScaler appliances now support load balancing virtual servers of type SSL_FIX, which can load balance FIX-protocol requests at the FIX message level and allow FIX-specific session persistence.
  [From Build 47.14]
  [# 634096]

• NetScaler appliances now support load balancing virtual servers of type SSL_FIX, which can load balance FIX-protocol requests at the FIX message level and allow FIX-specific session persistence.
  [From Build 41.26]
  [# 634096]

• Enabling or Disabling Persistence Session on Services that are in TROFS State

  You can set the new trofsPersistence flag to specify whether or not to honour persistence sessions for services that are in the TROFS state. Persistence sessions are honored If this flag is set to ENABLED. They are not honored if it is set to DISABLED. Previously, persistence sessions were honored if a service was in the TROFS state.
  [From Build 53.13]
  [# NSHELP-12696]

• RADIUS Interim Message Support for RADIUS-Only Mode

  RADIUS interim message support has been added for RADIUS-only mode, to treat interim messages as start messages.
  [From Build 54.16]
  [# NSHELP-10645]

NITRO

• Support for ping and traceroute commands

  You can now direct ping and traceroute operations to any host, by using the NITRO API through the NetScaler appliance.
  [From Build 49.16]
  [# 406603]

• Automate NetScaler Upgrade and Downgrade with a Single API

  A new API, install, can be used to upgrade or downgrade a NetScaler appliance. You can specify a local or remote location for the build file used to upgrade or downgrade the appliance.

  For more information about this NITRO API, see http://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/nitro-rest-usage-scenarios/automate-upgrade-downgrade.html.
  [From Build 41.26]
  [# NSHELP-13158]

• Handle Multiple NITRO Calls in a Single Request

  A new API, macroapi, can be used to configure a set of homogeneous or heterogeneous objects in a single API request. The query parameter "onerror" specifies the action to be taken if an error is encountered. Possible values for this parameter are exit, continue, and rollback.

  For more information about this NITRO API, see http://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/nitro-rest-usage-scenarios/multiple-nitrocalls-single-request.html.
  [From Build 41.26]
  [# NSHELP-13159]

• Retrieve Bindings in Bulk

  You can use a bulk GET API to fetch bindings of all the entities of a given entity type.

  For example, you can fetch bindings of all the load balancing virtual servers in one call instead of by using multiple GET by "name" calls.

  For information about this NITRO API, see http://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/nitro-rest-usage-scenarios/retrieve-bindings-bulk.html.
  [From Build 41.26]
  [# NSHELP-13160]

• Simplify Management Operations with an idempotent API

  You can add or update resources seamlessly, with a single API, by using the new "idempotent" query parameter. Previously, an attempt to add a resource that was already configured, or to update a resource that was not yet configured, caused an error.

  Now, if you include "idempotent=yes" in a POST request, NITRO executes the request in an idempotent manner.

  For more information about this API, see http://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/nitro-rest-usage-scenarios/management-operations-idempotentAPI.html.
  [From Build 41.26]
  [# NSHELP-13130]

• Scanning NetScaler Appliances for Hardware Errors using NITRO API

  A NITRO API resource ‘systemhwerror' has been introduced for scanning a NetScaler appliance for any hardware related errors, such as media errors, flash card errors, SSL cards errors, and BIOS errors. The API returns the output in the response field. The API also returns a counter ‘hwerrorcount', which can have one of the following values:

  * -1: when the scan fails

  * 0: when the scan succeeds and no hardware errors found

  * total number of hardware errors found
  [From Build 59.10]
  [# NSHELP-8937]

Networking

• Using a Source Port from a Specified Port Range for Backend Communication

  By default, for configurations with USIP option disabled or with USIP and use proxy port options enabled, the NetScaler appliance communicates to the servers from a random source port (greater than 1024).

  The NetScaler supports using a source port from a specified port range for communicating to the servers. One of the use case of this feature is for servers that are configured to identify received traffic belonging to a specific set on the basis of source port for logging and monitoring purposes. For example, identifying internal and external traffic for logging purpose. For more information, http://docs.citrix.com/en-us/netscaler/11-1/load-balancing/load-balancing-manage-clienttraffic/use-specified-sourceport.html.
  [From Build 47.14]
  [# NSHELP-16187, 420039]

• Setting the MTU on the NSVLAN

  By default, the MTU of the NSVLAN is set to 1500 bytes. You can now modify this setting to optimize throughput and network performance. For example, you can configure the NSVLAN to process jumbo frames. For more information, see http://docs.citrix.com/en-us/netscaler/11-1/networking/interfaces/configuring-nsvlan.html.
  [From Build 47.14]
  [# NSLB-1805]

• Stateful Connection Failover Support for RNAT configurations with TCP Proxy On

  Connection failover helps prevent disruption of access to applications deployed in a distributed environment. In a High Availability (HA) setup, stateful connection failover for RNAT is now supported with TCP proxy.

  Connection failover can be enabled per RNAT rule. For enabling connection failover on an RNAT rule, you enable the "connFailover" ("Connection Failover") parameter of that specific RNAT rule. To enable TCP proxy for RNAT, you must enable "tcpproxy" parameter by using the "set rnatparam" command in the NetScaler CLI or select "Enable RNAT Source IP Persistency" (System > Setting > Change Global System Settings) in the NetScaler GUI.

  For more information, see https://docs.citrix.com/en-us/netscaler/11-1/networking/ip-addressing/configuring-network-address-translation/configuring-rnat.html.
  [From Build 51.21]
  [# NSHELP-16216]

• Using NULL Policy Based Routes to Drop Outgoing Packets

  Some situations might demand that the NetScaler appliance drops specific outgoing packets instead of routing them, for example, in testing cases and during deployment migration. NULL policy based routes can be used to drop specific outgoing packets. A NULL PBR is a type of PBR that has the nexthop parameter set to NULL. The NetScaler appliance drops outgoing packets that match a NULL PBR. For more information, see http://docs.citrix.com/en-us/netscaler/11-1/networking/ip-routing/configuring-policy-based-routes/null-policy-based-routes-drop-outgoing-packets.html.
  [From Build 47.14]
  [# NSUI-7638]

• Stateful Connection Failover Support for RNAT

  Connection failover helps prevent disruption of access to applications deployed in a distributed environment. The NetScaler appliance now supports stateful connection failover for connections related to RNAT rules in a NetScaler High Availability (HA) setup.

  In an HA setup, connection failover (or connection mirroring) refers to the process of keeping an established TCP or UDP connection active when a failover occurs. The primary appliance sends messages to the secondary appliance to synchronize current information about the RNAT connections. The secondary appliance uses this connection information only in the event of a failover. When a failover occurs, the new primary NetScaler appliance has information about the connections established before the failover and hence continues to serve those connections even after the failover. From the client's perspective this failover is transparent. During the transition period, the client and server may experience a brief disruption and retransmissions.

  Connection failover can be enabled per RNAT rule. For enabling connection failover on an RNAT rule, you enable the connFailover (Connection Failover) parameter of that specific RNAT rule by using either NetScaler command line or configuration utility. Also, you must disable the tcpproxy (TCP Proxy) parameter globally for all RNAT rules in order for connection failover to work properly for TCP connections.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/networking/ip-addressing/configuring-network-address-translation/configuring-rnat.html.
  [From Build 47.14]
  [# NSHELP-16426]

• Managing High Availability Heartbeat Messages on a NetScaler Appliance

  The two nodes in a high availability configuration send and receive heartbeat messages to and from each other on all interfaces that are enabled. The heartbeat messages flow regardless of the HA MON setting on these interfaces. If NSVLAN or SYNCVLAN or both are configured on an appliance, the heartbeat messages flow only through the enabled interfaces that are part of the NSVLAN and SYNCVLAN.

  If a node does not receive the heartbeat messages on an enabled interface, it sends critical alerts to the specified Command Center and SNMP managers. These critical alerts give false alarms and draw unnecessary attention from the administrators for interfaces that are not configured as part of the connections to the peer node.

  To resolve this issue, the HAHeartBeat option for interfaces and channels is used for enabling or disabling HA heartbeat-message flow on them.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/system/high-availability-introduction/managing-ha-heartbeat-messages.html.
  [From Build 47.14]
  [# NSPLAT-1912, 575447, 604578]

• Configuring Allowed VLAN List

  NetScaler accepts and sends tagged packets of a VLAN on an interface if the VLAN is explicitly configured on the NetScaler appliance and the interface is bound to the VLAN. Some deployments (for example, Bump in the wire) require the NetScaler appliance to function as a transparent device to accept and forward tagged packets related to a large number of VLANs. For this requirement, configuring and managing a large number of VLANs is not a feasible solution.

  Allowed VLAN list on an interface specifies a list of VLANs. The interface transparently accepts and sends tagged packets related to the specified VLANs without the need for explicitly configuring these VLANs on the appliance. For more information, see http://docs.citrix.com/en-us/netscaler/11-1/networking/interfaces/configure-allowed-VLAN-list.html.
  [From Build 47.14]
  [# 495219]

• Extending VLANs from Multiple Enterprises to a Cloud

  CloudBridge Connector tunnels can now be used to extend an enterprise's VLAN to a cloud. VLANs extended from multiple enterprises can have overlapping VLAN ID. You can now isolate each enterprise's VLANs, by mapping them to a unique VXLAN in the cloud. On a NetScaler appliance, which is the CloudBridge connector endpoint in the cloud, you can configure a VXLAN-VLAN map that links an enterprise's VLANs to a unique VXLAN in the cloud. VXLANs now support VLAN tagging for extending multiple VLANs of an enterprise from CloudBridge Connector to the same VXLAN.
  [From Build 47.14]
  [# NSHELP-16289]

• Configuring Source IP Persistency for Backend Communication

  By default, for a load balancing configuration with the USIP option disabled and a net profile bound to a virtual server or services or service groups, the NetScaler appliance uses the round-robin algorithm to select an IP address from the net profile for communicating with the servers. Because of this selection method, the IP address selected can be different for different sessions of a specific client.

  Some situations require that the NetScaler appliance sends all of a specific client's traffic from the same IP address when sending the traffic to servers. The servers can then, for example, identify traffic belonging to a specific set for logging and monitoring purposes.

  The source IP persistency option of a net profile enables the NetScaler appliance to use the same address, specified in the net profile, to communicate with servers for all sessions initiated from a specific client to a virtual server. For more information, http://docs.citrix.com/en-us/netscaler/11-1/load-balancing/load-balancing-manage-clienttraffic/configure-source-IP-persistency-backend-communication.html.
  [From Build 47.14]
  [# NSNET-5394]

• Adding Default Route for the changed NSIP address Before a Restart

  If you change the NSIP address of a NetScaler appliance, you can now add a default route to the new address's subnet before restarting the NetScaler appliance. This change makes the new NSIP address accessible from other networks after the appliance is restarted.

  In previous releases, if the subnet address of the new NSIP address is different from the previous one, you cannot add a default route for this new subnet until you restart the appliance. Because of this restriction, the new NSIP address is unreachable from other networks after a restart.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/networking/ip-addressing/configuring-netscaler-owned-ip-addresses/configuring-netscaler-ip-address.html.
  [From Build 47.14]
  [# 551505]

• Dynamic Routing support for Link-Local Subnet IPv6 addresses

  NetScaler appliances now support dynamic routing on a link-local Subnet IPv6 (SNIP6) address for a VLAN. In a default admin partition, link-local SNIP6 address takes precedence over the link-local NSIP6 address for running dynamic routing on a VLAN. In a non-default partition, the NetScaler appliance does not support dynamic routing on link-local NSIP6 address for a VLAN. Link-local SNIP6 address can now be used for running dynamic routing on the VLAN.
  [From Build 47.14]
  [# 553544]

• IPv6 Support in Active-Active Mode using VRRP

  NetScaler Appliances Support VIP6 Addresses in Active-Active Deployments.

  An active-active deployment, in addition to preventing downtime, makes efficient use of all the NetScaler appliances in the deployment. In an IPv6 active-active deployment mode, the same VIP6 address is assigned to every NetScaler appliance in the configuration, but with different priorities, so that a given VIP6 can be active on only one appliance at a time.

  The active VIP6 address is called the master VIP6, and the corresponding VIP6s on the other NetScaler appliances are called the backup VIP6s. If a master VIP6 fails, the backup VIP6 with the highest priority takes over and becomes the master VIP6. All the NetScaler appliances in an active-active deployment use the Virtual Router Redundancy Protocol (VRRP) to advertise their VIP6s and the corresponding priorities at regular intervals.

  NetScaler appliances in active-active mode can be configured so that no appliance is idle. In this configuration, different sets of VIPs are active on each appliance.

  The following features of IPv4 active-active configuration are also supported for IPv6 active-active configuration:

  * Preemption

  * Delaying preemption

  * Sharing

  * Changing VIP address priority automatically
  [From Build 41.26]
  [# NSNET-5790]

• IPv6 Support in Active-Active Mode using VRRP

  NetScaler Appliances Support VIP6 Addresses in Active-Active Deployments.

  An active-active deployment, in addition to preventing downtime, makes efficient use of all the NetScaler appliances in the deployment. In an IPv6 active-active deployment mode, the same VIP6 address is assigned to every NetScaler appliance in the configuration, but with different priorities, so that a given VIP6 can be active on only one appliance at a time.

  The active VIP6 address is called the master VIP6, and the corresponding VIP6s on the other NetScaler appliances are called the backup VIP6s. If a master VIP6 fails, the backup VIP6 with the highest priority takes over and becomes the master VIP6. All the NetScaler appliances in an active-active deployment use the Virtual Router Redundancy Protocol (VRRP) to advertise their VIP6s and the corresponding priorities at regular intervals.

  NetScaler appliances in active-active mode can be configured so that no appliance is idle. In this configuration, different sets of VIPs are active on each appliance.

  The following features of IPv4 active-active configuration are also supported for IPv6 active-active configuration:

  * Preemption

  * Delaying preemption

  * Sharing

  * Changing VIP address priority automatically

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/networking/interfaces/active-active-mode-using-vrrp.html.
  [From Build 47.14]
  [# NSNET-5790]

• Graceful Restart for Dynamic Routing Protocols

  In a non-INC high availability (HA) setup in which a routing protocol is configured, after a failover, routing protocol is converged and routes between the new primary node and the adjacent neighbor routers are learned. Route learning take some time to complete. During this time, forwarding of packets is delayed, network performance might get disrupted, and packets might get dropped.

  Graceful restart enables an HA setup during a failover to direct its adjacent routers to not remove the old primary node's learned routes from their routing databases. Using the old primary node's routing information, the new primary node and the adjacent routers immediately start forwarding packets, without disrupting network performance.

  The following routing protocols support graceful restart in a non-INC high availability setup:

  - Border Gateway Protocol (BGP)

  - IPv6 Border Gateway protocol (IPv6 BGP)

  - Open Shortest Path First (OSPF)

  - IPv6 Open Shortest Path First (OSPFv3)

  For more information, see:

  - http://docs.citrix.com/en-us/netscaler/11-1/networking/ip-routing/configuring-dynamic-routes/configuring-ospf.html

  - http://docs.citrix.com/en-us/netscaler/11-1/networking/ip-routing/configuring-dynamic-routes/configuring-ipv6-ospf.html

  - http://docs.citrix.com/en-us/netscaler/11-1/networking/ip-routing/configuring-dynamic-routes/configuring-bgp.html
  [From Build 47.14]
  [# NSHELP-16350]

• Graceful Restart for Dynamic Routing Protocols

  In a non-INC high availability (HA) setup in which a routing protocol is configured, after a failover, routing protocol is converged and routes between the new primary node and the adjacent neighbor routers are learned. Route learning take some time to complete. During this time, forwarding of packets is delayed, network performance might get disrupted, and packets might get dropped.

  Graceful restart enables an HA setup during a failover to direct its adjacent routers to not remove the old primary node's learned routes from their routing databases. Using the old primary node's routing information, the new primary node and the adjacent routers immediately start forwarding packets, without disrupting network performance.

  The following routing protocols support graceful restart in a non-INC high availability setup:

  - Border Gateway Protocol (BGP)

  - IPv6 Border Gateway protocol (IPv6 BGP)

  - Open Shortest Path First (OSPF)

  - IPv6 Open Shortest Path First (OSPFv3)
  [From Build 41.26]
  [# NSHELP-16350]

• Network Service Header support for Service Function

  Network Services Header (NSH) is a new standard that enables the Service Function Chaining (SFC) architecture. NSH enables you to define the service chain paths and forward the data-plane traffic through multiple service nodes in a dynamic and fail-proof manner.

  A NetScaler appliance can now play the service-function role in a SFC architecture. The NetScaler appliance receives packets with Network Service headers and, upon performing the service, modifies the NSH bits in the response packet to indicate that the service has been performed. In that role, the appliance supports symmetric service chaining with features (for example, INAT, TCP and UDP load balancing services, and routing). The NetScaler appliance as service-function does not support IPv6 and Reclassification.
  [From Build 47.14]
  [# 593459]

• Logging Start Time and Connection Closure Reasons in RNAT Log Entries

  For diagnosing or troubleshooting problems related to RNAT connections, the NetScaler appliance now logs the following additional information:

  - Start time of the RNAT session.

  - Reason for closure of the RNAT session. The NetScaler appliance logs closure reason for TCP RNAT sessions that do not use the TCP proxy (TCP proxy disabled) of the appliance. The following are the type of closure reasons that are logged for TCP RNAT sessions:

  -- TCP FIN. The RNAT session was closed because of a TCP FIN sent by either the source or destination device.

  -- TCP RST. The RNAT session was closed because of a TCP Reset that was sent by either the source or destination device.

  -- TIMEOUT. The RNAT session timed out.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/networking/ip-addressing/configuring-network-address-translation/configuring-rnat.html.
  [From Build 47.14]
  [# 609410]

• NetScaler Support for Microsoft Direct Access Deployment

  Microsoft Direct Access is a technology that enables remote users to seamlessly and securely connect to enterprise's internal networks, without the need to establish a separate VPN connection. Unlike VPN connections, which require user intervention to start and close connections, a Direct Access-enabled client connects automatically to the enterprise's internal networks whenever the client connects to the Internet.

  Manage-Out is a Microsoft Direct Access feature that allows administrators inside the enterprise network to connect to Direct Access clients outside the network and manage them (for example, performing administration tasks, such as scheduling service updates, and providing remote support).

  In a Direct Access deployment, NetScaler appliances provide high availability, scalability, high performance, and security. NetScaler load balancing functionality sends client traffic through the most appropriate server. The appliances can also forward the Manage-Out traffic through the right path to reach the client. For more information, see http://docs.citrix.com/en-us/netscaler/11-1/networking/interfaces/netscaler-support-microsoft-direct-access-deployment.html.
  [From Build 47.14]
  [# 612455]

• NetScaler Support for Microsoft Direct Access Deployment

  Microsoft Direct Access is a technology that enables remote users to seamlessly and securely connect to enterprise's internal networks, without the need to establish a separate VPN connection. Unlike VPN connections, which require user intervention to start and close connections, a Direct Access-enabled client connects automatically to the enterprise's internal networks whenever the client connects to the Internet.

  Manage-Out is a Microsoft Direct Access feature that allows administrators inside the enterprise network to connect to Direct Access clients outside the network and manage them (for example, performing administration tasks, such as scheduling service updates, and providing remote support.

  In a Direct Access deployment, NetScaler appliances provide high availability, scalability, high performance, and security. NetScaler load balancing functionality sends client traffic through the most appropriate server. The appliances can also forward the Manage-Out traffic through the right path to reach the client.
  [From Build 41.26]
  [# 612455]

• Wildcard TOS Monitors

  In a load balancing configuration in DSR mode using TOS field, monitoring its services requires a TOS monitor to be created and bound to these services. A separate TOS monitor is required for each load balancing configuration in DSR mode using TOS field, because a TOS monitor requires the VIP address and the TOS ID to create an encoded value of the VIP address. The monitor creates probe packets in which the TOS field is set to the encoded value of the VIP address. It then sends the probe packets to the servers represented by the services of a load balancing configuration. With a large number of load balancing configurations, creating a separate custom TOS monitor for each configuration is a big, cumbersome task. Managing these TOS monitors is also a big task. Now, you can create wildcard TOS monitors. You need to create only one wildcard TOS monitor for all load balancing configurations that use the same protocol (for example, TCP or UDP).

  A wildcard TOS monitor has the following mandatory settings:

  -Type = <protocol>

  -TOS = Yes

  The following parameters can be set to a value or can be left blank:

  -Destination IP

  -Destination Port

  -TOS ID

  A wildcard TOS monitor (with destination IP, Destination port, and TOS ID not set) bound to a DSR service automatically learns the TOS ID and the VIP address of the load balancing virtual server. The monitor creates probe packets with TOS field set to the encoded VIP address and then sends the probe packets to the server represented by the DSR service.
  [From Build 49.16]
  [# NSHELP-16642]

• Monitoring Command Propagation Failures in a Cluster Deployment

  In a cluster deployment of NetScaler appliances, you can use the new command "show prop status" for faster monitoring and troubleshooting of issues related to command-propagation failure on non-CCO nodes. This command displays up to 20 of the most recent command propagation failures on all non-CCO nodes. You can use either the NetScaler command line or the NetScaler GUI to perform this operation after accessing them through the CLIP address or through the NSIP address of any node in the cluster deployment.

  To know more information about this feature, see http://docs.citrix.com/en-us/netscaler/11-1/clustering/cluster-managing/Monitoring-Command-Propagation-Failures-in-cluster-deployment.html
  [From Build 49.16]
  [# NSHELP-15932]

• NITRO API Support for Dynamic Routing

  NetScaler appliances now support NITRO API for configuring dynamic routing protocols.
  [From Build 47.14]
  [# NSHELP-16370]

• Support for Sending Response Traffic Through an IP-IP tunnel

  You can now configure a NetScaler appliance to send response traffic through an IP-IP tunnel instead of routing it back to the source. Previously, when the appliance received a request from another NetScaler or a third-party device through an IP-IP tunnel, it had to route the response traffic instead of sending it through the tunnel. You can now use policy based routes (PBRs) or enable MAC-Based Forwarding (MBF) to send the response through the tunnel.

  In a PBR rule, specify the subnets at both end points whose traffic is to traverse the tunnel. Also set the next hop as the tunnel name. When response traffic matches the PBR rule, the NetScaler appliance sends the traffic through the tunnel.

  Alternatively, you can enable MBF to meet this requirement, but the functionality is limited to traffic for which the NetScaler appliance stores session information (for example, traffic related to load balancing or RNAT configurations). The appliance uses the session information to send the response traffic through the tunnel.
  [From Build 49.16]
  [# NSHELP-16477]

• Advertisement of SNIP and VIP Routes to Selective Areas

  In a cluster setup, for a requirement to advertise spotted SNIP addresses to only the server-side routers, enabling DRADV mode or redistribute connect ZebOS operations cannot be used. This is because these operations send all the connected routes to ZebOS. Also, adding dummy static routes in ZebOS for the required subnets, or adding ACLs in ZebOS to filter unwanted connected routes is a cumbersome and tedious task.

  A new option, Network Route, addresses this issue. You can enable this option for only one SNIP address per subnet. The connected route for that SNIP address is sent as a kernel route to ZebOS.

  For VIP and SNIP addresses, another new option, Tag, can be assigned an integer from 1 to 4294967295. This parameter can be set only when Host Route or Network Route is enabled for VIP or SNIP addresses. The tag value associated with VIP and SNIP addresses are also sent along with their routes to ZebOS. Tags with different values can be set for VIP and SNIP routes. These tag values can then be matched in routemaps in ZebOS and advertised to selective areas.

  For more information, see https://docs.citrix.com/en-us/netscaler/11-1/networking/ip-routing/configuring-dynamic-routes/advertisement-of-snip-and-vip-routes-to-selective-areas.html.
  [From Build 51.21]
  [# NSHELP-16371]

• Support of Automatic ARP Resolution to Special MAC address

  In a cluster deployment, when the client-side or server side-link to a node goes down, traffic is steered to this node through the peer nodes for processing. Previously, the steering of traffic was implemented on all nodes by configuring dynamic routing and adding static ARP entries pointing to the special MAC address of each node. If there are a large number of nodes in a cluster deployment, adding and managing static ARP entries with special MAC addresses on all the nodes is a cumbersome task. Now, nodes implicitly use special MAC addresses for steering packets. Therefore, static ARP entries pointing to special MAC addresses no longer have to be added to the cluster nodes.
  [From Build 49.16]
  [# NSHELP-16437]

• Automatic TCP-Connection Reset for Inactive Nodes

  Previously, a cluster node did not reset its existing TCP connections (to clients and servers) when its state became Inactive. As a result, the states of the client and server connections became undefined. Now, a node resets all its TCP connections before entering the Inactive state.
  [From Build 49.16]
  [# NSHELP-15996]

• Loop Prevention Mechanism based on VLAN ID

  For a MAC-mode based load balancing configuration, the NetScaler appliance maintains a source MAC table. This table maps the virtual server to the MAC addresses of all the bound services. The appliance uses this table to prevent (loop prevention mechanism) the server traffic from reaching the virtual server.

  For a trunk link that is shared by the VLANs of the servers and the VLANs of clients, the appliance also prevents traffic from these clients from reaching the virtual server. To solve this issue, the NetScaler loop prevention mechanism now considers the VLAN ID along with the MAC address, so that the client traffic in a trunk link reaches the virtual server.
  [From Build 51.21]
  [# NSHELP-15690]

• Disabled ACL logging for Loopback Traffic

  By default, the NetScaler appliance bypasses ACL processing for loopback traffic, but it logs the loopback traffic for ACL rules for which the ACL logging option is enabled. These log entries for loopback traffic create a false impression that the NetScaler appliance has processed loopback traffic for ACL rules.

  Now, the NetScaler appliance does not log loopback traffic for ACL rules.
  [From Build 52.13]
  [# NSHELP-2999]

Platform

• Support for Hardware Platforms

  This release now supports the NetScaler MPX 5900 and NetScaler MPX 8900 platforms. For more information, see https://docs.citrix.com/en-us/netscaler/11-1/ssl/support-for-mpx-5900-8900-platforms.html.
  [From Build 56.19]
  [# NSAUTH-434, 681106]

• Amazon Web Service IAM Roles Support

  NetScaler VPX on AWS cloud now supports IAM roles. IAM roles are designed for AWS applications to securely make API requests from their instances, without requiring users to manage the security credentials that the applications use. The user can define which accounts or AWS services can assume the roles. The application is granted the permissions for the actions and resources that the user has defined for the role through the security credentials associated with the role. An application on the instance retrieves the security credentials provided by the role from instance metadata item iam/security-credentials/role-name. These security credentials are temporary and are renewed automatically. New credentials are available at least five minutes before the expiration of the old credentials.
  [From Build 47.14]
  [# 585172]

• Support for New Hardware Platforms

  The T1120 and T1300-40G platforms with NIC firmware 4.53 are now supported in this release.

  Note: T1300-40G platform with NIC firmware 4.26 has backward compatibility.
  [From Build 41.26]
  [# NSPLAT-6441]

• Support for New Hardware Platforms

  The T1120 and T1300-40G platforms with NIC firmware 4.53 are now supported.

  Note: T1300-40G platform with NIC firmware 4.26 is backward compatible.
  [From Build 47.14]
  [# NSPLAT-6441]

• New firmware version for SDX platforms

  NetScaler SDX provides the latest XL710 v5.04 firmware for the following platforms:

  * SDX Model: 14xxx 40G

  * SDX Model: 25xxx 40G

  The XL710 v5.04 firmware includes a tool to automatically upgrade the XL710 firmware from the previous version to v5.04.

  For more information, see https://support.citrix.com/article/CTX218219.
  [From Build 50.10]
  [# NSPLAT-6476]

• Support for SR-IOV interfaces on NetScaler VPX Appliance in XenServer

  You can now configure a NetScaler VPX appliance deployed on XenServer to use SR-IOV network interfaces.

  For performance information about SR-IOV interfaces on XenServer, see the latest VPX datasheet.
  [From Build 49.16]
  [# 632408]

• Support for PCI Passthrough interfaces on NetScaler VPX Appliance in Linux-KVM

  You can now configure a NetScaler VPX instance deployed on Linux-KVM to use PCI passthrough interfaces.

  For performance information about PCI passthrough interfaces on KVM, see the latest VPX datasheet.
  [From Build 49.16]
  [# 632416]

• Support for NetScaler MPX 26000 Platform

  This release supports the MPX 26000 platform.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000.html.
  [From Build 60.14]
  [# NSPLAT-4909, 688395, 693022]

• Support for VMXNET3 interfaces on NetScaler VPX Appliance in VMware ESX

  You can now configure NetScaler VPX appliance deployed on VMware ESX 6.0 or ESX 5.5 to use VMXNET3 network interfaces. The NetScaler VPX appliance now supports Intel 82599 10g Network Interface Card (NIC).

  For performance information of VMXNET3 interface on ESX, refer the latest VPX datasheet.

  For information on how to configure VMXNET3 interfaces on NetScaler VPX appliance, see http://docs.citrix.com/en-us/netscaler/11-1/deploying-vpx/install-vpx-on-esx/configure-vmxnet3.html.
  [From Build 47.14]
  [# NSDOC-92]

• Support for SR-IOV interfaces on NetScaler VPX Appliance in VMware ESX

  You can now configure NetScaler VPX appliance deployed on VMware ESX 6.0 or ESX 5.5 to use SR-IOV network interfaces. The NetScaler VPX appliance now supports Intel 82599 10g Network Interface Card (NIC).

  For performance information of SR-IOV interface on ESX, refer the latest VPX datasheet.

  For information on how to configure SR-IOV interfaces on NetScaler VPX Appliance, see http://docs.citrix.com/en-us/netscaler/11-1/deploying-vpx/install-vpx-on-esx/configure-sr-iov.html.
  [From Build 47.14]
  [# NSDOC-105]

• Support for SR-IOV interfaces on NetScaler VPX Appliance in Linux-KVM

  You can now configure NetScaler VPX appliance deployed on Linux-KVM to use SR-IOV network interfaces.

  For performance information of SR-IOV interface on KVM, refer the latest VPX datasheet.

  For information on how to configure SR-IOV interfaces on NetScaler VPX Appliance in Linux-KVM, see http://docs.citrix.com/en-us/netscaler/11-1/deploying-vpx/install-vpx-on-kvm/configure-SR-IOV-KVM.html.
  [From Build 47.14]
  [# NSDOC-148]

• Support for New Hardware Platforms

  This release now supports the NetScaler MPX 26000-100G and NetScaler MPX 26000T-100G platforms. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000-100g-26000T-100g.html.
  [From Build 56.19]
  [# NSPLAT-6288, 653372]

• NetScaler VPX for Telco Operators

  A new NetScaler VPX platform, VPX-T, is introduced for Telco operators, to meet their core-network requirements. VPX-T platform licenses are available for different throughput requirements (for example, 100G and 40G). NetScaler Telco software licensing editions (Basic and Advanced) are applicable for VPX-T.

  VPX-T is supported on the following virtualization platforms:

  * Citrix XenServer

  * VMware ESX

  * Linux-KVM

  For more information about the platform licenses available for VPX-T, recommended interfaces, performance details, and a list of features in different NetScaler Telco software licensing editions, see the VPX-T datasheet.
  [From Build 51.21]
  [# 656943]

• Support for NetScaler MPX 26000-50S Platform

  This release supports the MPX 26000-50S platform.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000-50s.html.
  [From Build 60.14]
  [# NSPLAT-7606, 703784, 688397]

• Support for NetScaler MPX 15000-25G Platform

  This release supports the MPX 15000-25G platform.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-15000.html.
  [From Build 60.14]
  [# NSPLAT-7566]

• New firmware version for SDX platforms

  NetScaler SDX provides the latest XL710 v6.01 firmware for the following platforms:

  * SDX Model: 14xxx-40G and 14xxx-40S

  * SDX Model: 25xxx-40G and 25xxxA
  [From Build 63.9]
  [# NSPLAT-11481]

• Support for NetScaler MPX 26000-100G platform

  This release now supports the NetScaler MPX 26000-100G and NetScaler MPX 26000T-100G platforms. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000-100g-26000T-100g.html.
  [From Build 62.8]
  [# NSPLAT-6288, NSPLAT-3076]

• Support for new SDX hardware platforms

  This release now supports the following new platforms:

  - NetScaler SDX 15000. For more information, see https://docs.citrix.com/en-us/citrix-hardware-platforms/sdx/hardware-platforms/sdx-15000.html

  - NetScaler SDX 26000. For more information, see https://docs.citrix.com/en-us/citrix-hardware-platforms/sdx/hardware-platforms/sdx-26000.html

  - NetScaler SDX 26000-50S. For more information, see https://docs.citrix.com/en-us/citrix-hardware-platforms/sdx/hardware-platforms/sdx-26000-50s.html
  [From Build 63.9]
  [# NSPLAT-7543]

SSL

• Removing RC4-MD5 cipher from the default cipher list

  The RC4-MD5 cipher is removed from the list of default ciphers that are supported on a NetScaler appliance.

  For the updated list of ciphers supported by the NetScaler appliance, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/supported-ciphers-list-release-11.html.
  [From Build 47.14]
  [# 258311]

• Providing the Revocation Status of a Server Certificate to a Client

  To avoid unnecessary congestion when each client requests the revocation status of a server certificate during an SSL handshake, the NetScaler appliance now supports OCSP stapling. That is, the appliance can now send the revocation status of a server certificate to a client, at the time of the SSL handshake, after validating the certificate status from an OCSP responder. The revocation status of a server certificate is "stapled" to the response the appliance sends to the client as part of the SSL handshake. To use the OCSP stapling feature, you must enable it on an SSL virtual server and add an OCSP responder on the appliance.

  Note: NetScaler appliances support OCSP stapling as defined in RFC 6066.

  Important: NetScaler support for OCSP stapling is limited to handshakes using TLS protocol version 1.0 or higher. This feature is not supported in a cluster setup.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/ssl-11-1-ocsp-stapling-solution.html.
  [From Build 51.21]
  [# NSHELP-4374]

• Support for TLS Session Ticket Extension

  An SSL handshake is a CPU-intensive operation. If session reuse is enabled, the server/client key exchange operation is skipped for existing clients. They are allowed to resume their sessions. This improves the response time and increases the number of SSL transactions per second that a server can support. However, the server must store details of each session state, which consumes memory and is difficult to share among multiple servers if requests are load balanced across servers.

  NetScaler appliances now support the SessionTicket TLS extension. Use of this extension indicates that the session details are stored on the client instead of on the server. The client must indicate that it supports this mechanism by including the session ticket TLS extension in the client Hello message. For new clients, this extension is empty. The server sends a new session ticket in the NewSessionTicket handshake message. The session ticket is encrypted with a key known only to the server. If a server cannot issue a new ticket at this time, it completes a regular handshake.

  To resume a session, the client must include the session ticket in the request. If, for any reason, the server does not honor the ticket, it attempts to initiate a full handshake with the client.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/customize-ssl-config/support-for-tls-session-ticket-extension.html.
  [From Build 51.21]
  [# NSHELP-4410, 577122, 648240]

• Support for SafeNet Network HSM

  All NetScaler MPX, SDX, and VPX appliances except the MPX 9700/10500/12500/15500 FIPS appliances now support the SafeNet network hardware security module (HSM). A NetScaler ADC used with a SafeNet Network HSM provides FIPS 140-2 Level 2 and FIPS 140-2 Level 3 protection, depending on which SafeNet HSM is being used.

  SafeNet HSM integration with the ADC is supported for TLS versions 1.0, 1.1, and 1.2.

  For more information about configuring SafeNet network HSM, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/ssl-support-safenet-hsm.html.
  [From Build 47.14]
  [# CGS-1000]

• Support for SNI on the Back-End Service

  The NetScaler appliance now supports Server Name Indication (SNI) at the back end. That is, the common name is sent as the server name in the client hello to the back-end server for successful completion of the handshake. In addition to helping meet federal system integrator customer security requirements, this enhancement provides the advantage of using only one port instead of opening hundreds of different IP addresses and ports on a firewall.

  Federal system integrator customer security requirements include support for Active Directory Federation Services (ADFS) 3.0 in 2012R2 and WAP servers. This requires supporting SNI at the back end on a NetScaler appliance.
  [From Build 41.26]
  [# NSHELP-14384, 559271, 595785]

• Support for SNI on the Back-End Service

  The NetScaler appliance now supports Server Name Indication (SNI) at the back end. That is, the common name is sent as the server name in the client hello to the back-end server for successful completion of the handshake. In addition to helping meet federal system integrator customer security requirements, this enhancement provides the advantage of using only one port instead of opening hundreds of different IP addresses and ports on a firewall.

  Federal system integrator customer security requirements include support for Active Directory Federation Services (ADFS) 3.0 in 2012R2 and WAP servers. This requires supporting SNI at the back end on a NetScaler appliance.

  For more information about SNI support on the back-end service, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/config-ssloffloading/support_for_sni_on_backend_service.html.
  [From Build 47.14]
  [# NSHELP-14384, 559271, 595785]

• The NetScaler VPX appliance now supports AES-GCM/SHA2 ciphers on the front end.
  [From Build 41.26]
  [# NSHELP-14554]

• Support for AES-GCM/SHA2 ciphers on the front-end of VPX appliances

  The NetScaler VPX appliance now supports AES-GCM/SHA2 ciphers on the front end.

  For the updated cipher/protocol support matrix, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/cipher_protocl_support_matrix.html.
  [From Build 47.14]
  [# NSHELP-14554]

• ECDSA Cipher Suites Support on the Back-end of MPX Appliances with N3 Chips

  The NetScaler MPX appliances with N3 chips now support the elliptical curve digital signature algorithm (ECDSA) cipher group end to end. ECDSA cipher suites use elliptical curve cryptography (ECC). Because of its smaller size, it is particularly helpful in environments where processing power, storage space, bandwidth, and power consumption are constrained.

  Note: if you add an ECDSA certificate-key pair, only the following curves are supported:

  -prime256v1

  -secp384r1

  The following ciphers are supported with ECDSA:

  -ECDHE-ECDSA-AES256-GCM-SHA384

  -ECDHE-ECDSA-AES256-SHA384

  -ECDHE-ECDSA-AES256-SHA

  -ECDHE-ECDSA-AES128-GCM-SHA256

  -ECDHE-ECDSA-AES128-SHA256

  -ECDHE-ECDSA-AES128-SHA

  -ECDHE-ECDSA-RC4-SHA

  -ECDHE-ECDSA-DES-CBC3-SHA

  For more information about ECDSA cipher suites, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/customize-ssl-config/ecdsa_cipher_suite_support_on_mpx_appliances_with_n3_chips.html.
  [From Build 47.14]
  [# NSHELP-4448]

• ECDSA Cipher Suites support on MPX appliances with N3 chips

  The NetScaler MPX appliances with N3 chips now support the elliptical curve digital signature algorithm (ECDSA) cipher group. The ECDHE_ECDSA key exchange mechanism provides forward secrecy. In ECDHE_ECDSA, the server's certificate must contain an ECDSA-capable public key. For client authentication, an ECDSA CA certificate must be bound to the virtual server.

  ECDSA cipher suites use elliptical curve cryptography (ECC). Because of its smaller size, it is particularly helpful in environments where processing power, storage space, bandwidth, and power consumption are constrained.

  Note: if you add an ECDSA certificate-key pair, only the following curves are supported:

  -prime256v1

  -secp384r1
  [From Build 41.26]
  [# NSHELP-4448]

• Support for Client Certificate Thumbprint

  NetScaler appliances now support inserting the thumbprint (also called a fingerprint) of a certificate into the header of a request sent to a back-end server. If client authentication is enabled, the appliance computes the thumbprint of the certificate, and uses an SSL policy action to insert the thumbprint into the request. The server searches for the thumbprint, and grants secure access if there is a match.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/config-ssl-actions-policies/config-ssl-based-hdr-insertion.html.
  [From Build 51.21]
  [# NSHELP-4490, 632507]

• Support for ECDHE Ciphers on the back end on the NetScaler MPX 9700/10500/12500/15500 FIPS appliances.

  Citrix NetScaler MPX 9700/10500/12500/15500 FIPS appliances running firmware version 2.2 now support the ECDHE cipher group on the back end. This group contains the following ciphers:

  - TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA 0xc012

  - TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xc014

  - TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256 0xc027

  - TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xc013

  Because of its smaller key size, Elliptic Curve Cryptography (ECC) is especially useful in a mobile (wireless) environment and in an interactive voice response environment, where every millisecond is important. Smaller key sizes result in power, memory, bandwidth, and computational cost savings.

  The following ECC curves are supported: P_256, P_384, P_224, and P_521.

  By default, all four curves are bound to an SSL virtual server.
  [From Build 41.26]
  [# NSHELP-14610]

• Support for ECDHE Ciphers on the NetScaler MPX 9700/10500/12500/15500 FIPS appliances

  Citrix NetScaler MPX 9700/10500/12500/15500 FIPS appliances running firmware version 2.2 now support the ECDHE cipher group on the frontend and backend. This group contains the following ciphers:

  - TLS1-ECDHE-RSA-DES-CBC3-SHA 0xc012

  - TLS1-ECDHE-RSA-AES256-SHA 0xc014

  - TLS1.2-ECDHE-RSA-AES-128-SHA256 0xc027

  - TLS1-ECDHE-RSA-AES128-SHA 0xc013

  Because of its smaller key size, Elliptic Curve Cryptography (ECC) is especially useful in a mobile (wireless) environment and in an interactive voice response environment, where every millisecond is important. Smaller key sizes result in power, memory, bandwidth, and computational cost savings.

  The following ECC curves are supported: P_256, P_384, P_224, and P_521.

  By default, all four curves are bound to an SSL virtual server.

  For the updated cipher/protocol support matrix, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/cipher_protocl_support_matrix.html.
  [From Build 47.14]
  [# NSHELP-14610]

• Support for AES-GCM and SHA2 Ciphers at the Front End of MPX/SDX 14000 FIPS Appliances

  The NetScaler MPX/SDX 14000 FIPS appliance now supports AES-GCM and SHA2 ciphers at the front end.

  The following AES-GCM and SHA2 ciphers are supported at the front end of the MPX/SDX 14000 FIPS appliance:

  - TLS1.2-AES256-GCM-SHA384

  - TLS1.2-AES128-GCM-SHA256

  - TLS1.2-ECDHE-RSA-AES256-GCM-SHA384

  - TLS1.2-ECDHE-RSA-AES128-GCM-SHA256

  - TLS1.2-AES-256-SHA256

  - TLS1.2-AES-128-SHA256

  For more information, see http://docs.citrix.com/en-us/netscaler/12/ssl/cipher_protocl_support_matrix.html.
  [From Build 53.13]
  [# NSSSL-4374]

• Support for ECC curves in Service Groups

  You can now bind ECC curves to back-end service groups by using the NetScaler command line.

  At the command prompt, type:

  bind ssl serviceGroup <serviceGroupName> -eccCurveName <eccCurveName>
  [From Build 47.14]
  [# 592418]

• Support for New FIPS Platform

  This release supports the MPX 14000 FIPS platform, which is a high-end platform containing 63 crypto cores, available in the following models:

  Model number System Throughput

  MPX 14030 FIPS 30 Gbps

  MPX 14060 FIPS 60 Gbps

  MPX 14080 FIPS 80 Gbps

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/configuring-mpx-14000-fips-appliance.html.
  [From Build 51.21]
  [# NSSSL-889, 498222, 590397]

• New Counters at the SSL Virtual Server Level and at the Global Level

  Six counters have been added to the output of the "stat ssl vserver" command, as follows:

  1. ssl_ctx_tot_enc_bytes: Tracks the number of encrypted bytes.

  2. ssl_ctx_tot_dec_bytes: Tracks the number of decrypted bytes.

  3. ssl_ctx_tot_hw_enc_bytes: Tracks the number of hardware encrypted bytes.

  4. ssl_ctx_tot_hw_dec_bytes: Tracks the number of hardware decrypted bytes.

  5. ssl_ctx_tot_session_new: Tracks the number of new sessions created.

  6. ssl_ctx_tot_session_hits: Tracks the number of session hits.

  Five counters have been added to the output of the "stat ssl -detail" command, as follows:

  1. ssl_tot_sslServerInRecords: Tracks the number of SSL records processed by the appliance.

  2. ssl_cur_sslInfo_SPCBInUseCount: Tracks the number of SSL protocol control blocks (SPCBs) used at any given point.

  2. ssl_cur_session_inuse: Tracks the number of active SSL sessions.

  4. ssl_cur_sslInfo_cardinBlkQ: Tracks the number of bulk encryption and decryption operations that are pending for card.

  5. ssl_cur_sslInfo_cardinKeyQ: Tracks the number of handshake-related operations that are pending for card.
  [From Build 47.14]
  [# NSHELP-13241, 582601]

• Support for New SDX FIPS Platform

  This release supports the SDX 14000 FIPS platform, which is a high-end platform containing 63 crypto cores, available in the following models:

  Model number System Throughput

  SDX 14030 FIPS 30 Gbps

  SDX 14060 FIPS 60 Gbps

  SDX 14080 FIPS 80 Gbps

  For more information, see http://docs.citrix.com/en-us/netscaler/11/traffic-management/ssl/configuring-SDX-14030-14060-14080-fips-appliance.html.
  [From Build 52.13]
  [# NSSSL-1062]

• Support to create a Certificate Signing Request signed with the SHA256 Digest Algorithm

  The NetScaler appliance supports creating a CSR signed with the SHA256 digest algorithm. The encryption hash algorithm used in SHA256 makes it stronger than SHA1.

  For more information about creating a CSR signed with the SHA256 digest algorithm, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/manage-certs/obtain-cert-frm-cert-auth.html.
  [From Build 47.14]
  [# NSHELP-13357, 595902]

• Support for TLS1.2 signature hash algorithm

  The NetScaler appliance is now completely TLS1.2 signature hash (sighash)-extension compliant.

  On an SDX appliance, if an SSL chip is assigned to a VPX instance, the cipher support of an MPX appliance applies. Otherwise, the normal cipher support of a VPX instance applies. NetScaler platforms support sighash combinations as follows:

  -On a VPX instance: RSA-MD5, RSA-SHA1, RSA-SHA224, RSA-SHA256, RSA-SHA384, RSA-SHA512, DSA-SHA1, DSA-SHA224, DSA-SHA256, DSA-SHA384, DSA-SHA512.

  -On an MPX/SDX appliance with N3 chips: RSA-MD5, RSA-SHA1, RSA-SHA224, RSA-SHA256, RSA-SHA384, RSA-SHA512, ECDSA-SHA1, ECDSA-SHA224, ECDSA-SHA256, ECDSA-SHA384, ECDSA-SHA512.

  -On an MPX/SDX appliance without N3 chips: RSA-MD5, RSA-SHA1, RSA-SHA224, RSA-SHA256, RSA-SHA384, RSA-SHA512.

  Previously, the appliance supported only RSA-SHA1 and RSA-SHA256 on the front end, and RSA-MD5, RSA-SHA1, and RSA-SHA256 on the back end. In addition, the VPX appliance supported DSA-SHA1 on the front end and back end.

  With this enhancement, a NetScaler appliance can send SHA-384 and SHA-512 signature_algorithm extensions in the back-end Client Hello message. As a result, Windows IIS servers do not reset the connection if a SHA-384 or SHA-512 certificate is used.
  [From Build 54.16]
  [# NSHELP-4525, 665257]

• Support for AES-GCM/SHA2 ciphers on the back-end of MPX appliances

  The NetScaler MPX appliance now supports AES-GCM/SHA2 ciphers on the back end.

  For the updated cipher/protocol support matrix, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/cipher_protocl_support_matrix.html.
  [From Build 47.14]
  [# NSHELP-13375]

• ECDSA Cipher Suites Support on SDX Appliances with N3 Chips

  The NetScaler SDX appliances with N3 chips now support the elliptical curve digital signature algorithm (ECDSA) cipher group end to end.

  In ECDHE_ECDSA, the server's certificate must contain an ECDSA-capable public key. For client authentication, an ECDSA CA certificate must be bound to the virtual server.

  To support ECDSA cipher suites on a NetScaler SDX appliance, an SSL core must be assigned to the VPX instance.

  ECDSA cipher suites use elliptical curve cryptography (ECC). Because of its smaller size, ECC is particularly helpful in environments where processing power, storage space, bandwidth, and power consumption are constrained.

  Note: if you add an ECDSA certificate-key pair, only the following curves are supported:

  -prime256v1

  -secp384r1

  The following ciphers are supported with ECDSA:

  -ECDHE-ECDSA-AES256-GCM-SHA384

  -ECDHE-ECDSA-AES256-SHA384

  -ECDHE-ECDSA-AES256-SHA

  -ECDHE-ECDSA-AES128-GCM-SHA256

  -ECDHE-ECDSA-AES128-SHA256

  -ECDHE-ECDSA-AES128-SHA

  -ECDHE-ECDSA-RC4-SHA

  -ECDHE-ECDSA-DES-CBC3-SHA

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/customize-ssl-config/ecdsa_cipher_suite_support_on_mpx_appliances_with_n3_chips.html.
  [From Build 51.21]
  [# NSPLAT-3858]

• Segregation of Certificates According to Type

  To facilitate certificate selection, certificates are now segregated according to type, such as server certificate, client certificate, and CA certificate.

  To view the certificates in the GUI, navigate to Traffic Management > SSL > Certificates.

  To view the certificates in the CLI, type "show ssl certkey"
  [From Build 47.14]
  [# NSHELP-14731, 623890]

• ECDSA Cipher Suites Support on the Back-End of MPX Appliances with N3 Chips

  The NetScaler MPX appliances with N3 chips now support the elliptical curve digital signature algorithm (ECDSA) cipher group end-to-end.

  ECDSA cipher suites use elliptical curve cryptography (ECC). Because of its smaller size, it is particularly helpful in environments where processing power, storage space, bandwidth, and power consumption are constrained.

  Note: if you add an ECDSA certificate-key pair, only the following curves are supported:

  -prime256v1

  -secp384r1

  The following ciphers are supported with ECDSA:

  -ECDHE-ECDSA-AES256-GCM-SHA384

  -ECDHE-ECDSA-AES256-SHA384

  -ECDHE-ECDSA-AES256-SHA

  -ECDHE-ECDSA-AES128-GCM-SHA256

  -ECDHE-ECDSA-AES128-SHA256

  -ECDHE-ECDSA-AES128-SHA

  -ECDHE-ECDSA-RC4-SHA

  -ECDHE-ECDSA-DES-CBC3-SHA

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/customize-ssl-config/ecdsa_cipher_suite_support_on_mpx_appliances_with_n3_chips.html.
  [From Build 51.21]
  [# NSHELP-4657]

• Optimizing ECDHE Computation

  ECDHE-RSA computation has been optimized by using a combination of software and hardware offload capabilities.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/customize-ssl-config/ssl-hybrid-ecdhe-optimization.html.
  [From Build 50.10]
  [# NSSSL-4580]

• Support for ECDHE Ciphers at the Front End and Back End on NetScaler MPX//SDX 14000 FIPS Appliances

  Citrix NetScaler MPX/SDX 14000 FIPS appliances now support the ECDHE cipher group.

  The following ciphers are supported at the front end of the MPX/SDX 14000 FIPS appliance:

  - TLS1-ECDHE-RSA-AES256-SHA

  - TLS1-ECDHE-RSA-AES128-SHA

  - TLS1.2-ECDHE-RSA-AES-256-SHA384

  - TLS1.2-ECDHE-RSA-AES-128-SHA256

  - TLS1-ECDHE-RSA-DES-CBC3-SHA

  This following ciphers are supported at the back end of the MPX/SDX 14000 FIPS appliance:

  - TLS1-ECDHE-RSA-AES256-SHA

  - TLS1-ECDHE-RSA-AES128-SHA

  - TLS1.2-ECDHE-RSA-AES-128-SHA256

  - TLS1-ECDHE-RSA-DES-CBC3-SHA

  Because of its smaller key size, Elliptic Curve Cryptography (ECC) is especially useful in a mobile (wireless) environment. It is also very useful in an interactive voice response environment, where every millisecond is important. Smaller key sizes result in power, memory, bandwidth, and computational cost savings.

  The following ECC curves are supported: P_256, P_384, P_224, and P_521.

  By default, all four curves are bound to an SSL virtual server.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/ssl/cipher_protocl_support_matrix.html.
  [From Build 53.13]
  [# NSSSL-2760]

• Support for SHA384 and SHA512 signed-certificates on the back-end of a NetScaler appliance

  All SHA-2 signed certificates (SHA384, SHA512) are now supported on the back-end of all appliances. Earlier, only SHA256 signed-certificates were supported.
  [From Build 54.16]
  [# NSHELP-4672, 681095, 683236, 683438]

• Support for a Hybrid FIPS Mode on the MPX/SDX 14000 FIPS Platform

  The new MPX/SDX 14000 FIPS platform contains one primary card and one or more secondary cards. If you enable the hybrid FIPS mode, the pre-master secret decryption commands are run on the primary card because the private key is stored on this card, but the bulk encryption and decryption is offloaded to a secondary card. This significantly increases the bulk encryption throughput on a MPX/SDX 14000 FIPS platform as compared to non-hybrid FIPS mode and the existing MPX 9700/10500/12500/15000 FIPS platform. Enabling the hybrid FIPS mode also increases the SSL transactions per second on this platform.
  [From Build 53.13]
  [# NSHELP-5120]

• Send Certificates to Back-End Servers as Strings, without Spaces

  A CLI command has been added to send a certificate to a back-end server as a string without any spaces, instead of in its original format (with spaces). Previously, you had to use an nsapimgr option to do this.

  At the NetScaler CLI, type:

  set ssl parameter -insertCertSpace ( YES | NO )
  [From Build 52.13]
  [# NSHELP-4717]

• Cluster Support for SSL Profiles

  The default SSL profiles are now supported in a cluster setup.

  For information about SSL profiles, see http://docs.citrix.com/en-us/netscaler/11-1/ssl/ssl-profiles1.html.
  [From Build 54.16]
  [# NSSSL-4363, 664706, 664726, 667119]

• Secure Implementation of Session Tickets

  You can now secure session tickets by using a symmetric key to encrypt them. Additionally, to achieve forward secrecy, you can specify a time interval at which the session-ticket key is refreshed. Session-ticket keys can be generated by the appliance, or you can manually enter session-ticket key data. Entering this data manually is helpful in HA or cluster deployments so that the appliances can decrypt each other's session tickets.
  [From Build 54.16]
  [# NSHELP-14895]

• A new category of SSL certificates

  A new category of SSL certificates called Unknown Certificates is added to the NetScaler GUI. This category is for certificates that do not meet the conditions for end-user certificates (both server and client), CA certificate, and intermediate CA certificate. To view these certificates, navigate to Traffic Management > SSL > Certificates>Unknown Certificates.
  [From Build 56.19]
  [# NSHELP-4713]

• Support for Safenet Client Library version 6.2.x

  The NetScaler appliance now supports Safenet Client Library version 6.2.x.
  [From Build 54.16]
  [# NSSSL-1984, 678980]

• Support for OCSP Stapling in a cluster setup

  OCSP stapling is now supported in a cluster setup. OCSP stapling is used to provide the revocation status of a server certificate to a client during an SSL handshake.
  [From Build 54.16]
  [# NSSSL-4556]

• Increased lifetime of previous session ticket key

  Previous session ticket key lifetime has been increased to 172800 seconds.

  For more information, see https://docs.citrix.com/en-us/netscaler/11-1/ssl/customize-ssl-config/secure-implementation-of-session-tickets.html.
  [From Build 59.10]
  [# NSHELP-14930]

• Support for FIPS 140-2 Level-3 on MPX/SDX 14000 FIPS Platforms

  This release adds support for FIPS 140-2 Level 3 on the MPX 14000 FIPS and SDX 14000 FIPS platforms. The "set fips" command allows only "Level-2" option but internally level-2 is converted to level-3.

  For more information, see https://docs.citrix.com/en-us/netscaler/11-1/ssl/configuring-mpx-14000-fips-appliance.html and https://docs.citrix.com/en-us/netscaler/11-1/ssl/configuring-sdx-14030-14060-14080-fips-appliance.html
  [From Build 56.19]
  [# NSSSL-2009]

Security

• Configuring DNS Security Options from the Add DNS Security Profile Page in the NetScaler GUI

  You can now configure the DNS security options from the Add DNS Security Profile page in the NetScaler GUI. This page provides a user-friendly graphical user interface for configuring DNS security settings. The Cache Poisoning Protection option is always enabled. The other security options can be applied to all DNS endpoints or to specific DNS virtual server(s) in your deployment.

  Two of the security options, Bypass the Cache and Provide root details in the DNS response, can be applied to all DNS endpoints. The following security options can be applied either to all DNS endpoints or to specific DNS virtual servers:

  DNS DDoS protection

  Manage exceptions - whitelist/blacklist servers

  Prevent random subdomain attacks

  Enforce DNS transactions over TCP

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/security/dis-security-options.html.
  [From Build 51.21]
  [# NSHELP-4669]

System

• Specifying a domain name for a logging server

  When configuring an auditlog action, you can specify the domain name of a syslog or nslog server instead of its IP address. Then, if the server's IP address changes, you do not have to change it on the NetScaler appliance.
  [From Build 49.16]
  [# 314438]

• Option to Allocate an Extra Management CPU

  According to your requirement, you can now allocate an extra management CPU from packet engine pool in the NetScaler MPX appliance, and achieve better performance for configuring and monitoring of your appliance. This feature is supported in NetScaler MPX models 25xxx, 22xxx, 14xxx, 115xx, 15xxx, and 26xxx. For more information, see https://docs.citrix.com/en-us/netscaler/12/system/basic-operations/allocate-extra-management-CPU.html
  [From Build 56.19]
  [# NSHELP-14022, 235321, 559207, 604165, 615657]

• TCP Fast Open (TFO) is a TCP mechanism that enables speedy and safe data exchange between a client and a server during TCP's initial handshake. This feature is available as a TCP option in the TCP profile bound to a virtual server of a NetScaler appliance. TFO uses a TCP Fast Open Cookie (a security cookie) that the NetScaler appliance generates to validate and authenticate the client initiating a TFO connection to the virtual server. By using the TFO mechanism, you can reduce an application's network latency and the delay experienced in short TCP transfers.
  [From Build 41.26]
  [# NSHELP-9772]

• TCP Fast Open Mechanism

  TCP Fast Open (TFO) is a TCP mechanism that enables speedy and safe data exchange between a client and a server during TCP's initial handshake. This feature is available as a TCP option in the TCP profile bound to a virtual server of a NetScaler appliance. TFO uses a TCP Fast Open Cookie (a cryptographic cookie) that the NetScaler appliance generates to validate the client initiating a TFO connection to the virtual server. By using the TFO mechanism, you can reduce an application's network latency and the delay experienced in short TCP transfers.
  [From Build 47.14]
  [# NSHELP-9772]

• Proportional Rate Recovery Algorithm

  The Proportional Rate Recovery (PRR) algorithm is a fast recovery algorithm that evaluates TCP data during a loss recovery. It is patterned after Rate-Halving, by using the fraction that is appropriate for the target window chosen by the congestion control algorithm. It minimizes window adjustment, so that the actual window size at the end of recovery is close to the Slow-Start threshold (ssthresh).
  [From Build 47.14]
  [# NSSDW-12460]

• Policy Infrastructure (PI) for Auditlog Framework

  Audit log actions now support advance policies and expressions. Advance policy expressions are very powerful and provide endless use cases to work with. Previously, the audit module supported only classic policies. You can now bind advanced audit-log policies to the syslog and nslog global entities.
  [From Build 49.16]
  [# 522692, 607221]

• RDX Error Management

  In the NetScaler GUI, if you skip a mandatory field or make an invalid entry, an error message appears beside the field or in the page header, depending on the type of error, and remains until you enter a valid value. For example, on the Add Virtual Server page, if you enter an invalid server IP address or port number, an error message appears beside the IP Address or Port field, and you cannot submit the page until you correct the error.
  [From Build 47.14]
  [# 552575]

• Configuring SNMP Audit Log Levels

  After you enable the SNMP trap logging option, a NetScaler appliance on which at least one trap listener is configured can log SNMP trap messages (for SNMP alarms in which logging capability is enabled). Now, you can specify the audit log level of trap messages sent to an external log server. The default log level is Informational. Possible values are Emergency, Alert, Critical, Error, Warning, Debug, and Notice.

  For example, you can set the audit log level to Critical for an SNMP trap message generated by a logon failure. That information is then available on the NSLOG or SYSLOG server for troubleshooting.
  [From Build 47.14]
  [# NSHELP-11137]

• MAC Address is tied to the IP Address in case of an IP Conflict

  An SNMP trap that is sent as a result of an IP address conflict now contains the MAC address of the device. You can therefore identify the device by its MAC address. Previously, identifying the device was not possible, because the conflict lasts for only a short time.
  [From Build 47.14]
  [# NSHELP-16574, 524621]

• You can now enable auto-bootstrapping on a NetScaler VPX or NetScaler 1000v instance running on Hyper-V, by attaching a DVD ROM with an appropriate ISO file to the instance before booting it up.
  [From Build 47.14]
  [# 578451]

• Bridge Group Support for Cluster

  Bridge Group functionality is now supported on a Layer 3 NetScaler cluster.
  [From Build 47.14]
  [# 587548]

• TCP Hystart Algorithm

  A new slow-start algorithm, Hybrid Start (Hystart) is configured as a TCP option in the relevant TCP profile bound to a virtual server. This algorithm dynamically determines a safe point at which to terminate (ssthresh) and enables a transition to avoid congestion with heavy packet losses. This option is disabled by default.
  [From Build 47.14]
  [# 603099]

• A new slow-start algorithm, Hybrid Start (Hystart) is configured as a TCP option in the relevant TCP profile bound to a virtual server. This algorithm dynamically determines a safe point at which to terminate (ssthresh) and enables a transition to avoid congestion with heavy packet losses. This option is disabled by default.
  [From Build 41.26]
  [# 603099]

• Capturing SSL Keys during NetScaler Trace

  The "start nstrace" command has a new parameter, -capsslkeys, with which you can capture the SSL master keys for all SSL sessions. If the capsslkeys option is enabled, a file named nstrace.sslkeys is generated along with the packet trace and imported into Wireshark to decrypt the SSL traffic in the trace file.
  [From Build 47.14]
  [# 603225]

• The "start nstrace" command has a new parameter, -capsslkeys, with which you can capture the SSL master keys for all SSL sessions. If the capsslkeys option is enabled, a file named nstrace.sslkeys is generated along with the packet trace and imported into Wireshark to decrypt the SSL traffic in the trace file.
  [From Build 41.26]
  [# 603225]

• In a NetScaler appliance, if the Ring Receive buffer is full, the appliance starts to discard data packets at the Network Interface Card (NIC). As a result, the appliance drops packets leading to a probe failure.
  [From Build 49.16]
  [# NSHELP-14860, 649735]

• Warning about an Unsaved NetScaler Configuration

  The NetScaler GUI displays a Save icon with a red dot when a running configuration is not saved. A unsaved configuration could be lost if a power outage or restart occurs.

  To save the configuration(s), you can click the Save icon and then click Yes at the configuration prompt. When you return to the main screen by clicking OK, the icon is white.

  Note: In some cases, the red dot might appear even though there is no unsaved configuration. In that case, if you click the Save icon, the following message appears: "The running configuration has not changed."
  [From Build 47.14]
  [# 626225]

• TCP Burst Rate Control

  A NetScaler appliance now uses a technique called "TCP Burst Rate Control" for burst management in a high speed mobile network. This technique evenly spaces the flow of data into the network, avoiding bursts by waiting for a period of time before sending the next group of packets. By using this technique, you can achieve better throughput and lower packet drop rates. This feature is available as a TCP option in the TCP profile bound to a virtual server on a NetScaler appliance.
  [From Build 49.16]
  [# NSHELP-3122]

• Dynamic TCP Buffer Management

  When you enable the Dynamic Receive Buffer option in a TCP profile, the NetScaler appliance can dynamically adjust the TCP receive buffer size for optimized memory usage based on the congestion window.
  [From Build 47.14]
  [# 628115]

• New Hardware-Script Option Removes Media Errors

  In a hardware script, the new -d option extracts CF, SSD, and HDD media errors from the log files.

  >ns_hw_err.bash -d
  [From Build 52.13]
  [# NSHELP-8771]

• Proactive Support for Hardware Errors

  The Citrix Call Home service automatically generates a support case and uploads the system data to the Technical Support server if a critical hardware error, such as failure of a hard disk drive (HDD), Compact Flash (CF) device, SSL card, or power supply unit (PSU), occurs in a NetScaler appliance on which the Call Home feature is enabled.
  [From Build 47.14]
  [# 639336, 599891]

• The TCP timestamp is now an interoperable parameter for TCP and Multipath TCP (MPTCP) data transmission.
  [From Build 50.10]
  [# NSHELP-3305]

• Displaying MPTCP Statistics

  The new "stat mptcp" command displays statistical information about MPTCP counters, including counters for total MPTCP traffic, current traffic, and erroneous traffic flowing through the NetScaler appliance.
  [From Build 54.16]
  [# NSHELP-8815, 350115]

• By default, a NetScaler appliance ignores the non-standard and obsolete "Proxy-Connection" HTTP header. To change this behavior, use the nsamimgr command to set the proxyConnection parameter to 1. This setting prioritizes the Proxy-Connection header over the Connection header.

  For example, nsapimgr -ys proxyconnection=1
  [From Build 51.21]
  [# NSHELP-8842]

• Half-closed or established TCP connections, between clients and a NetScaler appliance, cleaned up by the NetScaler zombie process can now be dropped silently, that is, without sending RST packets to the clients.

  To configure this feature, run the following commands at the NetScaler shell prompt:

  - nsapimgr_wr.sh -ys tcp_hc_zombie_silent_drop=1

  - nsapimgr_wr.sh -ys tcp_est_zombie_silent_drop=1
  [From Build 50.10]
  [# NSBASE-1355]

• Changes in NetScaler Telco Software Licensing Editions

  The software licensing editions for NetScaler Telco platforms (NetScaler T1000 series and NetScaler VPX-T) have changed as follows:

  Basic edition

  * Features added: Content Filtering

  * Features removed: None

  Advanced edition

  * Features added: AAA, Content Optimization, Appflow for ICA, RDP Proxy, RISE, and Internet On Hold (IOH)

  * Features removed: None
  [From Build 51.21]
  [# NSUI-1283]

• Configuring SYN-Cookie Timeout Interval

  In addition to the SYN Cookie setting in the TCP profile, a NetScaler appliance now maintains a second SYN Cookie setting for each virtual server. This enhancement is especially important for cluster deployments. To protect the appliance against SYN attacks, the SYN Cookie parameter in the TCP profile is enabled by default. Previously, if you disabled it, its value would toggle to ENABLED if a SYN attack was detected. If the appliance was deployed in a cluster, the cluster configuration would become inconsistent until the parameter was toggled back to the DISABLED state after the attack. Now, the SYN Cookie parameter is enabled and disabled only for the virtual server that detects the SYN attack.

  Note: A SYN attack does not enable the SYN Cookie parameter for a virtual server unless the SYN Cookie parameter in the TCP profile is set to DISABLED.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/system/tcp-configurations.html
  [From Build 62.8]
  [# NSBASE-343]

• Changing default RPC node passwords

  In HA, cluster, and GSLB deployments, a warning message appears for the nsroot and superuser login if the default RPC node password is not changed.
  [From Build 63.9]
  [# NSCONFIG-2224]

Telco

• Port Control Protocol for Large Scale NAT

  NetScaler appliances now support Port Control Protocol (PCP) for large scale NAT (LSN). Many of an ISP's subscriber applications must be accessible from Internet (for example, Internet of Things (IOT) devices, such as an IP camera that provides surveillance over the Internet). One way to meet this requirement is to create static large scale NAT (LSN) maps. But for a very large number of subscribers, creating static LSN NAT maps is not a feasible solution.

  Port Control Protocol (PCP) enables a subscriber to request specific LSN NAT mappings for itself and/or for other 3rd party devices. The large scale NAT device creates an LSN map and sends it to the subscriber. The subscriber sends the remote devices on the Internet the NAT IP address:NAT port at which they can connect to the subscriber.

  Applications usually send frequent keep-alive messages to the large scale NAT device so that their LSN mappings do not time out. PCP helps reduce the frequency of such keep-alive messages by enabling the applications to learn the timeout settings of the LSN mappings. This helps reduce bandwidth consumption on the ISP's access network and battery consumption on mobile devices.

  PCP is a client-server model and runs over the UDP transport protocol. A NetScaler appliance implements the PCP server component and is compliant with RFC 6887. Port Control Protocol is supported for NAT44, DS-Lite and NAT64 on the NetScaler appliance. For more information, see:

  - http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-introduction/port-control-protocol-large-scale-NAT.html

  - http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/dual-stack-lite/port-control-protocol-DS-Lite.html

  - http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-nat-64/port-control-protocol-largescale-nat64.html
  [From Build 47.14]
  [# 496807]

• Port Control Protocol for Large Scale NAT

  NetScaler appliances now support Port Control Protocol (PCP) for large scale NAT (LSN). Many of an ISP's subscriber applications must be accessible from Internet (for example, Internet of Things (IOT) devices, such as an IP camera that provides surveillance over the Internet). One way to meet this requirement is to create static large scale NAT (LSN) maps. But for a very large number of subscribers, creating static LSN NAT maps is not a feasible solution.

  Port Control Protocol (PCP) enables a subscriber to request specific LSN NAT mappings for itself and/or for other 3rd party devices. The large scale NAT device creates an LSN map and sends it to the subscriber. The subscriber sends the remote devices on the Internet the NAT IP address:NAT port at which they can connect to the subscriber.

  Applications usually send frequent keep-alive messages to the large scale NAT device so that their LSN mappings do not time out. PCP helps reduce the frequency of such keep-alive messages by enabling the applications to learn the timeout settings of the LSN mappings. This helps reduce bandwidth consumption on the ISP's access network and battery consumption on mobile devices.

  PCP is a client-server model and runs over the UDP transport protocol. A NetScaler appliance implements the PCP server component and is compliant with RFC 6887. Port Control Protocol is supported for NAT44, DS-Lite and NAT64 on the NetScaler appliance.
  [From Build 41.26]
  [# 496807]

• Compact Logging for Large Scale NAT

  Logging LSN information is one of the important functions needed by ISPs to meet legal requirements and be able to identify the source of traffic at any given time. This eventually results in a huge volume of log data, requiring the ISPs to make large investments to maintain the logging infrastructure.

  Compact logging is a technique for reducing the log size by using a notational change involving short codes for event and protocol names. For example, C for client, SC for session created, and T for TCP. Compact logging results in an average of 40 percent reduction in log size. Compact logging is supported for NAT44, DS-Lite, and NAT64. For more information, see:

  - http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-nat-64/log-monitor-largescale-nat64.html

  - http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/dual-stack-lite/logging-monitoring-DS-Lite.html

  - http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-introduction/lsn-logging-monitoring.html
  [From Build 47.14]
  [# NSAUTH-4700]

• Compact Logging for Large Scale NAT

  Logging LSN information is one of the important functions needed by ISPs to meet legal requirements and be able to identify the source of traffic at any given time. This eventually results in a huge volume of log data, requiring the ISPs to make large investments to maintain the logging infrastructure.

  Compact logging is a technique for reducing the log size by using a notational change involving short codes for event and protocol names. For example, C for client, SC for session created, and T for TCP. Compact logging results in an average of 40 percent reduction in log size.

  Compact logging is supported for NAT44, DS-Lite, and NAT64.
  [From Build 41.26]
  [# NSAUTH-4700]

• Large Scale NAT64

  Because of the imminent exhaustion of IPv4 addresses, ISPs have started transitioning to IPv6 infrastructure. But during the transition, ISPs must continue to support IPv4 along with IPv6, because most of the public Internet still uses IPv4. Large scale NAT64 is an IPv6 transition solution for ISPs with IPv6 infrastructure to connect their IPv6-only subscribers to the IPv4 Internet. DNS64 is a solution for enabling discovery of IPv4-only domains by IPv6-only clients. DNS64 is used with large scale NAT64 to enable seamless communication between IPv6-only clients and IPv4-only servers.

  A NetScaler appliance implements large scale NAT64 and DNS64 and is compliant with RFCs 6145, 6146, 6147, 6052, 3022, 2373, 2765, and 2464.

  The following lists some of the large scale NAT64 features supported on NetScaler appliance:

  - ALGs. Support of application Layer Gateway (ALG) for SIP, RTSP, FTP, ICMP, and TFTP protocols.

  - Deterministic/Fixed NAT. Support for pre-allocation of blocks of ports to subscribers to minimize logging.

  - Mapping. Support of Endpoint-independent mapping (EIM), Address-dependent mapping (ADM), and Address-Port dependent mapping (APDM).

  - Filtering. Support of Endpoint-Independent Filtering (EIF), Address-Dependent Filtering (ADF), and Address-Port-Dependent Filtering (APDF).

  - Quotas. Configurable limits on number of ports, sessions per subscriber, and sessions per LSN group.

  - Static Mapping. Support for manually defining a large scale NAT64 mapping.

  - Hairpin Flow. Support for communication between subscribers or internal hosts using NAT IP addresses.

  - 464XLAT connections. Support for communication between IPv4-only aware applications on IPv6 subscriber hosts and IPv4 hosts on the Internet through IPv6 network.

  - Variable length NAT64 and DNS64 prefixes. The NetScaler appliance supports defining NAT64 and DNS64 prefixes of lengths of 32, 40, 48, 56, 64, and 96.

  - Multiple NAT64 and DNS64 prefix. The NetScaler appliance supports multiple NAT64 and DNS64 prefixes.

  - LSN Clients. Support for specifying or identifying subscribers for large scale NAT64 by using IPv6 prefixes and extended ACL6 rules.

  - Logging. Support for logging NAT64 sessions for law enforcement. In addition, the following are also supported for logging.

  -- Reliable SYSLOG. Support for sending SYSLOG messages over TCP to external log servers for a more reliable transport mechanism.

  -- Load balancing of log servers. Support for load balancing of external log servers for preventing storage of redundant log messages.

  -- Minimal Logging. Deterministic LSN configurations or Dynamic LSN configurations with port block significantly reduce the large scale NAT64 log volume.

  -- Logging MSISDN information. Support for including subscribers' MSISDN information in large scale NAT64 logs to identify and track subscriber activity over the Internet.
  [From Build 41.26]
  [# NSHELP-15956]

• Large Scale NAT64

  Because of the imminent exhaustion of IPv4 addresses, ISPs have started transitioning to IPv6 infrastructure. But during the transition, ISPs must continue to support IPv4 along with IPv6, because most of the public Internet still uses IPv4. Large scale NAT64 is an IPv6 transition solution for ISPs with IPv6 infrastructure to connect their IPv6-only subscribers to the IPv4 Internet. DNS64 is a solution for enabling discovery of IPv4-only domains by IPv6-only clients. DNS64 is used with large scale NAT64 to enable seamless communication between IPv6-only clients and IPv4-only servers.

  A NetScaler appliance implements large scale NAT64 and DNS64 and is compliant with RFCs 6145, 6146, 6147, 6052, 3022, 2373, 2765, and 2464.

  The following lists some of the large scale NAT64 features supported on NetScaler appliance:

  - ALGs: Support of application Layer Gateway (ALG) for SIP, RTSP, FTP, ICMP, and TFTP protocols.

  - Deterministic/Fixed NAT: Support for pre-allocation of blocks of ports to subscribers to minimize logging.

  - Mapping: Support of Endpoint-independent mapping (EIM), Address-dependent mapping (ADM), and Address-Port dependent mapping (APDM).

  - Filtering: Support of Endpoint-Independent Filtering (EIF), Address-Dependent Filtering (ADF), and Address-Port-Dependent Filtering (APDF).

  - Quotas: Configurable limits on number of ports, sessions per subscriber, and sessions per LSN group.

  - Static Mapping: Support for manually defining a large scale NAT64 mapping.

  - Hairpinning Flow: Support for communication between subscribers or internal hosts using NAT IP addresses.

  - 464XLAT connections: Support for communication between IPv4-only aware applications on IPv6 subscriber hosts and IPv4 hosts on the Internet through IPv6 network.

  - Variable length NAT64 and DNS64 prefixes: The NetScaler appliance supports defining NAT64 and DNS64 prefixes of lengths of 32, 40, 48, 56, 64, and 96.

  - Multiple NAT64 and DNS64 prefix: The NetScaler appliance supports multiple NAT64 and DNS64 prefixes.

  - LSN Clients: Support for specifying or identifying subscribers for large scale NAT64 by using IPv6 prefixes and extended ACL6 rules.

  - Logging: Support for logging NAT64 sessions for law enforcement. In addition, the following are also supported for logging.

  -- Reliable SYSLOG: Support for sending SYSLOG messages over TCP to external log servers for a more reliable transport mechanism.

  -- Load balancing of log servers: Support for load balancing of external log servers for preventing storage of redundant log messages.

  -- Minimal Logging: Deterministic LSN configurations or Dynamic LSN configurations with port block significantly reduce the large scale NAT64 log volume.

  -- Logging MSISDN information: Support for including subscribers' MSISDN information in large scale NAT64 logs to identify and track subscriber activity over the Internet.

  For more information, see http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-nat-64.html
  [From Build 47.14]
  [# NSHELP-15956]

• HTTP Header Logging Support for DS-Lite

  The NetScaler appliance can now log request header information of an HTTP connection that is using the NetScaler's DS-Lite functionality. The HTTP header logs can be used by ISPs to see the trends related to the HTTP protocol among a set of subscribers. For example, an ISP can use this feature to find out the most popular website among a set of subscribers. For more information, see http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/dual-stack-lite/logging-monitoring-DS-Lite.html.
  [From Build 47.14]
  [# 558159, 559227]

• Subscriber Aware LSN Session Termination

  Currently, if a subscriber session is deleted when a RADIUS Accounting STOP or a PCRF-RAR message is received, or as a result of any other event, such as TTL expiry or flush, the corresponding LSN sessions of the subscriber are removed only after the configured LSN timeout period. LSN sessions that are kept open until this timeout expires continue to consume resources on the appliance.

  This enhancement adds a new parameter (subscrSessionRemoval). If this parameter is enabled, and the subscriber information is deleted from the subscriber database, LSN sessions corresponding to that subscriber are also removed. If this parameter is disabled, the subscriber sessions are timed out as specified by the LSN timeout settings.
  [From Build 41.26]
  [# NSHELP-15966]

• Subscriber Aware LSN Session Termination

  Currently, if a subscriber session is deleted when a RADIUS Accounting STOP or a PCRF-RAR message is received, or as a result of any other event, such as TTL expiry or flush, the corresponding LSN sessions of the subscriber are removed only after the configured LSN timeout period. LSN sessions that are kept open until this timeout expires continue to consume resources on the appliance.

  This enhancement adds a new parameter (subscrSessionRemoval). If this parameter is enabled, and the subscriber information is deleted from the subscriber database, LSN sessions corresponding to that subscriber are also removed. If this parameter is disabled, the subscriber sessions are timed out as specified by the LSN timeout settings.

  For more information about subscriber aware LSN session termination, see http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-telco-subscriber-management.html.
  [From Build 47.14]
  [# NSHELP-15966]

• Support for SIP and RTSP ALGs for DS-Lite

  The NetScaler appliance now supports SIP and RTSP application layer gateways (ALGs) for DS-Lite. For more information, see:

  - http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/dual-stack-lite/AGL-DS-Lite.html

  - http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-nat-64/configuring-agl-large-scale-NAT64.html
  [From Build 47.14]
  [# NSHELP-12765]

• NAT44 Wildcards Static Maps

  A static mapping entry is usually a one-to-one LSN mapping between a subscriber IP address:port and a NAT IP address:port. A one-to-one static LSN mapping entry exposes only one port of the subscriber to the Internet.

  Some situations might require exposing all ports (64K) of a subscriber to the Internet (for example, a server hosted on an internal network and running a different service on each port). To make these internal services accessible through the Internet, you have to expose all the ports of the server to the Internet.

  One way to meet this requirement is to add 64K one-to-one static mapping entries, one mapping entry for each port. Creating 64K entries is very cumbersome and a big task. Also, this large number of configuration entries might lead to performance issues in the NetScaler appliance.

  Another simple method is to use wildcard ports in a static mapping entry. You just need to create one static mapping entry with NAT-port and subscriber-port parameters set to the wildcard character (*), and the protocol parameter set to ALL, to expose all the ports of a subscriber to the Internet. For a subscriber's inbound or outbound connections matching a wildcard static mapping entry, the subscriber's port does not change after the NAT operation. For more information, see http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-introduction/configuring-static-lsn-maps.html.
  [From Build 47.14]
  [# NSHELP-16003]

• NAT44 Wildcards Static Maps

  A static mapping entry is usually a one-to-one LSN mapping between a subscriber IP address:port and a NAT IP address:port. A one-to-one static LSN mapping entry exposes only one port of the subscriber to the Internet.

  Some situations might require exposing all ports (64K) of a subscriber to the Internet (for example, a server hosted on an internal network and running a different service on each port). To make these internal services accessible through the Internet, you have to expose all the ports of the server to the Internet.

  One way to meet this requirement is to add 64K one-to-one static mapping entries, one mapping entry for each port. Creating 64K entries is very cumbersome and a big task. Also, this large number of configuration entries might lead to performance issues in the NetScaler appliance.

  Another simple method is to use wildcard ports in a static mapping entry. You just need to create one static mapping entry with NAT-port and subscriber-port parameters set to the wildcard character (*), and the protocol parameter set to ALL, to expose all the ports of a subscriber to the Internet. For a subscriber's inbound or outbound connections matching a wildcard static mapping entry, the subscriber's port does not change after the NAT operation.
  [From Build 41.26]
  [# NSHELP-16003]

• Policy-based TCP Profile

  You can now configure the NetScaler appliance to perform TCP optimization based on subscriber attributes. For example, the appliance can now select different TCP profiles at run time, based on the network to which the user equipment (UE) is connected. As a result, you can improve a mobile user's experience by setting some parameters in the TCP profiles and then using policies to select the appropriate profile.

  For more information about policy-based TCP profile, see http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-telco-subscriber-management.html.
  [From Build 47.14]
  [# 622947]

• Global override LSN parameter removed from L3 parameters

  The global override LSN parameter has been removed from L3 parameters. To override LSN, you must now create a net profile with the overrideLsn parameter enabled and bind this profile to all the load balancing virtual servers that are configured for value added services. For more information, see http://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-introduction/override-lsn-configuration-lb-configuration.html.
  [From Build 47.14]
  [# 642585]

• Wildcard Port Static Large Scale NAT64 Maps

  A static large scale NAT64 mapping entry is usually a one-to-one mapping between a subscriber IPv6 address:port and a NAT IPv4 address:port. A one-to-one static large scale NAT64 mapping entry exposes only one port of the subscriber IP address to the Internet.

  Some situations might require exposing all ports (64K - limited to the maximum number of ports of a NAT IPv4 address) of a subscriber IP address to the Internet (for example, a server hosted on an internal network and running a different service on each port). To make these internal services accessible through the Internet, you have to expose all the ports of the server to the Internet.

  One way to meet this requirement is to add 64 thousand one-to-one static mapping entries, one mapping entry for each port. Creating that entries is very cumbersome and a big task. Also, this large number of configuration entries might lead to performance issues in the NetScaler appliance.

  A simpler method is to use wildcard ports in a static mapping entry. You just need to create one static mapping entry with NAT-port and subscriber-port parameters set to the wildcard character (*), and the protocol parameter set to ALL, to expose all the ports of a subscriber IP address for all protocols to the Internet.

  For a subscriber's inbound or outbound connections matching a wildcard static mapping entry, the subscriber's port does not change after the NAT operation. When a subscriber-initiated connection to the Internet matches a wildcard static mapping entry, the NetScaler appliance assigns a NAT port that has the same number as the subscriber port from which the connection is initiated. Similarly, an Internet host gets connected to a subscriber's port by connecting to the NAT port that has the same number as the subscriber's port.
  [From Build 51.21]
  [# NSNET-6005]

• Wildcard Port Static Large Scale NAT64 Maps

  A static large scale NAT64 mapping entry is usually a one-to-one mapping between a subscriber IPv6 address:port and a NAT IPv4 address:port. A one-to-one static large scale NAT64 mapping entry exposes only one port of the subscriber IP address to the Internet.

  Some situations might require exposing all ports (64K - limited to the maximum number of ports of a NAT IPv4 address) of a subscriber IP address to the Internet (for example, a server hosted on an internal network and running a different service on each port). To make these internal services accessible through the Internet, you have to expose all the ports of the server to the Internet.

  One way to meet this requirement is to add 64 thousand one-to-one static mapping entries, one mapping entry for each port. Creating that entries is very cumbersome and a big task. Also, this large number of configuration entries might lead to performance issues in the NetScaler appliance.

  A simpler method is to use wildcard ports in a static mapping entry. You just need to create one static mapping entry with NAT-port and subscriber-port parameters set to the wildcard character (*), and the protocol parameter set to ALL, to expose all the ports of a subscriber IP address for all protocols to the Internet.

  For a subscriber's inbound or outbound connections matching a wildcard static mapping entry, the subscriber's port does not change after the NAT operation. When a subscriber-initiated connection to the Internet matches a wildcard static mapping entry, the NetScaler appliance assigns a NAT port that has the same number as the subscriber port from which the connection is initiated. Similarly, an Internet host gets connected to a subscriber’s port by connecting to the NAT port that has the same number as the subscriber’s port.
  [From Build 62.8]
  [# NSNET-6005]

Fixed Issues in Previous NetScaler 11.1 Releases

• The Client-Server Link Mapping option under Network > TCP/IP connections of Citrix GUI displays a blank connection in admin partition mode.
  [From Build 63.9]
  [# NSHELP-18772]

• The “stat system memory” command might display an incorrect value for “Free Memory (MB) “ field, whenever the NetScaler appliance reaches 100% memory usage in default partition.
  [From Build 63.9]
  [# NSHELP-19239]

• In a high availability setup with admin partition configuration, the audit logs generated from the secondary node are sent to SYSLOG or NSLOG server only when the SYSLOG or NSLOG server is reachable from the admin partition.
  [From Build 62.8]
  [# NSHELP-19399]

• In a partitioned setup, DNS slows down and times out after creating an admin partition.
  [From Build 63.9]
  [# NSHELP-19996]

• Setting the minimum bandwidth for an admin partition is not supported. Therefore, the 'minBandwidth' parameter is deprecated from the 'add ns partition' command.
  [From Build 63.9]
  [# NSNET-5717]

Admin Partitions

• SNMP profiles have been modified to avoid dropping SNMP responses intended for non-default partitions. An SNMP agent can now track each SNMP request and send a response to a non-default partition. Previously, if a non-default partition received an SNMP request through a subnet IP address, the SNMP agent on the partition responded to the default partition, because the SNIP address was defined on the default partition.
  [From Build 49.16]
  [# 609367]

• The CLI does not correctly display the command prompt to users who have read-only-access accounts created in the default partition and bound to a non-default partition.
  [From Build 55.13]
  [# NSHELP-11317]

• When you access a partitioned appliance through the NetScaler GUI, the Dashboard does not display the "CPU vs. Memory Usage and HTTP Requests Rate" graph in the left pane.
  [From Build 55.13]
  [# NSUI-5254]

• When you access a partitioned appliance through the NetScaler GUI, the Dashboard does not display the "CPU vs. Memory Usage and HTTP Requests Rate" graph in the left pane.
  [From Build 54.16]
  [# NSUI-5254]

• When you configure an administrative partition, validation of the partition's VMAC address might fail, causing the NetScaler appliance to crash.
  [From Build 54.16]
  [# NSHELP-371]

• On a partitioned NetScaler appliance, the system memory counters are not updated properly unless they are cleared during partition deletion.
  [From Build 55.13]
  [# NSHELP-372, 682240]

• In rare cases, one of the partitions on a partitioned appliance does not get enough slots to send Gratuitous Address Resolution Protocol (GARP) messages for all its IP addresses on the network.
  [From Build 56.19]
  [# NSHELP-373]

• In a rare scenario, the secondary appliance of a high availability setup fails during an HA force sync operation. The appliance fails because of a memory allocation failure in an admin partition.
  [From Build 58.13]
  [# NSHELP-16128, 690223]

Analytics

• The NetScaler Gateway login page fails to load if you have enabled client side measurements in the AppFlow action.
  [From Build 57.13]
  [# NSHELP-3476]

AppExpert

• When a NetScaler appliance receives a client request for evaluating a responder policy, it might not log the responder data. Before evaluation, the appliance sets the ns_auditlog_module_id global variable and uses the data for log processing. If during the evaluation you block the log action and wait for more data, and while you are waiting the appliance receives another client request to evaluate a different policy, the responder log data is not recorded for the responder module.
  [From Build 55.13]
  [# NSHELP-16075]

AppFlow

• ICA parsing uses a lot of memory, so the NetScaler appliance reaches its memory limit with a lower than expected number of connections.
  [From Build 49.16]
  [# NSUI-351]

• A NetScaler load balanced server responds with a 411 error code for a corrupted HTTP request.
  [From Build 50.10]
  [# NSHELP-5102]

• If you have configured NetScaler Gateway in a double-hop setup, HDX virtual desktops might become unresponsive when you perform the following sequence of actions: connect, disconnect and reconnect.
  [From Build 48.10]
  [# 641396]

• When AppFlow for ICA is enabled on a NetScaler appliance in a multicore environment, the Netscaler appliance might become unresponsive.
  [From Build 49.16]
  [# NSHELP-15663]

• Automatic client reconnection (ACR) for Linux VDA clients fails if the NetScaler appliance is in the path and ICA AppFlow is enabled for the appliance.
  [From Build 50.10]
  [# NSHELP-15681, 651200]

• Applications do not launch when AppFlow is enabled and connection chaining is disabled. This is because when a full sized packet is received, the connection chain ID is added to the packet resulting in the size of packet going beyond the maximum transmission unit (MTU). So, the packet gets dropped and the application fails to launch.
  [From Build 50.10]
  [# NSBASE-4190, 653126, 661587, 664792]

• If AppFlow for ICA is enabled on a NetScaler appliance, the appliance might become unresponsive under certain circumstances during ICA capability negotiation in ICA PROXY mode.
  [From Build 49.16]
  [# NSHELP-5224, 655823, 661720]

• If HDX Insight is enabled on a NetScaler appliances in high-availability mode, and if the nodes are set to STAY PRIMARY or STAY SECONDARY, session reliability fails when a failover happens.
  [From Build 49.16]
  [# 653438]

• If AppFlow clientside measurements and AppFirewall are enabled, due to incomplete and incorrect order of the restore/cleanup of AppFlow and AppFirewall feature, NetScaler might become unresponsive.
  [From Build 50.10]
  [# NSHELP-3472, 658547]

• When Web Insight is enabled, and if the configuration has wild card virtual servers, the NetScaler appliance might become unresponsive when writing the appflow records.
  [From Build 50.10]
  [# NSHELP-3452, 660103]

• Service states for the service groups cannot be updated. As a result, client requests are dropped.
  [From Build 53.13]
  [# NSHELP-3453]

• Memory usage on a NetScaler appliance might increase over time if AppFlow Client-side Measurements is enabled.
  [From Build 53.13]
  [# NSHELP-3465, 672859]

• Memory usage on a NetScaler appliance might increase over time if AppFlow Client-side Measurements is enabled.
  [From Build 52.13]
  [# NSHELP-3465, 672859]

• If AppFlow clientside measurements are enabled, NetScaler instance does not buffer the response packets even though it acknowledges the packet to the server. This will cause page load issues if the packets are lost.
  [From Build 50.10]
  [# NSHELP-9221]

• If you enable AppFlow on a SQL virtual server, the NetScaler appliance might become unresponsive.
  [From Build 53.13]
  [# NSHELP-3467, 672362, 668129, 670343]

• If you enable AppFlow on a SQL virtual server, the NetScaler appliance might become unresponsive.
  [From Build 52.13]
  [# NSHELP-3467, 672362]

• If numerous GET requests are sent to a NetScaler appliance on which AppFlow is enabled, at some point the requests begin to time out.
  [From Build 52.13]
  [# NSHELP-3417, 674438]

• Memory usage on a NetScaler appliance might increase over time if the AppFlow feature is enabled and HTTP pipelined requests are sent to the HTTP or SSL virtual servers that match at least one of the AppFlow policies.
  [From Build 52.13]
  [# NSHELP-3469, 670990, 671906]

• Memory usage on a NetScaler appliance might increase over time if the AppFlow feature is enabled and HTTP pipelined requests are sent to the HTTP or SSL virtual servers that match at least one of the AppFlow policies.
  [From Build 51.26]
  [# NSHELP-3469, 670990, 671906, 676930, 667606]

• If AppFlow Client-Side Measurements action is enabled on any of the AppFlow policies, connection to backend server might get terminated intermittently thereby sending only partial response to the client.
  [From Build 53.13]
  [# NSHELP-3471, 673532, 677954, 677576]

• If AppFlow Client-Side Measurements action is enabled on any of the AppFlow policies, connection to backend server might get terminated intermittently thereby sending only partial response to the client.
  [From Build 52.13]
  [# NSHELP-3471, 673532]

• The NetScaler appliance crashes, dumps core, and restarts if a certificate is unbound from an SSL virtual server while an SSL transaction is in progress.
  [From Build 54.16]
  [# NSHELP-3475]

• The NetScaler appliance crashes, dumps core, and restarts if a certificate is unbound from an SSL virtual server while an SSL transaction is in progress.
  [From Build 55.13]
  [# NSHELP-3475]

• When ClientSide Measurements is enabled, and you access the NetScaler Gateway, then the Microsoft Internet Explorer browser displays an error.
  [From Build 55.13]
  [# NSHELP-3478, 688758]

• When an AppFlow policy bound to a VPN virtual server applies an undef action, the NetScaler instance might become unresponsive.
  [From Build 54.16]
  [# NSHELP-5265]

• A NetScaler appliance crashes and dumps core if an ECDSA certificate is bound to the SSL virtual server that processes an SSL transaction.
  [From Build 55.13]
  [# NSHELP-4919, 686195]

• A NetScaler appliance crashes and dumps core if an ECDSA certificate is bound to the SSL virtual server that processes an SSL transaction.
  [From Build 54.16]
  [# NSHELP-4919, 686195]

• If there are more than 300 embedded objects in a web page, and if client-side-measurements is enabled, the NetScaler instance might become unresponsive.
  [From Build 56.19]
  [# NSHELP-3483, 692988, 683591, 694296, 691725, 692914]

• If an AppFlow policy is bound to ICA_REQUEST bindpoint for a virtual server with the ULFD mode enabled, disabling AppFlow for that virtual server from NetScaler MAS/NetScaler Insight Center can cause the NetScaler instance to become unresponsive.
  [From Build 55.13]
  [# NSHELP-3487, 687559, 685968, 684245, 691851]

• A NetScaler appliance might become unresponsive if an AppFlow action has client-side measurements enabled and the appliance receives a corrupted request.
  [From Build 56.19]
  [# NSHELP-9343]

• A NetScaler appliance might become unresponsive if an AppFlow action has client-side measurements enabled and the appliance receives an HTTP server response before the full client request.
  [From Build 56.19]
  [# NSHELP-3489]

• NetScaler MAS 12.0 does not process AppFlow records sent from NetScaler 11.1 appliances running build versions lesser than or equal to 55.x.
  [From Build 56.19]
  [# NSHELP-3477, 695724]

• When client side measurement option is enabled in a AppFlow action, in certain scenarios, a response of size greater than 16 MB fails to load.
  [From Build 59.10]
  [# NSHELP-3481]

• The NetScaler appliance crashes while exporting data to SSL insight if both of the following conditions are met:

  -AppFlow is enabled.

  -You update or unbind an SNI certificate during the SSL transaction.
  [From Build 59.10]
  [# NSHELP-13173, 706626, 708996, 706397]

• When Client Side Measurements is enabled and the AppFlow feature is disabled with the transaction running, NetScaler appliance fails to respond.
  [From Build 59.10]
  [# NSHELP-3484, 706076, 706079]

• An issue observed in MSISDN reporting logic causes AppFlow records to incorrectly populate the same MSISDN value for concurrent connections of different subscribers. The issue resulted in a potential memory leak on an HTTP virtual server.
  [From Build 59.10]
  [# NSHELP-3486]

• The NetScaler appliance might crash when a new user logs on. The crash happens if AppFlow logging is enabled on a VPN virtual server and memory allocation fails.
  [From Build 62.8]
  [# NSHELP-19360]

• When the AppFlow "client side measurements" feature is enabled, the NetScaler appliance unexpectedly parses the CSS files of an HTML page. Any error during the CSS parse can cause the HTML page to load incorrectly.
  [From Build 62.8]
  [# NSHELP-19375]

• The NetScaler appliance might crash if AppFlow is disabled but front-end optimization (FEO) is enabled with client side measurements, in the FEO action.
  [From Build 62.8]
  [# NSHELP-19531]

AAA-TM

• If you configure "CLI Accounting" on the NetScaler appliance, the RADIUS server does not send accounting message with Session ID.
  [From Build 51.21]
  [# NSHELP-8005]

• In a multi-core NetScaler environment, user sessions sometimes do not get terminated if the decision to terminate is based on a force timeout value that is configured on a TM traffic action.
  [From Build 50.10]
  [# NSHELP-8222, 618760]

• The StoreFront FQDN is not accepted as valid when a user uses it for the Test Connection function in the XA/XD Wizard. After the StoreFront FQDN is entered, the XA/XD Wizard displays an error when the user clicks Continue.
  [From Build 50.10]
  [# 612276, 621861, 639203, 650065, 651022]

• If you log on to the NetScaler Traffic Management (TM) virtual server using "401 Basic" authentication, you might observe authentication failures if your username or password contains special characters. This is because only UTF-8 characters below ASCII 128 (for example, A-Z, a-z, 0-9, and ~ ! @ # $ % ^ & * ( ) _ + - = [ { ] } \ | ; : ' " / ? . > , < special characters) are allowed.
  [From Build 56.19]
  [# NSHELP-8295, 589509, 650263, 672340]

• In a high availability setup, a session does not time out even if a force timeout is configured on a traffic action that is bound to a load balancing or content switching virtual server and a force fail over is performed.
  [From Build 50.10]
  [# NSHELP-744]

• If you remove the NT LAN Manager (NTLM) prompt while using Kerberos or NTLM authentication, the NetScaler appliance configured for NetScaler AAA does not fall back to the next authentication method.
  [From Build 57.13]
  [# NSAUTH-1869, 630764]

• The NetScaler appliance might restart if role-based access is enabled in admin partitions.
  [From Build 51.21]
  [# NSHELP-780]

• If the LDAP bind account password used on a NetScaler appliance contains the "at" special character (@), test connection performed on LDAP server fails, and the dashboard shows that the LDAP server is down.
  [From Build 55.13]
  [# NSHELP-764, 689891]

• If the LDAP bind account password used on a NetScaler appliance contains the "at" special character (@), test connection performed on LDAP server fails, and the dashboard shows that the LDAP server is down.
  [From Build 52.13]
  [# NSHELP-764]

• The NetScaler appliance fails if all of the following conditions are met:

  - The appliance is used as a SAML service provider.

  - Multiple load balancing and content switching virtual servers are configured for the same external identity provider (IdP) but with different FQDN.

  - SAML login happens on a virtual server with an existing SAML session from the same IdP.
  [From Build 51.21]
  [# NSAUTH-2423, 670657]

• In a multifactor SAML IdP configuration, if a SAML request is resent from the service provider during authentication, the NetScaler appliance sends an assertion before authentication is complete.
  [From Build 51.21]
  [# NSAUTH-2467]

• When OWA is configured for traffic policy based logout, once logout is triggered, sessions stay for longer time in few versions and cases because of application implementation. With this fix, once logout is configured in traffic policy, session is removed in at most 2 min regardless of activity from the client.
  [From Build 54.16]
  [# NSHELP-778]

• If a NetScaler AAA daemon sends a DNS query by using source port 3000 to LDAP or RADIUS servers, the CPU utilization goes high and the DNS data packet keeps looping. With this fix, the NetScaler AAA daemon sends queries to LDAP or RADIUS servers starting with source port 10000 and above.
  [From Build 55.13]
  [# NSHELP-783, 694723]

• An attempt to change an LDAP password through the NetScaler Gateway virtual server fails if the new password includes any multibyte UTF-8 characters, such as German umlauts (for example, kölnbonn207), Latin small letter sharp s (for example, straße2017), or special characters (for example, &%$§1Lucie-Marie).
  [From Build 54.16]
  [# NSHELP-798]

• An attempt to change an LDAP password through the NetScaler Gateway virtual server fails if the new password includes any multibyte UTF-8 characters, such as German umlauts (for example, kölnbonn207), Latin small letter sharp s (for example, straße2017), or special characters (for example, &%$§1Lucie-Marie).
  [From Build 56.19]
  [# NSHELP-798, 691269]

• An attempt to change an LDAP password through the NetScaler Gateway virtual server fails if the new password includes any multibyte UTF-8 characters, such as German umlauts (for example, kölnbonn207), Latin small letter sharp s (for example, straße2017), or special characters (for example, &%$§1Lucie-Marie).
  [From Build 55.13]
  [# NSHELP-798]

• In a high availability setup, a session does not time out even if a force timeout is configured on a traffic action that is bound to a load balancing or content switching virtual server and a force fail over is performed.
  [From Build 55.13]
  [# NSHELP-810, 684400]

• A NetScaler appliance connected to a back-end LDAP server logs an incorrect error code for the “restricted logon hours” parameter in the NetScaler AAA daemon logs
  [From Build 56.19]
  [# NSHELP-816]

• NTLM authentication fails when the NetScaler tries to negotiate with an LB virtual server in front of the NTLM server.
  [From Build 55.13]
  [# NSHELP-815]

• When persistent cookie is configured for AAA-TM access, response is not sent to client if server sends a connection-close header or closes connection when NetScaler determines to insert persistent cookie,
  [From Build 54.16]
  [# NSHELP-819, 665339]

• The NetScaler appliance might fail if you use Kerberos authentication and the cached ticket incorrectly points to NULL, because the Kerberos ticket has expired and removed from the Distributed Hash Table (DHT).
  [From Build 54.16]
  [# NSHELP-822]

• Inflate of the data fails intermittently when NetScaler IdP receives authentication request from external Service Provider (SP) incase "Redirect Binding" is used as the transport mechanism in SAML flow.

  When "Redirect Binding" is used as the transport mechanism in SAML flow, when NetScaler IdP receives authentication request from external Service Provider (SP), occasionally inflate of the data fails. This is highly intermittent. Current enhancement offers different variants for doing inflate as the issue in intermittent and disappears on a reboot.
  [From Build 53.13]
  [# NSHELP-1079]

• The NetScaler appliance crashes because of a failure to access the NetScaler AAA logon credentials. The failure occurs while attempting to match the rewrite policy against an AAA group.
  [From Build 55.13]
  [# NSHELP-827]

• The NetScaler appliance configured for NetScaler AAA by using LDAP authentication might become unresponsive because the wrong counter increments when alerts are received from a client counter. The ssl_tot_sslError_FatalAlertSentCount counter increments, instead of the ssl_tot_sslError_FatalAlertRecdCount counter.
  [From Build 55.13]
  [# NSHELP-845]

• If you set the ‘Validate LDAP Server Certificate’ parameter in an LDAP server configuration, you can log on even if the hostname does not match. With this fix, the hostname is checked when the option is enabled.
  [From Build 55.13]
  [# NSHELP-7936, 644099]

• If you set the ‘Validate LDAP Server Certificate’ parameter in an LDAP server configuration, you can log on even if the hostname does not match. With this fix, the hostname is checked when the option is enabled.
  [From Build 56.19]
  [# NSHELP-7936, 644099]

• The NetScaler appliance configured for NetScaler AAA using single sign-on to access backend server becomes unresponsive if both of the following conditions are met:

  • The NetScaler appliance tries to process client response based on 401 basic authentication request.

  • The traffic management virtual server is configured with basic authentication.
  [From Build 55.13]
  [# NSHELP-826, 684739, 684086, 686368, 688553]

• In rare scenarios, a NetScaler appliance becomes unresponsive when both nodes of a high availability (HA) setup claim to be the primary node.
  [From Build 55.13]
  [# NSHELP-830]

• A load balancing virtual server on a NetScaler appliance sends a reset code to the client when it receives the second packet of the client's POST request.
  [From Build 55.13]
  [# NSHELP-840]

• NetScaler fails to perform SAML Single Logout, if NetScaler is configured for SAML Authentication with an Identity Provider (IdP) that sends session index of 64 bytes. If the session index is less than 64 bytes, Single Logout is performed as expected.
  [From Build 54.16]
  [# NSHELP-846]

• If external LDAP authentication uses a case-insensitive user name, NetScaler AAA is unable to lock the user name after the number of attempts specified by the Max Login Attempts parameter.
  [From Build 56.19]
  [# NSHELP-839]

• Client logons are delayed by 15 seconds if Kerberos Constrained Delegation (KCD) is used on a NetScaler appliance. The delay occurs during the process of issuing a Kerberos ticket to the client.
  [From Build 55.13]
  [# NSHELP-842]

• In rare scenarios, NetScaler dumps core if dialogue mode operation like password change operation happens during RBA authentication.
  [From Build 55.13]
  [# NSHELP-862]

• If a NetScaler appliance configured for SAML Identity Provider (IdP) contains AAA.USER.GROUP_as_xml() attribute in the “samlIdPProfile” command, an extra AttributeValue tag is getting opened.
  [From Build 59.10]
  [# NSHELP-861]

• A NetScaler appliance configured for NetScaler AAA with single sign-on is unable to log off from Online Web Access (OWA).
  [From Build 56.19]
  [# NSHELP-860]

• A NetScaler appliance can add multiple NetScaler AAA groups, but the “save config” operation saves only the first group.
  [From Build 55.13]
  [# NSHELP-892, 689457]

• After an upgrade from an earlier release 10.5 build 60.7 to release 11.1 build 52.32, if the client sends an invalid basic authorization header as "Authorization: Basic (null)", then NetScaler appliance does not perform single sign-on (SSO) to access back end.
  [From Build 56.19]
  [# NSHELP-897]

• Assigning a custom port other than the default to an authentication enabled load balancing virtual server causes the NetScaler appliance to display an error message.
  [From Build 55.13]
  [# NSHELP-868]

• Assigning a custom port other than the default to an authentication enabled load balancing virtual server causes the NetScaler appliance to display an error message.
  [From Build 54.16]
  [# NSHELP-868]

• If an attribute is a binary-string type and contains “0x00” as a value, the LDAP attributes extraction fails. At this point, the NetScaler appliance configured for NetScaler AAA becomes unresponsive.
  [From Build 56.19]
  [# NSHELP-877]

• A NetScaler appliance configured for NetScaler AAA becomes unresponsive during a VPN session if both of the following conditions are met:

  • The primary session is in the timed out state.

  • The secondary session is in sync but the actual state of the session is reset to zero.
  [From Build 56.19]
  [# NSHELP-878]

• In some cases, if you log on to ShareFile through a load balancing virtual server by using NetScaler AAA, you are incorrectly directed to a different user profile.
  [From Build 56.19]
  [# NSHELP-881]

• In some cases, a NetScaler appliance becomes unresponsive if either or both of the following conditions are met:

  • The SSO and Proxy are configured

  • The authentication request is a POST method
  [From Build 57.13]
  [# NSHELP-891]

• If you run the 'ldapsearch' command at the NetScaler shell prompt, the following error message appears:

  Segmentation fault: 11 (core dumped)
  [From Build 56.19]
  [# NSAUTH-2983]

• A NetScaler appliance configured for forms single sign-on (SSO) to back end adds whitespaces at the end of URL and before HTTP version.
  [From Build 56.19]
  [# NSHELP-890, 686735]

• The Outlook Anywhere (OA) services traffic on the NetScaler appliance might intermittently slow down the authentication process. The delay in the authentication process is observed after sometime.
  [From Build 57.13]
  [# NSHELP-7990]

• The NetScaler appliance occasionally becomes unresponsive when the username is in “userPrincipalName” format and the domain length is one.
  [From Build 56.19]
  [# NSHELP-902]

• If the HTTPOnly flag is not set on the NSC_TASS cookie of NetScaler AAA, the script allows you to access an application. With this fix, the script is unable to read NSC_TASS cookie.
  [From Build 56.19]
  [# NSHELP-910]

• The custom protocol used to communicate data between the traffic management virtual server and NetScaler AAA virtual server sends sensitive data through URL.
  [From Build 58.13]
  [# NSHELP-911]

• The NetScaler AAA wrongly calculates the NSC cookie length if an authentication function calculates the string delimiter (/0) as well. In this context, the function also copies the character (/0) into the HTTP header. With this fix, NetScaler AAA now calculates the string length correctly without a string delimiters (/0) and is not copied to the HTTP header.
  [From Build 56.19]
  [# NSHELP-893]

• If the initial request to the traffic management virtual server is an unauthenticated POST request, the NetScaler appliance configured for NetScaler AAA, disregards the post body.
  [From Build 56.19]
  [# NSHELP-8037]

• A NetScaler appliance configured for NetScaler AAA might become unresponsive when trying to single sign-on (SSO) with a backend server, because the front-end loses the connection.
  [From Build 56.19]
  [# NSHELP-914]

• If a SAML Identity Provider (IdP) sends a namespace for a digital signature and if the namespace is not within the signedInfo or signature parameters, the NetScaler appliance configured for SAML Service Provider (SP) rejects the namespace assertion and the signature validation fails.
  [From Build 57.13]
  [# NSHELP-927]

• The NetScaler appliance becomes unresponsive if an invalid cookie tries to merge with a body cookie, causing the cookie parsing to fail.
  [From Build 58.13]
  [# NSHELP-915]

• The NetScaler appliance becomes unresponsive if an invalid cookie tries to merge with a body cookie, causing the cookie parsing to fail.
  [From Build 57.13]
  [# NSHELP-915]

• The NetScaler appliance becomes unresponsive if an invalid cookie tries to merge with a body cookie, causing the cookie parsing to fail.
  [From Build 57.13]
  [# NSHELP-951, 705826]

• A NetScaler appliance configured for NetScaler AAA might become unresponsive if the following conditions are met:

  • The samlAction parameter is configured.

  • The back-end server is unreachable.
  [From Build 58.13]
  [# NSHELP-8220]

• A NetScaler appliance does not attempt SSO when you configure client certificate authentication but client always sends basic authorization header.
  [From Build 59.10]
  [# NSHELP-977]

• In rare cases, a high availability setup NetScaler appliance might become unresponsive after AAA session is established.
  [From Build 59.10]
  [# NSHELP-994, 707125, 710266, 709557]

• In a high availability setup, AAA sessions on a NetScaler appliance becomes unresponsive during an upgrade from 11.1 build 57.11 to 11.1 build 58.x. To overcome this issue, you must complete the following steps:

  1. Disable HA sync on both primary and secondary nodes using the command set ha node –hasync disabled. Do not disable “ha prop.”

  2. Disable the ICA parameter using the command “set ica parameter -enableSRonHAFailover no.”

  3. Save the configuration.

  4. Upgrade the secondary appliance to 11.1 build 58.13. Do not run the “force failover” command.

  5. Upgrade the primary node and execute the “force failover” command.

  6. Enable HA sync on both primary and secondary nodes using the command “set ha node –hasync enabled.”

  7. Enable the ICA parameter “set ica parameter -enableSRonHAFailover yes.”

  8. Save the configuration.

  Note: During an upgrade, the state information from primary to secondary is not synched and this might cause some traffic disruption. Citrix recommends you to perform the upgrade in a special maintenance window.
  [From Build 58.13]
  [# NSHELP-444, 708016]

• In a high availability setup, a NetScaler appliance might become unresponsive when one of the nodes is running release 11.1 build 57.11 and the other node is running a different build.
  [From Build 57.13]
  [# NSHELP-444]

• In a high availability setup, a NetScaler appliance with active AAA sessions becomes unresponsive. The issue occurs when you upgrade the appliance from release 11.1 build 57.13 to later releases.
  [From Build 59.10]
  [# NSHELP-444, 708016, 709217]

• A NetScaler appliance becomes unresponsive because of memory corruption when it handles jumbo frames.
  [From Build 59.10]
  [# NSHELP-445, 712490, 711718, 698974, 714419, 712489]

• A NetScaler appliance configured for NetScaler AAA to protect traffic management resources might leak memory and becomes unresponsive.
  [From Build 59.10]
  [# NSHELP-978, 706270, 707244, 707722, 707504, 707589]

• If you use certificate authentication method in the nFactor authentication, users observe, “401 unauthorized” error and the NetScaler appliance fails to authenticate the NetScaler AAA request.
  [From Build 57.13]
  [# NSHELP-1574]

• If you use certificate authentication method in the nFactor authentication, users observe, “401 unauthorized” error and the NetScaler appliance fails to authenticate the NetScaler AAA request.
  [From Build 58.13]
  [# NSHELP-1574, 707798, 704500]

• In rare cases, a NetScaler appliance might become unresponsive if the following conditions are met:

  • The memory location is corrupted.

  • The NetScaler AAA daemon fails due to unsafe access.
  [From Build 59.10]
  [# NSHELP-992]

• In rare cases, a NetScaler appliance might become unresponsive if the following conditions are met:

  • The memory location is corrupted.

  • The NetScaler AAA daemon fails due to unsafe access.
  [From Build 58.13]
  [# NSHELP-992]

• The NetScaler appliance might fail to establish an SSO connection to a back-end server, if the form-SSO has a hidden value containing special characters such as &, <, >, and ‘.
  [From Build 60.14]
  [# NSHELP-939]

• A NetScaler appliance might become unresponsive if the following conditions are met:

  - User initiates logout through a traffic policy, and NetScaler appliance sends logout request to SAML IdP.

  - The SAML IdP does not respond to the RelayState parameter in the logout response message, which is sent from the NetScaler appliance.
  [From Build 59.10]
  [# NSHELP-512]

• The request to the back-end server fails if the following conditions are met:

  • Request URL to the back-end server is encoded prior to establishing AAA session.

  • NetScaler appliance decodes the URL after log on.
  [From Build 59.10]
  [# NSHELP-963, 711806, 713423]

• A NetScaler AAA session observes an accounting error on the logout method.
  [From Build 60.14]
  [# NSHELP-979]

• In a rare case, a NetScaler appliance restarts if it tries to access a memory that was previously freed.
  [From Build 60.14]
  [# NSHELP-449, 715848, 715865, 715201]

• CPU utilization increases and the DNS data packet keeps looping if NetScaler AAA uses port 3000 to send a DNS query to an LDAP or a RADIUS server. With this fix, NetScaler AAA uses source port 10000 and above to send DNS queries to LDAP or RADIUS servers.
  [From Build 60.14]
  [# NSHELP-8416]

• A NetScaler appliance might crash if clear config command is invoked when NetScaler AAA actions are handled.
  [From Build 61.7]
  [# NSHELP-18165]

• If “InitiateLogout” parameter is enabled, a NetScaler appliance might crash in memory crunch scenario.
  [From Build 61.7]
  [# NSHELP-18166]

• When the user accesses a resource that is in the parent domain, a NetScaler AAA might fail to establish an SSO connection using KCD.
  [From Build 62.8]
  [# NSHELP-18409]

• In a NetScaler appliance with two-factor authentication, the appliance prompts you to change the authentication password if the existing password has expired. During this prompt time, the appliance deletes the authentication, authorization, and auditing information.

  The NetScaler appliance might crash when it attempts to access the deleted authentication, authorization, and auditing information.
  [From Build 62.8]
  [# NSHELP-18474]

• A NetScaler appliance might fail when logging in end users to traffic management resources behind NetScaler Gateway appliance.
  [From Build 62.8]
  [# NSHELP-18517]

• The Citrix GUI displays the configured server IP address in the Server Name field for an authentication radius action if all the following conditions are true:

  * If you set the Server IP address parameter after setting the Server Name parameter.

  * If the Server Name Length parameter is not set to zero.
  [From Build 62.8]
  [# NSHELP-18703]

• The FormSSO fails if any of the form fields is more than 1365 bytes in length.
  [From Build 62.8]
  [# NSHELP-18783]

• In a cluster setup, the authentication daemon might crash if the authentication request is sent to the authentication daemon before the configuration is processed.
  [From Build 62.8]
  [# NSHELP-18788]

• A NetScaler appliance fails to obtain Kerberos tickets through a constrained delegation, if one of the following conditions are met:

  - The enterprise “realm” parameter is configured for the user.

  - The domain name in the “keytab” parameter is in lower case.
  [From Build 62.8]
  [# NSHELP-18946]

• In a NetScaler Gateway deployment, if the load balancing virtual server home page is accessed after VPN authentication, the page is not accessible.
  [From Build 62.8]
  [# NSHELP-19075]

• The Citrix appliance might crash if an authentication login schema policy is set to noschema.
  [From Build 62.8]
  [# NSHELP-19292]

• The base64 decoding fails if a digital signature has HTML entity encoded characters.
  [From Build 63.9]
  [# NSHELP-19410]

• If a dialogue cookie in the client request is processed before checking for any existing sessions, a NetScaler appliance sends a change password page to the client.
  [From Build 63.9]
  [# NSHELP-19528]

• If the dialogue cookie in the client request is processed before checking for any existing sessions, a NetScaler appliance sends a change password page to the client.
  [From Build 62.8]
  [# NSHELP-19528]

• If the URL contains ";" special character, the TASS cookie encodes the URL redirect at the time of login.
  [From Build 63.9]
  [# NSHELP-19634]

• A NetScaler appliance might crash if there is a change in the login related data structure.
  [From Build 62.8]
  [# NSHELP-19695]

• A NetScaler appliance does not authenticate duplicate password login attempts and prevents account lockouts.
  [From Build 62.8]
  [# NSHELP-563]

• The caching of custom themes in the NetScaler appliance reduces traffic to the Apache server which avoids any issues with management access.
  [From Build 62.8]
  [# NSHELP-8449]

• Occasionally, a NetScaler Gateway appliance might fail when it receives /vpns/services.html request from a client.
  [From Build 62.8]
  [# NSHELP-8513]

Cache

• A NetScaler VPX instance becomes unresponsive if a range request is greater than the cached response size. This issue happens if you enable the media classification mode on a NetScaler appliance.
  [From Build 51.21]
  [# NSHELP-15207, 659374, 661940, 662460, 667599]

Cache Redirection

• Counters for classic cache redirection policies are not incremented for HTTPS traffic.
  [From Build 56.19]
  [# NSHELP-3628]

• The NetScaler packet processing engine might crash when both of the following conditions are met:

  - The NetScaler appliance is configured as a forward proxy.

  - A request is made to an invalid IP address.
  [From Build 59.10]
  [# NSHELP-3676]

NetScaler 1000V

• AppFlow for ICA, Integrated Disk Caching, Delta Compression features should not be listed under "System->Licenses" section in the NetScaler Configuration Utility.
  [From Build 50.10]
  [# 501888]

NetScaler 1000V Appliance

• TCP services that go through tagged VLAN interfaces might go down.
  [From Build 54.16]
  [# NSHELP-2633]

• TCP services that go through tagged VLAN interfaces might go down.
  [From Build 55.13]
  [# NSHELP-2633]

NetScaler CLI

• When logged in as nsrecover user, nscli -U commands are throwing error.
  [From Build 62.8]
  [# NSCONFIG-1414]

• If you run a command that contains the symbol "@" remotely, the following error message appears:

  "No such argument"
  [From Build 62.8]
  [# NSHELP-12000]

NetScaler GUI

• When a partition admin tries to perform the Download, Create, or Create Directory operation on the "Manage Certificate" screen, an "operation not permitted" error appears. The expected behavior is that the buttons must be disabled.
  [From Build 51.21]
  [# 491353]

• The NetScaler GUI displays exponent 3 and key size 1024 when you try to create a FIPS key, but these options are not supported.

  Also, you cannot create a key of size 3072 from the GUI.
  [From Build 49.16]
  [# 639154, 654952]

• If the name of a load balancing virtual server contains a space, the virtual server is not listed by the reporting tool. (Reporting > Counters > System entities statistics > Entities)
  [From Build 51.21]
  [# NSHELP-4412]

• If you use "clear ns configuration" command to clear the NetScaler configuration and reset it to factory default, the command policies are restored to the default values.
  [From Build 51.21]
  [# NSHELP-4808, 200969]

• The field value for X-Forwarded-For HTTP header is not displayed as client IP in NetScaler Security Insight violation logs.
  [From Build 49.16]
  [# 645284, 636390]

• You cannot bind a cipher or cipher group to an SSL entity by using the NetScaler GUI. Therefore, after you upgrade or restart the appliance, you must bind the cipher suite to the custom cipher group again.
  [From Build 52.13]
  [# NSUI-1698, 638254]

• If you have configured static proximity as the load balancing method on a load balancing virtual server, you cannot set a backup method by using the GUI.
  [From Build 48.10]
  [# 648408]

• On a NetScaler SDX appliance, the selected order of external authentication servers for cascading authentication might change in the NetScaler GUI if you randomly switch views. This is a display issue.
  [From Build 48.10]
  [# 649190]

• When creating a cluster node group, you no longer have to specify a node state. The "Add Node Group" page in the NetScaler GUI displays "state" as optional, not as a required field.

  Page Navigation: Configuration > System >Cluster > NodeGroup > Add Node Group
  [From Build 48.10]
  [# NSHELP-4681]

• In NetScaler Gateway > Policies > RDP, you can now enable and disable the RDP feature. A regression caused this option to break.
  [From Build 49.16]
  [# NSHELP-4682]

• In NetScaler Gateway > Policies > RDP, you can now enable and disable the RDP feature. A regression caused this option to break.
  [From Build 48.10]
  [# NSHELP-4682]

• In Security > AAA > Virtual Servers, you can now bind an SSL profile to a virtual server.
  [From Build 48.10]
  [# NSHELP-12409]

• You cannot unbind a transform policy from a virtual server by using the GUI.
  [From Build 52.13]
  [# NSUI-4499]

• You cannot unbind a transform policy from a virtual server by using the GUI.
  [From Build 51.21]
  [# NSUI-4499]

• If you try to bind a default load balancing virtual server to a content switching virtual server in an admin partition, the following error message appears:

  Operation not permitted.
  [From Build 50.10]
  [# NSHELP-12443]

• SSL GSLB services are configured on port 443. However, if you try to edit the service by using the NetScaler GUI, port 80 appears instead of 443. This was a display issue and is fixed.
  [From Build 49.16]
  [# NSHELP-4688]

• When using the XenApp and XenDesktop wizard, the Retrieve Stores functionality intermittently fails on the first click.
  [From Build 56.19]
  [# CGOP-5934]

• If the features "Force password change for nsroot user when default nsroot password is being used" and "strong password" are enabled, any password is accepted when you change the nsroot password.
  [From Build 51.21]
  [# 656825]

• If you configure an external authentication server, such as RADIUS, by using the NetScaler GUI, the option to bind a classic authentication policy to a system global entity fails.
  [From Build 56.19]
  [# NSUI-5052]

• A NetScaler appliance might crash or become unresponsive if you restart the appliance when it is under memory stress.
  [From Build 56.19]
  [# NSHELP-4460]

• In a cluster setup, the content switching policies bound to a load balancing virtual server do not appear when you select “Show CS/CR Bindings” for that virtual server in the NetScaler GUI.
  [From Build 56.19]
  [# NSHELP-11504]

• You can now edit GUI parameters for a custom session policy in a cluster setup.
  [From Build 55.13]
  [# NSHELP-4736]

• If from the NetScaler GUI, you create a new session policy from an existing session policy, the attempt fails.
  [From Build 55.13]
  [# NSHELP-4737]

• The NetScaler appliance GUI does not display the StoreFront section details in the XA/XD wizard.
  [From Build 56.19]
  [# NSHELP-4750]

• After an upgrade, the NetScaler GUI randomly displays the management usage of a NetScaler appliance as high.
  [From Build 58.13]
  [# NSHELP-11867]

• In rare cases, a NetScaler appliance displays an ‘Error in retrieving Certificate-key pair. Unable to get property match of undefined or null reference’ error message if you update certkey from the Certificates tab.
  [From Build 60.14]
  [# NSUI-6885, 715207]

• The following error message appears after you perform steps 1 through 4.

  "Ambiguous argument value []"

  1. Create an SSL profile with default values.

  2. Bind the profile to an SSL virtual server.

  3. Edit SSL parameters, but do not change any values.

  4. Select OK to close the SSL parameters dialog box.
  [From Build 62.8]
  [# NSHELP-19402]

• Characters are corrupted when you import a UTF-8 file from AppExpert>Responder>HTML Page Imports.
  [From Build 62.8]
  [# NSHELP-20710]

NetScaler ICA

• When XenApp/XenDesktop users launch applications/desktops that have the Advanced Encryption policy enabled, memory allocation issues cause high-availability failovers.
  [From Build 51.21]
  [# NSHELP-15748]

• The NetScaler appliance fails because it attempts to process a large unexpected value for an Expander variable. This fix adds checks to prevent this condition.
  [From Build 51.21]
  [# NSHELP-5226, 662489, 668651]

• When Session Reliability is disabled on Storefront and Session Reliability on HA Failover is enabled on a NetScaler high availability pair running on 11.1 build 49.16, the passive NetScaler instance might reboot when you launch an application or a virtual desktop.

  You can avoid the issue by performing either of the following steps:

  * Disable "Session Reliability on HA" feature on the NetScaler instance.

  -or-

  * Enable Session Reliability on Storefront. (Navigate to Citrix Storefront > NetScaler Gateway > Secure Ticket Authority > Enable Session Reliability.)
  [From Build 51.21]
  [# NSHELP-5227, 667057]

• When ICA AppFlow is enabled on a NetScaler appliance, some network traffic patterns might cause the appliance to become unresponsive.
  [From Build 52.13]
  [# NSHELP-5229, 671134]

• When session reliability is enabled for the high availability feature, memory usage by the NetScaler appliance spikes and causes a failover.
  [From Build 53.13]
  [# NSHELP-5230, 673784, 656996, 672949, 676413]

• If AppFlow for ICA is enabled, some network traffic patterns, when followed by a client reconnect, might cause the appliance to become unresponsive.
  [From Build 52.13]
  [# NSHELP-5231]

• If Session Reliability on HA failover is enabled, the NetScaler appliance does not disable compression of the ICA data during capability negotiation. As a result, a parsing operation is skipped.
  [From Build 53.13]
  [# NSHELP-5232, 674038, 679904]

• When session Reliability on HA Failover is enabled on a NetScaler high availability pair, the primary NetScaler has a buffer to maintain CGP sequence updates, which will be sent to secondary. After a reconnect, buffer updates wrong offset, resulting in corruption. Once the buffer corruption happens, wrong addresses will be accessed which can lead the NetScaler instance to become unresponsive.
  [From Build 54.16]
  [# NSHELP-5235, 684204]

• Debug prints that are enabled by default cause unwanted logging in the NetScaler console.
  [From Build 53.13]
  [# NSHELP-5236]

NetScaler Insight Center

• The whitelist of Citrix Receiver versions used by HDX Insight now includes version 13.0.2.265571 of Citrix Receiver for Linux.
  [From Build 51.21]
  [# NSINSIGHT-313, 606817]

• System groups cannot be created in the NetScaler Insight Center GUI.
  [From Build 48.10]
  [# 650657]

• AppFlow configuration fails if you use the NetScaler Insight Center FQDN instead of the NetScaler Insight Center IP address.
  [From Build 48.10]
  [# 652425]

• For a NetScaler appliance in multicore setup, reports from all cores were not getting generated except "0" core.
  [From Build 50.10]
  [# 656225]

• When you use LDAP for external authentication, you will receive a "Error: Resource does not exist" error message when you click Configuration tab.
  [From Build 50.10]
  [# NSHELP-9225]

• The NetScaler appliance does not respond if AppFlow for ICA is enabled under certain network traffic conditions.
  [From Build 56.19]
  [# NSHELP-5239, 689052, 696701]

• When you launch the ICA application that is enabled with advanced encryption in XenApp or XenDesktop, in some cases, NetScaler does not respond while handling the advanced encryption handshake.
  [From Build 56.19]
  [# NSHELP-5240, 696819]

• The NetScaler appliance slows down if Session Reliability (SR) on HA failover is enabled for ICA HDX Insight.
  [From Build 56.19]
  [# NSHELP-5241]

• The NetScaler appliance does not respond if AppFlow for ICA is enabled under certain network traffic conditions.
  [From Build 56.19]
  [# NSHELP-5242, 692554]

• You cannot see analytics data in the day, week, or month report on Insight Center.
  [From Build 57.13]
  [# NSHELP-14513]

• HDX Insight does not display ICA channel data when Logstream transport is enabled for the AppFlow feature in the NetScaler appliance and if “smartctl” is enabled for ICA HDX Insight.
  [From Build 56.19]
  [# NSHELP-3527]

• If AppFlow for ICA is enabled, in an error scenario for ICA parser with a particular network traffic condition, the NetScaler appliance can go down.
  [From Build 56.19]
  [# NSHELP-5249]

• When HDX Insight is enabled in NetScaler Appliance. In a rare scenario, due to a negative length saved in one of the structures used for logging mechanism, the NetScaler Appliance fails.
  [From Build 57.13]
  [# NSHELP-5250, 698444, 650103]

• The NetScaler appliance might fail when you delete and re-apply the AppFlow configuration while the ICA applications are launched after the AAA sessions are created for approximately 5000 users.
  [From Build 59.10]
  [# NSHELP-5251]

• NetScaler Gateway fails after a duplicate memory-free operation if you have enabled HDX Insight for ICA applications.
  [From Build 58.13]
  [# NSHELP-5252, 700412, 703435, 702111, 704081, 704573]

• When Session Reliability on NetScaler high availability pair is enabled. The output throughput on the primary NetScaler appliance is comparatively higher than the input throughput of the appliance.
  [From Build 60.14]
  [# NSHELP-5261]

• A NetScaler appliance might become unresponsive in a multi-core environment if ICA AppFlow or SmartControl feature is enabled.
  [From Build 60.14]
  [# NSHELP-15834]

NetScaler MPX Appliance

• If you execute the “unset interface lacpkey” command on a NetScaler command line interface, the following error message appears, “LACP key not set”.
  [From Build 59.10]
  [# NSHELP-14074]

• A NetScaler appliance might become unresponsive due to one or both of the following situations that occur during interface reset, or change in interface state to UP, or high availability failover.

  - An internal process fails to fetch the current state of an interface link.

  - A NetScaler packet engine is terminated.
  [From Build 54.16]
  [# NSHELP-2574, 570287, 601816, 609401, 616054, 628184, 630630, 638162, 647061, 653868, 663084, 663461, 663716, 664778, 665684, 666824, 668332]

• In a NetScaler MPX appliance, the GUI and command interface is unable to distinguish between Mellanox 100G and 50G interfaces. As a result, the interfaces allow you to set 50G on 100G interface.
  [From Build 59.10]
  [# NSHELP-14761]

• In a NetScaler MPX appliance, the GUI and command interface is unable to distinguish between Mellanox 100G and 50G interfaces. As a result, the interfaces allow you to set 50G on 100G interface.
  [From Build 60.14]
  [# NSHELP-14761]

• In some cases, the 50G NIC on the MPX 15081-50G and MPX 15041 appliances does not restore to normal state after toggling the power control of the interface.
  [From Build 62.8]
  [# NSHELP-18786]

NetScaler NITRO

• NetScaler logon credentials are locked and the error message “connection limit CFE exceeded” appears if the following conditions are met:

  - The “show ns runningconfig” command takes a long time to execute

  - The same command is re-run multiple times while the first command is still running at the background.

  The NetScaler appliance remains locked until the command completes.
  [From Build 56.19]
  [# NSHELP-4795]

• The HTTP daemon on a NetScaler appliance might fail if the “probe server” NITRO call to the appliance fails.
  [From Build 56.19]
  [# NSHELP-4796]

NetScaler SAMLIdP

• If the RelayState value in a SAML Authentication request is more than 512 bytes but less than 1024 bytes, the SAML IdP server causes buffer overrun when sending an assertion after successful authentication.
  [From Build 50.10]
  [# NSAUTH-2235, 664051, 664765]

NetScaler SDX Appliance

• The Management Service command-line interface (CLI) might fail if you access it over Telnet by using a Perl script with a Net::Telnet object.
  [From Build 53.13]
  [# NSDOC-343]

• The "hostname" field displays no information when you click a NetScaler SDX backup file to fetch its details.
  [From Build 57.13]
  [# NSSVM-573]

• A NetScaler VPX instance on a NetScaler SDX appliance might fail because of kernel memory corruption caused by a problem in the error handling path in the kernel. The issue occurs when a user-space process fails and dumps the core file at a time when the value for "sysctl.kern.corefile" points to a nonexistent directory.

  You can stack trace this issue by searching for the following message in the /var/log/messages file:

  Core dump of pid xxx (yyy) uid zzz could not be done at %s; switching core dump pattern to default: /var/core/%N-%P

  Where xxx, yyy, and zzz are specific values.
  [From Build 51.21]
  [# NSHELP-459, 607629, 634970, 644162, 652390, 657167, 664426, 671795, 671806]

• You can only assign 22 partition MAC addresses to the following SDX platforms and the virtual machine will not start, if you assign more than 22 partition MAC addresses:

  * 11500

  * 13500

  * 14500

  * 16500

  * 18500

  * 20500

  * 115xx series
  [From Build 57.13]
  [# 647534]

• If you configure a large number of channels or interfaces on a NetScaler SDX appliance, Management Service UI screens that display the system interface list or channels load slowly.
  [From Build 51.21]
  [# NSSVM-360]

• If you configure a large number of channels or interfaces on a NetScaler SDX appliance, Management Service UI screens that display the system interface list or channels load slowly.
  [From Build 53.13]
  [# NSSVM-360, 674635]

• If you configure a large number of channels or interfaces on a NetScaler SDX appliance, Management Service UI screens that display the system interface list or channels load slowly.
  [From Build 52.13]
  [# NSSVM-360]

• The NICs of a 14xxx 40G or 25xxx 40G NetScaler SDX appliance are not shown under Configuration > System > Interfaces if, after a factory reset, you use the Platform Upgrade option in the Management Service to upgrade the appliance to NetScaler SDX release 10.5 or 11.1 with 5.04 firmware.
  [From Build 52.13]
  [# NSPLAT-7356, 659913]

• The NICs of a 14xxx 40G or 25xxx 40G NetScaler SDX appliance are not shown under Configuration > System > Interfaces if, after a factory reset, you use the Platform Upgrade option in the Management Service to upgrade the appliance to NetScaler SDX release 10.5 or 11.1 with 5.04 firmware.
  [From Build 51.21]
  [# NSPLAT-7356]

• An attempt to upgrade a NetScaler SDX appliance fails if _32.tgz or _64.tgz is part of the file name of the firmware image.
  [From Build 55.13]
  [# NSSVM-406, 664303, 689021]

• On the NetScaler SDX 25000A platform, you cannot create NetScaler VPX instances on the NetScaler SDX appliance after using the clean install option to reset the appliance to a NetScaler SDX 11.1.50.x. image.
  [From Build 51.21]
  [# NSPLAT-3341]

• A NetScaler SDX appliance always sends requests for authenticated time synchronization updates to an NTP server, even if authentication is disabled. This causes time synchronization between the SDX appliance and the NTP server to fail.
  [From Build 53.13]
  [# NSHELP-2504]

• If you send multiple I/O request to the NetScaler SDX appliance, it becomes unresponsive.
  [From Build 54.16]
  [# NSHELP-2629, 686864]

• Upgrading the Management Service to NetScaler SDX release 11.1.50.x fails with the following error message and with error code 10008:

  This platform sysid 450088 is not supported
  [From Build 52.13]
  [# NSSVM-231]

• Upgrading the Management Service to NetScaler SDX release 11.1.50.x fails with the following error message and with error code 10008:

  This platform sysid 450088 is not supported
  [From Build 51.21]
  [# NSSVM-231]

• When you use a single-bundle image file to upgrade a NetScaler SDX appliance, the upgrade-progress page might become unresponsive.
  [From Build 55.13]
  [# NSSVM-658, 686510]

• When you upgrade from an earlier build of NetScaler release 10.5, with a supplemental pack older than 100015, to 10.5 build 62.x or later, static rules are not applied on the host, which might cause interface renaming issues.
  [From Build 54.16]
  [# NSHELP-2515]

• When external users authenticate by using RADIUS, LDAP, or TACACS authentication, the external user data is stored locally on the SDX Management Service running NetScaler release 11.0. After you upgrade to a later release, the user data is also migrated to the upgraded version, and the data appears under the Users tab of Owner/Readonly group when the "show systemgroup" command is run.

  With this fix, external user data no longer appears.
  [From Build 56.19]
  [# NSHELP-4563]

• Upgrading the firmware of a NetScaler VPX instance through SDX service management fails if you've disabled pinging the NSIP address of the instance. When you attempt the upgrade, the following error message appears even if the instance is in the UP state: "VPX not up and running."
  [From Build 54.16]
  [# NSHELP-4568]

• If system logs are not rotated properly, over time they consume too much disk space. This causes the XenServer server to run out of disk space and creates unexpected system behaviour.

  This issue is fixed in NetScaler release 11.1 build 53.13. For version 11.1 53.11, apply the following workaround.

  1. Log on to dom0.

  2. Run the df command to check the available disk space.

  3. If the disk space is full (100%) and the /var/log directory has large log files, run the rm <fileName> command to delete files and free space.

  3. Check the permission of "opt/xensource/bin/rotate_logs_by_size" file by running the Is -I command:

  # ls -l /opt/xensource/bin/rotate_logs_by_size

  If the result appears as "-r--r--r-- 1" and with no x characters, as in the following example, you need to change the permission.

  -r--r--r-- 1 root root 3794 Mar 27 13:48 /opt/xensource/bin/rotate_logs_by_size

  4. Run the chmod 555 to change the file permission.

  # chmod 555 /opt/xensource/bin/rotate_logs_by_size

  Recheck the file permission. For example:

  # ls -l /opt/xensource/bin/rotate_logs_by_size

  -r-xr-xr-x 1 root root 3794 Mar 27 13:48 /opt/xensource/bin/rotate_logs_by_size

  5. Reboot the system for the above changes to take effect immediately, or wait for a few hours for the changes to become effective.
  [From Build 53.13]
  [# NSPLAT-4318, 684959]

• If system logs are not rotated properly, over time they consume too much disk space. This causes the XenServer server to run out of disk space and creates unexpected system behaviour.
  [From Build 54.16]
  [# NSPLAT-4318, 684959, 685535]

• A NetScaler VPX instance's configuration is deleted if you use the Management Service to force a reboot of the instance.
  [From Build 55.13]
  [# NSSVM-473]

• If a channel configuration that is created by using the Management Service is pushed to an existing VPX instance, the channel name on the VPX instance might differ from the channel name on the Management Service.

  Because of this behavior the channel name might differ on two VPX instances of an HA pair, running on two different SDX appliances. This causes a NetScaler VPX HA pair to break after a failover.

  With this fix, Management Service creates channels on VPX instances with the same names provided the LA IDs are available on the VPX instances.

  For example, if channel LA/3 is created on Management Service, the same is created on the VPX instance, provided LA/3 ID is available on the VPX instance.

  However, for example, if LA/9 is created on Management Service, the channel is created with the first available LA ID on the VPX instance, because a VPX instance can support channels only up to LA/8.

  Note: Upon upgrade to this version, the existing LA configurations on the SDX Management Service or on the VPX instance do not change.
  [From Build 57.13]
  [# NSHELP-4575]

• The /var directory of a NetScaler VPX instance running on a NetScaler SDX appliance runs out of space after scheduled backups, because the old backup files are not removed automatically.
  [From Build 55.13]
  [# NSSVM-387, 688365]

• When you upgrade the NetScaler SDX Management Service from release 11.0 or lower to release 11.1 or higher, some anomalies might occur such as:

  - Management Service does not display the VPX instances running on the SDX appliance.

  - The NetScaler VPX instances fail to come up.

  - Management Service becomes unreachable.

  - XenServer upgrade is incomplete.

  These issues occur if the NetScaler database contains large sets of NetScaler events-related historical data. With this fix, reports of historical data is lost; however, reports collected after upgrade is retained.
  [From Build 57.13]
  [# NSHELP-12203, 694388]

• In a VPX instance (standalone or part of an HA setup) running on a SDX-21550/SDX-20500 platform, TX stalls are observed and the state of the configured load balancing services in the VPX instance flaps.
  [From Build 56.19]
  [# NSHELP-2375, 697369]

• The "Version-Bit" field displays no information when you perform any of the following actions:

  - Click a backup file and fetch its details.

  - Add instances for instance restore.
  [From Build 57.13]
  [# NSSVM-509]

• The “Date” field in the Events detail page displays no information. To see the Events details, navigate to Configuration > System > Events on the NetScaler SDX GUI.
  [From Build 57.13]
  [# NSHELP-4597]

• On a NetScaler SDX 8900 appliance running software release 11.1 build 56.19 and earlier, you might experience some load balancing virtual server-related issues, such as service monitors randomly going down and flapping.
  [From Build 57.13]
  [# NSHELP-2586, 700675]

• The NetScaler SDX GUI freezes and stops responding after you save a configuration under Configuration > NetScaler > NetScaler Configuration > Save Configuration.
  [From Build 57.13]
  [# NSSVM-691]

• In NetScaler SDX 26000-100 G platform, VLAN bindings are not displayed in the user interface though they are propagated to the VPX instances hosted on the appliance.
  [From Build 58.13]
  [# NSSVM-230]

• In NetScaler SDX 26000-100 G platform, VLAN bindings are not displayed in the user interface though they are propagated to the VPX instances hosted on the appliance.
  [From Build 59.10]
  [# NSSVM-230]

• The management IP (NSIP) of a NetScaler VPX instance running on SDX 14000 platform becomes unreachable when the following conditions are met:

  - An LACP channel comprising 10G or 40G interfaces is assigned as VPX management NIC.

  - One of the member interfaces in the LACP channel goes down.
  [From Build 59.10]
  [# NSHELP-13895]

• Upon upgrade to release 11.0 72.x, on an SDX appliance, you cannot add a new virtual router ID (VRID) configuration or modify an existing VRID configuration on a static or a link aggregation control protocol (LACP) channel.
  [From Build 59.10]
  [# 708950]

• The virtual router ID (VRID) configuration on a static or a link aggregation control protocol (LACP) channel does not work on SDX 26000 and SDX 15000-50G platforms.
  [From Build 59.10]
  [# NSPLAT-7364]

• On NetScaler SDX 26000 and SDX 15000-50G platforms, the virtual router ID (VRID) configuration on a static or a link aggregation control protocol (LACP) channel does not work if any one of the following conditions is met:

  - The VPX instance configured with the VRID restarts.

  - The SDX appliance on which the VPX instance is running restarts.
  [From Build 59.10]
  [# NSPLAT-4076]

• The VPX instance restarts by itself in the following case.

  - You change the admin profile associated with a NetScaler VPX instance with channel configuration; and

  - The NetScaler VPX instance is running on NetScaler SDX 26XXX and 15XXX appliances.
  [From Build 60.14]
  [# NSHELP-12377]

• In a VPX HA setup running on SDX appliances, when one of the switches in the virtual port channel (VPC) goes down, all the interfaces that are part of the LACP flap. This triggers HA failover.
  [From Build 62.8]
  [# NSHELP-19095]

• After upgrading NetScaler SDX 8900 and SDX 15000 50G appliances to version 11.1 63.9, 10G NICs do not appear on the appliances. This issue prevents the VPX instances from booting up. As a result, the instances become unreachable.
  [From Build 63.9]
  [# NSPLAT-12093]

NetScaler SDX appliance

• In a VPX HA setup running on SDX appliances, when one of the switches in the virtual port channel (VPC) goes down, all the interfaces that are part of the LACP flap. This triggers HA failover.
  [From Build 63.9]
  [# NSHELP-19095]

• On an SDX appliance, the “No additional MACs available for members of interface 10/1” error message appears when all the following conditions are met:

  1. You instantiate 19 VPX instances on the SDX appliance, all with the same network interface

  2. Then add MAC addresses to the 20th VPX instance that uses the same network interface as the previous instances.

  3. The number of MAC address on the 20th VPX instance is twice as great as the MAC addresses added to the 1st VPX
  [From Build 63.9]
  [# NSHELP-20158]

• When configuring pooled licensing in SDX 14000 FIPS appliance, the minimum instances you could check out was 25. With this fix, the minimum instances you can check out is two.
  [From Build 63.9]
  [# NSHELP-20305]

• On an SDX appliance, if you use the Intel i40e network driver and restart the VPX instance one or more times, the SDX appliance might crash.
  [From Build 63.9]
  [# NSPLAT-9416, NSPLAT-9405]

• After you have configured a VLAN from the allowed VLAN list (AVL) on a VPX instance running on an SDX appliance, the instance fails to restart automatically. As a result, communication between the VPX instance and AVL stops.
  [From Build 63.9]
  [# NSSVM-135]

• Upgrade to release 12.1 build 50.x and later, release 12.0 build 60.1 and later, release 11.1 build 60.7 and later might result in one of the following outcomes:

  - VLAN filtering on SDX channels is disabled.

  - The SDX Management Service becomes unresponsive, even though the upgrade is successful, if the channels on the SDX appliance have VLAN filtering enabled and VPX instances have L2 mode enabled
  [From Build 62.8]
  [# NSSVM-2540]

NetScaler UI

• A NetScaler appliance adds a "\" (backslash) before a " "(space) for organization name, locality name, and other fields in the certificate signing request (CSR) if the following conditions are met:

  - A user without shell access, tries to connect to an upgraded NetScaler appliance by using the CLI, GUI, or NITRO.

  - The user creates a CSR.
  [From Build 62.8]
  [# NSHELP-4521]

NetScaler VPX Appliance

• In an ESX environment, a CLAG channel that includes a VMXNET3 interface might continue to send LACPDUs to its partner even when it is in DETACHED state.
  [From Build 51.21]
  [# NSPLAT-3746]

• A NetScaler VPX instance might stop responding and dump core memory if you allocate a large disk size for log messages. The higher the rate of log messages, the more quickly the instance runs out of memory and fails.
  [From Build 50.10]
  [# NSHELP-2272]

• A NetScaler VPX instance might stop responding and dump core memory if you allocate a large disk size for log messages. The higher the rate of log messages, the more quickly the instance runs out of memory and fails.
  [From Build 52.13]
  [# NSHELP-2272]

• A NetScaler VPX instance might stop responding and dump core memory if you allocate a large disk size for log messages. The higher the rate of log messages, the more quickly the instance runs out of memory and fails.
  [From Build 53.13]
  [# NSHELP-2272]

• A NetScaler VPX instance might stop responding and dump core memory if you allocate a large disk size for log messages. The higher the rate of log messages, the more quickly the instance runs out of memory and fails.
  [From Build 51.21]
  [# NSHELP-2272]

• In a KVM environment, a NetScaler VPX instance fails to start if you have configured more than 11 vCPUs.
  [From Build 49.16]
  [# NSPLAT-5154]

• If you deploy NetScaler VPX on Azure in HA mode, the VPN virtual servers on the secondary node are not reachable after a failover. This is because, during a synchronization operation, the NSIP address of the primary node is used to create the virtual server on the secondary node. After a failover, when the secondary node becomes the new primary, the VPN virtual server has the NSIP address of the old primary.
  [From Build 49.16]
  [# NSHELP-8162]

• When a remote tagged IP address is accessed through a NetScaler VPX appliance hosted on Linux KVM, the checksum value in each sent packet is incorrect.
  [From Build 52.13]
  [# NSHELP-2211, 668302]

• If you use the following command to remove an allowed-VLAN list from an SR-10V interface, the list is not removed, and therefore you cannot configure new VLAN settings for the interface.

  unset int -trunkallowedVlan
  [From Build 55.13]
  [# NSPLAT-3627]

• If you add additional SR-IOV or PCI passthrough interfaces to an existing NetScaler virtual appliance configured with SR-IOV or PCI passthrough interfaces, the existing interface names might get corrupted.
  [From Build 52.13]
  [# NSPLAT-7104, 662429]

• If you add additional SR-IOV or PCI passthrough interfaces to an existing NetScaler virtual appliance configured with SR-IOV or PCI passthrough interfaces, the existing interface names might get corrupted.
  [From Build 51.21]
  [# NSPLAT-7104, 662429]

• The NetScaler VPX GUI incorrectly shows Moscow's time zone as GMT+4 instead of GMT+3.
  [From Build 52.13]
  [# NSHELP-2228]

• Certificate-based authentication (SSH key pair) does not work on a NetScaler VPX appliance running on Azure. This happens due to internal logic that uses different keys to encrypt and decrypt certificate data.
  [From Build 53.13]
  [# NSPLAT-1547]

• In a VPX high availability setup running on AWS, if you force the primary node to restart, and you run the show interface command on the node after it restarts and becomes the new secondary node, the command's output shows an extra (nonexistent) interface (ENI).
  [From Build 54.16]
  [# NSPLAT-1889, 676774]

• A NetScaler VPX appliance running on a VMware ESX server and configured with a VMXNET3 network interface stops responding and restarts if any traffic is sent to a tagged interface. Also, in the log message, the VLAN ID of the tagged interface is incorrect.
  [From Build 52.13]
  [# NSHELP-2395, 676316]

• When you add custom DNS name server in the NetScaler VPX appliance through NetScaler CLI, DNS lookup fails. This happens due to a default Azure DNS server entry present in /etc/resolv.conf.
  [From Build 54.16]
  [# NSPLAT-1937]

• In a NetScaler VPX HA deployment running on AWS, when a failover makes the secondary node primary, the network interfaces are attached to the new primary in the wrong order.

  For example, if the primary node has NICS 1/2 (AA:BB:CC:DD:EE:FF), 1/3 (12:34:56:78:90:12), and 1/4 (1A:2B:3C:4D:5E:6F), upon failover the new primary would have 1/2 (1A:2B:3C:4D:5E:6F), 1/3(AA:BB:CC:DD:EE:FF), 1/4(12:34:56:78:90:12). Here, the interface MAC order has changed. However, this behavior does not apply to the NIC that's configured with the NetScaler management IP address.
  [From Build 55.13]
  [# NSPLAT-1963]

• The NetScaler "set ha node <NODE_ID> -haStatus STAYPRIMARY" and "set ha node <NODE_ID> -haStatus STAYSECONDARY" commands are disabled by default on VPX instances running on AWS. An error message appears if you try to run one of these commands.
  [From Build 54.16]
  [# NSPLAT-1977]

• A NetScaler VPX instance running on a NetScaler SDX appliance does not receive any traffic under the following set of conditions:

  - The Intel 710 series NICs of the NetScaler SDX appliance are connected to a switch with an LLDP-enabled port.

  - That port has been disabled and then enabled.
  [From Build 58.13]
  [# NSHELP-2521, 703400]

• If you try to use the VMware vSphere snapshot feature on a NetScaler VPX appliance running on a VMware ESX hypervisor, network connectivity to the NetScaler VPX instance is lost. This happens because a VPX appliance does not support the snapshot feature. This fix adds support for the snapshot feature. You can now use this feature to manage your VPX appliance.
  [From Build 55.13]
  [# NSPLAT-4239, 688953]

• After a failover of a NetScaler VPX HA setup running on AWS, the interfaces from both the nodes do not attach and detach properly. This happens if the stack name of the Citrix CloudFormation template exceeds 25 characters.

  With the fix, the stack name of the Citrix CloudFormation template supports up to 90 characters.
  [From Build 56.19]
  [# NSHELP-2618]

• A NetScaler VPX instance configured with VMXNET3 interfaces and running on VMware ESX server might crash if the ESX server sends a zero-length packet through these interfaces.
  [From Build 59.10]
  [# NSHELP-2647, 706660, 707542]

• A NetScaler VPX instance running on a VMWare ESX hypervisor becomes unreachable if you select "Register with NetScaler MAS for manageability" while configuring pooled licensing in the instance GUI.
  [From Build 56.19]
  [# NSHELP-4803]

NetScaler Gateway

• Expired AD (active directory) accounts produce "Incorrect Credentials" error messages, which is inaccurate and leads the user to keep trying their username and password when they will not work. The message should be similar to: "Your user account has expired".
  [From Build 56.19]
  [# NSHELP-8414]

• The NetScaler appliance fails when the corrupted NSB structure member is de-referenced.
  [From Build 54.16]
  [# NSHELP-10623, 604548, 647540, 650845, 665351, 675623]

• When encryption is enabled for client security expressions (in the VPN session action parameter), the device might fail occasionally.
  [From Build 54.16]
  [# NSHELP-1991, 616311]

• When encryption is enabled for client security expressions (in the VPN session action parameter), the device might fail occasionally.
  [From Build 55.13]
  [# NSHELP-1991, 616311]

• The NetScaler Gateway appliance dumps core intermittently while validating an STA ticket in FrameHawk channel, if either of the following conditions is met:

  - ICA Session Timeout is set ON in global settings.

  - An ICA policy is bound to the appliance.
  [From Build 58.13]
  [# CGOP-5367, 685618, 701704]

• For SmartControl to work, the Gateway login is required on the NetScaler appliance enforcing SmartControl. Storefront's session timeout causes automatic disconnections of ICA sessions launched through NetScaler Gateway if the ICA Smart Control policy is bound to the VPN virtual server. This requirement is now relaxed.
  [From Build 49.16]
  [# NSHELP-8442, 640223, 642970]

• If DNS Truncate configuration is used, all the DNS suffixes are pushed from the NetScaler appliance, but not all of the DNS suffixes are used by the AGEE Client.
  [From Build 48.10]
  [# NSHELP-1740, 543403]

• Single sign-on (SSO) users connected to a VPN virtual server configured for SAML authentication cannot log off if Shibboleth is the SAML identity provider (IDP). Instead of the logoff page, an HTTP error message appears. This failure occurs with the following configuration:

  * VPN virtual server is configured for SAML authentication.

  * Shibboleth is the SAML identity provider (IDP).
  [From Build 48.10]
  [# 642554, 576014]

• Under the following set of conditions, the wrong error message appears:

  A VPN traffic action is configured with SSO OFF.

  A samlSSOProfile is configured.

  The user tries to set this samlSSOProfile to the VPN traffic action.
  [From Build 57.13]
  [# CGOP-3261]

• If Certificate Authentication with Two Factor ON is chosen, and username extraction from Certificate has been configured, the username field is editable with old Portal Themes (Default, Greenbubble, X1).
  [From Build 49.16]
  [# CGOP-1672, 641162, 646600]

• The console shows many IPv4 Socks errors that are constantly being generated.
  [From Build 49.16]
  [# NSHELP-8473, 639579, 639782]

• A control channel between a NetScaler Gateway Plug-in and a NetScaler appliance is terminated if multicast IP packets are tunneled over the control channel.
  [From Build 49.16]
  [# NSHELP-1969, 649729]

• If the LDAP bind account password used on NetScaler contains a pair of dollar signs"$$", the authentication for the bind account fails, and the dashboard shows that the LDAP server is down.
  [From Build 48.10]
  [# NSHELP-6570]

• Functionality issues were present if the following do not have a trailing slash:

  - The VPN URLs are of the Selfauth/Samlauth type

  - The relay state is evaluated from the SAMLSSO Profile

  - The relay state is sent from the IDP to the SAML SP case
  [From Build 48.10]
  [# 645585]

• POST EPA scans fail on Windows 8 and 8.1 machines. This problem no longer occurs, because OPSWAT revised the OESIS 3 library.
  [From Build 49.16]
  [# NSHELP-6744]

• SAML authentication fails if the NetScaler appliance is configured as a service provider and redirect binding is used as the means of trust. The error message "Parsing of presented Assertion failed..." appears.
  [From Build 54.16]
  [# NSHELP-738]

• If SSO is enabled on an AAA-TM or Gateway configuration, the NetScaler appliance might fail.
  [From Build 49.16]
  [# NSHELP-8129]

• If the NetScaler Gateway appliance is configured for End Point Analysis (EPA) and the user has bookmarked the advanced login page (/logon/LogonPoint/tmindex.html), attempts to log on fail.
  [From Build 48.10]
  [# 647678]

• On the LDAP side, if the administrator sets the option to change the user password at the next logon, the X1 Theme is applied to the Password Change page. If the user clicks Submit without entering the password, the "You need to enter the password" prompt is shown in English, even on systems localized for a different language.
  [From Build 51.21]
  [# 647784]

• For Windows 7 in English, Espanol, or Francaise, the NetScaler Gateway plug-in truncates the Add button on the Connection tab if the browser is Internet Explorer 8.
  [From Build 48.10]
  [# 647789]

• User access to servers might be erratic, and users might lose information if step-up authentication is configured to begin or end with a SAML action.
  [From Build 48.10]
  [# 648306]

• If RfWebUI or a VPN portal theme with RfWebUI as the base theme is bound at the VPN Global level, users cannot connect to VPN virtual servers that are configured with a non-RfWebUI theme.
  [From Build 48.10]
  [# 648950]

• If a client machine with the following configuration is on the Internet when it enters the logged-off state, its network access remains blocked if it is moved to an intranet:

  *A location-based VPN is set to REMOTE.

  *Network access upon VPN failure is set to onlyToGateway.
  [From Build 48.10]
  [# 649057]

• The NetScaler appliance fails when it attempts to send traffic to an SSL back end through a forward proxy in cvpn/securebrowse mode.
  [From Build 50.10]
  [# NSHELP-1075]

• Users cannot access the RfWebUI homepage if wiHome in the session action points to a load balancing virtual server.
  [From Build 48.10]
  [# 649395]

• Build 47.14 of the Enterprise Edition does not support the RDP Proxy feature. (This issue does not apply to the Platinum Edition).
  [From Build 48.10]
  [# NSHELP-1737]

• After an upgrade to NetScaler release 11.0 build 66.11nc, Microsoft Surface PRO 4 Laptops users connected to a WI-FI network have issues when connecting to NetScaler Gateway.
  [From Build 50.10]
  [# NSHELP-7166]

• Kerberos authentication can fail, and the connection might be dropped, if consumption of AAA session memory is very high. In a high availability setup, a failover might occur.
  [From Build 48.10]
  [# NSHELP-743]

• Mac OSX users are unable to sign on to the OSX Receiver client and are denied access to their apps and desktops.
  [From Build 49.16]
  [# NSHELP-1520]

• Mac OSX users are unable to sign on to the OSX Receiver client and are denied access to their apps and desktops.
  [From Build 51.21]
  [# NSHELP-1520, 652955, 666081]

• When using NetScaler Gateway, Citrix Receiver fails to enumerate applications.
  [From Build 52.13]
  [# NSHELP-2044]

• NetScaler Gateway is not able to generate URLs for SharePoint 2013 in CVPN format. As a result, SharePoint is inaccessible.
  [From Build 51.21]
  [# NSHELP-1861]

• In rare cases, the NetScaler appliance might incorrectly detect the SSO status and stop processing traffic.
  [From Build 52.13]
  [# NSHELP-1077, 656760, 665571, 665669]

• The RADIUS accounting feature does not send an accounting-session-id parameter, which is required (RFC 2866).
  [From Build 51.21]
  [# NSHELP-748]

• If the NetScaler appliance is used as a SAML Service Provider to support the IBM Tivoli Identity Provider, the SAML assertion verification fails. SAML assertion verification failures occur after upgrading to version 11.0.
  [From Build 50.10]
  [# NSHELP-1081]

• The NetScaler appliance fails because of a NetScaler packet processing engine (PPE) error.
  [From Build 49.16]
  [# NSHELP-6629, 654602]

• The NetScaler appliance fails whenever a Content Switching VIP is accessed with IP 154.2.78.13.
  [From Build 49.16]
  [# NSHELP-6634]

• Kerberos Authentication fails when Kerberos Traffic is sent through UDP.
  [From Build 51.21]
  [# NSHELP-1663]

• Kerberos Authentication fails when Kerberos Traffic is sent through UDP.
  [From Build 52.13]
  [# NSHELP-1663]

• A safety check was created for incomplete/invalid homepage URLs. The safety check redirects the user to the correct homepage based on the Portal theme. The URL redirects to the correct homepage only when a valid homepage request is received; otherwise, the server sends back a 404 error message.
  [From Build 49.16]
  [# 654168]

• If only nFactor certificate authentication is configured for NetScaler Gateway, a VPN session is created instead of a traffic management (TM) session for access to a load balancing virtual server.
  [From Build 49.16]
  [# NSHELP-7861]

• If you connect to NetScaler Gateway by using full tunnel VPN and attempt to access an internal URL that has Kerberos authentication enabled, the authentication fails. You are directed to the authentication screen and prompted for username and password.
  [From Build 49.16]
  [# NSHELP-7172]

• If a NetScaler Gateway appliance with a split-tunnel configuration is used only as a DNS Server, all traffic sent to the appliance is sent through the VPN tunnel. Therefore, some local resources are inaccessible.
  [From Build 52.13]
  [# NSHELP-1762]

• When used for debugging, Internet Explorer issues 404 errors related to fonts because the NetScaler 11.1 landing page uses the Times New Roman font instead of Citrix Sans in the area where user name and password are displayed.
  [From Build 50.10]
  [# NSHELP-6376]

• Microsoft Office 2016 documents trigger authentication prompts when using SSO Sharepoint with the NetScaler Gateway appliance.
  [From Build 50.10]
  [# NSHELP-1864]

• The Citrix virtual adapter is not enabled on a Windows 7 64-bit machine, and its driver is shown as unsigned in the device manager.

  Note: If a Windows 7 64-bit user is logged out immediately after logging in, install security patch KB3033929 on that user's Windows machine.
  [From Build 49.16]
  [# NSHELP-7883]

• The Citrix virtual adapter is not enabled on a Windows 7 64-bit machine, and its driver is shown as unsigned in the device manager.

  Note: If a Windows 7 64-bit user is logged out immediately after logging in, install security patch KB3033929 on that user's Windows machine.
  [From Build 50.10]
  [# NSHELP-7883]

• Global Server Load Balancing (GSLB) HTTP cookie based persistence does not work with NetScaler Gateway SSL VPN clients when the site prefix is a substring of a GSLB domain.
  [From Build 50.10]
  [# NSHELP-8173]

• If a NetScaler appliance is used to load balance SharePoint servers with AAA-TM, then an upgrade to the office 2016 suite on the client device causes failures during inline editing of the documents.
  [From Build 50.10]
  [# NSHELP-1164, 658202]

• A NetScaler appliance might periodically restart after an upgrade if the deployment uses STA servers and, during the upgrade, the administrator's browser is closed while the appliance is communicating with a STA server.
  [From Build 50.10]
  [# NSHELP-1528, 658333, 661742, 661981, 663944]

• A NetScaler appliance might periodically restart after an upgrade if the deployment uses STA servers and, during the upgrade, the administrator's browser is closed while the appliance is communicating with a STA server.
  [From Build 51.21]
  [# NSHELP-1528, 658333, 661742, 661981, 662842, 663944, 665773]

• If the AAA subsystem is configured for NTLM authentication, and the backend server is used for NTLM authentication, the server sends a content-length response that spans multiple TCP packets in a Type2 message. The NetScaler appliance then fails to complete NTLM authentication.
  [From Build 51.21]
  [# NSHELP-793]

• The NetScaler appliance becomes unresponsive while processing heavy UDP traffic.
  [From Build 51.21]
  [# NSHELP-1760, 661104]

• If jumbo frames are enabled on loopback, processing of data sent by AAAd in the packetEngine can cause massive memory corruption. This happens because the TCP data in the jumbo frame exceeds the application maximum segment size (MSS).
  [From Build 51.21]
  [# NSHELP-799, 662324, 664318, 664591, 664837, 665693, 665865, 668202]

• Processing IPv6 packets on a MUX channel while the feature is disabled leads to a device failure.
  [From Build 50.10]
  [# NSHELP-8192]

• If negotiate authentication is the first authentication factor, non-pass-through authentication in the next factor is not supported.
  [From Build 51.21]
  [# 657741]

• The NetScaler appliance fails if it tries to clean up the control channel between the NetScaler Gateway plugin and the NetScaler appliance at a time when memory usage is high.
  [From Build 50.10]
  [# NSHELP-8206]

• The NetScaler Gateway appliance fails when a user attempts to log on, if the logon page uses the RfWebUI theme and the appliance has insufficient CCU Licenses.
  [From Build 51.21]
  [# NSHELP-7461]

• A memory leak gradually diminishes the amount of memory available for SSL VPNs. The NetScaler appliance eventually fails unless it is rebooted before memory utilization reaches too high a percentage.
  [From Build 55.13]
  [# NSHELP-7468, 677197, 551669, 544066, 684981]

• If an iPhone client uses Safari to access Netscaler Gateway, the NetScaler or NetScaler Gateway appliance might dump core memory.
  [From Build 51.21]
  [# NSHELP-1181, 663343]

• The primary NetScaler appliance in a high availability (HA) pair might reboot under the following conditions:

  > The MTU of one of the HA interfaces of the primary appliance is modified.

  > ICA sessions are active, and session reliability for the HA feature is enabled.
  [From Build 52.13]
  [# NSINSIGHT-392]

• A GSLB virtual server using the least connections method always resolves to the same site IP address.
  [From Build 51.21]
  [# NSHELP-1531]

• If AD/LDAP authentication is configured to communicate on SSL channel in authentication actions, under heavy login load, Gateway portal results in blank pages.
  [From Build 51.21]
  [# NSHELP-1681, 661917]

• If AD/LDAP authentication is configured to communicate on SSL channel in authentication actions, under heavy login load, Gateway portal results in blank pages.
  [From Build 50.10]
  [# NSHELP-1681, 661917]

• If Client Certificate authentication and Pre-Auth End Point Analysis are both configured, redundant End Point Analysis occurs before the logon page is displayed. This behavior is due to the EPA Session Reset with Cert Two Factor Authentication set to On.
  [From Build 51.21]
  [# NSHELP-6788]

• In certain cases, when an SSL proxy is configured for Clientless VPN access mode, the NetScaler Gateway appliance dumps core memory because of partial cleanup of connections.
  [From Build 52.13]
  [# NSHELP-1182, 671999]

• If a VPN virtual server to which a custom RfWebUI portal theme is bound is accessed from a browser that has the language set to German, French, Spanish or Japanese, the log on page does not load.
  [From Build 51.21]
  [# NSHELP-1190]

• The TURN service does not start if there are two or more VPN servers with the same IP address but different port numbers.
  [From Build 51.21]
  [# NSHELP-1544, 655808]

• In certain cases, the NetScaler Gateway appliance dumps core memory when a client making a logout request reads a NULL value from AAA session information.
  [From Build 52.13]
  [# NSHELP-1200]

• The NetScaler appliance occasionally dumps core memory during system initialization, because of a VPN module error.
  [From Build 51.21]
  [# NSHELP-1899]

• The NetScaler Gateway appliance sends duplicate RADIUS access-requests to the RADIUS authentication service for each logon to the appliance.
  [From Build 52.13]
  [# NSHELP-11148]

• The Connection Proxy" persistence does not work when accessing the NetScaler Gateway GSLB Service if the GSLB services are configured with publicIP different from the service IP.
  [From Build 51.21]
  [# NSHELP-1232, 672355, 673913]

• In some AAA logout sessions, the appliance dumps core memory.
  [From Build 51.21]
  [# NSHELP-763]

• In some AAA logout sessions, the appliance dumps core memory.
  [From Build 52.13]
  [# NSHELP-763]

• In certain cases, the NetScaler Gateway appliance dumps core when client sends only one STA ticket whereas the appliance expects two STA tickets.
  [From Build 52.13]
  [# NSHELP-1788]

• It takes longer to access Storefront or in rare scenarios Storefront becomes inaccessible in case "wihome" parameter in vpn session profile is set to a Load balanced v-server configured on the same NetScaler.
  [From Build 53.13]
  [# NSHELP-1241, 676111, 680660]

• Not all intranet applications are loaded onto the client machine when a large number of intranet applications and CSEC encryption are configured.
  [From Build 51.21]
  [# NSHELP-8240]

• If Gateway is configured with client certificate authentication and client fails to submit certificate, a blank screen is displayed instead of an error page.
  [From Build 54.16]
  [# NSHELP-774]

• If you configure the Windows Gateway plug-in with split tunnel set to Reverse, traffic is not processed after a client's computer wakes up from sleep.
  [From Build 54.16]
  [# NSHELP-1231]

• In rare cases, a NetScaler appliance dumps core if the server-side connection closes while NTLM Authentication is in progress.
  [From Build 56.19]
  [# NSHELP-779, 657633, 684467, 686139, 672074, 681078, 690645]

• In rare scenarios, NetScaler dumps core in case Server side connection gets closed while NTLM Authentication is in progress.
  [From Build 54.16]
  [# NSHELP-779, 657633, 684467, 681078, 686139, 672074]

• The NetScaler Gateway appliance dumps core memory whenever it tries to access the Access Gateway virtual server during the authentication process for a device running the MAC OS
  [From Build 52.13]
  [# NSHELP-1263]

• Memory leak in SSLVPN pool is encountered when connection to AAAD daemon is closed at the time of authentication.
  [From Build 55.13]
  [# NSHELP-2128, 683809, 671944]

• Memory leak in SSLVPN pool is encountered when connection to AAAD daemon is closed at the time of authentication.
  [From Build 54.16]
  [# NSHELP-2128, 683809, 671944]

• Multi-Stream ICA Functionality Support for EDT

  NetScaler Gateway now supports multi-stream ICA functionality while using HDX Enlightened Data Transport (EDT) as a data transmission path.
  [From Build 52.13]
  [# CGOP-5798]

• If you configure TACACS authentication in “password*OTP” format, and a user types an invalid credential, the following incorrect error message appears:

  Error in retrieving Versions. Cannot read property ‘replace’ of undefined.

  You can ignore the message.
  [From Build 55.13]
  [# NSHELP-4710]

• Upon employing WebAuth authentication mechanism for validating user credentials, if the user connection that initiated the login gets terminated after NetScaler receives response from external server but before it validates the success rule, then occasionally the NetScaler appliance fails.

  For this issue to recur all of the below conditions should be met in the specified sequence.

  1. WebAuth is used as authentication mechanism

  2. NetScaler contacts external server using webAuth for login

  3. External server responds with a valid data

  4. WebAuth success rule is configured such that NetScaler waits for further data from server. Hence, it 'blocks' execution.

  5. In the meantime, client connection times out, or user closes browser tab

  6. Complete data from server arrives. By then, client connection is already closed.
  [From Build 53.13]
  [# NSHELP-791]

• Intermittently active FTP file download fails over VPN tunnel. This happens when VPN plugin receives VPN protocol specific data along with FTP data.
  [From Build 52.13]
  [# NSHELP-1253]

• A NetScaler Gateway appliance becomes unresponsive if the following conditions are met:

  - The appliance is configured with a content switching (CS) virtual server that acts as the front-end server for a VPN virtual server.

  - The CS virtual server is deleted after the VPN virtual server is renamed.
  [From Build 55.13]
  [# NSHELP-7504, 681420, 684770]

• If you log on to NetScaler Gateway using plug-in for Windows, the challenge-response text from back-end prompting you to give specific inputs during logon does not get displayed if the text exceeds 100 characters.
  [From Build 53.13]
  [# NSHELP-1269]

• In rare scenarios, if X1 is used as the Gateway portal theme, the NetScaler appliance fails to process the "setclient" requests.
  [From Build 54.16]
  [# NSHELP-7776, 674020, 682547]

• If an extracted AD attribute is non-text and contains 0x00 or other delimiters as a value, LDAP attribute extraction fails.
  [From Build 53.13]
  [# NSAUTH-743, 672353]

• The following command pertaining to internal monitor for next hop server fails "add lb monitor STAMON* in HA failover scenario. The failure causes configuration loses of updated parameter for internal monitor.
  [From Build 53.13]
  [# NSHELP-1569]

• Gateway configured with nFactor authentication does not respond in case Preauth EPA is configured for the same and certificate authentication is attempted after EPA.
  [From Build 53.13]
  [# NSHELP-2051]

• A large cache file can cause high CPU-usage levels on a NetScaler appliance during synchronization of a high availability (HA) setup.
  [From Build 55.13]
  [# NSHELP-797]

• Updating a certificate-key pair used in SAML IDP samlSPCertName creates a duplicate entry and generates a "Cannot allocate memory" error message.
  [From Build 55.13]
  [# NSHELP-801]

• In rare scenarios, if the failover versions are different in SSLVPN, then the secondary node reboots due to memory outage.
  [From Build 54.16]
  [# NSHELP-1330]

• The initial connection to a particular internal resource use client IP when global USIP is enabled.

  The subsequent new connections do not use the configured global USIP and use SNIP to initiate the back-end connection.
  [From Build 54.16]
  [# NSHELP-1342, 385457]

• In rare cases, upon accessing NetScaler Gateway using Clientless Virtual Private Network (CVPN), NetScaler Gateway dumps core if SSO and Proxy are configured in Traffic policy.
  [From Build 55.13]
  [# NSHELP-1060]

• The session connection fails in case of a fail-over on second hop HA pair.
  [From Build 53.13]
  [# NSHELP-1571]

• In CS-UG deployment, NetScaler dumps core while accessing a self-authentication link.
  [From Build 54.16]
  [# CGOP-2028, 682169]

• NetScaler Gateway dumps core in case SingleSignOn (SS0) is disabled and the connection to server is removed or gatetimeout happens during TCP handshake with the back-end server.
  [From Build 54.16]
  [# NSHELP-1744]

• If you use client machine with Windows 10 operating system to logon to VPN using VPN plug-in, in rare scenarios, the plug-in fails to establish VPN tunnel with error code 1012.
  [From Build 54.16]
  [# CGOP-3797]

• The NetScaler appliance dumps core when a user connected, through NetScaler Gateway, to a VPN virtual server bound to an AppFlow policy does the following:

  1. Changes the content switching (CS) action to connect to another VPN virtual server, which is not bound to an Appflow policy.

  2. Then removes the first VPN virtual server.

  3. Continues to access resources over the initial VPN session.
  [From Build 55.13]
  [# NSHELP-1942]

• Intermittently, a NetScaler Gateway appliance dumps core if a connection is reset during data transfer between a client and a VPN server.
  [From Build 56.19]
  [# NSHELP-1758, 674356, 676859, 676857, 684178, 692683]

• DTLS feature must not be enabled on a virtual server configured with "listen" policy. Using command "add vpn vser" on a virtual server with the DTLS feature enabled and "listen" policy configured returns success but the DTLS feature does not get enabled on the virtual server.
  [From Build 56.19]
  [# NSHELP-8474, 691573]

• DTLS feature must not be enabled on a virtual server configured with "listen" policy. Using command "add vpn vser" on a virtual server with the DTLS feature enabled and "listen" policy configured returns success but the DTLS feature does not get enabled on the virtual server.
  [From Build 55.13]
  [# NSHELP-8474, 691573]

• While using Clientless VPN to access SharePoint 13 over Gateway, if your documents folder is named as "Shared Document", the document link is not rewritten and does not return the desired pages.
  [From Build 54.16]
  [# CGOP-5035]

• In rare scenarios, NetScaler dumps core while accessing virtual server information when the RDP traffic is handled by separate RDP listener on NetScaler and the virtual server information is not present.
  [From Build 55.13]
  [# NSHELP-8703]

• Upon failover or after clearing the configuration, SSL connections via proxy fail if the last octet in the IP address assigned to the proxy is greater than 127.
  [From Build 54.16]
  [# NSHELP-1385, 672306, 685958]

• In rare situations, the Windows plug-in fails during VPN session logout.
  [From Build 54.16]
  [# NSHELP-8021]

• Upon accessing NetScaler Gateway using Clientless Virtual Private Network (CVPN), back-end sites take too long to open.
  [From Build 54.16]
  [# NSHELP-1394]

• In rare cases, a NetScaler Gateway appliance in a NetScaler Gateway (UG) deployment dumps core if the traffic management (TM) virtual server behind the UG is configured for SAML with advanced policies and the content switching (CS) policies are not properly configured to route SAML responses to TM.
  [From Build 54.16]
  [# NSHELP-820]

• EPA and VPN plugin does not get launched from the latest Firefox build (52.0 or later). This happens as Firefox does not support NPAPI plugins anymore.
  [From Build 54.16]
  [# CGOP-3842, 682798]

• Logon for users belonging to multiple groups fails if AppFlow is enabled on the appliance. The logon failure happens once the data from authentication server exceeds 1460 bytes, the default TCP MSS. This also affects features such as SAML and SAML IDP that rely on authentication deamon (AAAD).
  [From Build 53.13]
  [# NSHELP-829, 679246, 682187, 677643, 682324, 673992, 681300]

• Intermittently, a NetScaler Gateway appliance becomes unresponsive when multiple STA servers are bound to VPN virtual server (or VPN global) and IPv6 communication protocol is used between client and Gateway virtual server in Gateway deployment with XenApp/XenDesktop.
  [From Build 55.13]
  [# CGOP-1727, 684833]

• NetScaler dumps core when the client connection is closed during TCP handshake with back-end server.
  [From Build 54.16]
  [# NSHELP-1748]

• If Gateway is configured for certificate authentication in primary cascade with ldap group extraction in secondary, Gateway is disregarding errors from aaad when group extraction is attempted.
  [From Build 54.16]
  [# NSHELP-849]

• Single sign-on (SSO) to SMB fileshare servers fails when a user tries to access the servers from the Fileshare tab on the portal home page. This issue occurs rarely, and only when the single sign-on credential index is set to Secondary.
  [From Build 55.13]
  [# NSHELP-1946]

• When a VPN virtual server is configured with RfWebUI as a portal theme, the NetScaler Gateway Windows plug-in does not automatically reconnect after the upgrade.
  [From Build 57.13]
  [# CGOP-2457]

• In rare scenarios, blue screen appears (BSOD) when NetScaler VPN plugin is installed along with Pulse Secure plugin.
  [From Build 54.16]
  [# NSHELP-8030]

• A user's session with an Identity Service Provider (IDP) does not get logged out after the user clicks "logout" on the NetScaler Gateway portal screen. This issue occurs if the NetScaler Gateway appliance uses SAML for logon.
  [From Build 55.13]
  [# NSHELP-1912, 687229]

• The NetScaler appliance dumps core intermittently if both of the following conditions are met:

  - FQDN is used in session profile parameters, such as wihome.

  - Failover occurs twice (that is the original primary node becomes primary again.)
  [From Build 57.13]
  [# NSHELP-1580, 643082]

• In rare cases, the NetScaler appliance dumps core when a client sends a FIN event without an HTTP body.
  [From Build 54.16]
  [# NSHELP-1950]

• In rare cases, a NetScaler Gateway appliance becomes unresponsive after an attempt to access the portal page if the HTTP header of the request is large (possibly with google analytics enabled). A buffer overrun leads to memory corruption.
  [From Build 55.13]
  [# NSHELP-1430]

• HTML5 Receiver app launch fails while accessing a NetScaler Gateway bound with RfWebUI theme portal.
  [From Build 54.16]
  [# CGOP-1267]

• In rare scenarios, NetScaler Gateway dumps core if you have an SSL-Proxy configured at NetScaler Gateway and you access the intranet web application through a Clientless Virtual Private Network (CVPN) via Gateway that has proxy-authentication configured at proxy.
  [From Build 55.13]
  [# NSHELP-1852]

• In rare scenarios, after rebooting the system, AlwaysON enabled VPN plugin fails to connect to Gateway.
  [From Build 54.16]
  [# NSHELP-1303]

• In rare scenarios, after rebooting the system, AlwaysON enabled VPN plugin fails to connect to Gateway.
  [From Build 55.13]
  [# NSHELP-1303]

• When hundreds of users try to log on to NetScaler Gateway at about the same time, the logon page might stop loading, or it might load very slowly, in which case the logon process takes a very long time to complete.
  [From Build 55.13]
  [# NSHELP-1812]

• In rare cases, a NetScaler Gateway appliance becomes unresponsive because core-to-core Gateway messages are processed incorrectly under heavy load situations.
  [From Build 55.13]
  [# NSHELP-1448]

• If you log on to SharePoint 13 through a Clientless Virtual Private Network (CVPN) and upload a form that has a post body exceeding 8 KB, NetScaler rewrite policies do not decode the form content beyond 8 KB.
  [From Build 55.13]
  [# NSHELP-6689]

• In rare cases, a NetScaler Gateway appliance dumps core when the single-sign-on feature tries to access an authentication resource that has been removed.
  [From Build 55.13]
  [# NSHELP-867]

• A secure load balancing virtual server on a NetScaler appliance processes both secure and insecure cookies.
  [From Build 55.13]
  [# NSHELP-852]

• A secure load balancing virtual server on a NetScaler appliance processes both secure and insecure cookies.
  [From Build 57.13]
  [# NSHELP-852]

• In rare cases, the NetScaler appliance dumps core while binding Classic session polices to an existing binding entity, when you have multiple VPN policies configured to the NetScaler appliance.
  [From Build 56.19]
  [# NSHELP-8360, 670544, 691767]

• In rare scenarios, NetScaler dumps core while binding Classic session polices to an existing binding entity, when you have multiple VPN policies configured to the NetScaler.
  [From Build 55.13]
  [# NSHELP-8360, 670544, 691767]

• In a CS-UG setup, if users log on to Access Gateway virtual server directly, they are "looped" back to the VPN logon page.
  [From Build 55.13]
  [# NSHELP-6749]

• If you use the NetScaler Gateway plug-in for Windows, a simultaneous download of 128 or more files fails upon accessing NetScaler Gateway.
  [From Build 55.13]
  [# NSHELP-1311]

• In rare cases, a NetScaler Gateway appliance dumps core if it receives incorrect SOCKS requests from clients.
  [From Build 56.19]
  [# NSHELP-1976, 689726, 690771, 693841]

• In rare cases, a NetScaler Gateway appliance dumps core if it receives incorrect SOCKS requests from clients.
  [From Build 55.13]
  [# NSHELP-1976, 689726, 690771]

• The client detection logic for Citrix Receiver does not work in Firefox, because the browser no longer supports NPAPI plug-ins.
  [From Build 55.13]
  [# NSHELP-1605]

• In a double-hop deployment, a NetScaler Gateway appliance intermittently dumps core when the first-hop server receives a TCP RST event from the second-hop server.
  [From Build 55.13]
  [# NSHELP-1609]

• When a user configures a NetScaler appliance for SAML Authentication, duplicate apps appear on the home page if the RfWeb UI portal theme is bound to the appliance.
  [From Build 56.19]
  [# NSHELP-1913, 660563]

• NetScaler Gateway does not comply with RFC7230 for POSTLOGINFLAGS headers.
  [From Build 56.19]
  [# NSHELP-1461]

• The NetScaler Gateway VPN plug-in fails to launch when you enter the logon credentials by using Google Chrome browser if the post-auth End-point Analysis(EPA) functionality is enabled and the "Client Choices" option is disabled.
  [From Build 56.19]
  [# NSHELP-1816]

• The NetScaler appliance fails to access the gateway home page after an upgrade to software release 11.1 build 51.21. The cause of the failure is the presence of an unexpected parameter (/ilearn).
  [From Build 55.13]
  [# NSHELP-864, 687092]

• Some traffic patterns cause application launch through NetScaler Gateway to fail if EDT is enabled on virtual desktop applications.
  [From Build 55.13]
  [# NSHELP-5107, 686960, 687587]

• In rare cases, while accessing Gateway via proxy, NetScaler dumps core if KCD based Single Sign-On is attempted to back-end servers.
  [From Build 55.13]
  [# NSHELP-1080]

• In rare situations, VPN plug-in installation fails and a "Citrix Access Gateway is not supported on this platform" error message appears on a machine running a 64-bit operating system.
  [From Build 55.13]
  [# NSHELP-1333, 691368]

• The NetScaler appliance dumps core during Core2Core communication as resetting the TCP connection closes the connection without cleaning the connection structure.
  [From Build 55.13]
  [# NSHELP-1465]

• The NetScaler appliance dumps core during core-to-core communication, because resetting the TCP connection closes the connection without cleaning the connection structure.
  [From Build 56.19]
  [# NSHELP-1465]

• When you use the XenApp/XenDesktop wizard to remove a StoreFront and RSA deployment, it doesn't clean up the virtual-server configurations.
  [From Build 55.13]
  [# NSUI-5870]

• The NetScaler Gateway plug-in incorrectly displays a “green bullet” icon suggesting a connected VPN virtual server session status even after the session is disconnected. The plug-in UI display is not in sync with the plug-in tray icon status.
  [From Build 57.13]
  [# NSHELP-1928]

• The NetScaler appliance fails when it tries to authenticate an invalid incoming HTTP packet.
  [From Build 55.13]
  [# NSHELP-876]

• In rare cases, a NetScaler Gateway appliance dumps core when processing forms based SSO to URLs larger than 4 KB.
  [From Build 56.19]
  [# NSHELP-1083]

• In some cases, the STA server information is not deleted from the Gateway appliance even after clearing configuration of the High Availability (HA) fail-over.
  [From Build 56.19]
  [# NSHELP-1958]

• NTLM Single sign-on (SSO) fails because of invalid signature of type-3 NTLM message.
  [From Build 56.19]
  [# NSHELP-1794]

• Both of the following issues are fixed:

  - A NetScaler Gateway appliance becomes unresponsive because the Gateway plug-in continuously tries to connect to the Gateway server.

  - The VPN plug-in displays the Connect button instead of automatically logging on, even when the client certificate is cached and the AlwaysON feature is enabled.
  [From Build 56.19]
  [# NSHELP-6798, 689622, 653527, 674320, 688142]

• A single sign-on (SSO) attempt might use the wrong domain in a configuration that has parent and child domains. If SSO expressions are used to compute the correct domain, the NetScaler appliance uses the domain obtained at the time of logon instead of the one computed with the expression.
  [From Build 56.19]
  [# NSHELP-1084, 689721]

• If a NetScaler Gateway appliance that has partitions is configured with an intranet IP address, traffic from one of the partitions to the default partition loops back to the sender instead of treating the partitioned appliance as two independent appliances.
  [From Build 56.19]
  [# NSHELP-1668]

• Signing on to an outbound proxy can cause the NetScaler appliance to dump core if Kerberos constrained delegation (KCD) is used for single sign-on.
  [From Build 56.19]
  [# NSHELP-1089]

• In some cases, when the NetScaler Gateway appliance is configured with the Smart Control policy, even though the ICA apps launch successfully, the following error message appears in the ns.log file. STA Ticket not found in the ICA file, closing the connection, user: username, SSID xxx.
  [From Build 56.19]
  [# NSHELP-8492]

• A user of Internet Explorer version 8 or 9 can't establish a VPN connection through a NetScaler Gateway appliance that uses the RfWebUI portal theme. The VPN virtual server doesn't respond.
  [From Build 56.19]
  [# NSHELP-6418]

• A user of Internet Explorer version 8 or 9 can't establish a VPN connection through a NetScaler Gateway appliance that uses the RfWebUI portal theme. The VPN virtual server doesn't respond.
  [From Build 55.13]
  [# NSHELP-6418]

• In rare cases, a persistent cookie can cause a NetScaler Gateway appliance in a NetScaler Gateway (UG) deployment to dump core.
  [From Build 56.19]
  [# NSHELP-1960]

• End-point Analysis (EPA) scan fails on the client computer, even though the logs indicate otherwise, if the connection between the computer running on Mac OS and the NetScaler appliance is relatively slow (for example, if there's a client-side proxy).
  [From Build 56.19]
  [# NSHELP-6824, 687892]

• End-point analysis (EPA) scan becomes unresponsive if the EPA plug-in is installed for the first time on the user machine that accesses the NetScaler appliance bound to the RfWeb UI portal theme.
  [From Build 56.19]
  [# NSHELP-1996, 696260]

• In some cases, the NetScaler appliance becomes unresponsive while back-end authentication cookies are cached when a proxy server is configured between the NetScaler appliance and a back-end server.
  [From Build 57.13]
  [# NSHELP-1506]

• When you configure the Gateway server in ICA Proxy mode, the server occasionally becomes unresponsive if the Secure Ticket Authority (STA) servers do not respond in time or the client connection is closed.
  [From Build 56.19]
  [# NSHELP-8519, 697088]

• "Authentication" submenu under "System" cannot be expanded.
  [From Build 56.19]
  [# NSHELP-4744]

• In case the Split tunnel ON, the Automatic detect settings checkbox (under LAN Settings) in the Internet Explorer settings was being modified after connecting to VPN, because of which external traffic wasn't reachable.
  [From Build 56.19]
  [# NSHELP-1376]

• Upon dual refresh of the logon page, the following error message is displayed "Error 404, object not found". The error appears because "NS_TMAC" cookie is missing in the request.
  [From Build 56.19]
  [# NSHELP-6751]

• The NetScaler appliance sends a huge quantity of "auditlog" messages to the Syslog server when a duplicate server connection is found.
  [From Build 56.19]
  [# NSHELP-1706]

• The NetScaler Gateway plug-in fails to list a device certificate under the Certificate drop-down menu if the Subject field inside the certificate has no value.
  [From Build 56.19]
  [# NSHELP-6680]

• When you have Windows AutoLog-ON feature enabled on your NetScaler Gateway appliance, during logon the client is unable to find the "nsauto.exe" file because the path to the file is incorrectly truncated.

  The issue is noticed when you modify the following registry entry:

  NtfsDisable8dot3NameCreation

  This registry entry truncates the applications file path in Windows.
  [From Build 56.19]
  [# NSHELP-6720]

• In some cases, the NetScaler appliance cannot load the background image when the VPN virtual server has custom theme and DFA policy bound to it.
  [From Build 57.13]
  [# NSHELP-1822]

• Client and server IP addresses are not displayed if a VPN session is disconnected before successful logon.
  [From Build 56.19]
  [# NSHELP-1513, 697635]

• In some cases, the connection from a client computer to the NetScaler appliance is aborted.
  [From Build 57.13]
  [# NSHELP-1514, 696270, 697255]

• In some cases, the connection from a client computer to the NetScaler appliance is aborted.
  [From Build 56.19]
  [# NSHELP-1514, 696270, 697255]

• Endpoint analysis (EPA) scan fails on the client machine, because the EPA package does not get installed on the machine properly.
  [From Build 56.19]
  [# NSHELP-2009, 700831]

• When a logon request is made to an affected URL, the URL incorrectly responds with an HTTP 403 response displaying the following error message instead of redirecting users to the logon page. Error: Not a privileged User.
  [From Build 56.19]
  [# NSHELP-8453]

• In some cases, the NetScaler Gateway appliance is unable to block access to the Internet and the intranet. This happens if you enable the AlwaysOn feature with NetworkAccessOnVPNFailure parameter set to onlyToGateway and if the FQDN of the virtual server is not accessible by client over the intranet.
  [From Build 57.13]
  [# NSHELP-1391]

• False SNMP alarms for SYN flood are reported when the NetScaler Gateway appliance is deployed in an ICA Proxy mode and session reliability functionality is enabled.
  [From Build 57.13]
  [# NSHELP-1631]

• In rare cases, the NetScaler appliance configured for Session Reliability (SR) and High Availability (HA) becomes unresponsive as it misses initialization of some of the ICA context fields.
  [From Build 57.13]
  [# NSHELP-1634]

• In a multi-core NetScaler appliance, Enlightened Data Transport (EDT) application fails to launch on a NetScaler instance deployed on VMware ESX, and configured to use VMXNET3 NIC.
  [From Build 57.13]
  [# NSHELP-1639]

• A NetScaler appliance using classic policies over VPN or NetScaler AAA traffic management sessions might occasionally become unresponsive.
  [From Build 59.10]
  [# NSHELP-1711, 708184, 709484, 713861]

• A NetScaler Gateway appliance running release 11.1. build 55.13 or 56.19 fails while attempting forms-based single sign on (SSO) to the back-end server. This happens because the POST request sent from the NetScaler appliance to the back-end server contains corrupted headers, resulting in SSO failure.
  [From Build 57.13]
  [# NSHELP-7843, 702495, 702678]

• In some cases, the NetScaler Gateway appliance dumps core due to memory corruption caused by the CVPN module.
  [From Build 57.13]
  [# NSHELP-6701, 702311]

• The NetScaler Gateway appliance is unable to handle the new Secure Ticket Authority (STA) server request if the following conditions are met:

  - The NetScaler Gateway appliance uses the previous STA request information.

  - The host FQDN information does not match with the one in the new STA request.
  [From Build 58.13]
  [# NSHELP-1554, 697065]

• The VPN plug-in displays an upgrade prompt if the following conditions are met:

  • User login is from a browser to a NetScaler Gateway appliance.

  • VPN plug-in cannot connect to a VPN gateway.
  [From Build 58.13]
  [# NSHELP-1792, 707228]

• If you access an HTTP request URL of length greater than 1024 characters, the Citrix VPN module causes memory corruption.
  [From Build 59.10]
  [# NSHELP-1878, 707429]

• In some cases, the NetScaler Gateway appliance dumps core upon changing the default virtual server of a context switching virtual server.
  [From Build 59.10]
  [# NSHELP-2059, 707800, 707825, 707839, 711798]

• The NetScaler Gateway appliance dumps core if the following conditions are met:

  • HTTP websites are accessed.

  • Memory allocation is low.

  • Memory allocation for code compression feature fails.
  [From Build 59.10]
  [# NSHELP-5747]

• A NetScaler Gateway appliance displays an error message upon accessing services using SAML based authentication. This happens when the appliance is bound to RFWebUI portal theme and has been successfully validated to the NetScaler appliance.
  [From Build 59.10]
  [# NSHELP-1910]

• POST request has some non-required fields.
  [From Build 60.14]
  [# NSHELP-428]

• Connection to file-shares at times requires authentication with Domain Controller.
  [From Build 59.10]
  [# NSHELP-1453]

• In rare cases, the VPN plug-in crashes.
  [From Build 59.10]
  [# NSHELP-1454]

• A NetScaler Gateway appliance dumps core if a Regex in a patset takes a long time to execute.
  [From Build 59.10]
  [# NSHELP-6706, 710642]

• Accessing a NetScaler Gateway appliance results in 404 error, if the NetScaler Gateway and AAA-TM are deployed on the same NetScaler appliance in the same domain but outside of NetScaler Gateway domain.
  [From Build 59.10]
  [# NSHELP-8636]

• Windows Gateway Plugin displays incorrect message on the user interface when the VPN virtual server with NetScaler Gateway is in disabled or in out of order state.
  [From Build 59.10]
  [# NSHELP-6760]

• In some cases, the NetScaler Gateway appliance with multiple core crashes if the HDX Insight feature is enabled.
  [From Build 59.10]
  [# NSHELP-15792, 712124, 712553]

• The NetScaler Gateway appliance displays incorrect http content for STA ticket refresh request.
  [From Build 60.14]
  [# NSHELP-1721]

• In rare cases, the NetScaler Gateway appliance dumps core when a proxy server is configured.
  [From Build 60.14]
  [# NSHELP-1616]

• In some cases, applications accessed using NetScaler Gateway become unresponsive because excessive logon redirects causes memory build up in the appliance.
  [From Build 60.14]
  [# NSHELP-2138]

• Connection to file-shares at times requires authentication with Domain Controller.
  [From Build 59.10]
  [# NSHELP-1453]

• In rare cases, the VPN plug-in crashes.
  [From Build 59.10]
  [# NSHELP-1454]

• After an upgrade to NetScaler version 11.1 build 60.13, enrolment of iOS devices via NetScaler failed.

  With this fix, the iOS devices are successfully enrolled.
  [From Build 62.8]
  [# NSHELP-18372, NSHELP-18540, NSHELP-19031]

• In some cases, upon landing on the NetScaler Gateway virtual server logon page, the "Cannot complete your request" error message is displayed.
  [From Build 62.8]
  [# NSHELP-18564, NSHELP-19093]

• In some cases, upon accessing the NetScaler Gateway appliance using an IE browser, the NetScaler Gateway logon page appears only after a refresh.
  [From Build 62.8]
  [# NSHELP-18938]

• In some cases, upon accessing the NetScaler Gateway appliance using an IE browser, the NetScaler Gateway logon page appears only after a refresh.
  [From Build 63.9]
  [# NSHELP-18938]

• In a high availability setup, the secondary node crashes if the removed user information is not synced with the node.
  [From Build 62.8]
  [# NSHELP-19065]

• The ns.log file for NetScaler Gateway is flooded with the "File does not exist" error message because "Style.css" and "Script.js" files are missing from the themes folder of the appliance.
  [From Build 62.8]
  [# NSHELP-19167]

• The following message incorrectly appears when NetScaler Gateway is accessed from the Microsoft Edge browser, and EPA or VPN is not used.

  "Full VPN and EPA are not supported in Edge browser. Please use different browser for a better experience."
  [From Build 63.9]
  [# NSHELP-19367]

• In some cases, the NetScaler Gateway appliance sets invalid cookie while processing the unauthenticated requests.
  [From Build 63.9]
  [# NSHELP-19403]

• In some cases, the NetScaler Gateway appliance sets invalid cookie while processing the unauthenticated requests.
  [From Build 62.8]
  [# NSHELP-19403]

• In some cases, the NetScaler Gateway appliance dumps core if the appliance is accessed in

  the Full VPN tunnel mode.
  [From Build 63.9]
  [# NSHELP-19444]

• When the StoreFront FQDN resolution takes longer time than expected on the client, NetScaler Gateway uses the client IP address as the source IP address to send traffic to the StoreFront server.
  [From Build 63.9]
  [# NSHELP-19476]

• In an HA pair setup, the persistent sessions on the primary node are not cleared because of an issue with the session sync code in the VPN server.
  [From Build 63.9]
  [# NSHELP-19557]

• In some cases, the NetScaler Gateway appliance fails to boot because certain commands do not get executed.
  [From Build 62.8]
  [# NSHELP-19645]

• In rare cases, the NetScaler Gateway crashes while GSLB updates VPN services statistics.
  [From Build 63.9]
  [# NSHELP-19992]

• In CVPN mode, when Workspace Control is enabled for Citrix StoreFront, the app sessions are lost upon disconnecting and logging on again.
  [From Build 62.8]
  [# NSHELP-6722]

• NetScaler Gateway server invariably downloads the plug-in configuration files from the Citrix downloads page, ignoring the settings pushed from the Citrix StoreFront server.
  [From Build 61.7]
  [# NSHELP-6724]

• Windows Gateway Plugin displays incorrect message on the user interface when the VPN virtual server with NetScaler Gateway is in disabled or in out of order state.
  [From Build 59.10]
  [# NSHELP-6760]

• Upon accessing VPN virtual server using Edge browser, the following error message is displayed. Full VPN and EPA are not supported on Edge browser.
  [From Build 62.8]
  [# NSHELP-7773]

• In a multicore environment, NetScaler Gateway appliance dumps core during login transfer when intranet IP address is enabled in VPN.
  [From Build 61.7]
  [# NSHELP-8164, NSHELP-7078, NSHELP-7082, NSHELP-17438, NSHELP-18156, NSHELP-18368]

• In a multicore environment, the NetScaler Gateway appliance dumps core during login transfer when intranet IP address is enabled in VPN.
  [From Build 62.8]
  [# NSHELP-8164, NSHELP-7078, NSHELP-7082, NSHELP-17438, NSHELP-18156, NSHELP-18368]

• Connection lookup from a client to a NetScaler Gateway appliance fails during core to core messaging in a multi-core NetScaler Gateway deployment.
  [From Build 61.7]
  [# NSHELP-8663]

NetScaler Application Firewall

• The exported, learned data for field formats does not match the output of the following command: sh appfw learning data.
  [From Build 48.10]
  [# NSHELP-17987, 303481]

• When editing application firewall signatures, you cannot sort the "Enabled" column.
  [From Build 56.19]
  [# NSHELP-4846]

• A NetScaler appliance in a high availability configuration might fail when the NetScaler Application Firewall HTTP request is chunked or the chunk-header information is split across the packet and the content-type is "application/x-www-form-urlencoded" and "multipart/form-data".
  [From Build 50.10]
  [# NSHELP-17091, 646749, 650320]

• The NetScaler appliance fails if the signature match function accesses invalid memory while matching signature rules.
  [From Build 48.10]
  [# NSHELP-17645]

• A NetScaler AppFirewall appliance might run out of memory, because firewall sessions might not get cleaned up in a high availability environment if sync or propagation is disabled or the software versions running on a pair of nodes do not match. This is due to DHT not being able to clean up entries properly.
  [From Build 49.16]
  [# NSHELP-2869, 645547, 658502]

• Sites that use the NetScaler application firewall have excessive high availability failovers because of a faulty error-handling routine related to memory allocation.
  [From Build 48.10]
  [# NSHELP-2887]

• The name of a user defined signature objects must not contain a hash character (#), even though the feedback message inaccurately lists it as an allowed character.
  [From Build 48.10]
  [# 648010]

• If the HTML response page contains a pair of hyphens (--) in the comment tag, the NetScaler appliance might parse the response page incorrectly and not add the URLs to starturl closure. This could result in some starturl violations.
  [From Build 48.10]
  [# NSHELP-18086]

• The NetScaler appliance might fail if both of the following conditions are met:

  - The application firewall and compression modules are both active for a connection.

  - The connection is aborted for any reason, such as connection failure on the client or server, or invalid HTTP content is received from the client or server.

  Typically, the application firewall and compression modules free the resources, including references to the connection. However, in rare cases, freeing a connection results in a dangling connection structure pointer or duplicate freeing of the structure pointer. In either of these cases, the appliance might fail.
  [From Build 49.16]
  [# NSHELP-2861, 648996, 653492, 654739]

• Applications might not load properly when the memory_max_allowed value for the AppFW pool is low. This low memory condition can also cause memory allocation errors that result in numerous connection resets.
  [From Build 48.10]
  [# NSHELP-2871, 651536]

• On a NetScaler appliance running release 11.1 build 64, SQL and cross-site scripting relaxations might not work for application or json content types. The AppFW logs display the following message, even when the relaxation rules are applied for User-Agent:

  SQL Keyword check failed for header User-Agent.
  [From Build 55.13]
  [# NSHELP-2880]

• On a NetScaler appliance running release 11.1 build 64, SQL and cross-site scripting relaxations might not work for application or json content types. The AppFW logs display the following message, even when the relaxation rules are applied for User-Agent:

  SQL Keyword check failed for header User-Agent.
  [From Build 54.16]
  [# NSHELP-2880]

• CPU utilization becomes high if you upgrade the NetScaler appliance to release 11.0 build 65 and enable NetScaler Application Firewall Starturl Closure protection.
  [From Build 51.21]
  [# NSHELP-2888, 656061, 658404, 670134]

• If the NetScaler appliance sends AppFlow data with application firewall records to the Security Insight collector, the appliance might fail. This might occur if the built-in NOPOLICY policy, which does not have any specified action, is configured as a global policy.
  [From Build 50.10]
  [# NSHELP-17193]

• If the NetScaler appliance sends AppFlow data with application firewall records to the Security Insight collector, the appliance might fail. This might occur if the built-in NOPOLICY policy, which does not have any specified action, is configured as a global policy.
  [From Build 49.16]
  [# NSHELP-17193]

• Executing force sync operation using the nssync -s command from the shell triggers NetScaler appliance reboot and crash. The nsnetsvc crash occurs when the import filename length exceeds MAX_FILE_PATH_LEN.
  [From Build 51.21]
  [# NSHELP-2890]

• A NetScaler appliance fails under the following set of conditions:

  - The appliance is configured to log for parsing errors in XML responses, and the configuration includes a confidential field. Webform fields can be designated as confidential fields to protect the information that users type into them.

  - The appliance receives a request in which query parameters are set.

  - A parsing error occurs during processing of the XML response.
  [From Build 50.10]
  [# NSHELP-17918, 639647]

• The NetScaler appliance fails to upload files for a policy profile with signatures when the NetScaler AppFirewall signature function is enabled.
  [From Build 53.13]
  [# NSHELP-2736]

• NetScaler release 11.0 build 47 or later logs error messages when you enable the NetScaler Application Firewall feature on a NetScaler appliance in high availability mode.
  [From Build 52.13]
  [# NSHELP-2896]

• NetScaler release 11.0 build 47 or later logs error messages when you enable the NetScaler Application Firewall feature on a NetScaler appliance in high availability mode.
  [From Build 51.21]
  [# NSHELP-2896]

• If you upgrade NetScaler appliance in a high availability (HA) setup from version 10.5.56.15 to version 11.1.51.1901 and skip 250 rules with active traffic, the GUI or CLI displays a "failed to skip some rules" error message and an operation time-out error message.
  [From Build 52.13]
  [# NSHELP-18062]

• In a high availability setup, after successful deployment of the NetScaler Application Firewall learned StartURL rule from the GUI, the rule remains in the learned database and is not removed. Deploying the same startURL rule results in the following error message: "The StartURL check is already in use."
  [From Build 51.21]
  [# NSHELP-18062]

• On a NetScaler Application Firewall appliance in a high availability configuration, learning mode does not work after an upgrade to release 11.0 build 68.10.
  [From Build 52.13]
  [# NSHELP-2783, 670726]

• On a NetScaler Application Firewall appliance in a high availability configuration, learning mode does not work after an upgrade to release 11.0 build 68.10.
  [From Build 51.21]
  [# NSHELP-2783, 670726]

• On a NetScaler Application Firewall appliance in a high availability configuration, learning mode does not work after an upgrade to release 11.0 build 68.10.
  [From Build 51.21]
  [# NSHELP-2784]

• On a NetScaler Application Firewall appliance in a high availability configuration, learning mode does not work after an upgrade to release 11.0 build 68.10.
  [From Build 52.13]
  [# NSHELP-2784]

• NetScaler Application Firewall uses master-slave communication for processing security checks and retrieves connection information through Protocol Control Block (PCB). In a high availability mode, the NetScaler appliance might fail, if factory reset occurs when PCB variables are cleared before freeing NetScaler Application Firewall context data when accessing null pointer during processing.
  [From Build 51.21]
  [# NSHELP-2908, 665334]

• A log message is not generated when the FormFieldConsistency protection is enabled on an NetScaler Application Firewall profile and the generated hidden field "as_fid" is modified.

  With this fix, the NetScaler Application Firewall now generates a log message when the "FormFieldConsistency" protection is enabled and the hidden field "as_fid" is modified in the NetScaler Application Firewall profile.
  [From Build 51.21]
  [# NSHELP-16940]

• The Onhover pattern has been added to the default list of cross-site scripting (XSS) denied patterns that the NetScaler Application Firewall looks for when scanning traffic.
  [From Build 51.21]
  [# NSHELP-2914]

• A NetScaler appliance might fail when NetScaler Application Firewall processes a request for SQL injection inspection, if the request has the SQLInjectiontype field set to "SQL Special Char or Keyword" and SQL comment handling is set to "ANSI/Nested".
  [From Build 51.21]
  [# NSHELP-2920, 669524]

• If the NetScaler Application Firewall learning feature is enabled, Form Field Consistency violations result in blocking URL requests that end with a question mark (?), with no query parameters.
  [From Build 51.21]
  [# NSHELP-2924]

• The output of the appfw learningdata command does not include a caret and dollar sign (^$) at the beginning and end of a URL string. Therefore, the URLs are not in proper regex format. If you do not enclose a URL in ^$ characters when you specify a learned rule to be deleted, all the rules are deleted.
  [From Build 56.19]
  [# NSWAF-1136]

• The NetScaler appliance crashes during a field-consistency check if processing a large number of form-select fields.
  [From Build 52.13]
  [# NSHELP-2893, 664482]

• The NetScaler appliance crashes during a field-consistency check if processing a large number of form-select fields.
  [From Build 53.13]
  [# NSHELP-2893, 664482]

• Application firewall signature rule #14990 has a PCRE expression pattern to detect the presence of a violation string in the Accept-Charset header. This expression is computationally intensive and results in generation of log message "PCRE match limit exceeded with regex..." With this fix, rule #14990 is deprecated and replaced by signature rule #999972, which has an optimized PCRE expression. The new rule shows the source as Snort and the Snort ID as 14990.
  [From Build 52.13]
  [# NSHELP-2751]

• An archive error can occur when application firewall profiles are exported and archived, because the export file is not removed from the /var/archive/appfw/ and /var/tmp directories after profile export is successful. The problem is caused by an uppercase profile name when the archived export file is saved with the same case as the profile name.
  [From Build 52.13]
  [# NSHELP-2901]

• During the downgrade process, the NetScaler appliance becomes unresponsive and generates an aslearn core file if the application firewall schema profile of the learned database files is not installed properly.
  [From Build 52.13]
  [# NSHELP-2904]

• A large number of DHT operations causes high CPU usage when StartURLClosure is enabled.
  [From Build 54.16]
  [# NSHELP-2913, 672753]

• The NetScaler application firewall blocks web-service URLs and displays the following error message: No_Service_URL.
  [From Build 53.13]
  [# NSHELP-2917]

• A NetScaler AppFirewall appliance displays the following error message when you try to deploy learned rules with the WAF learning mode enabled: Error in retrieving NetScaler Application Firewall learning data.
  [From Build 53.13]
  [# NSHELP-2921]

• When a user-defined application firewall signature object is updated by using the configuration utility, the enabled signature rules might get disabled and the configured actions in some signature rules might not be preserved.
  [From Build 52.13]
  [# NSHELP-2781]

• The NetScaler appliance fails to restart after an upgrade to software release 11.1 build 51.21. The failure, caused by memory corruption in the AppSecure module, occurs while evaluating an invalid session cookie.
  [From Build 53.13]
  [# NSHELP-2926]

• A NetScaler appliance might fail to start after URL transformation, because of low memory allocation.
  [From Build 53.13]
  [# NSHELP-2711, 675793, 679479, 678765, 677990]

• Form based NetScaler AppFirewall checks can be bypassed by a multipart POST request in which the Content-type header has been tampered with.
  [From Build 55.13]
  [# NSWAF-778]

• The IP reputation feature does not get enabled when the application firewall add-on license is added.
  [From Build 52.13]
  [# NSHELP-2929]

• The IP reputation feature does not get enabled when the application firewall add-on license is added.
  [From Build 53.13]
  [# NSHELP-2929]

• When you enable the AppFirewall custom signature feature on a NetScaler appliance running software version 11.0 build 69, the appliance stops processing traffic and dumps core memory.
  [From Build 53.13]
  [# NSHELP-2787]

• During the URL transformation process, cross-site scripting (XSS) protection does not consider relaxation rules for HTTP request tags that have no content except a comma (<, >).
  [From Build 53.13]
  [# NSHELP-17430, 676397, 660890]

• A NetScaler appliance running release 11.1 fails to restart after a failover if Distributed Hash Table (DHT) entries are not in sync across the HA nodes.
  [From Build 54.16]
  [# NSWAF-365]

• The NetScaler AppFirewall appliance crashes while copying form data if the form field consistency check is enabled.
  [From Build 55.13]
  [# NSHELP-2936, 689073]

• You cannot select a range of learned rules by using the SHIFT key, even though you could do so in release 11.0. With this fix, you can use the SHIFT key to select a range of learned rules.
  [From Build 54.16]
  [# NSHELP-4848]

• On a NetScaler Application Firewall appliance in a high availability configuration, learning mode does not work after an upgrade to release 11.0 build 68.10.
  [From Build 53.13]
  [# NSHELP-2911]

• A NetScaler appliance running release 11.1 and build 52 might fail because of a mismatch during memory allocation and display the following error message:

  userspace_panic as_free().
  [From Build 54.16]
  [# NSHELP-2752, 683564, 684632]

• Since release 11.1 build 41, the ImportSizeLimit parameter in the AppFW settings can be set to limit the size of the objects that are imported to the NetScaler appliance. This limit is now extended from 128 MB to 256 MB. Execute the following set command from the CLI to change the value to meet your requirement:

  set appfw setting -importsizelimit

  Maximum value: 268435456

  Minimum value: 1

  Default: 134217728

  Example

  > set appfw setting -importsizelimit 268435457
  [From Build 54.16]
  [# NSHELP-4849]

• Since release 11.1 build 41, the ImportSizeLimit parameter in the AppFW settings can be set to limit the size of the objects that are imported to the NetScaler appliance. This limit is now extended from 128 MB to 256 MB. Execute the following set command from the CLI to change the value to meet your requirement:

  set appfw setting -importsizelimit

  Maximum value: 268435456

  Minimum value: 1

  Default: 134217728

  Example

  > set appfw setting -importsizelimit 268435457
  [From Build 55.13]
  [# NSHELP-4849]

• The application firewall signature-update warning messages are not delivered in standard syslog message format. Therefore, NetScaler MAS does not process them. The warning messages do not include the module name or a time stamp, both of which are part of the syslog standard. Signature update messages are also not in standard syslog format.
  [From Build 54.16]
  [# NSHELP-2943]

• Applying cross-site scripting checks to complete URLs causes applications to stop after an upgrade. With this fix, cross-site scripting checks run only on the URL's base path if the CrossSiteScriptingCheckCompleteURLs option is enabled in the AppFw profile.
  [From Build 54.16]
  [# NSHELP-2945]

• Application firewall log messages generated when data is dropped because of Unknown Content-Type do not include the Content-Type Header value, which would facilitate tracking and monitoring.

  This issue has been fixed now. Application firewall logs allows requests which have multiple charsets with same value in the content-type header.
  [From Build 54.16]
  [# NSHELP-17446]

• On a NetScaler AppFirewall appliance, URL global pages cause memory buildup on the secondary node when the URL closure protection feature is enabled.
  [From Build 54.16]
  [# NSHELP-18091]

• When you attempt to export learned data for an application firewall profile, the appliance fails because of improper initialization of a stack variable. The Aslearn process restarts continuously because of connection failure.
  [From Build 55.13]
  [# NSHELP-2915]

• Traffic to a back-end application is blocked by the HTML cross-site scripting check when the profile type is XML. The cross-site scripting check fails for field with following tags; &lt;?xml version="Bad tag: ?xml" <blocked>.

  When you have cross-site scripting enabled, the application firewall makes the following changes to requests that match the HTML Cross-Site Scripting check:

  Left angle bracket (<) to HTML character entity equivalent (&lt;) Right angle bracket (>) to HTML character entity equivalent (&gt;) This prevents browsers from interpreting unsafe html tags, such as <script>, and thereby executing malicious code. If you enable both request-header checking and XSS transformation, any special characters found in request headers are also modified as described above. If scripts on your protected web site contain cross-site scripting features, but your web site does not rely upon those scripts to operate correctly, you can safely disable blocking and enable transformation. This configuration allows legitimate web traffic while stopping any potential cross-site scripting attacks.
  [From Build 55.13]
  [# NSHELP-17514]

• If you use the CLI of a NetScaler AppFirewall appliance to display an enum definition, the AS_CCARD_DEFAULT_CARD_TYPE default value for credit card options is not included.
  [From Build 55.13]
  [# NSWAF-955]

• If you use the CLI of a NetScaler AppFirewall appliance to display an enum definition, the AS_CCARD_DEFAULT_CARD_TYPE default value for credit card options is not included.
  [From Build 56.19]
  [# NSWAF-955]

• The NetScaler packet processing engine fails to start when URL transform regression scripts are executed during a low-memory condition.
  [From Build 55.13]
  [# NSWAF-998]

• The NetScaler appliance restarts if it attempts to process an invalid incoming HTTP packet.
  [From Build 56.19]
  [# NSHELP-2994]

• The NetScaler appliance crashes when security insight is enabled and the application firewall detects a violation of the maximum limit for fld_name length.

  Set the fld_name length limit to the same value as MAX_AS_NAME_LEN.
  [From Build 56.19]
  [# NSHELP-17583, 690556, 690467, 692023, 695808]

• After an upgrade from an earlier release 11.0 build to release 11.1 build 55.4, the 'APPFW_RESET' and 'APPFW_DROP' AppFw profiles do not appear when you run the sh appfw profile command with the "more" option.

  For example:

  sh appfw profile | more

  1) Name: APPFW_BYPASS LogEveryPolicyHit: OFF

  2) Name: APPFW_RESET LogEveryPolicyHit: ON

  3) Name: APPFW_DROP LogEveryPolicyHit: ON

  4) Name: APPFW_BLOCK UseHTMLErrorObject: OFF

  This issue does not occur after upgrading a NetScaler AppFirewall appliance to release 11.1 build 55.8.
  [From Build 56.19]
  [# NSWAF-1036, 689327]

• After an upgrade from an earlier release 11.0 build to release 11.1 build 55.4, the 'APPFW_RESET' and 'APPFW_DROP' AppFw profiles do not appear when you run the sh appfw profile command with the "more" option.

  For example:

  sh appfw profile | more

  1) Name: APPFW_BYPASS LogEveryPolicyHit: OFF

  2) Name: APPFW_RESET LogEveryPolicyHit: ON

  3) Name: APPFW_DROP LogEveryPolicyHit: ON

  4) Name: APPFW_BLOCK UseHTMLErrorObject: OFF

  This issue does not occur after upgrading a NetScaler AppFirewall appliance to release 11.1 build 55.8.
  [From Build 55.13]
  [# NSWAF-1036, 689327]

• A NetScaler AppFirewall custom signature request for field name value parsing does not clear the field name pattern match buffer.
  [From Build 56.19]
  [# NSHELP-17668]

• On a NetScaler application firewall appliance in high-availability mode, using the "aslearn -stop" command to stop the aslearn process causes a core dump but does not stop the aslearn process.
  [From Build 56.19]
  [# NSHELP-2955]

• The NetScaler Application Firewall auto-update feature does not work and the ‘https://s3.amazonaws.com/NSAppFwSignatures/SignaturesMapping.xml" file fails to download.
  [From Build 57.13]
  [# NSHELP-17705]

• The NetScaler AppFirewall search filter for cookie consistency learned rules does not work.
  [From Build 56.19]
  [# NSHELP-17635]

• In some cases, when a credit card number is split across multiple packets, the learned data rules of a NetScaler application firewall report incorrect credit card information.
  [From Build 56.19]
  [# NSHELP-18072]

• On a NetScaler application firewall appliance in a high-availability mode, the DUT might crash when performing application security check because of memory resource constraints for the NetScaler appliance.
  [From Build 56.19]
  [# NSHELP-2714]

• If a signature rule is configured on POST body with the content-type “application/xml”, the NetScaler application firewall appliance might not apply the associated rule actions to a traffic even after the rule matches the traffic.
  [From Build 56.19]
  [# NSHELP-2740]

• On a NetScaler AppFW profile, when the charset is set to Japanese(SJIS), enabling SQL transform on AppFW profile transforms Japanese data containing Yen symbols
  [From Build 56.19]
  [# NSHELP-2889]

• The XML pages might not be rendered properly in the web browsers if XML protection to strip XML comments is enabled on the application firewall profile.
  [From Build 56.19]
  [# NSHELP-18057]

• NetScaler Application Firewall AppFw Field Format learned Data is different from the Export Learned Data. When aslearn configured learned data is deployed and the field types reaches aslearn supported limit, the get learnt data will not able to display total learnt data.
  [From Build 56.19]
  [# NSHELP-18077]

• NetScaler Application Firewall blocks POST requests with more than 8250 bytes per signature. Uploading more than 8000 bytes of files fails when request content-type is configured as 'application/octet-steam' and signatures are bound to the application firewall profile. This is due to NetScaler advertising "TCP window Full" to the client after client sends the first 8000 bytes.
  [From Build 56.19]
  [# NSHELP-17727]

• Application firewall truncates html error page response, if the configured html error page is more than 8 KB in size.
  [From Build 57.13]
  [# NSHELP-17671]

• The error message “Cannot deploy CSS relaxation with empty value” appears when you attempt to deploy CSS learned rules with value type as "$" on a NetScaler application firewall appliance.
  [From Build 56.19]
  [# NSHELP-2753]

• The refine search option in the NetScaler application firewall web GUI for AppFW Field Format Learned Rules does not work properly.
  [From Build 56.19]
  [# NSHELP-17725]

• On a NetScaler appliance, traffic is impacted due to high bandwidth utilization when binding AppFW policy to the load balancing virtual server.
  [From Build 58.13]
  [# NSHELP-17768, 699863, 705637, 706371]

• The NetScaler appliance crashes when the NetScaler Application Firewall feature is enabled.
  [From Build 59.10]
  [# NSHELP-2777, 700528, 706388, 706342]

• After an upgrade, the NetScaler appliance enabled with the application firewall feature crashes and dumps core memory.
  [From Build 57.13]
  [# NSHELP-2786, 703832, 700422, 706353]

• The NetScaler application firewall allows SQL injection attack if the Content-Type of the HTTP header is modified.
  [From Build 58.13]
  [# NSHELP-2894]

• NetScaler appliance resets the HTTP connection and does not upload large files when application firewall is configured.
  [From Build 58.13]
  [# NSHELP-2797, 702124]

• The application firewall referer header check fails even after you manually add the referer URL to the relaxation rule.
  [From Build 59.10]
  [# NSHELP-16685]

• The HTML response page does not render properly if you enable URL transformation, and if the page attribute values contain non-breaking space ("&nbsp").
  [From Build 59.10]
  [# NSHELP-2809]

• In the NetScaler Application Firewall GUI, the newly added counter in the Imports tab does not correctly retrieve the imported files because the entries for the imported objects require additional processing. The NetScaler Application Firewall now allows you to import and perform additional processing in order to produce the correct number of file entries.
  [From Build 58.13]
  [# NSHELP-4850]

• When you deploy CSRF learned rules from the application firewall GUI, the rules do not get deleted and the following error "The CrossSiteRequestForgery check is already in use" is displayed if you try to redeploy the rules.
  [From Build 59.10]
  [# NSHELP-2817]

• In NetScaler release 11.0 version 1, you cannot remove the AppFW FieldFormat relaxation rules from the GUI. The relaxation rules uses a transformed string displayed in the GUI. As a result the system is unable to find a matching entry in the database for removing a rule as the learned string to remove the learned data is fixed.
  [From Build 58.13]
  [# NSHELP-2823]

• A high availability setup that has an application firewall profile with starurl closure enabled, experiences high CPU usage and system failover. The issue occurs if response pages contain many URLs.
  [From Build 60.14]
  [# NSHELP-16694, 706156, 713509]

• After a software upgrade, the NetScaler appliance crashes due to memory allocation failure when the NetScaler Application Firewall feature is enabled.
  [From Build 59.10]
  [# NSHELP-2828]

• When you attempt to add an expression under Signature Rules Pattern in the Signature Editor, the expression is not displayed in the Name (Expression) field. The rule pattern option is reverted to Any. The same behavior is observed even if you select the URL or Name options, and specify an expression.
  [From Build 59.10]
  [# NSHELP-2815]

• When you attempt to add an expression under Signature Rules Pattern in the Signature Editor, the expression is not displayed in the Name (Expression) field. The rule pattern option is reverted to Any. The same behavior is observed even if you select the URL or Name options, and specify an expression.
  [From Build 58.13]
  [# NSHELP-2815]

• The functionality for importing NetScaler Application Firewall profile configuration fails, if the profile contains user-defined field types and if the field types are used in multiple relaxation rules.
  [From Build 60.14]
  [# NSHELP-17851]

• The leading TCP window size is rounded off when the post body limit is set to 4294967295(2^32-1). The fix ensures that the limit max TCP window set by NetScaler Application Firewall is 100 MB in non-streaming data and 20 MB for streaming data.
  [From Build 58.13]
  [# NSHELP-17873, 708678]

• The leading TCP window size is rounded off when the post body limit is set to 4294967295(2^32-1). The fix ensures that the limit max TCP window set by NetScaler Application Firewall is 100 MB in non-streaming data and 20 MB for streaming data.

  As a workaround, please add the post body limit on profile to values <=512MB, preferably to value 100MB. Also when requests are of larger sizes, please ensure that the profile has streaming enabled. Enable streaming only if backend server is able to accept chunked requests.
  [From Build 59.10]
  [# NSHELP-17873, 708678, 707955, 708851, 711014]

• When you use special characters in AppFW SessionCookieName, the AppFirewall policy resets website URLs. The issue is resolved, if you remove special characters and use alphabets in the cookie name.
  [From Build 59.10]
  [# NSHELP-16795]

• After an upgrade to NetScaler 11.1 build 57.13, the URL transformation policy for cookie domains is not applied to application secure cookies.
  [From Build 59.10]
  [# NSHELP-2771]

• After a software upgrade, the NetScaler appliance crashes with AppFW violation data record when the AppFlow feature is disabled.
  [From Build 59.10]
  [# NSHELP-18106]

• A NetScaler application firewall appliance intermittently blocks requests for some URLs under heavy traffic loads when advance application firewall start url check is enabled.
  [From Build 62.8]
  [# NSHELP-16678]

• A high availability set up might crash when you upgrade the secondary node to version 11.1 build 56.x and the failover becomes the primary node.
  [From Build 62.8]
  [# NSHELP-17644]

• The NetScaler Application Firewall original settings are overridden to default.

  For example, if you have selected the “enable” option for some signatures, the setting gets overridden to “disable” during the signature merge operation.
  [From Build 63.9]
  [# NSHELP-17841]

• A NetScaler appliance might crash if the WSDL schema includes an "anyAttribute" element.
  [From Build 62.8]
  [# NSHELP-17943]

• The Citrix Web NetScaler Application Firewall GUI interface slows down when you optimize default signatures.
  [From Build 62.8]
  [# NSHELP-17975]

• NetScaler Application Firewall resets an incoming request if the following conditions are observed:

  - The SQL comment size is greater than 4k bytes

  - The configured action is log or stats.
  [From Build 62.8]
  [# NSHELP-18073]

• After a software upgrade, the NetScaler appliance crashes with AppFW violation data record when the AppFlow feature is disabled.
  [From Build 59.10]
  [# NSHELP-18106]

• A NetScaler appliance might crash if the NetScaler Application Firewall feature is enabled and there is a memory allocation failure on the appliance.
  [From Build 62.8]
  [# NSHELP-18161]

• NetScaler Application Firewall is unable to import or export firewall profiles on a NetScaler appliance. This issue occurs if there are many stale empty directories prefixed "appfwXXXXXX" under "/tmp/" folder and if the auto-update is enabled for signatures.
  [From Build 62.8]
  [# NSHELP-18472]

• The DHT update failure warnings are logged in the ns.log file if cookie proxy is enabled on the NetScaler appliance.
  [From Build 62.8]
  [# NSHELP-18616]

• If the token size is greater than 128k, the token buffer is reset multiple times leading to the loss of some data.
  [From Build 62.8]
  [# NSHELP-18741]

• When a command is set to netsvc and if the secondary node takes more than 15 secs to respond, the setsvc command logs or increments the propagation failure counter. If the secondary node takes more than 10 secs to respond, some failure is logged at the secondary configd and the corresponding timer is updated with an SNMP trap.
  [From Build 62.8]
  [# NSHELP-18834, NSHELP-18568]

• A NetScaler appliance might crash if there is high memory usage and memory values are not freed up because of an application failure.
  [From Build 63.9]
  [# NSHELP-18863]

• A NetScaler appliance might crash if there is high memory usage and memory values are not freed up because of an application failure.
  [From Build 62.8]
  [# NSHELP-18863]

• A NetScaler appliance might crash if the NetScaler Application Firewall configuration changes are not handled properly in a cluster setup.
  [From Build 63.9]
  [# NSHELP-18870]

• A NetScaler appliance might crash when processing large form bodies and if the field consistency parameter is enabled on the NetScaler Application Firewall profile.
  [From Build 62.8]
  [# NSHELP-19299]

• If you enable the URL transform policy and if the response from a body attribute value contains special characters, the ContentSwitching in an SSL offload might replace the special characters as entity encoded values.
  [From Build 62.8]
  [# NSHELP-19356]

• A NetScaler appliance might crash when CONNECT requests are received. The issue occurs if you set the default profile settings to any value other than APPFW_BYPASS, APPFW_RESET, APPFW_DROP, APPFW_BLOCK.
  [From Build 63.9]
  [# NSHELP-19603]

• Web Requests with many query parameters might receive no response if the field consistency protection parameter is enabled.
  [From Build 63.9]
  [# NSHELP-19811]

• A NetScaler appliance fails, if the following conditions are observed:

  - Web App Firewall policies use HTTP body based rule, for example, HTTP.REQ.BODY(..)),

  - Web App Firewall feature is disabled.
  [From Build 63.9]
  [# NSHELP-19879]

• A NetScaler appliance might crash when processing signature file regex patterns and if bigstack is unavailable.
  [From Build 63.9]
  [# NSHELP-20359]

• NetScaler Application Firewall is unable to block requests with Wordpress vulnerabilities.
  [From Build 62.8]
  [# NSWAF-2521]

Clustering

• For some commands, such as "add cs policy" and "add server," the ID generated on a non-CCO node already exists for another command of same type on the cluster configuration coordinator (CCO). Therefore, command execution on the non-CCO node fails.
  [From Build 55.13]
  [# NSHELP-4872, 615459]

• If a load balancing server is trying to synchronize its states, occasionally one or more cluster nodes might get stuck in a Service state. As a result, the other nodes in the cluster might be unavailable, which leads to an improper cluster formation.
  [From Build 50.10]
  [# NSHELP-8721]

• The NetScaler appliance might fail to reestablish a connection if both of the following conditions are met:

  • The policy engine (PE) receiving the traffic is in the DOWN state.

  • The NetScaler buffer (NSB) is kept on hold by a recovery mechanism.
  [From Build 56.19]
  [# NSHELP-9831, 687732]

• In a layer 3 cluster deployment, fragmented traffic steered through a GRE tunnel might cause packet loops, which result in high traffic load.
  [From Build 59.10]
  [# NSHELP-3447]

• If a node in layer 2 cluster deployment does not receive jumbo frames, the NetScaler appliance displays a warning error message “Jumbo frames are not supported on this node. To support jumbo frames, set the MTU for interfaces of the backplane switch to greater than or equal to 1,532 bytes”.
  [From Build 59.10]
  [# NSHELP-16112]

• In a NetScaler cluster setup, you might find some inconsistencies in the server state in the database and in the packet engine, if you perform the following tasks in a sequence:

  1. Add a server in DISABLED state.

  2. Enable the server.

  If you use this server when executing the “bind servicegroup” command, the servicegroup members are added in OUT OF SERVICE state.
  [From Build 60.14]
  [# NSHELP-10943, 716644]

• In a cluster setup, the packet might be dropped if the following conditions are met:

  - The return traffic is attempted on a CLAG member interface, which is DOWN.

  - MBF is enabled and CLAG is configured with HAMON OFF on the interfaces.
  [From Build 61.7]
  [# NSHELP-16126]

• In a cluster setup, if one of the nodes connectivity is lost with the backplane, the other nodes do not do a proxy ARP for the IP address of that node.
  [From Build 62.8]
  [# NSHELP-16139]

• The following behavior is observed in a clustered setup:

  - The node addition or deletion commands are not sent to ZebOS daemons when there is no cluster view change.

  - The node mismatch information is observed in ZebOS daemon and packet engine.

  - Errors are seen while configuring vtysh command.

  - ZebOS configuration is not cleared when a node is deleted.
  [From Build 62.8]
  [# NSHELP-18494]

• In a cluster setup, a VIP address in disabled state might automatically become enabled after a reboot.
  [From Build 62.8]
  [# NSHELP-18589]

• In a cluster setup, the cluster propagation might fail if one of the following condition is met:

  - Connection fails between cluster daemon and configuration daemon.

  - Increase in memory usage in cluster daemon.
  [From Build 63.9]
  [# NSHELP-19771]

• In a cluster setup, you might observe continuous failure logs that indicate connection failure between ZebOS dynamic routing IMI daemon and internal cluster daemon. This issue occurs when either the ZebOS dynamic routing IMI daemon or internal cluster daemon is restarted.
  [From Build 63.9]
  [# NSNET-10655]

• The following behavior is observed in a cluster setup:

  - There is a configuration mismatch if you execute enable/disable servicegroupmember, service group, and server command.

  - The unset command does not reset the netprofile for service/service group.
  [From Build 62.8]
  [# NSNET-9599]

Content Switching

• The NetScaler appliance might fail if you change the target of a content switching policy action from virtual server based to expression based.
  [From Build 50.10]
  [# NSHELP-11252, 653722, 659696, 661214]