Release Notes for Build 60.9 of NetScaler 12.0 Release

Additional Changes/Fixes Available in Versions

What's New?

• Support for NetScaler MPX 15000 platform

  This release supports the NetScaler MPX 15000 platform. It includes MPX 15020, MPX 15030, MPX 15040, MPX 15060, MPX 15080, and MPX 15100 models.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-15000.html.
  [# NSPLAT-7566, 688399]

• Support for NetScaler MPX 26000-50S Platform

  This release supports the MPX 26000-50S platform.

  For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000-50s.html.
  [# NSPLAT-7606, NSPLAT-4122, NSPLAT-3133, NSPLAT-4047, 662685]

Fixed Issues

• When a NetScaler appliance configured for SAML SP sends a request to SAML IdP, the following issues are identified:

  - URL is decoded sent from the traffic management virtual server.

  - Incorrect URL is displayed when authentication is complete.
  [# NSHELP-995, 716958]

NetScaler SDX Appliance

• After upgrading an SDX appliance to 12.1 or 12.0 (any build) from any previous version, Management Service becomes unreachable if the CPU assigned to Management Service is used by another instance on the SDX appliance. The issue occurs in platforms SDX 15XXX, 26XXX, 14XXX 40S, 14XXX FIPS, and 89XX.
  [# NSSVM-311]

NetScaler VPX Appliance

• In a hypervised environment, the management CPU usages could appear high if the hypervisor schedules the management CPUs incorrectly.
  [# NSHELP-18184, 714691]

• When a NetScaler VPX instance running on KVM hypervisor is provisioned with one or more ntel XL710 40G NICs, the 40G interface does not initialize correctly inside the VPX instance. Also, the interface name or MAC address appears incorrectly.
  [# NSPLAT-8533]

Unified Gateway

• URLs are not rewritten if SharePoint is configured with IT folder. Also, URLs with Unicode encoding for the following special character “\” are broken and hence are not rewritten.
  [# NSHELP-6709, 710577]

Clustering

• In a NetScaler cluster setup, you might find some inconsistencies in the server state in the database and in the packet engine, if you perform the following tasks in a sequence:

  1. Add a server in DISABLED state.

  2. Enable the server.

  If you use this server when executing the “bind servicegroup” command, the servicegroup members are added in OUT OF SERVICE state.
  [# NSHELP-10943, 715328]

GUI

• A time zone setting ("set timezone” command) in a NetScaler appliance running release 11.1 might get lost after you upgrade it to a later release.
  [# NSHELP-11550, 692565]

Integrated Caching

• A NetScaler appliance crashes if the following conditions are met:

  - The cache contentgroup's memory limit exceeds the threshold.

  - The PINNED option is enabled on the cache contentgroup.
  [# NSHELP-3629, 714583]

Load Balancing

• If a wildcard TCP-based virtual server is moved to a wildcard HTTP-based virtual server or vice versa, there might be a possibility of linking TCP and HTTP sessions resulting in an unexpected behavior.
  [# NSHELP-10014, 714154]

• In a NetScaler GSLB parent-site topology setup, the appliance might crash, if the following conditions are observed:

  1. A child site has requested some information from a parent site because of site persistence.

  2. A client connection is terminated at the child site before the parent sends the response.

  3. An MEP connection is terminated after step 2.
  [# NSHELP-18129, 716318]

NetScaler GUI

• The state of the service goes down for which the configurations among the packet engines are inconsistent.
  [# NSHELP-11835, 703463]

NetScaler Gateway

• NetScaler Gateway now supports a new version of NetworkAccessControl (NAC) checks using Microsoft Enterprise Mobility (Microsoft Intune) suite. This variant uses a signed device information of the end client for validation. To use this feature, you need a compatible version of the Citrix SSO app.
  [# NSAUTH-4239, 716353]

• In some cases, the NetScaler Gateway appliance dumps core based on a particular sequence of events, if the appliance is configured for EDT proxy.
  [# NSHELP-2134, 715713]

• In some cases, applications accessed using NetScaler Gateway become unresponsive because excessive logon redirects causes memory build up in the appliance.
  [# NSHELP-2138, NSHELP-17908, 717351]

• In some cases, performing certificate related operations after changing the RDP listeners by setting and unsetting RDP ServerProfile result in a crash.
  [# NSHELP-5756, 714720]

• When a user enters an incorrect password for logon, "Bad Pass" error message is displayed. This happens when "enhancedAuthenticationFeedback" feature is enabled.
  [# NSHELP-6508, 716404]

• In case of secure browser, when the request contains the same hostname as last connection, but a different port, the last connection is reused, instead of creating another connection.
  [# NSHELP-6713, 715163]

• Chrome does not trigger EPA plug-in when multiple EPA factors configured.
  [# NSHELP-6840, 712659]

NetScaler Insight Center

• In a certain scenario, the NetScaler appliance might become unresponsive if ICA AppFlow or SmartControl feature is enabled.
  [# NSHELP-15475, 718403]

• A NetScaler appliance might become unresponsive in a multi-core environment if ICA AppFlow or SmartControl feature is enabled.
  [# NSHELP-15834, 716479]

• A NetScaler appliance might become unresponsive in certain traffic patterns if AppFlow feature is enabled for ICA traffic.
  [# NSHELP-15858, 718196]

NetScaler MPX Appliance

• In a NetScaler MPX appliance, the GUI and command interface is unable to distinguish between Mellanox 100G and 50G interfaces. As a result, the interfaces allow you to set 50G on 100G interface.
  [# NSHELP-14761, 707811]

NetScaler VPX Appliance

• When you run SNMP commands to fetch interface-related statistics, you might get variation in the counter value “ifLastChange“ even if the interface has not changed its state. This happens because the NetScaler VPX appliance uses two different time sources for computing the “ifLastChange” value.
  [# NSHELP-13918, 714675]

Networking

• In a high availability configuration in INC mode, dynamic routing parameters might not get set properly because of the conversion errors.
  [# NSHELP-253, NSHELP-16415, 708496]

• In some cases, when a net profile is bound to VPN virtual server, the Unified Gateway logon page does not load and the NetScaler admin user interface becomes inaccessible.
  [# NSHELP-92, 715048]

Networks

• Though you can upload any certificate or certificate key file from your local storage system to Citrix ADM, the “read” permissions for such files are not retained by NetScaler MAS. When such files are uploaded by NetScaler MAS to respective NetScaler instances, ADC displays such files as invalid files.
  [# NSHELP-5842, 716691]

Platform

• In some cases, packets can be corrupted on the MPX-26000-100G and MPX-26000T-100G appliances.
  [# NSHELP-14823, 714851]

SNMP

• When configuring entity-Down and entity-Up traps, the entity state alarms do not work as expected. This issue is observed if an extra suffix (_UP or _DOWN) is added to the entity name "varbind" for configuring the UP and DOWN traps.
  [# NSHELP-16607, 715922]

SSL

• Key file installation fails if you are using the GUI to install the bundle containing the certificates and the key file.
  [# NSDOC-502, 717443]

• You can directly upgrade from build 11.1-48.x or earlier to build 11.1-60.x and to build 12.1-50.x without losing the PFX certificate-key pairs.

  For earlier builds, you must upgrade incrementally as follows:

  11.1-48.10 --> 11.1-50.10 --> 11.1-59.10

  OR

  11.1-48.10 --> 11.1-50.10 --> 12.1-49.23
  [# NSHELP-13337, 716272]

• Memory allocation might fail leading to memory leak in a heavy traffic scenario.
  [# NSHELP-14606, 715348]

• You might see a lower throughput on the following platforms even though you might have purchased a license for higher throughput.

  - MPX 5900

  - MPX 8900

  - MPX 26000-100G

  - MPX 15000-50G
  [# NSHELP-5117, 717302]

System

• At a given time, you can configure the domain name of the server only for one SYSLOG action or NSLOG action. If you try to add another action (either an SYSLOG action or NSLOG action) with the server's domain name, the system displays an error message.

  Example:

  > add syslogaction act1 syslog.server.com -loglevel all

  Done

  > add nslogaction act2 nslog.server.com -loglevel all

  ERROR: Name conflicts with an existing service or service group member name

  > add syslogaction act3 syslog2.server.com -loglevel all

  ERROR: Name conflicts with an existing service or service group member name
  [# CGOP-6838, 715341]

• Market specific violation is caused, if you have CallHome enabled by default on a NetScaler 12.1 appliance. The feature should be configured as an user's opt-in feature.
  [# NSCALLHOME-82, 716240]

• A NetScaler appliance crashes if invalid MP_JOIN options of MP_JOIN SYN packet are sent in an MP_CAPABLE subflow.
  [# NSHELP-10986, 714030]

• When a client sends an HTTP2 request to a NetScaler appliance and if the MSS value is lesser than the response generated by the appliance, an internal parsing issue occurs.
  [# NSHELP-11542, 714410]

• A NetScaler appliance might crash if you observe the following conditions:

  - Fail to respond to the client with reset stream.

  - Drop request body when more packets arrive from the client.
  [# NSHELP-11614, 715665]

• If the “Stale Cache Group Table” devices reside in the SNMP AVL tree, the SNMP walk operation fails. As a result, the SNMP walk operation does not return an error message for the subsequent SNMP table counters.
  [# NSHELP-15094, 716890]

• If you are authorized to view only certain applications in an ADC instance, NetScaler MAS should display only those servers, service groups, and domains that belong to that application.

  NetScaler MAS currently displays all servers, service groups, and domains present in that instance.
  [# NSHELP-5862, 717069]

• gPRC transactions fail under the following conditions:

  - If the initial client request goes to an HTTP/2 enabled virtual server and service but a response is not received.

  - If the server sends a trailer header with multiple header entries.
  [# NSHELP-9308, 715863]

Web App Firewall

• In a cluster setup, when you deploy a Learned Rule for HTML Cross-Site Scripting check, the NetScaler appliance displays an error, "The CrossSiteScripting Check is already in use".
  [# NSHELP-18085, 714392]

Web Application Firewall

• A NetScaler appliance might crash if there is a Cross-Site Request Forgery (CSRF) tag failure.
  [# NSHELP-17940, 715105]

• A HTTP request is blocked if the header contains the same cookie name prefix that is used in a Web Application Firewall (WAF) signature cookie.
  [# NSHELP-17956, 716380]

• Memory leak issue occurs in a NetScaler appliance, if:

  - Security violations are observed in application firewall fields such as as_url_id, as_fid, as_ffc_field

  - Field consistency protection feature is enabled.
  [# NSHELP-17965, 716561]

• Memory leak is observed in a NetScaler appliance, if the Integrated Cache and the Web Application Firewall features are enabled.
  [# NSHELP-17969, NSHELP-17158, 717405]

Known Issues

• The back end is not accessible through a clientless VPN (CVPN). The issue occurs when SSO is ON, the proxy is specified in a traffic action, and the back-end credentials are different from the logon credentials.

  Workaround:

  Create a traffic policy based on back-end URL and create a trafficAction with SSO OFF and No Proxy. The backend should be accessible.
  [# NSAUTH-2536, BUG0689153]

• If you have to set a domain wide cookie for an authentication domain, you must enable authentication profile on a load balancing virtual server.
  [# NSHELP-15356, TSK0697727]

• The LDAP authentication might fail on a NetScaler Gateway appliance when a nested group extraction is configured and LDAP groups exceed 16000 bytes.
  [# NSHELP-18160, TSK0696784]

• In a high availability setup, a NetScaler appliance with active AAA sessions becomes unresponsive. The issue occurs when you upgrade the appliance from release 11.1 build 57.13 to later releases.
  [# NSHELP-444, CGOP-2759, NSAUTH-1810, NSHELP-547, NSHELP-581, TSK0705349]

• A NetScaler appliance configured for NetScaler AAA with LDAP over SSL can become unresponsive when the LDAP server is very slow to respond to requests. At this point, the packet engine is unable to process anymore authentication requests.
  [# NSHELP-7882, TSK0660065]

• A NetScaler appliance configured for NetScaler AAA might become unresponsive if the following conditions are met:

  • The samlAction parameter is configured.

  • The back-end server is unreachable.
  [# NSHELP-8220, TSK0702827]

• A NetScaler appliance might become unresponsive if there is a high CPU usage.
  [# NSHELP-8356, TSK0711351]

• When a NetScaler Gateway or NetScaler AAA is used with Kerberos authentication there can be a memory leak.
  [# NSHELP-8397, TSK0713903]

• CPU utilization increases and the DNS data packet keeps looping if NetScaler AAA uses port 3000 to send a DNS query to an LDAP or a RADIUS server. With this fix, NetScaler AAA uses source port 10000 and above to send DNS queries to LDAP or RADIUS servers.
  [# NSHELP-8416, TSK0714739]

Admin Partitions

• Admin partitions are not supported on FIPS appliances, but you can nonetheless create them. You are advised against creating admin partitions on a FIPS appliance, because they will not function properly.
  [# NSSSL-2456, BUG0517145]

Analytics

• Using the NetScaler MAS GUI, you cannot enable the Video Insight feature.

  Workaround: To enable Video Insight on NetScaler MAS, see http://docs.citrix.com/en-us/netscaler-mas/12/analytics/video-insight.html.
  [# NSADM-8967, NSADM-5718, 681681]

• When you edit a previously created IP block in the Configure IP Blocks page under Analytics > Settings by changing the city, region, and country, and when you try to edit the settings again, the Configure IP Blocks page displayed the name of the previous city. This build fixes this issue.
  [# NSHELP-6162, 712110]

• Due to service subsystem failures, NetScaler MAS GUI is not displayed.
  [# NSHELP-6191, 702395]

• If client side measurement is enabled, Web Insight data collection might fail, in which case the corresponding reports are not displayed.
  [# NSUI-8178, BUG0659569]

• The NetScaler MAS GUI does not display the threshold name when you click Breach Count in Security Insight.
  [# NSUI-8235, BUG0671407]

AppFlow

• In a NetScaler cluster setup, "show appflow collector" command does not display the correct state of the AppFlow collectors. Apart from the show command, there is no functional impact on the AppFlow functionality.
  [# NSBASE-1747, BUG0716497]

• If multiple AppFlow policies are bound to the same bind point, only the last policy is chosen.
  [# NSBASE-4140, BUG0603177]

• The NetScaler appliance crashes while exporting data to SSL insight if both of the following conditions are met:

  -AppFlow is enabled.

  -You update or unbind an SNI certificate during the SSL transaction.
  [# NSHELP-13173, TSK0704352]

• In some cases, if the connection duration is very small, the end timestamp (TX) might be smaller than the start timestamp (RX). Based on this, if the flow duration is calculated using the timestamp values, the result can be negative or erroneously large. The issue is consistently seen with policies (for example, vide detection policies) which resets the connection.

  Workaround: Compare the date of the file containing the records with the timestamp value in the records. If the timestamp value is greater than the file date then the flow duration can be subtracted from the end-timestamp value to recover the correct timestamp value.
  [# NSHELP-9655, BUG0710900]

Application Firewall

• The IP address of a content switching virtual server cannot be accessed after an upgrade from a previous release to the current release. The POST request results in a 302 redirect error.
  [# NSHELP-15354, TSK0687314]

• A NetScaler application firewall appliance intermittently blocks requests for some URLs under heavy traffic loads when advance application firewall start url check is enabled.
  [# NSHELP-16678, TSK0694123]

• The NetScaler application firewall should bypass requests from application firewall processing after the system reaches a specified CPU/memory usage limit, but there is currently no policy for reviewing CPU and memory capacity and bypassing the application firewall.
  [# NSHELP-17352, BUG0660546]

• If you have multiple application firewall policies configured on a load balancing virtual server, and a policy has a GotoPriority Expression of NEXT, the NetScaler AppFirewall policy order bypasses all security checks in that policy's profile and moves to the next policy.
  [# NSHELP-17461, TSK0682935]

• When using IE, an RFC violation occurs when submitting a form with Form Field Name and value triggering the request as malformed multipart request. This issue does not occur in Chrome or Firefox.

  The correct format of the request should be; Content-Disposition: form-data; name="<fld_name>".
  [# NSHELP-17547, BUG0688390]

• In a HA environment, after an upgrade to release version 11.1 56.x, the NetScaler Application Firewall primary node fails to restart after a failover.
  [# NSHELP-17644, TSK0693905]

• The in-use memory of a NetScaler appliance reaches 90% when the expression match type in signatures along with auto-update causes the memory leak.

  Workaround: To resolve memory recovery error, increase the recovery limit and number of recovery pages. Execute the following two nsapimgr commands monitor the issue.

  nsapimgr -ys num_recovery_pages=20

  nsapimgr -ys mem_recoverlimit=251658240

  Also append settings in the “/nsconfig/rc.netscaler” file, or else restarting the NetScaler appliance will erase above settings. If “/nsconfig/rc.netscaler” file is missing, then create new one.
  [# NSHELP-17771, BUG0696820]

• On a NetScaler Application Firewall appliance, the Analytics security insight support for content switching target load balancing virtual server is not available.
  [# NSHELP-17865, TSK0707373]

• In an HA environment, a NetScaler appliance running release 11.0 does not learn new rules when the application firewall feature is enabled.
  [# NSHELP-18068, TSK0672864]

• In a rare case, when Application Firewall Learning option is enabled, the resulting aslearn.log file can consume a high amount of hard disk space, starving other disk users.
  [# NSHELP-18083, BUG0712139]

• On a NetScaler Application Firewall appliance in a high availability configuration, learning mode does not work after an upgrade to release 11.0 build 68.10.
  [# NSHELP-2783, TSK0662359]

• On a NetScaler Application Firewall appliance in a high availability configuration, learning mode does not work after an upgrade to release 11.0 build 68.10.
  [# NSHELP-2784, TSK0662734]

• If you set the AppFW profile post body limit to a value greater than 2 GB, client requests get dropped. The issue occurs because of TCP overflow for a window size variable.
  [# NSHELP-8860, TSK0708549]

• Application Firewall port information about open ports, such as port 443, is not suppressed. It can therefore be detected by port scan tools such as NMAP in targeted hacker attacks.
  [# NSHELP-9289, TSK0674864]

• In the Visualizer, some buttons might not work if you use Mozilla Firefox or Internet Explorer.

  Workaround: Use the Google Chrome browser.
  [# NSUI-8412, BUG0648272]

• If you upgrade a NetScaler appliance in a high availability (HA) setup from version 10.5.56.15 to version 11.1.51.1901 and skip 250 rules with active traffic, the GUI or CLI displays a "failed to skip some rules" error message and an operation time-out error message.

  Workaround: Turn off the Learning feature when skipping learned rules.
  [# NSWAF-1184, BUG0671807]

• The information that the GUI displays for the application firewall web services interoperability (WSI) check does not say that it is a prerequisite and cannot be disabled.
  [# NSWAF-679, NSHELP-17084, NSHELP-17498, BUG0650789]

• An alert is generated when you set the NetScaler AppFirewall session limit to a value of 0 or lower, because such a setting affects advanced protection check functionality that requires a properly functioning application firewall session.
  [# NSWAF-92, BUG0668892]

Base

• ABR video connections are throttled in nature and thus can negatively impact the correctness of Connection Quality Analytics (CQA).

  So, CQA metrics produced for ABR video transactions should be discarded.
  [# NSBASE-1116, BUG0711964]

Unified Gateway

• Files and folders hosted under the following SharePoint default folder cannot be accessed.

  - SitesPages

  - Shared Documents
  [# NSHELP-18114, TSK0717798]

• Files and folders hosted under the SharePoint default folder "PublishingImages" cannot be accessed.
  [# NSHELP-18116, TSK0716394]

• Unified Gateway appliance dumps core when STA server closes the connection abruptly.
  [# NSHELP-18141, TSK0716179]

• In a multicore environment, Unified Gateway appliance dumps core during login transfer when intranet IP address is enabled in VPN.
  [# NSHELP-8164, NSHELP-17438, NSHELP-18156, NSHELP-7078, NSHELP-7082, TSK0714043]

• In some cases, Unified Gateway appliance dumps core during freeing up the VPN session.
  [# NSHELP-8664, TSK0715925]

• Upon attempting to bind a previously bound VPN virtual server to a CS virtual server, the following error message is displayed, "ERROR: Only one VPN vserver can be bound to a CS vserver."
  [# NSHELP-8672, TSK0718302]

Clustering

• The node-to-node messaging (NNM) stalls on a cluster-enabled NetScaler appliance.
  [# NSHELP-16150, TSK0717052]

• For some commands, such as "add cs policy" and "add server," the ID generated on a non-CCO node already exists for another command of same type on the cluster configuration coordinator (CCO). Therefore, command execution on the non-CCO node fails.
  [# NSHELP-4872, NSHELP-10708, TSK0614718]

Domain Name System

• If you have configured a large number of HTTP profiles, occasionally the NetScaler appliance might dump core and restart.
  [# NSHELP-3957, TSK0662929]

GSLB

• The show gslb domain command does not populate the correct MIR and ECS values between the GSLB virtual server and the GSLB domain bound to the same virtual server.
  [# NSHELP-11729, TSK0707702]

High Availability

• In an HA to HA restore or an HA to standalone restore, Syslog and AppFlow settings are not restored. Also, restoring from HA to HA has issues as device ownership changes, and device migration will not happen correctly after a node failure.
  [# NSADM-9221, 676887]

• When a pair of NetScaler instances in high availability are discovered, the SNIP of the pair was set in the management_ip field of the primary node of the instances in high availability in NetScaler MAS.

  This fix sets the floating IP address in the management_ip field in both primary and secondary instances.
  [# NSHELP-6439, 715287]

• While registering a node during a High Availability deployment, both the node passwords must be the default "nsroot."
  [# NSHELP-6468, 691836]

Licensing

• When NetScaler licenses hosted on NetScaler MAS expires, the NetScaler appliance moves into a grace period of 30 days. If valid licenses are updated during the grace period, the NetScaler appliance continues to function as usual. If not, licenses are revoked and the appliance ceases to function.
  [# NSPLAT-6417, BUG0697665]

Load Balancing

• The NetScaler appliance is unable to reuse an existing probe connection if an HTTP wildcard load balancing virtual server is configured in MAC mode with use source IP (USIP) mode enabled and the Use Proxy Port option turned off. As a result, the connection fails and client the receives a TCP reset.
  [# NSBASE-2785, BUG0632872]

• If a service group member is assigned a wildcard port (port *), the monitor details for that service group member can be viewed from the Monitor Details page.
  [# NSHELP-9409, BUG0671729]

• In a NetScaler cluster setup, you cannot add multiple subscriber profiles with the same IP address and different VLAN IDs.
  [# NSLB-1816, BUG0711327]

• In a NetScaler cluster setup, after adding subscriber profiles with IPv6 and VLAN, there is an inconsistency between the cluster view and the NetScaler view. In the cluster view, VLAN is shown whereas, in the NetScaler view, VLAN is not shown.
  [# NSLB-1828, BUG0711328]

• When adding new load balancing services to a new server in GUI (Traffic Management > Load Balancing > Services), you cannot add an IP address. You can only select an existing SNIP.

  Workaround: Use CLI instead of GUI to add new services.
  [# NSUI-9211]

NITRO

• The .NET NITRO SDK get call for snmpmib resource (snmpmib.get()) fails with JSON derserialization errors.
  [# NSHELP-9032, BUG0702648]

NITRO API

• The NetScaler appliance does not send a response for a NITRO API request for restarting the appliance.
  [# NSHELP-9044, TSK0708209]

NSADM-Infra-aaS

• Send Email Action does not work for Event Rules.
  [# NSADM-7498, 688985]

NetScaler GUI

• If the feature "Force password change for nsroot user when default nsroot password is being used" is enabled and the nsroot password is changed at the first logon to the NetScaler appliance, the nsroot password change is not propagated to non-CCO nodes. Therefore, when an nsroot user logs on to non-CCO nodes, the appliance asks for password change again.
  [# NSUI-1730, BUG0658132]

• In older versions of Internet Explorer version 7, the browser incompatibility message does not appear for NetScaler release 11.1. The logon page directly appears, and you can log on successfully.
  [# NSUI-4470, BUG0649052]

NetScaler Gateway

• If a Windows user name has non-ASCII characters, the user is unable to collect logfiles by using the Collect Log button.
  [# CGOP-3359, BUG0645098]

• If you log on to SharePoint 2013 through a Clientless Virtual Private Network (CVPN), you cannot use Internet Explorer to open a word (.doc) document.

  Workaround: Use Firefox to open the document.
  [# CGOP-5153, BUG0679713]

• In rare cases, the NetScaler Gateway appliance dumps core when a client machine tries to open more than one DTLS connection.
  [# NSHELP-1135, NSHELP-1971, TSK0710131]

• After upgrading to 11.1 build 55.13, the n-Factor authentication does not work if the first factor has NO-Authentication policy with "true" rule.

  Workaround: Avoid configuring "true" as rule for policy. Add the following expression for this policy:

  "http.req.url.contains("/nf/auth/doAuthentication.do")"
  [# NSHELP-15351, TSK0695650]

• In some cases, the NetScaler Gateway appliance with multiple cores crashes if the HDX Insight feature is enabled, during a session reconnect.
  [# NSHELP-15792, NSHELP-15687, NSHELP-15689, NSHELP-17901, TSK0711720]

• After upgrading the NetScaler Gateway appliance to release 11.x or later, users might see a blank page upon log on. The blank page appears because the browser serves some of the files from its own cache, instead of requesting all the files from the upgraded appliance.

  Workaround: Clear the browser cache.
  [# NSHELP-6807, BUG0698839]

• Enabling MD5 option in the pre-authentication policy results in EPA failure and an eventual log on failure.
  [# NSHELP-8413, TSK0688940]

• In an outbound ICA proxy deployment, the NetScaler appliance closes the client connection if the following conditions are met:

  - A TCP service has the same IP address as the destination server.

  - The TCP service also has the same IP port as the destination server.

  The appliance closes the connection because it fails to establish a connection with the destination server.
  [# NSHELP-8469, TSK0674632]

• SOCKS Proxy CR virtual server configuration for a NetScaler Gateway appliance fails if you use a Fully Qualified Domain Name (FQDN) for Virtual Delivery Agent (VDA).

  Workaround: Use an IP address for VDA.
  [# NSHELP-8549, TSK0704511]

NetScaler ICA

• The whitelist of Citrix Receiver versions used by HDX Insight now includes version 13.0.3.265571 of Citrix Receiver for Linux.
  [# NSINSIGHT-313, NSHELP-9702, BUG0614558]

NetScaler Insight Center

• NetScaler Insight Center does not report an application-launch failure caused by a user trying to launch an application or desktop to which the user does not have access.
  [# NSINSIGHT-943, BUG0609604]

NetScaler SDX Appliance

• The message "Appliance license expired" appears when you log on to the NetScaler SDX GUI, after upgrading from any previous NetScaler version to 12.0-58.15 or 12.1 48.13. This is a harmless message and can be ignored safely.
  [# NSHELP-11980, TSK0710430]

• Upgrading the Management Service to NetScaler SDX release 11.1.50.x fails with the following error message and with error code 10008:

  This platform sysid 450088 is not supported
  [# NSSVM-231, BUG0670131]

• A NetScaler SDX appliance does not propagate a global MAC address to the VPX instances if you do both of the following:

  - Assign a global base MAC address in generated mode to a manual channel or an LACP channel.

  - Reset the global base MAC address.
  [# NSSVM-390, BUG0682573]

• The "hostname" field displays no information when you click a NetScaler SDX backup file to fetch its details.
  [# NSSVM-573, BUG0638437]

NetScaler Secure Web Gateway

• The default certificate bundle is not listed when you run the show certbundle command.
  [# NSSSL-1116, BUG0685789]

• If you create a negotiate action by using a keytab file, the SWG wizard displays the domain name and user name instead of the service principal name (SPN).
  [# NSSWG-329, BUG0686741]

NetScaler VPX Appliance

• Support for VMware vMotion

  From this release, you can migrate a NetScaler VPX instance by using VMware vMotion. The vMotion feature does not support NetScaler VPX instances configured to use SR-IOV and PCI passthrough interfaces. Supported interfaces are E1000 and VMXNET3.

  For more information, see Install a NetScaler VPX instance on VMware ESX topic: https://docs.citrix.com/en-us/netscaler/12-1/deploying-vpx/install-vpx-on-esx.html
  [# NSHELP-15343, TSK0690477]

• The NetScaler VPX GUI incorrectly shows Moscow's time zone as GMT+4 instead of GMT+3.
  [# NSHELP-2228, NSPLAT-5428, TSK0662630]

• Compatibility issues between Linux-KVM and the Intel XL710 interface might cause a NetScaler virtual appliance configured with a PCI passthrough to become unresponsive during startup.

  Workaround: Restart the Linux-KVM host.
  [# NSPLAT-3829, BUG0660139]

• Error messages appear when an SR-IOV-enabled NetScaler VPX instance configured with Intel X710 10G and XL710 40G NICs, running on KVM hypervisor, restarts. The error messages are harmless and can be safely ignored.
  [# NSPLAT-3883, BUG0692334]

• DNS resolution for existing DNS configurations fails after you upgrade a NetScaler VPX instance running on AWS to release 12.0 build 53.20.
  [# NSPLAT-4737, BUG0693877]

Networking

• A NetScaler appliance might become unresponsive when Bidirectional Forwarding Detection (BFD) is configured on the appliance.
  [# NSHELP-90, TSK0714384]

• In some cases of FTP data connections, the NetScaler appliance performs only NAT operation and not TCP processing on the packets for TCP MSS negotiation. As a result, the optimal interface MTU is not set for the connection. This incorrect MTU setting results in fragmentation of packets and impacts CPU performance.
  [# NSNET-5233, BUG0485678]

Networks

• Ability to Manage NetScaler VPX Instances Deployed in Cloud

  You can now use NetScaler MAS to manage and monitor NetScaler VPX instances deployed in a public cloud such as Amazon Web Services (AWS) or Microsoft Azure.
  [# NSADM-10201, 690312]

• While creating a Certificate Signing Request (CSR) and uploading the key in DER format locally, NetScaler MAS displays the key format as PEM and does not generate a CSR.
  [# NSADM-824, 675875]

• There might be a situation where a table spills over to multiple pages because NetScaler MAS displays only 25 row entries in one page. Earlier you were able to sort row entries only on the current page. The other pages never displayed sorted entries. You can now sort the table in any page, and all the pages of that table will display the sorted results.

  Note: This feature works only if the number of records in a table is less than 25,000.
  [# NSHELP-4172, NSADM-4584, NSADM-6161, NSADM-15337, 689564]

• In NetScaler MAS, when you are running a configuration job using a Master Config template created by using C# API, jobs in pending state show Zero percent as progress and it is not possible to abort them.

  This issue was seen in customer environment when category was not set for Master Config templates created by using C# API, as setCategory method is not available in the API. As set category issue is fixed as part of #687591, this issue cannot be reproduced.
  [# NSHELP-5906, 686878]

• In NetScaler MAS, if you delete a NetScaler instance, failure objects associated with the respective NetScaler instances are not deleted.
  [# NSHELP-5972, 690059]

• In NetScaler MAS, you cannot export reports for some tabular views and dashboards. With this fix, you can now export the content of the tables and dashboards.
  [# NSHELP-5973, 670226]

• NetScaler SD-WAN WO Advanced platform backup is not compatible with a user defined device profile.
  [# NSHELP-5987, 690508]

• Network inventory improvements

  You can now view the complete list of instances maintained by NetScaler MA Service. You can view the inventory report by navigating to Networks > Dashboard and click All Instances in the top right corner of your screen. The new inventory report displays the following information:

  • All instances

  • Instance versions

  • Serial numbers
  [# NSHELP-6055, 687676]

• Though you can see system notifications about "userlogout," you might not receive any email notifications.
  [# NSHELP-6195, 704344]

Orchestration

• OpenStack supports 255 chars as maximum length of name and description for LB entities. But NetScaler MAS orchestration APIs restrict the maximum length to 40 chars. Because of this, OpenStack neutron lbaas commands to create or update LB entities with name or description length greater than 40 chars fails. With this fix, NetScaler MAS orchestration APIs are modified to support 255 chars as maximum length of name and description of LB entities.
  [# NSHELP-6021, 695351]

Policies

• If you use classic expressions to filter the output of the show connectiontable command, only a warning message appears.

  Workaround: Use advanced expressions instead.
  [# NSUI-1944, BUG0680916]

SSL

• You might see heartbeat failures eventually leading to a high availability failover. The issue is seen when secure monitors are enabled on a NetScaler VPX appliance and the appliance performs DH-key exchange with the backend servers. The failures happen because some CPU intensive DH operations are performed inline.
  [# NSHELP-13321, TSK0715231]

• In a high availability configuration, the cipher binding to a service group might be lost if you force a node to failover.
  [# NSHELP-13329, TSK0715993]

• A NetScaler MPX/SDX 14000 FIPS appliance becomes unresponsive if it receives a packet of size > 18 KB from the backend server.
  [# NSHELP-14133, TSK0707061]

• On a NetScaler MPX 14000 FIPS appliance, users might not be able to access StoreFront through the NetScaler Gateway. Also, when the user accesses the NetScaler GUI, it might take a long time to connect, or the connection might time out. This happens when many command timeout errors appear, and the resources for these commands are not subsequently released.
  [# NSHELP-14769, TSK0708532]

• You cannot add a CRL with X.509 version 1 on a NetScaler appliance if the explicit version field in that CRL is set to 0.
  [# NSHELP-14919, TSK0681878]

• In a cluster setup, if a client certificate is bound to a back-end SSL service or service group, it appears as a "Server Certificate" instead of a "Client Certificate" when you run the "show ssl service" or the "show ssl servicegroup" command on the CLIP address.
  [# NSSSL-1223, BUG0667389]

• On a NetScaler Secure Web Gateway appliance, running the clear config command does not reset the certificate bundle to the default certificate bundle.
  [# NSSSL-1483, BUG0689898]

• The SSL entities to which an SSL profile is bound do not appear when you run the show ssl profile <Default-Profile> command on a cluster IP (CLIP) address.

  Workaround: You can view the bound entities from the NetScaler IP (NSIP) address.
  [# NSSSL-2481, NSHELP-4421, BUG0673458]

• Secure renegotiation using SSLv3 protocol fails on MPX-FIPS appliances running firmware version 2.2.
  [# NSSSL-2650, BUG0550788]

• In a cluster setup, some cluster nodes might not honor the reuse request of a session ticket, but the SSL full handshake succeeds.
  [# NSSSL-3161, NSSSL-1258, NSSSL-1264, BUG0678175]

• An expired session ticket is honored on a non-CCO node and on an HA node after an HA failover.
  [# NSSSL-3184, NSSSL-1379, NSSSL-1394, BUG0678176]

• An incorrect warning message, "Warning: No usable ciphers configured on the SSL vserver/service," appears if you try to change the SSL protocol or cipher in the SSL profile.
  [# NSSSL-4001, BUG0682859]

• If you have configured two SafeNet HSMs in a high availability setup on a standalone NetScaler appliance, and the primary HSM goes down, the secondary HSM does not serve traffic after a failover.
  [# NSSSL-4228, BUG0628075]

• Session Key Auto Refresh incorrectly appears as disabled on a cluster IP address. (This option cannot be disabled.)
  [# NSSSL-4427, BUG0687208]

• Support for OCSP Stapling in a cluster setup

  OCSP stapling is now supported in a cluster setup. OCSP stapling is used to provide the revocation status of a server certificate to a client during an SSL handshake.
  [# NSSSL-4556, BUG0688057]

Settings

• In NetScaler MAS, while using Nitro SDKs, setters for "Category" property is not available in Configuration Templates resource.
  [# NSHELP-5941, 687591]

System

• A NetScaler appliance in a clustered setup displays a "Cannot allocate memory" error message if you use the set command to set the server domain name in a SYSLOG action.

  Workaround: Delete the SYSLOG action in which you set the domain name, and add a new SYSLOG action that specifies the server domain name instead of the server IP address.

  rm syslogaction

  add syslogaction -loglevel [-options ...]
  [# CGOP-6745, BUG0687067]

• In a cluster deployment, if you run "force cluster sync" command on a non-cco node, the ns.log file contains duplicate log entries.
  [# CGOP-6794, BUG0702608]

• In a cluster deployment, the RESPONDER log messages do not appear when you run the following commands:

  - The "show audit messages" command from command line interface.

  - The "recent audit messages" command from NetScaler GUI.

  Workaround:

  You can locate the RESPONDER logs in /var/log/ns.log.
  [# CGOP-6804, BUG0703928]

• The initial probe connection that a NetScaler appliance makes with the back-end internet server to check for server availability is now reusable for actual server connection with the internet server.
  [# NSBASE-1185, TSK0654087]

• USIP configuration support for HTTP 1.1 and HTTP/2 protocols

  The User Source IP (USIP) address configuration is now supported for both HTTP/1.1 AND HTTP/2 protocols in a NetScaler appliance.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/system/http-configurations.html
  [# NSBASE-2653, NSBASE-1981, BUG0652126]

• Random packets on loopback interface are found missing if you capture nstrace on a NetScaler appliance.
  [# NSHELP-10166, TSK0689837]

• If you enable Web Logging feature before configuring the log buffer size, the NetScaler appliance does not apply the buffer size after a restart.

  Workaround: Configure the log buffer size before you enable the Web Logging feature.
  [# NSHELP-10788, TSK0667392]

• A weblogging client crashes, if a clustered setup on a VMware ESX platform with VMXNET3 interfaces encounters time synchronization issues.
  [# NSHELP-10850, TSK0711086]

• A NetScaler appliance silently truncates and drops HTTP request body packets greater than the maximum HTTP header size configured in the HTTP profile. The request body is truncated only if the appliance receives an HTTP request after an incomplete header assembly (request header spanning more than one packet) and the request body is received when the appliance awaits a TCP acknowledgment for the request header sent to the server. The truncation results in TCP retransmission and latency issues.
  [# NSHELP-11096, TSK0695668]

• A NetScaler appliance might crash if the SPDY feature is enabled in an HTTP profile for accessing freed internal connection structures.
  [# NSHELP-11242, TSK0704835]

• When you run the set command on a NetScaler appliance, the ns.log file stores the command with all parameter values, including customer provided values.
  [# NSHELP-11291, TSK0674165]

• In a high availability (HA) setup, if you use the NetScaler GUI to modify the Responder policy configuration, the system displays the following error message, "Command failed on a secondary node but succeeded on the primary." However, the changes get synchronized from primary to secondary NetScaler.
  [# NSHELP-12708, TSK0692261]

• The ipFreePorts counter value is always zero.

  Workaround: Correct the counter to read proper values.
  [# NSHELP-16587, TSK0715208]

• In an MPTCP connection, a NetScaler appliance sets the TCP PSH flag during retransmission of FastClose and DataFIN packets.
  [# NSHELP-3442, BUG0667765]

• Transfer of backup files from the primary node to a remote node fails if the remote backup server is down. You are not notified that the remote server is down as there is no system event for such a situation. With this fix, a system event is created whenever the remote backup server is down and NetScaler MAS generates an alarm.
  [# NSHELP-6001, 691841]

• In NetScaler MAS, auto purging of data in the database does not free up disk space.
  [# NSHELP-6351, 711405]

• A NetScaler appliance might crash if two client connections inadvertently reuse the probe connection in a transparent (multiple server connections use the same client IP port) wildcard configuration.
  [# NSHELP-9072, TSK0685101]

• A TCP transaction delay is observed if a NetScaler appliance is unable to use the TCP connection to connect to the back-end server. In this case, the appliance opens a new connection to forward the client requests to the back-end server after some waiting period. The waiting period ranges from 400 ms to 600 ms.
  [# NSHELP-9118, TSK0690965]

• After an upgrade to NetScaler 12.0 build, tcpCurPhysicalServers SNMP OID does not report the number of dynamically learned server information.
  [# NSHELP-9216, TSK0705912]

• Connections might hang if the size of processing data is more than the configured default TCP buffer size.

  Workaround: Set the TCP buffer size to maximum size of data that needs to be processed.
  [# NSPOLICY-1267, BUG0707209]

• Customizations made in httpd.conf file in 11.1 or older NetScaler releases are not supported in NetScaler release 12.0 58.x. As a result, the HTTP daemon does not start after the NetScaler appliance is upgraded to release 12.0 58.x.

  Workaround: After upgrading the NetScaler appliance from an 11.1 or an older release to 12.0 58.x release, make the needed customization again in the httpd.conf file.
  [# NSUI-7684, NSHELP-17855, BUG0695652]

Telco System

• When there is an incoming client request, if you manually run the “clear subscriber sessions” command, the appliance does not restart the Subscriber Database Controller (SDC) service to clear the database. Instead, the old request is still stored in the database when a new request is triggered.
  [# NSBASE-5156, BUG0718603]

• If there are junk or binary data found in the /var/nslog/ns.log file, the showtechsupport bundle fails to collect the latest 5 newnslog files. Instead it collects only one newnslog file.
  [# NSTOOLS-197, BUG0693733]

Telco Traffic Management

• GUI settings are missing in the Traffic Management page of the NetScaler T-series platform i.e the following ones:

  - Cache redirection

  - Subscriber

  - Service chaining

  - User

  As a workaround, one can visit MAS and configure a configuration job to run the relevant commands for the missing configuration. Please refer to the citrix documentation for exact details.
  [# NSUI-7265, BUG0712839]

Telco Video Optimization

• Memory leak is observed in the SSL detected domain extraction algorithm. The issue occurs if the SSL detected domain is extracted by the server certificate. The memory leak eventually causes the NetScaler appliance to become unresponsive.
  [# NSHELP-5780, NSHELP-5787, BUG0714470]

• The NetScaler TCP/IP processing module (also known as, Packet Processing Engine (PPE)) crashes when a TCP connection attached to a non-master TCP processing module stays open for more than 3,276 seconds.
  [# NSHELP-8799, BUG0710123]

• In a corner case, a NetScaler appliance reboots when an internal function performs Server Name Indication (SNI) extraction from server certificate. This happens because server side certificate is invalid with a zero-length DNS name.
  [# NSHELP-8803, BUG0718515]

URL Categorization

• When a cloud categorization lookup failure is observed, a NetScaler appliance displays a generic error for level 4 logs.
  [# NSSWG-397, BUG0705070]

URL Filtering

• NetSTAR (third party vendor) seed database was missing entries for popular websites. NetSTAR provided an updated URL, which supports an augmented seed database that includes all the missing entries. The new URL has been incorporated into this Netscaler Telco release.
  [# NSHELP-4383, BUG0706362]

• A NetScaler appliance might crash if the PCRF device is up but unresponsive to the appliance's Capability Exchange Request (CER).
  [# NSSWG-212, BUG0696827]

• NetSTAR (third party vendor) now uses a separate domain for hosting URL filtering cloud service for a specific group of customers (for example, UK customers).
  [# NSSWG-428, BUG0705899]

• A NetScaler appliance crashes, if you disable Video Optimization feature with video detection policy bound to it and enable URL Categorization feature.
  [# NSSWG-513, BUG0711473]

• A NetScaler appliance blocks HTTPS video traffic and displays an error message, "This site cannot be reached", if the following conditions are observed:

  - URL Filtering feature is disabled.

  - Video Optimization feature is enabled.

  - URL Filtering policy is bound to SSL bridge load balancing virtual server.

  Workaround: Unbind the URL Filtering policy.
  [# NSSWG-517, BUG0712263]

• Video optimization detection policies now support DROP and RESET actions in a NetScaler cluster setup.
  [# NSSWG-521, BUG0713314]

• If a consecutive import of URLset times out because of connectivity issues with the download server, the Comman Line tool will freeze, create a core dump, and will restart. The appliance's traffic will run as expected.

  Workaround: Download the URL set from the same server and disperse their download frequency.
  [# NSSWG-656, NSHELP-4492, BUG0712904]

Web App Firewall

• Web App Firewall blocks the request to Storefront if the following conditions are met:

  - You upgrade from release 12.0 build 58.15 to release 12.1 build 49.x or later.

  - The content length header is zero for an incoming request.
  [# NSHELP-17967, BUG0716783]

What's New in Previous NetScaler 12.0 Releases

• Support for Non-Blocking of TACACS Accounting and Authorization Requests

  The Terminal Access Controller Access-Control System (TACACS) is now not blocking the NetScaler AAA daemon while sending the TACACS accounting request. With this enhancement, the NetScaler AAA daemon allows LDAP, and RADIUS authentication to proceed with the request. The TACACS authentication request resumes once TACACS server acknowledges the TACACS request.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/aaa-tm/configure-aaa-policies/ns-aaa-setup-policies-authntcn-tsk.html.
  [From Build 57.24]
  [# 638597, 685002, 633598, 590652, 604515, 684539, 697289, 700605]

• POST and Redirect Bindings Support during Logout

  A NetScaler appliance used as a SAML SP now supports POST and Redirect bindings during logout. Previously, only POST binding was supported.
  [From Build 35.6]
  [# 642102]

• SAMLIDP Single Logout Support for Redirect and Post Bindings

  SAMLIDP single logout support for Redirect and Post bindings is now available.
  [From Build 35.6]
  [# 642105]

• Support for SHA2 Message Digest on a NetScaler MPX FIPS Appliance

  A NetScaler MPX FIPS appliance functioning as a SAML service provider or a SAML identity provider can now be configured to use the SHA2 algorithms on FIPS hardware.
  [From Build 53.22]
  [# 673799]

• Group Attribute Parsing Support from a SAML Assertion

  You can now configure a NetScaler appliance to parse attributes in SAML assertions as group attributes. Parsing them as group attributes enables the appliance to bind policies to the groups. For more information, see http://docs.citrix.com/en-us/netscaler/12/aaa-tm/saml-authentication.html.
  [From Build 53.22]
  [# 681375]

• HMAC SHA256 Authentication Support for NetScaler AAA

  The NetScaler appliance configured for NetScaler AAA now accepts incoming tokens that are signed using keyed-hash message authentication code (HMAC) HS256 algorithm. In addition, the public keys of the SAML Identity Provider (IdP) are read from a file, instead of learning from a URL endpoint.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/aaa-tm/oauth-authentication.html.
  [From Build 56.20]
  [# 681415]

• Audience Restriction Check Support for NetScaler configured as SAML SP

  A NetScaler appliance configured as a SAML service provider can now enforce an audience restriction check. The audience restriction condition evaluates to “Valid” only if the SAML replying party is a member of at least one of the specified audiences. For more information, see http://docs.citrix.com/en-us/netscaler/12/aaa-tm/saml-authentication.html.
  [From Build 53.22]
  [# 687628]

• Support for RSA Private Key Decryption for SAML Operations on a NetScaler MPX FIPS Appliance

  A NetScaler MPX FIPS appliance used as a SAML service provider now supports encrypted assertions.
  [From Build 53.22]
  [# 688140, 635174]

• OpenID connect support for NetScaler AAA

  A NetScaler appliance can now be configured as an identity provider by using OpenID Connect protocol. OpenID Connect protocol is an add-on to OAuth mechanism to get user information from an authorization server.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/aaa-tm/configuring-openid-connect-protocol.html.
  [From Build 56.20]
  [# 691235, 691739, 617838]

• Support to unlock locked-out user accounts

  The administrator can now unlock a locked user account by following ways:

  1. By NetScaler GUI

  - AAA user: To unlock a locked-out aaa user account by using the configuration utility, navigate to Security > AAA-Application Traffic > Users. In the data pane, select the user account to unlock, and then in the Actions drop-down list, choose Unlock.

  - Local system user: To unlock local system user using NetScaler GUI, navigate to Configuration > System > User Administration > Users. Select the user, which needs to be unlocked. In the Select Action dropdown list, select Unlock.

  NetScaler GUI Limitation:

  The external role-based authentication (RBA) users cannot be unlocked using NetScaler GUI.

  Workaround: To unlock the locked external user, you have to use command line interface or NITRO API.

  2. By CLI

  You can now unlock any locked user (aaa user/external rba user/local system user) by command line interface: unlock aaa user <username>
  [From Build 58.18]
  [# 706443]

Admin Partitions

• VXLAN Support for Admin Partitions

  A partitioned NetScaler appliance now supports Virtual eXtensible Local Area Networks (VXLANs) protocol. A VXLAN can be created in the default partition and bound to any administrative partition. When you extend a VXLAN to a VLAN, binding a VLAN to a partition will also bind the VXLAN to the same partition. However, the appliance does not support shared VXLAN and does not allow you to extend a VXLAN to a shared VLAN.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 651332]

• Configurable Partition Resource Limit

  When you create an administrative partition, you can now set a partition resource (such as memory, bandwidth, or connections) limit to zero, which specifies that use of the resource is unlimited. The partition can consume up to the system limit. For a previously created partition, you can increase or decrease the limit or set the limit to zero.
  [From Build 35.6]
  [# 652187]

• Memory Management in Admin Partitions

  In a partitioned NetScaler appliance, the partition connections are now accounted from the partition quota memory. Previously, the connections were accounted from the default partition quota memory.
  [From Build 35.6]
  [# 652198]

• Blocking VRRP on Shared VLANs in Admin Partitions

  On a partitioned NetScaler appliance, Virtual Router Redundancy Protocol (VRRP) protocol is now supported only on non-shared VLANs. It is blocked on shared VLANs (tagged or untagged type) bound to a default or an administrative partition.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 655514]

• SNMP Traps for Admin Partition Rate Limiting

  On a partitioned NetScaler appliance, a SNMP-RATE-LIMIT alarm can generate six new SNMP traps for notification that a partition resource (such as connection or memory) has reached its limit or returned to normal. Previously, only three SNMP traps were available for rate limiting partition resources.

  Note: To enable generation of the SNMP trap messages, you must enable the SNMP-RATE-LIMIT alarm on the appliance and then configure the destination device to which the appliance can send the trap messages.

  The threshold and limit values for partition rate limiting are:

  Highest threshold = 80% (applicable for all partition rate limit traps)

  Lowest threshold = 60 % (applicable for all partition rate limit traps)

  Memory limit = 95% (applicable only for partition memory traps)

  The six new SNMP traps are:

  partitionCONNThresholdReached. Number of active connections for a partition exceeds its high threshold.

  partitionCONNThresholdNormal. Number of active connections are less than or equal to the configured normal threshold percentage.

  partitionBWThresholdReached. Partition's bandwidth usage reaches configured high threshold percentage.

  partitionMEMThresholdReached. Current memory usage of the partition exceeds its high threshold percentage.

  partitionMEMThresholdNormal. Current memory usage of the partition is less than or equal to the configured normal threshold percentage.

  partitionMEMLimitExceeded. Current memory usage of the partition exceeds its memory limit percentage
  [From Build 35.6]
  [# 655560]

• SNMP Monitoring for Partition Resource Utilization

  The SNMP Get and Walk functionalities are now supported on a partitioned NetScaler appliance for monitoring resource utilization details such as of bandwidth, memory, or connection resources.
  [From Build 56.20]
  [# 676597]

AppExpert

• Blacklisting Up to One Million URLs by Using URL Sets

  To prevent access to restricted websites, a NetScaler appliance uses a specialized URL matching algorithm. The algorithm uses a URL set that can include up to one million (1,000,000) blacklisted URLs. Each entry can include metadata that defines URL categories and category groups as indexed patterns. The appliance can also periodically download highly sensitive URL sets managed by internet enforcement agencies (with government websites) or independent internet organizations such as the Internet Watch Foundation (IWF). After downloading and importing the URL set, the appliance encrypts it (as required by these agencies) and keeps it confidential so that the entries are not tampered with.

  The NetScaler appliance uses advanced policies to determine whether an incoming URL should be blocked, allowed, or redirected. These policies use advanced expressions to evaluate incoming URLs against blacklisted entries. An entry can include metadata. For entries that have no metadata, you can use an expression that evaluates the URL on the basis of an exact string match. For URLs that have metadata, you can use an expression that evaluates the URL's metadata, in addition to an expression that checks for an exact string match.
  [From Build 35.6]
  [# 628124]

Application Firewall

• Generate SNMP alarm and log message when application firewall Session limit is reached

  When NetScaler reaches appfw_session_limit and CSRF checks are enabled, the web application freezes.

  To prevent web application freeze, decrease the session timeout and increase the session limit by using the following commands:

  From CLI: > set appfw settings -sessiontimeout 300

  From shell: root@ns# nsapimgr_wr.sh -s appfw_session_limit=200000

  Logging and generating SNMP alarm when appfw_session_limit is reached assists users in troubleshooting and debugging issues.
  [From Build 35.6]
  [# 589567]

• Application Firewall GUI - Signature Editor

  When using the signature editor to perform an import and merge operation from the NetScaler GUI, you can now see the new, updated, duplicate, and invalid rules.

  The signature editor displays the following four new rows:

  1. New Rules

  2. Updated Rules

  3. Duplicate Rules

  4. Invalid Rules

  The output of the New Rules Only and Updated Rules Only filters also appears in the Category filter pane of the Edit window in signature editor.
  [From Build 35.6]
  [# 656279]

• Configure Application Firewall Session Limit Through the CLI

  You can now use the CLI to configure the Application Firewall session limit. Enter the following command:

  set appfw settings -sessionLimit <value>

  Where <value> is the maximum number of sessions allowed for each packet engine. Minimum value: 0. Maximum value: 500000. Default: 100000.
  [From Build 35.6]
  [# 662582]

NetScaler VPX Appliance

• Support for vCPU-based perpetual licensing

  Virtual CPU (vCPU)-based perpetual licensing is now supported for NetScaler VPX instances. This licensing provides the computing power requirement of VPX on-prem and cloud customers. For each VPX model, existing NetScaler licensing editions apply: NetScaler Standard Edition, Enterprise Edition, Platinum Edition.
  [From Build 59.8]
  [# 701340]

CloudBridge Connector

• AES 256-bit Support

  The NetScaler appliance now supports AES 256-bit encryption algorithm for IPSec tunnel (CloudBridge Connector) configurations.

  For more information about CloudBridge Connector, see https://docs.citrix.com/en-us/netscaler/12/system/cloudbridge-connector-introduction.html.
  [From Build 57.24]
  [# 696803]

Clustering

• SNMP MIB Support for Cluster Nodes

  In a cluster setup, you can now configure the SNMP MIB on any node by including the ownerNode parameter in the set snmp mib command. Without this parameter, the set snmp mib command applies only to the cluster coordinator node.

  To display the MIB configuration for an individual node other than the cluster coordinator node, include the ownerNode parameter in the show snmp mib command.
  [From Build 35.6]
  [# 628136, 623888]

• Disabling Steering for Forwarding Sessions in a Cluster Setup

  The default behavior of a NetScaler cluster is to direct the traffic that it receives (flow receiver) to another node (flow processor) that must then process the traffic. This process of directing the traffic from flow receiver to flow processor occurs over the cluster backplane and is called steering. This steering can be an overhead for real time processing or when high latency links are present in the setup.

  Steering for forwarding sessions can now be disabled so that the processing becomes local to the flow receiver and therefore makes the flow receiver the flow processor.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 636825]

• Monitor Static Route (MSR) Support for Inactive Nodes in a Spotted Cluster Configuration

  In a spotted cluster configuration, you can now configure an inactive or spare node to monitor a static route for which the MSR option is enabled. From a SNIP address owned exclusively by an inactive node, the node can send PING and ARP probes to an IPv4 route or ping5 and nd6 probes to an IPv6 route. Previously, only active nodes could monitor a static route.
  [From Build 35.6]
  [# 648194]

• VRID/VRID6 support for cluster

  When you migrate a high availability (HA) setup to a cluster setup, all configurations must be compatible and must be supportable in the cluster. To achieve this, you can now configure virtual router IDs (VRIDs and VRID6s) on a single-node cluster interface.
  [From Build 35.6]
  [# 655726]

• Managing Cluster Heartbeat Messages

  In a cluster configuration, you can now disable the heartbeat option on node interfaces. However, the heartbeat option on the backplane interface cannot be disabled, because it is required for maintaining connectivity among the cluster nodes.
  [From Build 35.6]
  [# 655842]

• TFTP Support in a Cluster Setup

  Trivial File Transfer Protocol (TFTP) is now supported in a NetScaler cluster setup. TFTP is a simple form of file transfer protocol and is based on the UDP protocol. TFTP does not provide any security features and is generally used for automated transfer of configuration and boot files between devices in a private network. TFTP support on a NetScaler cluster setup is compliant with RFC 1350. A server listens on port 69 for any TFTP request.

  The following features are supported:

  * INAT processing compliant with TFTP. If a NetScaler cluster receives a request packet whose destination is port 69 and that matches an INAT rule with the TFTP option enabled, the cluster's processing of the request and the corresponding response is compliant with the TFTP protocol. For an INAT configuration for a TFTP server, only spotted SNIP addresses are supported for the server-side communication.

  * RNAT processing compliant with TFTP. When a request packet generated by a server is destined to a TFTP server, and the packet matches an RNAT rule on a NetScaler cluster, the cluster's processing of the request and the corresponding response from the TFTP server is compliant with the TFTP protocol. In an RNAT configuration of TFTP servers, only spotted NAT IP addresses are supported for the TFTP server-side communication.
  [From Build 35.6]
  [# 658631]

• Audit-Log Support in Cluster

  A cluster setup of NetScaler appliances now supports the audit-log feature.
  [From Build 35.6]
  [# 669938]

• Support for Heterogeneous Cluster

  The NetScaler appliance now supports heterogeneous cluster in a cluster deployment. A heterogeneous cluster spans nodes of different NetScaler hardware and you can have a combination of different platforms in the same cluster. For more information, see https://docs.citrix.com/en-us/netscaler/12/clustering/support-for-heterogeneous-cluster.html.
  [From Build 56.20]
  [# 691119, 682150]

DNS

• Support for Wildcard DNS Domains

  You can now use wildcard DNS domains to handle requests for a nonexistent domains and subdomains. In a zone, if you want to redirect queries for all nonexistent domains or subdomains to a particular server, you can use wildcards rather than creating a separate Resource Record (RR) for each such domain. The wildcard RRs synthesize the responses to queries for a nonexistent domain or a subdomain name.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 558993]

• Caching of EDNS0 Client Subnet (ECS) Data when the NetScaler Appliance is in Proxy Mode

  In NetScaler Proxy mode, if a back-end server that supports ECS sends a response containing the ECS option, the NetScaler appliance forwards the response as-is to the client and stores it in the cache, along with the client subnet information. Further DNS requests that are from the same subnet of the same domain, and for which the server would send the same response, are then served from the cache instead of being directed to the server.
  [From Build 35.6]
  [# 626837]

• Securing DNS Keys with Passwords on a Partitioned NetScaler Appliance

  You can now secure the DNS keys with passwords on a partitioned NetScaler appliance.

  Specify the password in the create dns key command, and then specify the same password in the add dns key command when adding the DNS key to the NetScaler appliance.
  [From Build 35.6]
  [# 655295]

GSLB

• Configuring GSLB by Using a Wizard in the NetScaler GUI

  You can now use a wizard to configure the GSLB deployment types (active-active and active-passive) and parent-child topologies. In the NetScaler GUI, navigate to Configuration > Traffic Management > GSLB, and click Get Started.

  You can also start the GSLB configuration wizard from the dashboard. The dashboard provides the overall status of the GSLB sites participating in GSLB. You can also synchronize the sites and test the GSLB setup from the dashboard. To access the GSLB dashboard, navigate to Configuration > Traffic Management > GSLB > Dashboard.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 664467]

• Service Groups Support for GSLB

  The NetScaler appliance now supports service groups for GSLB. The following types of GSLB service groups are supported:

  - IP address-based service groups

  - Domain name-based service groups

  - Domain name-based autoscale service groups

  You can configure the GSLB service groups to use domain names instead of IP addresses when referring to the load balancing endpoints.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/global-server-load-balancing/configure/configuring-a-gslb-service-group.html.
  [From Build 57.24]
  [# 693071]

Licensing

• Support for checking NetScaler license expiration information through GUI and CLI

  Now you can check NetScaler license expiration information through GUI or CLI. Previously, customers were notified of an expired license only after a system rebooted, causing the NetScaler appliance to restart as an unlicensed appliance.

  To check license information through the NetScaler GUI, navigate to Configuration > System > Licenses. Alternatively, run the command “show ns license” to view the license information.
  [From Build 59.8]
  [# 556558]

• Support for Higher Number of vCPUs

  With NetScaler Pooled Capacity, the NetScaler VPX instances can be configured for bandwidth licensing up to 100G and 20 vCPUs.

  With NetScaler Check-in/Check-out licensing, the NetScaler VPX instances can be configured with bandwidth licenses up to 100G
  [From Build 53.22]
  [# 687192]

Load Balancing

• SNMP OID for Tracking Persistence Sessions on a Per-Vserver Basis

  The vsvrCurPersistenceSessions (1.3.6.1.4.1.5951.4.1.3.1.1.76) SNMP OID provides the number of current persistence sessions on each virtual server.
  [From Build 35.6]
  [# 346825]

• Setting alertRetries to a Value Higher than the Retries Value

  The alertRetries parameter, which specifies the maximum number of consecutive monitoring-probe failures after which the NetScaler appliance generates an SNMP trap called monProbeFailed, can now be set to a value higher than the Retries value (which specifies the maximum number of probes to send to establish the state of a service for which a monitoring probe failed). If the alertRetries value is higher than the Retries value, the SNMP trap is not sent until after the service is DOWN.

  For example, if you set Retries to 3, alertRetries to 12, and the time interval to 5 seconds, the service is marked DOWN after 15 seconds (3*5), but no alert is generated. If the monitor probes are still failing after 60 seconds (12*5), the NetScaler appliance generates a monProbeFailed trap. If a probe succeeds at some time between 15 and 60 seconds, the service is marked UP and no alert is generated.
  [From Build 35.6]
  [# 422816]

• Connection Failover Support for IPv6 Load Balancing Configurations

  Connection failover support has been extended for IPv6 load balancing configurations. Connection failover helps prevent disruption of access to applications deployed in a distributed environment. In a NetScaler High Availability (HA) setup, connection failover (or connection mirroring) refers to keeping an established TCP or UDP connection active when a failover occurs. The new primary NetScaler appliance has information about the connections established before the failover and continues to serve those connections. After failover, the client remains connected to the same physical server. The new primary appliance synchronizes the information with the new secondary appliance by using the SSF framework. If the L2Conn parameter is set, Layer 2 connection parameters are also synchronized with the secondary.

  You can set up connection failover in either stateless or stateful mode. In the stateless connection failover mode, the HA nodes do not exchange any information about the connections that fail over. This method has no runtime overhead. In the stateful connection failover mode, the primary appliance synchronizes the data of the failed-over connections with the new secondary appliance. Connection failover is helpful if your deployment has long lasting connections.

  For example, if you are downloading a large file over HTTP and a failover occurs during the download, the connection breaks and the download is aborted. However, if you configure connection failover in stateful mode, the download continues even after the failover.
  [From Build 35.6]
  [# 472611]

• Configuring Backup Persistence

  You can now configure a virtual server to use source IP persistence as the backup persistence type when the primary persistence type is rule-based. If the primary persistence lookup fails, the appliance uses source-IP based persistence when the parameter specified in the rule is missing in the incoming request.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 519440]

• Support for RADIUS Shared Secret

  A shared secret must now be configured in RADIUS load balancing deployments. A RADIUS client and server communicate with each other by using a shared secret that is configured on the client and the server. Transactions between the client and RADIUS server are authenticated through the use of a shared secret. This secret is also used to encrypt some of the information in the RADIUS packet.

  You can configure a default RADIUS shared secret, or you can configure a shared secret on a per-node basis. The appliance uses the client IP address or the server IP address in the RADIUS packet to decide which shared secret to use.

  In telco deployments, you must now configure a RADIUS client when you configure a RADIUS listener service. If a shared secret is not configured, the RADIUS message is silently dropped.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 564185]

• RADIUS Interim Message Support for RADIUS-Only Mode

  RADIUS interim message support has been added for RADIUS-only mode, to treat interim messages as start messages.
  [From Build 51.24]
  [# 675763]

• Support for Autofill of username from SAML Service Provider (SP)

  A NetScaler appliance used as a SAML Service Provider (SP) with Multi-Factor (nFactor) authentication now prepopulates the user-name field on the login page. The appliance sends a NameID attribute as part of an SAML authorization request, retrieves the NameID attribute value from the NetScaler SAML Identity Provider (IdP), and prepopulates the user-name field.
  [From Build 51.24]
  [# 677540]

• Backup Persistence Support for SSL Session ID

  Source IP persistence is now supported as a backup persistence type for SSL session ID persistence. If the client and load-balanced server renegotiate the session, and source IP persistence is configured as the backup persistence, client requests are forwarded to the same server.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/load-balancing/load-balancing-persistence/session-id-persistence.html
  [From Build 56.20]
  [# 681813]

• Support for Gx Interface in a Cluster Topology

  The NetScaler appliance now supports Gx interface in a cluster topology.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/netscaler-support-for-telecom-service-providers/lsn-telco-subscriber-management.html.
  [From Build 57.24]
  [# 697737]

NITRO

• Prevent XSS and CSRF Attacks by Disabling Basic Authentication

  As an administrator or a root user, you can now prevent users from making API calls after using basic authentication (such as one-time credentials) to log on. You can use this feature to prevent Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and other types of attacks.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 611690, 570838]

• View Individual Counter Information

  To view global counters that are not otherwise shown by the NetScaler CLI or the NITRO API, you can now use the following URL format.

  URL: http://<NSIP>/nitro/v1/stat/nsglobalcntr?args=counters:<counter1>;<counter2>

  Previously, these counter values could be viewed only through the "nsconmsg" Shell command.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 622976]

NetScaler CPX

• Ability to Assign Multiple Interfaces to NetScaler CPX

  You can now assign dedicated network interfaces to the NetScaler CPX container by using a NetScaler CPX-specific environment variable. The network interfaces that you define are held by the NetScaler CPX container until you uninstall the NetScaler CPX container. For more information, see http://docs.citrix.com/en-us/netscaler-cpx/12/deploy-using-docker-image-file.html.
  [From Build 53.22]
  [# 656533]

• Support for Licensing the NetScaler CPX with Multiple Cores

  You can use NetScaler MAS to pool your NetScaler CPX licenses, and use NetScaler MAS as a licensing server. You can use the NetScaler GUI to install licenses in MAS by uploading the license files or using the License Access Codes (LACs) that you purchased from Citrix. If you are provisioning a NetScaler CPX deployment with multiple vCPU cores, each core is allocated a CPX license from the license pool. For more information, see http://docs.citrix.com/en-us/netscaler-cpx/12/cpx-licensing.html.
  [From Build 51.24]
  [# 673368]

• Ability to Control the Throughput Performance of NetScaler CPX

  When a NetScaler CPX container does not receive any incoming traffic to process, it yields CPU cycles, which causes low throughput performance. When provisioning the NetScaler CPX container, you can now use the CPX_CONFIG environment variable to control the throughput performance of the NetScaler CPX container in such cases. For more information, see http://docs.citrix.com/en-us/netscaler-cpx/12/deploy-using-docker-image-file.html.
  [From Build 51.24]
  [# 687896]

NetScaler GUI

• PHP Version Upgraded from Version 5.3.17 to 7.0.13

  PHP has been upgraded from version 5.3.17 to version 7.0.13 on the NetScaler appliance to resolve security vulnerabilities and stability issues with PHP.
  [From Build 35.6]
  [# 572765]

• NetScaler GUI Masks Full Path

  To enhance security, the NetScaler GUI no longer displays the full path to an admin partition when a file browser is opened for an activity such as SSL certificate installation. Everything except the last part of the path is masked.
  [From Build 35.6]
  [# 661475]

• Changes in Create Monitor Page and Persistence Type Selection

  In Create Monitor Page, the Standard Parameters and Special Parameters are renamed to Basic Parameters and Advanced Parameters respectively. The Basic Parameters section contains the parameters that must be set for each monitor. The Advanced Parameters section contains the parameters that can be used in advanced use cases.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/load-balancing/load-balancing-configure-monitors/create-monitor.html

  In Persistence Type Selection page, when selecting the persistence types, the most suitable persistence types for a virtual server is available as option buttons. Other persistence types that are applicable to the specific virtual server type can be selected from the Others list.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/load-balancing/load-balancing-persistence/rule-persistence.html
  [From Build 56.20]
  [# 669787, 655064, 687327]

• Support for Atomocity in Wizards

  The new atomicity feature removes the residual configuration left by an unsuccessful configuration attempt, so that you can successfully reconfigure the entity by using a wizard in Citrix XenMobile, XenApp, NetScaler Gateway, NetScaler Unified Gateway, or GSLB. Previously, co-entities and other unwanted configurations left by the unsuccessful configuration attempt caused error messages to appear.
  [From Build 35.6]
  [# 669990]

NetScaler Gateway

• Configuring Separate Ports of a RADIUS Server for Accounting and Authentication Functionalities

  You can now configure separate ports of a RADIUS server (other than the default ports) for accounting and authentication functionalities.
  [From Build 35.6]
  [# 355523, 634307]

• Proxy Auto Configuration for Outbound Proxy

  You can now configure the NetScaler Gateway appliance to support Proxy Auto Configuration (PAC). Upon configuration, a PAC file URL is pushed to the client browser, the traffic initiated from browser is then redirected to the respective proxies based on the conditions defined in the PAC file.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 378411]

• Support for validating the server certificate provided by the back-end server during an SSL handshake.

  The NetScaler Gateway appliance can now be configured to validate the server certificate provided by the back-end server during an SSL handshake.

  You can use the NetScaler CLI or the NetScaler GUI to configure the NetScaler appliance to validate the server certificate.

  For more information, see https://docs.citrix.com/en-us/netscaler-gateway/12/validating-server--certificate-during-ssl-handshake.html.
  [From Build 56.20]
  [# 481784, 402833, 508834, 682862]

• Support for One Time Password (OTP)

  NetScaler Gateway now supports one-time passwords (OTPs) without having to use a third-party server. In addition to reducing capital and operating expenses, this feature enhances the administrator's control by keeping the entire configuration on the NetScaler appliance.

  Note that, since third-party servers are no longer needed, the gateway administrator has to configure an interface to manage and validate user devices.

  To use the OTP feature, a user must be registered with a NetScaler Gateway virtual server. Registration is required only once per unique device, and typically is restricted to certain environments. Configuring validation of a registered user is similar to configuring an additional authentication policy. For more information about this feature, see http://docs.citrix.com/en-us/netscaler-gateway/12/native-otp-support.html
  [From Build 51.24]
  [# 603663]

• Support for EPA in GSLB Active-Active deployment

  EPA now functions reliably on GSLB Active-Active deployment.
  [From Build 35.6]
  [# 619596]

• Authorization policy support for UDP, DNS, and ICMP Traffic

  The NetScaler Gateway appliance now supports authorization policy configuration for UDP, DNS, and ICMP traffic. The policy can be configured by using only default syntax policies.
  [From Build 56.20]
  [# 621062]

• SNI Support for NetScaler Gateway

  A NetScaler Gateway appliance can now be configured to include a server name indication (SNI) extension in the SSL “client hello” packet sent to the backend server. The SNI extension helps the backend server identify the FQDN being requested during the SSL handshake and respond with the respective certificates.

  Note: Enable SNI support when multiple SSL domains are hosted on same server.

  For more information, see http://docs.citrix.com/en-us/netscaler-gateway/12/configuring-server-name-indication-extension.html.
  [From Build 53.22]
  [# 624091]

• PCoIP Proxy Support for VMware View

  NetScaler Gateway now supports the PCoIP protocol which is the core building block for several VDI solutions, including VMware Horizon View solution. This enables the solution to deliver desktops and applications and secure data on a variety of endpoint devices more efficiently.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 632624]

• Support for Logon Lockdown Control

  Logon lockdown control is now supported on a NetScaler cluster. Unsuccessful logon attempts are recorded in a distributed hash table (DHT). The advantage of using the DHT is that both n2n (node to node) and c2c (cluster to cluster) messaging are supported.
  [From Build 35.6]
  [# 635415]

• Support for Logon Lockdown Control

  The User Lockdown Control feature is now available for system role-based access control users on a cluster.
  [From Build 35.6]
  [# 650547, 490670]

• Support for logging out from a VPN session upon removal of smart-card from the logged on device.

  You can now optionally log out from a VPN session if you remove smart-card from the logged on device.
  [From Build 35.6]
  [# 654943]

• EDT as a Data Transmission Path Support for NetScaler Gateway

  The NetScaler Gateway appliance now supports the HDX Enlightened Data Transport (EDT) as a data transmission path. EDT provides a high definition in-session user experience of virtual desktops for users running a Citrix Receiver.
  [From Build 35.6]
  [# 659795, 666135]

• Logging "Destination IP address" and "ICA Proxy policy name" for Outbound ICA Proxy

  Now "Destination IP address" and "ICA Proxy policy name" are logged additionally along with other information logged earlier for Outbound ICA Proxy.
  [From Build 35.6]
  [# 661832]

• Support for SAML ForceAuthn Parameter and Artifact Binding (when NetScaler is SP) using GET HTTP Method

  NetScaler SAML SP (Service Provider) module now sends additional attribute called 'ForceAuth' in the authentication request to external IDP (Identity Provider). By default, the ForceAuthn carries a value of 'false'. It can be set to 'true' to provide a hint to IDP to force authentication despite existing authentication context.

  Additionally, NetScaler SP does authentication request in query parameter when configured with artifact binding.
  [From Build 35.6]
  [# 665828]

• Inter-operability with OAuth

  NetScaler Gateway is now able to process JWT (Json Web Tokens) during logon. Gateway is required to be configured with an OAuth action that contains a URL to fetch the certificates to verify incoming JWT. This enables Gateway to inter-operate with OAuth providers.
  [From Build 35.6]
  [# 671380]

• Multi-Stream ICA Functionality Support for EDT

  NetScaler Gateway now supports multi-stream ICA functionality while using HDX Enlightened Data Transport (EDT) as a data transmission path.
  [From Build 35.6]
  [# 671878]

• Support for End-point analysis and VPN plugins for Firefox

  End-point analysis and VPN plug-ins get launched from Firefox browser, build 52.0 or later, even though the browser no longer supports NPAPI plug-ins.
  [From Build 51.24]
  [# 679998, 682798]

• Network Access Control and Conditional Access for Windows by using Microsoft Enterprise Mobility + Security (EMS).

  The NetScaler Gateway client running on Windows machine can now be configured to provide Network Access Control and Conditional Access using Microsoft Enterprise Mobility + Security (EMS).
  [From Build 56.20]
  [# 689493]

• Support for End-to End Encryption with DTLS 1.0 for Enhanced Data Transport (EDT) Termination between Receiver and VDA.

  With this enhancement, the NetScaler Gateway appliance supports end-to end encryption with DTLS 1.0 for EDT termination between Receiver and VDA.

  Also, the appliance can now be configured for the Double-hop functionality for EDT traffic between Receiver and VDA.

  For more information, see https://docs.citrix.com/en-us/netscaler-gateway/12/hdx-enlightened-data-transport-support.html.
  [From Build 56.20]
  [# 690030]

• Proxy Auto Configuration (PAC) Support for Client Running on Mac Operating System

  The NetScaler Gateway appliance can now be configured to support Proxy Auto Configuration (PAC) for a client running on Mac operating system.

  For more information, see https://docs.citrix.com/en-us/netscaler-gateway/12/proxy-auto-configuration-for-outbound-proxy-support-for-netScaler-gateway.htmlhttps://docs.citrix.com/en-us/netscaler-gateway/12/proxy-auto-configuration-for-outbound-proxy-support-for-netScaler-gateway.html.
  [From Build 56.20]
  [# 690852]

• OPSWAT v4 Support for EPA plug-in

  You can now configure the following End-point analysis (EPA) scans for the NetScaler Gateway appliance. The client computers use the NetScaler Gateway plug-in to access the software environment of their enterprise network.

  The following OPSWAT scans are configured on a NetScaler Gateway appliance.

  -Product specific scan

  -Vendor specific scan

  -Generic scan

  The following system scans are configured on a NetScaler Gateway appliance.

  -MAC Address

  -Domain Check

  -Numeric Registry

  -Non-numeric Registry

  -Windows Update

  For more information, see https://docs.citrix.com/en-us/netscaler-gateway/12/vpn-user-config/advanced-epa-policies.html
  [From Build 57.24]
  [# 693089]

• Using Advance Policy

  - The following VPN policies can now be configured by using default syntax policies.

  - Session Policy

  - Authorization Policy

  - Traffic Policy

  - Tunnel Policy

  - Audit Policy

  - End Point Analysis (EPA) scan functionality can be now configured as an nFactor for authentication. Previously the EPA scan was configured as part of session policy. Now it can be linked to nFactor providing more flexibility, as to when it can be performed.

  For more information, see https://docs.citrix.com/en-us/netscaler-gateway/12/using-advance-policy-to-create-vpn-policies.html.
  [From Build 56.20]
  [# 695727]

• Support for a new version of Network Access Control (NAC)

  NetScaler Gateway now supports a new version of NAC checks using Microsoft Enterprise Mobility (Microsoft Intune) suite. This variant uses a signed device information of the end client for validation. To use this feature, you need a compatible version of the Citrix SSO app.
  [From Build 59.9]
  [# NSAUTH-4239, BUG0716353]

NetScaler Insight Center

• Support for Lightweight NSAP Virtual Channel

  NetScaler Gateway now supports the parsing of lightweight NSAP virtual channel for ICA traffic. This provides improved performance and scalability of NetScaler Gateway while generating HDX Insight reports for ICA connections.
  [From Build 57.24]
  [# 686381]

NetScaler SDX Appliance

• Support for FQDN as External Server Name

  For LDAP and RADIUS servers, you can now use Fully Qualified Domain Names (FQDNs) to specify external servers. Previously you had to specify IP addresses for all external servers.

  For more information, see http://docs.citrix.com/en-us/sdx/12/configuring-management-service/configuring-external-authentication-server.html.
  [From Build 51.24]
  [# 684417]

• An Interactive GUI for Restoring a NetScaler Appliance

  For a successful NetScaler SDX appliance restore, you need the following resources:

  - A valid license

  - An XVA images

  - A NetScaler image

  - A Single Bundle Image

  If any of these resources are missing in the backup file, the GUI now prompts to upload the resource before proceeding further – enabling you to restore the appliance efficiently in a single go.

  Previously, if any resource was found missing, the process terminated with an error message. The user needed to start the process again after uploading the required resources.

  For more information, see https://docs.citrix.com/en-us/sdx/12/configuring-management-service/backup-restore.html
  [From Build 57.24]
  [# 689549, 666240, 603135]

• Jumbo MTU Support for CLAG

  In a cluster setup that involves one or more NetScaler SDX appliances, you get confirm messages when you perform the following actions:

  - When you click Create to configure a CLAG in one of NetScaler SDX appliances in the cluster setup, a message prompts you to refresh the CLAG settings in the other SDX appliances. At the prompt, select Yes to continue. If you select No, the CLAG is not configured. Note that you must manually refresh the CLAG settings in the other SDX appliances.

  - If you change the MTU setting in one of the SDX appliances, a message prompts you to change the setting in the other SDX appliances. At the prompt, select Yes to continue. If you select No, the MTU is not set. Note that you must manually change the MTU setting in the other SDX appliances.

  For more information about how to configure CLAG on SDX appliances, see https://docs.citrix.com/en-us/sdx/12/configuring-management-service/configure_cluster_link_aggregation.html
  [From Build 57.24]
  [# 689767]

• Support for SWG Instances on a NetScaler SDX Appliance

  This release supports Secure Web Gateway (SWG) instances on all NetScaler SDX platforms. You must purchase an "SDX 2-Instance Add-On Pack for Secure Web Gateway" license to provision an SWG instance on the SDX appliance. For more information, see https://docs.citrix.com/en-us/sdx/12/deploying-sdx-swg-instances.html.
  [From Build 56.20]
  [# 693950]

• Support for Automatic LOM Firmware Upgrade

  With this release, the Lights Out Management (LOM) firmware is automatically upgraded after the NetScaler SDX single bundle image is upgraded. When the appliance restarts after upgrading the single bundle image, it checks if LOM firmware upgrade is required and upgrades the firmware accordingly. The LOM upgrade might take a few minutes.

  However, the following exceptions and usage guidelines apply:

  - Do not upgrade NetScaler SDX 8010/8015/8400/8600 appliances to release 12.0 57.19, because LOM upgrade hangs during single bundle image upgrade. For more information, see 706269 in the Known Issues section in this release notes.

  - For SDX 115XX/175XX series appliances with LOM firmware version lower than 3.03, manual upgrade is required. For more information about manual upgrade, see the following documentations:

  https://support.citrix.com/article/CTX137970

  https://support.citrix.com/article/CTX140270

  - SDX 14000-40S platform is not enabled for automatic LOM firmware upgrade. Support will be provided in future releases.

  - Before upgrading the single bundle image, verify that LOM is running successfully by checking health monitoring events in the NetScaler SDX GUI dashboard. If LOM is in hung state, power cycle the appliance by pulling all the AC power cables on the power supplies. Wait for a minute and then replug the AC cables to power up the unit. Next, upgrade the single bundle image and complete the LOM upgrade.

  For more information, see:

  Lights Out Management Port of the NetScaler SDX Appliance documentation

  https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/lights-out-management-port.html

  Citrix LOM Firmware Upgrade page

  https://www.citrix.com/downloads/netscaler-adc/components/lom-firmware-upgrade.html?_ga=2.171892064.1772880763.1519622542-31978247.1493873654
  [From Build 57.24]
  [# 695122, 690194]

• ACL Rules for Accessing an SDX Appliance

  Now you can create ACL rules to control and restrict access to your NetScaler SDX appliances, by using the SDX GUI.

  For more information, see https://docs.citrix.com/en-us/sdx/12/configuring-management-service/access-control-lists.html
  [From Build 57.24]
  [# 696715]

• Support for SDX 26000-100G Platform

  This release supports the SDX 26000-100G platform. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/hardware-platforms/sdx-26xxx100g.html
  [From Build 58.18]
  [# 703467]

• Support for SDX 15000-50G Platform

  This release supports the SDX 15000-50G platform. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/hardware-platforms/sdx-15xxx50g.html
  [From Build 58.18]
  [# 704960]

NetScaler Secure Web Gateway

• Support for a new product called NetScaler Secure Web Gateway

  The NetScaler Secure Web Gateway (SWG) implementation supports the following features:

  * SSL Interception - Intercept HTTPS traffic and apply policies to enforce compliance rules and security checks. The traffic is intercepted, blocked, or bypassed on the basis of the configured policies.

  * Forward Proxy - Support for transparent and explicit proxy modes. In explicit proxy mode, an IP address must be specified in the client's browser, unless the organization pushes the setting onto the client's device. This address is the IP address and port of a proxy server that is configured on the SWG appliance. All client requests are sent to this IP address. In transparent proxy mode, a proxy is not configured on the client's device. The SWG appliance is configured in an inline deployment, and the appliance transparently accepts all HTTP and HTTPs traffic.

  * Identity Management - Tag traffic to the users so that administrators can take user based actions. Authentication is explicitly enabled, or user information from the active directory is extracted and tagged to the traffic.

  * URL Threat Intelligence - Enable the appliance to categorize internet sites to more effectively enforce compliance policies around internet usage. URL threat intelligence also provides the reputation score of the URLs that are being accessed, to protect the users from exposure to harmful (malware/phishing) internet sites. You can also deploy custom URL lists that are managed by independent internet organizations, such as the Internet Watch Foundation (IWF), or create blacklists and whitelists of URLs by using pattern sets.

  * Analytics - The transaction-level records are exported from Secure Web Gateway to NetScaler MAS by using the Logstream transport mechanism. In NetScaler MAS, the User Behaviour Analytics dashboard displays user internet-usage information. It also shows the transaction-level details per user. From the Outbound Traffic Dashboard, you can view the overall network details, and the top websites in terms of maximum bandwidth consumption.

  Using the above features, an administrator can protect the enterprise network from external threats coming from the web in the form of malware, by defining policies to do the following:

  - Block access to URLs identified as serving harmful content.

  - Identify end users in the enterprise (employees) who are accessing malicious websites, and categorize them as high-risk users.

  For more information about this feature, see http://docs.citrix.com/en-us/netscaler-secure-web-gateway/12.html.

  Important! Secure Web Gateway requires its own platform license. Contact your local Citrix sales representative to purchase your license.
  [From Build 51.24]
  [# 653661]

• New nodes in the GUI

  The Load Balancing and Content Switching nodes now appear, after the Secure Web Gateway node, in the NetScaler Secure Web Gateway GUI. You can configure deployments with both secure web gateway, and load balancing or content switching features from the NetScaler Secure Web Gateway GUI.

  Also, the SSL Interception node is renamed to SSL Interception Policies.
  [From Build 56.20]
  [# 695039]

NetScaler VPX Appliance

• Support for AWS Auto Scaling Service

  AWS Auto Scaling in now supported on VPX instances.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/deploying-vpx/install-vpx-on-aws/configuring-aws-auto-scaling-service.html.
  [From Build 51.24]
  [# 432348, 432345, 487534]

• Support for Key-Pair Based Authentication

  For VPX deployment on KVM OpenStack, you can now use key-pair based authentication to log on and access a VPX instance in a more secure way. You can also execute custom scripts with a userdata file.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 617478]

• Two New Commands to Control CPU Usage Behavior

  Two new commands, set ns vpxparam and show ns vpxparam, control the CPU-usage behavior of VPX instances in VMWare ESX and Citrix XEN environments:

  1. set ns vpxparam -cpuyield (YES | NO | DEFAULT)

  Allow each VM to use CPU resources that have been allocated to another VM but are not being used.

  Set ns vpxparam parameters:

  -cpuyield: Release or do not release of allocated but unused CPU resources.

  YES: Allow allocated but unused CPU resources to be used by another VM.

  NO: Reserve all CPU resources for the VM to which they have been allocated.

  DEFAULT: Reset -cpuyield to its factory default value based on license.

  - If license <= 8G, release CPU resources.

  - If license > 8G, use up all the CPU resources allocated to it.

  2. show ns vpxparam

  Display the current vpxparam settings.
  [From Build 35.6]
  [# 625698]

• Two New Commands to Control CPU Usage Behavior

  Two new commands, set ns vpxparam and show ns vpxparam, control the CPU-usage behavior of VPX instances in VMWare ESX and Citrix XEN environments:

  1. set ns vpxparam -cpuyield (YES | NO | DEFAULT)

  Allow each VM to use CPU resources that have been allocated to another VM but are not being used.

  Set ns vpxparam parameters:

  -cpuyield: Release or do not release of allocated but unused CPU resources.

  YES: Allow allocated but unused CPU resources to be used by another VM.

  NO: Reserve all CPU resources for the VM to which they have been allocated. This option shows higher percentage in hypervisor for VPX CPU usage.

  DEFAULT: NO

  Note: On all NetScaler VPX platforms, the vCPU usage on the host system will be 100 percent. Type the set ns vpxparam –cpuyield YES command to override this usage.

  2. show ns vpxparam

  Display the current vpxparam settings.
  [From Build 51.24]
  [# 625698]

• Support for VMware ESXi 6.5 server

  NetScaler VPX appliances now support VMware ESXi 6.5 server.
  [From Build 35.6]
  [# 643974]

• Support for High-Performance VPX on OpenStack

  You can now deploy high-performance NetScaler VPX instances that use single-root I/O virtualization (SR-IOV) technology, on OpenStack. Also, on the OpenStack host, you can configure VLAN tagging on the SR-IOV virtual functions.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 660055]

• Support for SR-IOV Interfaces for NetScaler VPX Instances on AWS

  After you have created a NetScaler virtual instance on AWS, you can use the AWS CLI to configure the virtual appliance to use SR-IOV network interfaces. For more information, see http://docs.citrix.com/en-us/netscaler/12/deploying-vpx/install-vpx-on-aws/Config-NS-VPX-SRIOV-AWS.html
  [From Build 53.22]
  [# 673928]

• Active/Passive Multi-NIC Multi-IP HA-INC Deployment on Azure

  You can deploy a NetScaler VPX pair with multiple IP addresses and network interfaces in active/passive high availability (HA) Independent Network Configuration (INC) mode. Use the new Citrix NetScaler HA template on Azure for deployment, or use Windows PowerShell commands.

  For more information, see the following topics:

  http://docs.citrix.com/en-us/netscaler/12/deploying-vpx/deploy-vpx-on-azure/configuring-multiple-azure-nics-ip-for-vpx-in-ha-mode.html

  http://docs.citrix.com/en-us/netscaler/12/deploying-vpx/deploy-vpx-on-azure/configuring-gslb-active-standby-ha-deployment-azure.html
  [From Build 53.22]
  [# 675920]

• SR-IOV Support with Intel X710 10G and XL710 40G NICs

  You can now configure a NetScaler VPX appliance to use single-root I/O virtualization (SR-IOV) technology with Intel X710 10G and XL710 40G NICs.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/deploying-vpx/install-vpx-on-kvm/configure-SR-IOV-KVM.html
  [From Build 53.22]
  [# 679513]

• OVS DPDK for NetScaler VPX Instances Running on KVM

  You can configure a NetScaler VPX instance running on KVM to use Open vSwitch (OVS) with the Data Plane Development Kit (DPDK). This configuration provides better network performance. Also, certain NetScaler VPX deployments require the VPX host on KVM to operate on the vhost user ports exposed by OVS rather than the standard MacVTap-based vhost interfaces.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/deploying-vpx/install-vpx-on-kvm/configure-ovs-dpdk-kvm.html.
  [From Build 53.22]
  [# 682999]

• Support for Subscription-Based Licensing Model

  A subscription based licensing model is now supported for NetScaler VPX in the Azure Marketplace. When creating a NetScaler VPX instance on Azure, you can choose either subscription (pay by hour) or Bring Your Own License (BYOL).

  For more information, see http://docs.citrix.com/en-us/netscaler/12/deploying-vpx/deploy-vpx-on-azure.html.
  [From Build 51.24]
  [# 683144, 644004]

• Support for NetScaler Pooled Capacity Licensing Framework

  The NetScaler pooled-capacity licensing framework is now supported on Microsoft Azure and Hyper-V, and Amazon Web Services. A pooled-capacity enabled NetScaler VPX instance can check out licenses from a bandwidth pool of any NetScaler software edition (Platinum/Enterprise/Standard) hosted on and served by NetScaler MAS server. The bandwidth pool is the total bandwidth that can be shared by NetScaler instances. You can dynamically modify the bandwidth of a VPX instance as appropriate for the available pool.

  For more information, see http://docs.citrix.com/en-us/netscaler-mas/12/netscaler-pooled-capacity.html.
  [From Build 51.24]
  [# 684408]

• Auto-Provision a NetScaler VPX Instance by Using Virtual Machine Manager

  You now have the option to auto-provision a NetScaler VPX instance by using the Virtual Machine Manager. If auto-provisioning is enabled, the IP address, gateway, and netmask are automatically assigned to the instance during initial setup. If auto-provisioning is not enabled, you must provide the networking configuration manually.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/deploying-vpx/install-vpx-on-kvm/provision-on-kvm-using-vmm.html
  [From Build 53.22]
  [# 690684]

• NetScaler VPX Check-In/Check-Out Licensing Support for New Licenses

  You can now purchase and use the new 10Gbps+ NetScaler VPX Check-In/Check-Out Licenses for NetScaler VPX instances deployed on any supported hypervisors, and for instances used in cloud deployments. The newly supported licenses include 10Gbps, 15Gbps, 25Gbps, 40Gbps and 100Gbps versions of the Standard, Enterprise, and Platinum editions.
  [From Build 53.22]
  [# 691005]

• Support for VPX Express License

  VPX Express license is a new license offering for NetScaler VPX on-prem and cloud deployments. If the VPX instance does not have any license, it comes up with the VPX Express license by default.

  The Express license includes:

  - 20 Mbps bandwidth

  - All NetScaler standard license features, except NetScaler Gateway

  - Maximum 250 SSL sessions

  - 20 Mbps SSL throughput

  You can upgrade the VPX Express License to the following two options:

  1. A standalone NetScaler VPX license

  2. NetScaler Pooled Capacity license for VPX instances. For more information, see https://docs.citrix.com/en-us/netscaler-mas/12/netscaler-pooled-capacity.html

  For more information about NetScaler licenses, see https://docs.citrix.com/en-us/netscaler/12/licensing/netscaler-licensing-overview.html.
  [From Build 56.20]
  [# 693061]

• Support for High Availability for VPX Instances with SR-IOV Interfaces Running on AWS

  High availability is now supported for VPX instances with SR-IOV interfaces running on AWS.

  For more information, see the following topics:

  https://docs.citrix.com/en-us/netscaler/12/deploying-vpx/install-vpx-on-aws/vpx-aws-ha.html

  https://docs.citrix.com/en-us/netscaler/12/deploying-vpx/install-vpx-on-aws/configure-vpx-to-use-sr-iov-aws.html
  [From Build 57.24]
  [# 694260]

• Support for Extra Management CPU for NetScaler VPX Instances

  To achieve better performance for configuring and monitoring of your appliance, you can now allocate an extra management CPU from packet engine pool in all NetScaler VPX models except VPX instances that run on an SDX appliance. Previously the feature was supported only in NetScaler MPX models 25xxx, 22xxx, 14xxx, 115xx, 15xxx, and 26xxx.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/system/basic-operations/allocate-extra-management-CPU.html
  [From Build 57.24]
  [# 700311]

Networking

• Support for Bidirectional Forwarding Detection Protocol

  Bidirectional Forwarding Detection (BFD) protocol is a mechanism for fast detection of failures of forwarding paths. BFD detects path failures in the order of milliseconds. BFD is used in conjunction with dynamic routing protocols.

  In BFD operation, routing peers exchange BFD packets at a negotiated interval. If a packet is not received from a peer within the negotiated interval plus grace interval, the peer is considered to be dead and a notification will be sent to the set of registered routing protocols. In turn, the routing protocols recalculate the best path and reprogram the routing table. BFD supports smaller time interval, when compared to the timers provided by the routing protocols, thus resulting in faster detection of failures.

  The NetScaler appliance supports BFD for the following routing protocols: BGP (IPv4 and IPv6), OSPFv2 (IPv4), and OSPFv3 (IPv6). BFD support in the NetScaler appliance is compliant with RFCs 5880, 5881, and 5883.

  For more information about this feature, see http://docs.citrix.com/en-us/netscaler/12/networking/ip-routing/configuring-dynamic-routes/configuring-bidirectional-forwarding-detection.html.
  [From Build 51.24]
  [# 647447]

• IPv6 Virtual Router Redundancy Protocol Support for a Cluster Setup

  IPv6 Virtual Router Redundancy Protocol (VRRP6) protocol is now supported on a cluster setup.

  The following are the two VRRP6 features supported on a cluster setup:

  * Interface based VRRP6: This feature is only applicable to a two-node cluster where one of node is in active state and the other in Spare. In this feature, same VMAC address is configured on both the nodes of a cluster setup. This VMAC address is used in GARP advertisements and ARP responses for the IPv6 addresses configured on a node. This feature is useful in an active-spare two-node cluster setup that has external devices/routers that do not accept GARP advertisements. By configuring a same VMAC address on both cluster nodes, when the active node goes down and the spare node takes over as active, the MAC address for the IP addresses in the new active node remain unchanged and the ARP tables on the external devices/ routers do not need to be updated.

  * IP based VRRP6: In this feature, striped VIP6 addresses bound to the same VRID6 are configured on all nodes of a cluster setup. These VIP6 addresses are active on all the nodes One of the cluster nodes acts as the VRID6 owner and sends out the VRRP6 advertisement to other nodes. In case of failure of the VRID6 owner node, another node in the cluster assumes the ownership of the VRID6 and starts sending VRRP6 advertisements.
  [From Build 35.6]
  [# 657315]

• Removing RNAT Sessions

  You can remove any unwanted or inefficient RNAT sessions from the NetScaler appliance. The appliance immediately releases resources (such as a port of the NAT IP address, and memory) allocated for these sessions, making the resources available for new sessions. The appliance also drops all the subsequent packets related to these removed sessions. You can remove all or selected RNAT sessions from the NetScaler appliance.

  For more information about this feature, see http://docs.citrix.com/en-us/netscaler/12/networking/ip-addressing/configuring-network-address-translation/configuring-rnat.html.
  [From Build 51.24]
  [# 672953]

• Using the Client IP address in the Outer Header of Tunnel Packets in DSR IP tunneling mode

  The NetScaler supports using the client IP address as the source IP address in the outer header of tunnel packets related to direct server return mode using IP tunneling. This feature is supported for DSR with IPv4 and DSR with IPv6 tunneling modes. For enabling this feature, enable the use client source IP address parameter for IPv4 or IPv6. This setting is applied globally to all the DSR configurations that use IP tunneling.

  For more information about this feature, see the section "Using the Client IP address in the Outer Header of Tunnel Packets" at http://docs.citrix.com/en-us/netscaler/12/load-balancing/load-balancing-dsrmode-tos-ipoverip.html.
  [From Build 51.24]
  [# 677829]

• Increase in Maximum Value for VRRP Dead Interval

  In an active-active setup of NetScaler appliances using Virtual Router Redundancy Protocol (VRRP), VRRP dead interval is the time interval after which the master VIP address is marked down if the VRRP advertisements are not received from the node of the master VIP address.

  The maximum value that can be set for VRRP dead interval has been increased from 3 to 60 seconds.
  [From Build 51.24]
  [# 679999]

• Detecting a NetScaler Appliance in a UDP Load Balancing Setup through TTL Updates

  Some enterprises/scenarios running a monitoring application requires the NetScaler appliance of a load balancing setup to be detected as one of the hop in a traceroute. A NetScaler appliance of a load balancing setup is not detected in a traceroute because the appliance, by default, sets the TTL value to 255 instead of decrementing it when forwarding the request to a backend server.

  To meet this requirement, Decrement TTL parameter of a VIP address can be used. This parameter applies to all UDP virtual servers using this VIP.

  When you enable the Decrement TTL parameter of a VIP, the NetScaler appliance decrements the TTL value by 1 instead of setting it to 255 when forwarding requests, which are received on the UDP virtual servers that use this VIP. Monitoring applications using traceroute data can now detect the presence of a NetScaler appliance of a UDP load balancing setup.

  For more information, see https://docs.citrix.com/en-us/netscaler/11/networking/ip-addressing/configuring-netscaler-owned-ip-addresses/configuring-and-managing-virtual-ip-addresses-vips.html.
  [From Build 57.24]
  [# 695718]

Optimization

• Support for Facebook Video Optimization

  The NetScaler Video Optimization feature now enables you to detect and optimize Facebook video traffic.
  [From Build 57.24]
  [# 690410]

Platform

• Support for Hardware Platforms

  This release now supports the NetScaler MPX 5900 and NetScaler MPX 8900 platforms. For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/support-for-mpx-5900-8900-platforms.html.
  [From Build 57.24]
  [# 493998, 681106]

• Support for Pooled Licensing

  NetScaler MPX 115xx models are now supported with pooled licensing. For more information about pooled licensing, see http://docs.citrix.com/en-us/netscaler-mas/12/netscaler-pooled-capacity.html.
  [From Build 53.22]
  [# 599575]

• Support for New Hardware Platforms

  This release now supports the NetScaler MPX 26000-100G and NetScaler MPX 26000T-100G platforms. For more information, see https://docs.citrix.com/en-us/netscaler-hardware-platforms/mpx/netscaler-hardware-platforms/citrix-netscaler-mpx-26000-100g-26000T-100g.html.
  [From Build 57.24]
  [# 648922, 653372]

• Support for SDX 8900 Appliance

  This release supports the NetScaler SDX 8900 appliance.

  For more information see the following documentation:

  NetScaler SDX Hardware-Software Compatibility Matrix

  https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/supported-versions.html

  Citrix NetScaler SDX 8900

  https://docs.citrix.com/en-us/netscaler-hardware-platforms/sdx/hardware-platforms/8900.html

  Citrix Downloads page

  https://www.citrix.com/downloads/netscaler-adc/components/netscaler-firmware-59xx-89xx.html
  [From Build 57.24]
  [# 653122, 636909]

• Support for NetScaler Pooled Capacity

  The following new NetScaler MPX platforms now support NetScaler Pooled Capacity:

  * MPX-22000

  * MPX-24000
  [From Build 57.24]
  [# 680354]

• Support for New Hardware Platform

  This release now supports the NetScaler MPX 15000-50G platform.
  [From Build 57.24]
  [# 698112]

SSL

• Support for ECDHE Ciphers on the Back End of NetScaler VPX Instances

  Citrix NetScaler VPX instances now support the ECDHE cipher group on the back end. This group contains the following ciphers:

  - TLS1-ECDHE-RSA-AES256-SHA 0xc014

  - TLS1-ECDHE-RSA-AES128-SHA 0xc013

  - TLS1-ECDHE-RSA-DES-CBC3-SHA 0xc012

  - TLS1-ECDHE-RSA-RC4-SHA 0xc011

  Because of its smaller key size, Elliptic Curve Cryptography (ECC) is especially useful in a mobile (wireless) environment and in an interactive voice response environment, where every millisecond is important. Smaller key sizes result in power, memory, bandwidth, and computational cost savings.

  The following ECC curves are supported: P_256, P_384, P_224, and P_521.

  By default, all four curves are bound to an SSL virtual server.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/cipher_protocl_support_matrix.html.
  [From Build 56.20]
  [# 543535, 603626]

• Support for AES-GCM and SHA2 Ciphers at the Front End of MPX/SDX 14000 FIPS Appliances

  The NetScaler MPX/SDX 14000 FIPS appliance now supports AES-GCM and SHA2 ciphers at the front end.

  The following AES-GCM and SHA2 ciphers are supported at the front end of the MPX/SDX 14000 FIPS appliance:

  - TLS1.2-AES256-GCM-SHA384

  - TLS1.2-AES128-GCM-SHA256

  - TLS1.2-ECDHE-RSA-AES256-GCM-SHA384

  - TLS1.2-ECDHE-RSA-AES128-GCM-SHA256

  - TLS1.2-AES-256-SHA256

  - TLS1.2-AES-128-SHA256
  [From Build 35.6]
  [# 579751]

• Support for New FIPS Platform

  This release supports the MPX 14000 FIPS platform, which is a high-end platform containing 63 crypto cores, available in the following models:

  Model number System Throughput

  MPX 14030 FIPS 30 Gbps

  MPX 14060 FIPS 60 Gbps

  MPX 14080 FIPS 80 Gbps

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 592833, 498222, 590397]

• Support for New SDX FIPS Platform

  This release supports the SDX 14000 FIPS platform, which is a high-end platform containing 63 crypto cores, available in the following models:

  Model number System Throughput

  SDX 14030 FIPS 30 Gbps

  SDX 14060 FIPS 60 Gbps

  SDX 14080 FIPS 80 Gbps

  For more information, see http://docs.citrix.com/en-us/netscaler/11/traffic-management/ssl/configuring-SDX-14030-14060-14080-fips-appliance.html.
  [From Build 35.6]
  [# 597890]

• Support for ECDSA ciphers on the front end and back end of NetScaler VPX Appliances

  The NetScaler VPX appliances now support the elliptical curve digital signature algorithm (ECDSA) cipher group end to end. ECDSA cipher suites use elliptical curve cryptography (ECC). Because of its smaller size, it is particularly helpful in environments where processing power, storage space, bandwidth, and power consumption are constrained.

  Note: ECDSA certificates with only the following curves are supported:

  -prime256v1

  -secp384r1

  -secp521r1

  -secp224r1

  The following ciphers are supported with ECDSA:

  -ECDHE-ECDSA-AES256-GCM-SHA384

  -ECDHE-ECDSA-AES256-SHA384

  -ECDHE-ECDSA-AES256-SHA

  -ECDHE-ECDSA-AES128-GCM-SHA256

  -ECDHE-ECDSA-AES128-SHA256

  -ECDHE-ECDSA-AES128-SHA

  -ECDHE-ECDSA-RC4-SHA

  -ECDHE-ECDSA-DES-CBC3-SHA

  For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/customize-ssl-config/ecdsa_cipher_suite_support_on_mpx_appliances_with_n3_chips.html
  [From Build 57.24]
  [# 603602]

• Support for 4096-bit Server Certificates and 4096-bit DH Keys on a NetScaler VPX Instance

  A NetScaler VPX instance now supports 4096-bit server certificates on the back end and 4096-bit DH keys on the front end and back end.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/ssl-server-cert-support-matrix.html.
  [From Build 56.20]
  [# 603623, 690665, 676131, 695579]

• Support for AES-GCM and SHA2 Ciphers at the Back End of MPX/SDX 14000 FIPS Appliances

  The NetScaler MPX/SDX 14000 FIPS appliance now supports AES-GCM and SHA2 ciphers at the back end.

  The following AES-GCM and SHA2 ciphers are supported at the back end of the MPX/SDX 14000 FIPS appliance:

  - TLS1.2-AES256-GCM-SHA384

  - TLS1.2-AES128-GCM-SHA256

  - TLS1.2-ECDHE-RSA-AES128-GCM-SHA256

  - TLS1.2-AES-256-SHA256

  - TLS1.2-AES-128-SHA256
  [From Build 35.6]
  [# 611983]

• Support for DTLS 1.0 on the Back End of a NetScaler Appliance

  The NetScaler appliance now supports DTLS 1.0 on the back end. With this enhancement, a NetScaler or a NetScaler Gateway appliance can talk to a virtual desktop agent over DTLS.

  You can use the NetScaler CLI or the NetScaler GUI to configure a DTLS back-end service on the NetScaler appliance.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/config-ssloffloading/configuring-a-dtls-service.html.
  [From Build 56.20]
  [# 632600]

• Support for Skipping Policy Extension Check in a Certificate Chain

  The NetScaler appliance now supports skipping the policy extension check, if present inside a X509 certificate chain. If client authentication is enabled and client certificate is set to mandatory, you can set the "Skip Client Certificate Policy Check" in the front-end SSL profile.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/config-client-auth.html.
  [From Build 56.20]
  [# 636019, 629981]

• Support for ChaCha20-Poly1305 Ciphers on a NetScaler VPX Instance

  ChaCha20-Poly1305 ciphers are now supported on the front-end and back-end of NetScaler VPX instances. These ciphers are secure stream ciphers that provide better performance and security, and faster encryption. The following cipher suites are supported in this release:

  - TLS1.2-DHE-RSA-CHACHA20-POLY1305 (Hex: 0xCCAA)

  - TLS1.2-ECDHE-RSA-CHACHA20-POLY1305 (Hex: 0xCCA8)

  The cipher alias name is CHACHA20.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/cipher_protocl_support_matrix.html.
  [From Build 56.20]
  [# 636381]

• Support for HTTP strict transport security (HSTS)

  NetScaler appliances now support HTTP strict transport security (HSTS) as an inbuilt option in SSL profiles and SSL virtual servers. Using HSTS, a server can enforce the use of an HTTPS connection for all communication with a client. That is, the site can be accessed only by using HTTPS. Support for HSTS is required for A+ certification from SSL Labs.

  You can enable HSTS in an SSL front-end profile or on an SSL virtual server. By setting the maximum age header, you specify that HSTS is in force for that duration for that client. You can also specify whether subdomains should be included.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 636384, 651353]

• Support for ECDHE Ciphers at the Front End and Back End on NetScaler MPX//SDX 14000 FIPS Appliances

  Citrix NetScaler MPX/SDX 14000 FIPS appliances now support the ECDHE cipher group.

  The following ciphers are supported at the front end of the MPX/SDX 14000 FIPS appliance:

  - TLS1-ECDHE-RSA-AES256-SHA

  - TLS1-ECDHE-RSA-AES128-SHA

  - TLS1.2-ECDHE-RSA-AES-256-SHA384

  - TLS1.2-ECDHE-RSA-AES-128-SHA256

  - TLS1-ECDHE-RSA-DES-CBC3-SHA

  This following ciphers are supported at the back end of the MPX/SDX 14000 FIPS appliance:

  - TLS1-ECDHE-RSA-AES256-SHA

  - TLS1-ECDHE-RSA-AES128-SHA

  - TLS1.2-ECDHE-RSA-AES-128-SHA256

  - TLS1-ECDHE-RSA-DES-CBC3-SHA

  Because of its smaller key size, Elliptic Curve Cryptography (ECC) is especially useful in a mobile (wireless) environment. It is also very useful in an interactive voice response environment, where every millisecond is important. Smaller key sizes result in power, memory, bandwidth, and computational cost savings.

  The following ECC curves are supported: P_256, P_384, P_224, and P_521.

  By default, all four curves are bound to an SSL virtual server.
  [From Build 35.6]
  [# 651524]

• Support for a Hybrid FIPS Mode on the MPX 14000 FIPS Platform

  The new MPX 14000 FIPS platform contains one primary card and one or more secondary cards. If you enable the hybrid FIPS mode, the pre-master secret decryption commands are run on the primary card because the private key is stored on this card, but the bulk encryption and decryption is offloaded to a secondary card. This significantly increases the bulk encryption throughput on a MPX 14000 FIPS platform as compared to non-hybrid FIPS mode and the existing MPX 9700/10500/12500/15000 FIPS platform. Enabling the hybrid FIPS mode also increases the SSL transactions per second on this platform.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 651814]

• Recording the time taken for an SSL handshake in the syslog

  The time taken for an SSL handshake to complete can now be recorded in the system log (syslog). To do this, set the log level in the syslog parameters to All.
  [From Build 53.22]
  [# 669508]

• Secure Implementation of Session Tickets

  You can now secure session tickets by using a symmetric key to encrypt them. Additionally, to achieve forward secrecy, you can specify a time interval at which the session-ticket key is refreshed. Session-ticket keys can be generated by the appliance, or you can manually enter session-ticket key data. Entering this data manually is helpful in HA or cluster deployments so that the appliances can decrypt each other's session tickets.

  For more information about this enhancement, see http://docs.citrix.com/en-us/netscaler/12/ssl/customize-ssl-config/secure-implementation-of-session-tickets.html.
  [From Build 53.22]
  [# 669514]

• A new category of SSL certificates

  A new category of SSL certificates called Unknown Certificates is added to the NetScaler GUI. This category is for certificates that do not meet the conditions for end-user certificates (both server and client), CA certificate, and intermediate CA certificate. To view these certificates, navigate to Traffic Management > SSL > Certificates>Unknown Certificates.
  [From Build 56.20]
  [# 673219]

• Optimizing ECDHE Computation on NetScaler MPX 5900/8900 and NetScaler SDX 8900 Platforms

  ECDHE-RSA computation has been optimized by using a combination of software and hardware offload capabilities.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/ssl/customize-ssl-config/ssl-hybrid-ecdhe-optimization.html.
  [From Build 56.20]
  [# 677459]

• Support for wildcard in the subject alternative name in a certificate signing request

  You can now use wildcards in the subject alternative name (SAN) entry in the certificate signing request. For example, *.example.com.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ssl-certificates/obtain-cert-frm-cert-auth.html#support-for-subject-alternative-name-in-a-certificate-signing-request.
  [From Build 59.8]
  [# 686067]

• Support for Subject Alternative Name in a Certificate Signing Request

  The subject alternative name (SAN) field in a certificate allows you to associate multiple values, such as domain names and IP addresses, with a single certificate. By using SAN, you can secure multiple domains, such as www.example.com, www.example.net, www.example.org, with a single certificate. The NetScaler appliance now supports adding SAN entries when creating a certificate signing request (CSR). You can send a CSR to a Certificate Authority to obtain a signed certificate.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/manage-certs/obtain-cert-frm-cert-auth.html.
  [From Build 57.24]
  [# 686067]

• Increased lifetime of previous session ticket key

  Previous session ticket key lifetime has been increased to 172800 seconds.

  For more information, see https://docs.citrix.com/en-us/netscaler/11-1/ssl/customize-ssl-config/secure-implementation-of-session-tickets.html.
  [From Build 59.8]
  [# 694324]

• Support for FIPS 140-2 Level-3 on MPX/SDX 14000 FIPS Platforms

  This release adds support for FIPS 140-2 Level 3 on the MPX 14000 FIPS and SDX 14000 FIPS platforms. The "set fips" command allows only "Level-2" option but internally level-2 is converted to level-3.

  For more information, see https://docs.citrix.com/en-us/netscaler/12/ssl/configuring-mpx-14000-fips-appliance.html and https://docs.citrix.com/en-us/netscaler/12/ssl/configuring-SDX-14030-14060-14080-fips-appliance.html.
  [From Build 56.20]
  [# 694386]

• Addition of TLS1.2 ciphers in the DEFAULT_BACKEND cipher group

  TLS1.2 ciphers are added to the DEFAULT_BACKEND cipher group.

  For more information, see https://docs.citrix.com/en-us/netscaler/12-1/ssl/ciphers-available-on-the-citrix-ADC-appliances.html
  [From Build 59.8]
  [# 698452]

Secure Web Gateway

• Support for ICAP for Remote Content Inspection

  The NetScaler Secure Web Gateway (SWG) appliance can now act as an ICAP client and use policies for interacting with third-party security vendors that specialize in antimalware and data leak prevention (DLP). The encrypted files, which were earlier bypassed, can now be scanned by security vendors using ICAP on a NetScaler SWG appliance.

  The appliance intercepts client traffic (HTTP and HTTPS), decrypts it, and sends the decrypted traffic to the ICAP server(s). The appliance supports content inspection in both request mode (REQMOD) and response mode (RESPMOD). While REQMOD is ideal for DLP integration, RESPMOD is used in checking for antimalware. You must configure policies to select the traffic to send to the ICAP servers.

  For more information, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12/security-configuration/using-icap-for-remote-content-inspection.html.

  For the use case, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12/use-case-icap-for-remote-malware-inspection.html.
  [From Build 57.24]
  [# 638345]

System

• Option to Allocate an Extra Management CPU

  According to your requirement, now you can allocate an extra management CPU from packet engine pool in the NetScaler MPX appliance, and achieve better performance for configuring and monitoring of your appliance. This feature is supported in NetScaler MPX models 250xxx, 220xxx, 14xxx, 115xx.
  [From Build 35.6]
  [# 352233, 235321, 559207, 604165, 615657]

• Configuring HMAC Keys for PI Function

  A new parameter of the ns hmackey command specifies the HMAC key value. A NetScaler default syntax policy expression uses the HMAC () function to compute a Hash-based Message Authentication Code on selected text. This function is derived from the RFC 2104 technique to authenticate the sender of a message and verify that the contents of the message have not been altered. To set this value, type:

  HMAC (<keyValue>)

  The HMAC key value specifies the digest method and the shared secret key to be used for the HMAC computation.
  [From Build 35.6]
  [# 415808]

• SNMP Alarm for Saved NetScaler Configuration Failure

  You can now enable the CONFIG-SAVE alarm for saving a configuration failure on a NetScaler appliance. On enabling the alarm, the appliance sends a proactive notification (SNMP Trap) to the trap destination. This helps administrators to timely correct system failures and respond to a configuration loss.
  [From Build 56.20]
  [# 550606]

• Call Home Support for NetScaler Services in Citrix Service Provider (CSP) Deployments

  In a Citrix Service Provider (CSP) environment where NetScaler services are deployed on VPX instances, the call home feature can now monitor and track the license specific information and securely send it to Citrix Insight Services (CIS). The CIS in turn sends the information to the License Usage Insights (LUI) portal for accounting purposes and for CSP customers to review their license usage. Currently, CSP environments support NetScaler services on VPX instances only, not on MPX or SDX appliances. The VPX instances can be deployed in either standalone or high availability mode.

  For more information about this feature, see http://docs.citrix.com/en-us/netscaler/12/system/configuring-call-home.html.
  [From Build 51.24]
  [# 637763]

• Policy Support for RSA Encryption

  A NetScaler appliance now supports policy-based RSA encryption. The algorithm uses the PKEY_ENCRYPT_PEM() function to encrypt HTTP predefined and user-defined header or body content. The function accepts only RSA public keys (not private keys) and the encrypted data cannot be longer than the length of the public key. If the data being encrypted is shorter than the key length, it will be padded using the PKCS1 padding method.

  For example, the function can be used with the B64ENCODE() function in a rewrite action to replace an HTTP header value with the value encrypted by an RSA public key, which can then be decrypted by the recipient with its corresponding RSA private key.
  [From Build 56.20]
  [# 641912]

• Displaying MPTCP Statistics

  The new "stat mptcp" command displays statistical information about MPTCP counters, including counters for total MPTCP traffic, current traffic, and erroneous traffic flowing through the NetScaler appliance.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 646498, 350115]

• Configuring SYN-Cookie Timeout Interval

  In addition to the SYN Cookie setting in the TCP profile, a NetScaler appliance now maintains a second SYN Cookie setting for each virtual server. This enhancement is especially important for cluster deployments. To protect the appliance against SYN attacks, the SYN Cookie parameter in the TCP profile is enabled by default. Previously, if you disabled it, its value would toggle to ENABLED if a SYN attack was detected. If the appliance was deployed in a cluster, the cluster configuration would become inconsistent until the parameter was toggled back to the DISABLED state after the attack. Now, the SYN Cookie parameter is enabled and disabled only for the virtual server that detects the SYN attack.

  Note: A SYN attack does not enable the SYN Cookie parameter for a virtual server unless the SYN Cookie parameter in the TCP profile is set to DISABLED.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 651196]

• HTTP Version 2 Support for Server Side

  The NetScaler appliance now supports HTTP version 2 (HTTP/2) for the server side of an HTTPS or HTTP load balancing setup. If the backend server supports HTTP/2 protocol, the appliance and the server use one of the following methods to start communicating in HTTP/2.

  - TLS ALPN (for HTTPS load balancing setup)

  - HTTP/2 Upgrade ( for HTTP load balancing setup)

  - Direct HTTP/2 (for HTTP load balancing setup)

  - Direct HTTP/2 using Alternative Service (for HTTP load balancing setup)

  For more information, see https://docs.citrix.com/en-us/netscaler/12/system/http-configurations/configuring-http2.html.
  [From Build 56.20]
  [# 652119]

• Protection Against Wrapped Sequence (PAWS) Algorithm

  On a NetScaler appliance, you can now enable the TCP timestamp option in the default TCP profile to use the Protection Against Wrapped Sequence (PAWS) algorithm. The algorithm can identify and discard old packets whose sequence numbers are within the current TCP connection's receive window because the sequence has "wrapped" (reached its maximum value and restarted from 0).

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 652210]

• HTTP version 2 Protocol Support for Plaintext

  A NetScaler appliance now supports HTTP version 2 (HTTP/2) protocol for plaintext messaging. The appliance advertises the service availability to its clients by including an Alt-Svc field in its response so that the client can directly send a subsequent HTTP/2 request instead of an HTTP 1.1 or HTTP/2 upgrade request. Previously, the appliance supported plaintext messaging only as an upgrade request in HTTP version 1.1.
  [From Build 35.6]
  [# 653154]

• Configuring Heartbeat Time Interval for Call Home

  The Call Home feature periodically reports the latest status of the NetScaler appliance to Citrix Technical Support servers. The report has the same content as the registration message. Previously, CallHome sent the report once every 30 days, but you can now specify a time interval of from 1 to 30 days. However, a value of less than 5 days is not recommended, because the frequent uploads are usually not very useful.
  [From Build 35.6]
  [# 655515]

• Monitoring Rate Limit Errors in Call Home

  The NetScaler Call Home feature can now monitor rate-limiting packet drops caused by exceeding either the throughput (Mbps or Gbps) limit or the packets-per-second (pps) limit.
  [From Build 35.6]
  [# 656569]

• Encrypting user passwords by using SHA-512

  For enhanced security, the NetScaler appliance now uses the SHA-512 hashing algorithm to encrypt user passwords.

  Note: A user to which the following set of conditions applies cannot log on:

  1. The user is added, or the user's credentials are modified.

  2. The NetScaler software is then downgraded to an earlier build, but the modified configuration file (ns.conf) is used.
  [From Build 35.6]
  [# 658393, 204279, 658859]

• Audit-log Support for Admin Partitions

  A partitioned NetScaler appliance now supports audit logging for non-default partitions by using advanced (PI) policies. Previously, you could configure the audit-log feature only in a default partition, not in administrative partitions.
  [From Build 35.6]
  [# 659649]

• Configuring TCP Burst Control Parameters by using NetScaler GUI

  The following TCP Burst Control parameters are now configurable through either the NetScaler GUI or the command line interface. Previously, you could configure the following parameters through only the command line interface:

  - BurstRateCntrl

  - CreditBytePrms

  - RateBytePerms

  - RateSchedulerQ
  [From Build 35.6]
  [# 660828]

• Silently Dropping Idle TCP Connections

  In a Telco network, almost 50 percent of a NetScaler appliance's TCP connections become idle, and the appliance sends RST packets to close them. The packets sent over radio channels activate those channels unnecessarily, causing a flood of messages that in turn cause the appliance to generate a flood of service reject messages. The default TCP profile now includes DropHalfClosedConnOnTimeout and DropEstConnOnTimeout parameters, which by default are disabled. If you enable both of them, neither a half-closed connection nor an established connection causes an RST packet to be sent to the client when the connection times out. The appliance just drops the connection.

  For more information, see the Citrix NetScaler 12.0 Beta features document.
  [From Build 35.6]
  [# 664057]

• NetScaler Adaptive TCP Optimization

  The new NetScaler Adaptive TCP feature can optimize TCP and HTTP traffic over a mobile network. On receiving a connection request, the appliance uses an advanced optimization technique that independently adapts a TCP profile based on the subscriber’s network conditions. By enabling the feature on the appliance, the network operators can have deep insights of a TCP connection and adapt different TCP profiles to get maximum benefits of TCP optimization for any network condition.
  [From Build 56.20]
  [# 671824]

• NetScaler Connection Quality Analytics (CQA)

  The NetScaler Connection Quality Analytics (CQA) feature derives CQA parameters such as network type (2G, 3G or 4G), congestion level (None, Low, Medium, or High), and signal quality (Excellent, Good, Fair, or Poor) from raw metrics extracted during an active connection. The NetScaler appliance stores the derived data in its memory and also exports it to the AppFlow collectors for TCP statistics and reporting.
  [From Build 56.20]
  [# 677352]

• Advanced TCP Statistics Reporting

  The Advanced TCP Statistics feature can now generate a rich insight of a TCP connection by collecting raw metrics such as maximum RTT, Maximum bytes-in-flight (BIF), Average bandwidth-delay product, and total packets transmitted or retransmitted. The statistics is calculated based on the burst detection mechanism of TCP Speed Reporting feature.
  [From Build 56.20]
  [# 684446]

• Call Home Enabled by Default on All NetScaler Platforms

  The NetScaler Call Home is now enabled by default on NetScaler platforms such as MPX, VPX, and SDX. By enabling this feature on the appliance, you allow Citrix to collect NetScaler deployment and usage details for better product design, implementation, and support service.
  [From Build 56.20]
  [# 691276, 690506, 693505]

• Direct HTTP/2 Version 2 Support for Server Side

  A NetScaler appliance supports direct HTTP/2 for the server side of an HTTP load balancing setup. When direct HTTP/2 is enabled for an HTTP load balancing service, the NetScaler appliance directly starts communicating to a server in HTTP/2 instead of using the HTTP/2 upgrade method. If the server does not support HTTP/2 or is not configured to directly accept HTTP/2 requests, it drops the HTTP/2 requests from the appliance.

  The NetScaler appliance also supports direct HTTP/2 using alternative service (ALT-SVC) for the server side of an HTTP load balancing setup. When alternative service is enabled for an HTTP load balancing service, the NetScaler appliance sends a direct HTTP/2 request to the server after the server advertised that it supports HTTP/2 in the ALT-SVC field in its HTTP/1.1 responses to the appliance. The appliance and the server start communicating directly in HTTP/2.



  For more information, see https://docs.citrix.com/en-us/netscaler/12/system/http-configurations/configuring-http2.html.
  [From Build 56.20]
  [# 694164]

• Support for TCP Fast Open (TFO) in Multipath TCP (MPTCP)

  A NetScaler appliance now supports TCP Fast Open (TFO) mechanism for establishing Multipath TCP (MPTCP) connections and speeding up data transfers. The mechanism allows subflow data to be carried during the initial MPTCP connection handshake in SYN and SYN-ACK packets. Also, while establishing the MTCP connections, the mechanism enables the receiving node to consume data.
  [From Build 57.24]
  [# 696961]

• Support for Variable TCP Fast Open (TFO) Cookie Size

  A NetScaler appliance now enables you to configure a variable length TCP Fast Open (TFO) cookie of a minimum size of 4 bytes and a maximum size of 16 bytes in a TCP profile. By doing this, the appliance can respond to the client with the configured TFO cookie size in the SYN-ACK packet.
  [From Build 57.24]
  [# 699083]

• Enabling TCP timestamp option

  In certain scenarios, transactions might be slow or incomplete, if you enable the TCP timestamp option on a NetScaler appliance.
  [From Build 59.8]
  [# 710224]

• Maximum limit for name attribute is set to 64 characters

  In rate limiting, the maximum limit for name attribute is now increased to 64 characters.
  [From Build 59.8]
  [# 710289]

Telco

• IPFIX Logging Support for Large Scale NAT

  The NetScaler appliance supports sending information about LSN events in Internet Protocol Flow Information Export (IPFIX) format to the configured set of IPFIX collector(s).

  The appliance uses the existing AppFlow feature to send LSN events in IPFIX format to the IPFIX collectors.

  IPFIX based logging of LSN events is available for the following events in the context of NAT44, NAT64, and Dual-Stack Lite.

  * Creation or deletion of an LSN session.

  * Creation or deletion of an LSN mapping entry.

  * Allocation or de-allocation of port blocks in the context of deterministic NAT.

  * Allocation or de-allocation of port blocks in the context of dynamic NAT.

  * Whenever subscriber session quota is exceeded.

  For more information about IPFIX logging for large scale NAT44, see IPFIX Logging section in http://docs.citrix.com/en-us/netscaler/12/netscaler-support-for-telecom-service-providers/lsn-introduction/lsn-logging-monitoring.html.

  For more information about IPFIX logging for dual-stack lite, see IPFIX Logging section in http://docs.citrix.com/en-us/netscaler/12/netscaler-support-for-telecom-service-providers/dual-stack-lite/logging-monitoring-DS-Lite.html.

  For more information about IPFIX logging for large scale NAT64, see IPFIX Logging section in http://docs.citrix.com/en-us/netscaler/12/netscaler-support-for-telecom-service-providers/lsn-nat-64/log-monitor-largescale-nat64.html.
  [From Build 53.22]
  [# 496832, 677632]

• URL Filtering for Telco Mobile Networks

  The new NetScaler URL Filtering feature for telco mobile network provides policy based control of websites by using information contained in a URL. The feature helps administrators monitor and comply with government mandated safe internet usage policies on mobile networks. As an administrator, you can filter websites by using either the URL Categorization feature or the URL List feature.

  URL Categorization. Controls access to websites and web pages by filtering traffic on the basis of a predefined list of categories.

  URL List. Controls access to blacklisted websites and web pages by denying access to URLs contained in a URL set imported into the appliance.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/netscaler-support-for-telecom-service-providers/url-filtering.html
  [From Build 53.22]
  [# 628121]

• Large Scale NAT64 SIP and RTSP ALGs Support for 464XLAT Connections

  NetScaler appliances now support Large Scale NAT64 RTSP and SIP ALGs for 464XLAT connections that use large Scale NAT64.

  For a 464XLAT SIP connection using NAT64 and SIP ALG, the show lsn sipalgcall command now displays the IPv4 address (XLAT IP) of the subscriber. For a 464XLAT RTSP connection using NAT64 and RTSP ALG, the show lsn rtspalgsession command now displays the IPv4 address (XLAT IP) of the subscriber.

  464XLAT is an architecture that provides IPv4 connectivity across an IPv6-only ISP core network by combining the existing and well-known stateful translation at the core (Stateful NAT64; RFC 6146) and stateless protocol translation at the edge (IP/ICMP Translation algorithm; RFC 6145). In other words, 464XLAT provides connectivity between IPv4-only applications on IPv6 subscriber hosts and IPv4 Servers on the internet through an IPv6-only ISP core network.

  For more information about configuring SIP and RTSP ALGs for Large NAT64, see https://docs.citrix.com/en-us/netscaler/11-1/netscaler-support-for-telecom-service-providers/lsn-nat-64/configuring-agl-large-scale-NAT64.html.
  [From Build 35.6]
  [# 635880]

• NetScaler Video Optimization: Support for QUIC over UDP Protocol for Encrypted ABR Traffic

  The NetScaler video optimization feature is now enhanced to optimize video delivery over TCP (as HTTP and HTTPS traffic) and UDP (as QUIC traffic). The appliance can detect incoming video traffic as Adaptive Bit Rate (ABR) and optimize both the unencrypted and the encrypted video. The new capabilities are especially useful for reducing the overall network bandwidth consumption in mobile networks.

  For more information, see http://docs.citrix.com/en-us/netscaler/12/netscaler-support-for-telecom-service-providers/NetScaler-Video-Optimization.html
  [From Build 53.22]
  [# 674151]

• Configuring IPSec Application Layer Gateway for Large Scale NAT44

  If communication between two network devices (for example, client and server) uses the IPSec protocol, IKE traffic (which is over UDP) uses port fields, but Encapsulating Security Payload (ESP) traffic does not. If a NAT device on the path assigns the same NAT IP address (but different ports) to two or more clients at the same destination, the NAT device is unable to distinguish and properly route the return ESP traffic. Therefore, IPSec ESP traffic fails at the NAT device.

  NAT-Traversal (NAT-T) capable IPSec endpoints detect the presence of an intermediate NAT device during IKE phase 1 and switch to UDP port 4500 for all subsequent IKE and ESP traffic (encapsulating ESP in UDP). Without NAT-T support on the peer IPSec endpoints, IPSec protected ESP traffic is transmitted without any UDP encapsulation. Therefore, IPSec ESP traffic fails at the NAT device.

  The NetScaler appliance supports IPSec application layer gateway (ALG) functionality for large scale NAT configurations. The IPSec ALG processes IPSec ESP traffic and maintains session information so that the traffic does not fail when the IPSec endpoints do not support NAT-T (UDP encapsulation of ESP traffic).

  For more information, see For https://docs.citrix.com/en-us/netscaler/12/netscaler-support-for-telecom-service-providers/lsn-introduction/lsn-configuring-alg/configure-ipsec-application-layer-gateway-for-large-scale-nat.html.
  [From Build 53.22]
  [# 675938, 496583]

• License Change for Telco Platform Consolidation

  As part of Telco platform consolidation, the following set of features are now added to the CNS Platinum edition.

  * Telco URL Filtering

  * ABR Video Optimization

  * Adaptive TCP

  * Connection Quality Analytics (CQA)

  To support the effort, the features work on Telco platforms with the purchase of a basic CBM license and CBM Premium license and for other NetScaler platforms, the features work with the purchase of a CNS Platinum license.

  Note: For Telco URL Filtering feature to work on all platforms, it requires an additional URL Threat Intelligence license. You can purchase the license with a subscription service for one year or for three years.

  License support for Telco platforms:

  * CBM_TXXX_SERVER_Retail.lic

  * CBM_TPRE_SERVER_Retail.lic

  * CNS_WEBF_SSERVER_Retail.lic

  Where XXX is the throughput, for example, NetScaler T1000.

  License support for other NetScaler platforms:

  * CNS_XXX_SERVER_PLT_Retail.lic

  Where XXX is the throughput.
  [From Build 57.24]
  [# 697194]

Video Optimization

• Policy Support for QUIC Based Video Optimization

  NetScaler now supports policy-based video optimization for QUIC traffic over UDP.
  [From Build 56.20]
  [# 681754]

Fixed Issues in Previous NetScaler 12.0 Releases

• If you remove the NT LAN Manager (NTLM) prompt while using Kerberos or NTLM authentication, the NetScaler appliance configured for NetScaler AAA does not fall back to the next authentication method.
  [From Build 58.18]
  [# 644276, 630764]

• If the LDAP bind account password used on a NetScaler appliance contains the "at" special character (@), test connection performed on LDAP server fails, and the dashboard shows that the LDAP server is down.
  [From Build 53.22]
  [# 654375, 689891]

• An attempt to change an LDAP password through the NetScaler Gateway virtual server fails if the new password includes any multibyte UTF-8 characters, such as German umlauts (for example, kölnbonn207), Latin small letter sharp s (for example, straße2017), or special characters (for example, &%$§1Lucie-Marie).
  [From Build 53.22]
  [# 672846, 691269]

• NTLM authentication fails when the NetScaler tries to negotiate with an LB virtual server in front of the NTLM server.
  [From Build 51.24]
  [# 677747]

• The NetScaler appliance might fail if you use Kerberos authentication and the cached ticket incorrectly points to NULL, because the Kerberos ticket has expired and removed from the Distributed Hash Table (DHT).
  [From Build 51.24]
  [# 678865]

• The NetScaler appliance crashes because of a failure to access the NetScaler AAA logon credentials. The failure occurs while attempting to match the rewrite policy against an AAA group.
  [From Build 51.24]
  [# 680099]

• If you set the ‘Validate LDAP Server Certificate’ parameter in an LDAP server configuration, you can log on even if the hostname does not match. With this fix, the hostname is checked when the option is enabled.
  [From Build 53.22]
  [# 681888, 644099]

• NetScaler fails to perform SAML Single Logout, if NetScaler is configured for SAML Authentication with an Identity Provider (IdP) that sends session index of 64 bytes. If the session index is less than 64 bytes, Single Logout is performed as expected.
  [From Build 51.24]
  [# 683429]

• If external LDAP authentication uses a case-insensitive user name, NetScaler AAA is unable to lock the user name after the number of attempts specified by the Max Login Attempts parameter.
  [From Build 53.22]
  [# 683645]

• Client logons are delayed by 15 seconds if Kerberos Constrained Delegation (KCD) is used on a NetScaler appliance. The delay occurs during the process of issuing a Kerberos ticket to the client.
  [From Build 51.24]
  [# 683869]

• In some cases, authentication on a NetScaler appliance fails, when a certificate on an RDP listener is not properly bound even if the certificate is bound on the VPN virtual server.
  [From Build 57.24]
  [# 683992]

• In rare scenarios, NetScaler dumps core if dialogue mode operation like password change operation happens during RBA authentication.
  [From Build 51.24]
  [# 684648]

• If a NetScaler appliance configured for SAML Identity Provider (IdP) contains AAA.USER.GROUP_as_xml() attribute in the “samlIdPProfile” command, an extra AttributeValue tag is getting opened.
  [From Build 58.18]
  [# 686070]

• If an assertion is sent twice from the same browser, a NetScaler authentication virtual server configured by using SAML authentication returns a 404-error message.
  [From Build 56.20]
  [# 686810]

• In some authentication modes, a NetScaler appliance configured for NetScaler AAA becomes unresponsive if a “Max Login Attempt” value is configured on an authentication virtual server.
  [From Build 51.24]
  [# 688463]

• A NetScaler appliance can add multiple NetScaler AAA groups, but the “save config” operation saves only the first group.
  [From Build 53.22]
  [# 689212, 689457]

• A NetScaler appliance configured for NetScaler AAA becomes unresponsive during a VPN session if both of the following conditions are met:

  • The primary session is in the timed out state.

  • The secondary session is in sync but the actual state of the session is reset to zero.
  [From Build 53.22]
  [# 690468]

• In some cases, a NetScaler appliance becomes unresponsive if either or both of the following conditions are met:

  • The SSO and Proxy are configured

  • The authentication request is a POST method
  [From Build 56.20]
  [# 691795]

• A NetScaler Gateway might occasionally become unresponsive if the following set of conditions are met:

  • The static text string is configured in the webAuthAction parameter.

  • The webAuthAction action is updated or removed after using at least once.
  [From Build 56.20]
  [# 693241]

• A NetScaler appliance configured for forms single sign-on (SSO) to back end adds whitespaces at the end of URL and before HTTP version.
  [From Build 56.20]
  [# 694433, 686735]

• In the SAML LogoutRequest parameter, the attributes SPNameQualifier and NameQualifier are missing from the NameID element when a SAML Service Provider (SP) receives an assertion from SAML Identity Provider (IdP).
  [From Build 56.20]
  [# 695087]

• If the HTTPOnly flag is not set on the NSC_TASS cookie of NetScaler AAA, the script allows you to access an application. With this fix, the script is unable to read NSC_TASS cookie.
  [From Build 56.20]
  [# 695118]

• If the initial request to the traffic management virtual server is an unauthenticated POST request, the NetScaler appliance configured for NetScaler AAA, disregards the post body.
  [From Build 56.20]
  [# 695703]

• A NetScaler appliance configured for NetScaler AAA might become unresponsive when trying to single sign-on (SSO) with a backend server, because the front-end loses the connection.
  [From Build 56.20]
  [# 695764]

• In a high availability (HA) setup, a NetScaler appliance configured for NetScaler AAA might become unresponsive if it tries to communicate with an SSL backend server through a proxy server, by using a Clientless Virtual Private Network (CVPN).
  [From Build 58.18]
  [# 696158, 710057]

• If a SAML Identity Provider (IdP) sends a namespace for a digital signature and if the namespace is not within the signedInfo or signature parameters, the NetScaler appliance configured for SAML Service Provider (SP) rejects the namespace assertion and the signature validation fails.
  [From Build 56.20]
  [# 697392]

• A NetScaler appliance configured for NetScaler AAA might become unresponsive when it accesses a NULL pointer.
  [From Build 57.24]
  [# 698595]

• If single sign-on credentials are enabled in authentication loginschema, a NetScaler appliance might miss executing NetScaler AAA session policy bind to a particular user after nFactor authentication.
  [From Build 57.24]
  [# 698752]

• If a NetScaler appliance configured for SAML has a password that is not authenticated by Active Directory (such as RADIUS password), you cannot access Citrix StoreFront by using single sign-on.
  [From Build 57.24]
  [# 698830]

• If a SAML LogoutResponse parameter does not contain destination attribute in a SAML Identity Provider (IdP), the logout request might fail on a SAML Service Provider (SP).
  [From Build 57.24]
  [# 699475]

• A NetScaler appliance configured for NetScaler AAA by using advanced authentication policies over a VPN session might become unresponsive if both of the following conditions are met:

  • The connection is initiated from LAN to a client by using assigned Intranet IP (IIP).

  • The default authorization action is denied.
  [From Build 57.24]
  [# 699513]

• The NetScaler appliance configured for NetScaler AAA might become unresponsive if the following conditions are met:

  • The check did not happen to verify that the user group is NULL before freed.

  • Access to memory is violated.
  [From Build 58.18]
  [# 699781, 707898]

• The NetScaler appliance is unable to handle the authentication request if the client sends the request again after the authentication server has already generated the response.
  [From Build 58.18]
  [# 701201]

• The NetScaler appliance configured for NetScaler AAA rejects the authentication if both of the following conditions are met:

  • The client certificate authentication is used for logon.

  • The certificate revocation list (CRL) check fails even though the checks are configured as optional.
  [From Build 59.8]
  [# 701206]

• In case of multiple cascades, if the user is applied with only first authentication policy, the NetScaler appliance sends an incorrect authentication feedback.
  [From Build 57.24]
  [# 701290]

• Client authentication fails if a NetScaler appliance deployed for Microsoft InTune Network Access Compliance (NAC) sends an invalid token.
  [From Build 58.18]
  [# 702834]

• A NetScaler appliance configured for NetScaler AAA might become unresponsive while validating many incoming Kerberos authentication requests.
  [From Build 58.18]
  [# 702907]

• In a high availability setup, after SAML authentication is complete at the service provider side, the secondary node becomes unresponsive during failover.
  [From Build 58.18]
  [# 703294, 705102, 705445, 706530, 708085]

• In a high availability setup, after SAML authentication is complete at the service provider side, the secondary node becomes unresponsive during failover.
  [From Build 57.24]
  [# 703294, 705102, 705445, 706530]

• A NetScaler appliance does not attempt SSO when you configure client certificate authentication but client always sends basic authorization header.
  [From Build 58.18]
  [# 703466]

• A NetScaler appliance configured for SAML Service Provider (SP) might intermittently fail to validate the incoming assertion.
  [From Build 58.18]
  [# 703818]

• In rare cases, a high availability setup NetScaler appliance might become unresponsive after AAA session is established.
  [From Build 58.18]
  [# 704253, 707125, 710266, 709557]

• In rare cases, a high availability setup NetScaler appliance might become unresponsive after AAA session is established.
  [From Build 59.8]
  [# 704253, 707125, 710266, 709557]

• The loginSchema policy in NetScaler AAA does not allow SSL expressions.
  [From Build 58.18]
  [# 704497]

• In a high availability setup, with NetScaler AAA sessions on a NetScaler appliance might become unresponsive during an upgrade from earlier release 11.1 build 57.11 to release 11.1 build 58.x. To overcome this issue, and before upgrading, follow the steps given below:

  1. Disable HA sync on both primary and secondary nodes, using the command set ha node –hasync disabled. Do not disable “ha prop.”

  2. Disable the ICA parameter using the command “set ica parameter -enableSRonHAFailover no”

  3. Save the configuration.

  4. Proceed with the 11.1 build 58.13 upgrade on secondary. Do not run the “force failover” command.

  5. Upgrade the primary node and execute the “force failover” command.

  6. Enable the HA sync on both primary and secondary nodes, using the command “set ha node –hasync enabled.”

  7. Enable the ICA parameter “set ica parameter -enableSRonHAFailover yes.”

  8. Save the configuration.

  Note: During an upgrade, the state information from primary to secondary is not synched and there might be some traffic disruption. Citrix recommends performing the upgrade in a special maintenance window.
  [From Build 58.18]
  [# 705349, 708016, 709217]

• In a high availability setup, a NetScaler appliance with active AAA sessions becomes unresponsive. The issue occurs when you upgrade the appliance from release 11.1 build 57.13 to later releases.
  [From Build 59.8]
  [# 705349, 708016, 709217, 715506, 712326]

• A NetScaler appliance is unable to evaluate an advanced policy expression if you either bind the policy to a virtual server or to an AAA group.
  [From Build 58.18]
  [# 705898]

• A NetScaler appliance is unable to evaluate an advanced policy expression if you either bind the policy to a virtual server or to a NetScaler AAA group.
  [From Build 59.8]
  [# 705898]

• A NetScaler appliance becomes unresponsive because of memory corruption when it handles jumbo frames.
  [From Build 59.8]
  [# 705972, 712490, 711718, 698974, 714419, 712489, 715399]

• A NetScaler appliance configured for NetScaler AAA to protect traffic management resources might leak memory and becomes unresponsive.
  [From Build 58.18]
  [# 706190, 706270, 707244, 707722, 707504, 707589]

• If you use certificate authentication method in the nFactor authentication, users observe, “401 unauthorized” error and the NetScaler appliance fails to authenticate the NetScaler AAA request.
  [From Build 58.18]
  [# 706250, 707798, 704500]

• If you use certificate authentication method in the nFactor authentication, users observe, “401 unauthorized” error and the NetScaler appliance fails to authenticate the NetScaler AAA request.
  [From Build 57.24]
  [# 706250]

• A NetScaler appliance configured for NetScaler AAA might become unresponsive if you attempt to free the already freed VPN session.
  [From Build 58.18]
  [# 706414]

• In rare cases, a NetScaler appliance might become unresponsive if the following conditions are met:

  • The memory location is corrupted.

  • The NetScaler AAA daemon fails due to unsafe access.
  [From Build 58.18]
  [# 706713]

• The NetScaler appliance might fail to establish an SSO connection to a back-end server, if the form-SSO has a hidden value containing special characters such as &, <, >, and ‘.
  [From Build 59.8]
  [# 707018]

• A NetScaler appliance configured for nFactor authentication might become unresponsive if both of the following conditions are met:

  • NetScaler Gateway uses an external SAML server for logon.

  • Additional authentication factor after SAML.
  [From Build 58.18]
  [# 707134]

• The SAML assertion verification might fail on a NetScaler appliance during SAML authentication.
  [From Build 58.18]
  [# 707237]

• A NetScaler appliance might become unresponsive if the following conditions are met:

  • NetScaler appliance is in dialogue mode.

  • Classic authentication policy is used.
  [From Build 58.18]
  [# 707604, 708908, 710627]

• A NetScaler appliance might crash if there is a configuration change in the system global bindings in-between the response time from NetScaler AAA daemon.
  [From Build 58.18]
  [# 707816]

• If you perform a nFactor EPA and change the configuration in the middle, a NetScaler appliance might become unresponsive.
  [From Build 58.18]
  [# 708100, 710507]

• If you perform a nFactor EPA and change the configuration in the middle, a NetScaler appliance might become unresponsive.
  [From Build 59.8]
  [# 708100, 710507]

• A NetScaler appliance configured for NetScaler AAA does not expire a dialogue mode (NSC_DLGE) cookie, which causes issues for the next logon.
  [From Build 58.18]
  [# 708395]

• A NetScaler appliance might become unresponsive if the following conditions are met:

  - A user initiates logout through a traffic policy, and NetScaler appliance sends logout request to SAML IdP.

  - The SAML IdP does not respond to the RelayState parameter in the logout response message, which is sent from the NetScaler appliance.
  [From Build 59.8]
  [# 709370]

• A NetScaler appliance might become unresponsive if the following conditions are met:

  - User initiates logout through a traffic policy, and NetScaler appliance sends logout request to SAML IdP.

  - The SAML IdP does not respond to the RelayState parameter in the logout response message, which is sent from the NetScaler appliance.
  [From Build 58.18]
  [# 709370]

• The NetScaler appliance configured for NetScaler AAA might become unresponsive if the following conditions are met:

  • Cookie validation function decodes the NSC_BODY cookie, which reduces its length.

  • The decoded length is less than the minimum length.
  [From Build 58.18]
  [# 709401]

• The NetScaler appliance configured for NetScaler AAA might become unresponsive if the following conditions are met:

  • Cookie validation function decodes the NSC_BODY cookie, which reduces its length.

  • The decoded length is less than the minimum length.
  [From Build 59.8]
  [# 709401]

• In case of nFactor authentication, the extracted AAA group name from certificate-factor is concatenated with first extracted group from LDAP-factor without any delimiter.
  [From Build 58.18]
  [# 709794]

• In case of nFactor authentication, the extracted AAA group name from certificate-factor are concatenated with the first extracted group from LDAP-factor without any delimiter.
  [From Build 59.8]
  [# 709794]

• A NetScaler appliance might crash if there is a memory corruption due to a buffer overflow.
  [From Build 59.8]
  [# 710433]

• The NetScaler appliance might become unresponsive if both of the following conditions are met:

  • Login schema policy with reset action provokes the reset function to send reset packet, and then free it later.

  • The same packet is freed again, resulting in a duplicate packet free condition.
  [From Build 59.8]
  [# 710993]

• The request to the back-end server fails if the following conditions are met:

  • Request URL to the back-end server is encoded prior to establishing AAA session.

  • NetScaler appliance decodes the URL after log on.
  [From Build 58.18]
  [# 711287, 711806, 713423]

• The request to the back-end server fails if the following conditions are met:

  • Request URL to the back-end server is encoded prior to establishing authentication, authorization, and auditing session.

  • NetScaler appliance decodes the URL after log on.
  [From Build 59.8]
  [# 711287, 711806, 713423, 714336]

• A NetScaler AAA session observes an accounting error on the logout method.
  [From Build 59.8]
  [# 712813]

• In a rare case, a NetScaler appliance restarts if it tries to access a memory that was previously freed.
  [From Build 59.8]
  [# 714441, 715848, 715865]

• A NetScaler appliance configured as SAML Service Provider (SP) with artifact bindings occasionally return assertion replay when there is no replay.
  [From Build 59.8]
  [# 714920]

Admin Partitions

• When you access a partitioned appliance through the NetScaler GUI, the Dashboard does not display the "CPU vs. Memory Usage and HTTP Requests Rate" graph in the left pane.
  [From Build 51.24]
  [# 676700]

• WWhen you configure an administrative partition, validation of the partition's VMAC address might fail, causing the NetScaler appliance to crash.
  [From Build 41.24]
  [# 677765]

• When you configure an administrative partition, validation of the partition's VMAC address might fail, causing the NetScaler appliance to crash.
  [From Build 51.24]
  [# 677765]

• On a partitioned NetScaler appliance, the system memory counters are not updated properly unless they are cleared during partition deletion.
  [From Build 51.24]
  [# 681422, 682240]

• In rare cases, one of the partitions on a partitioned appliance does not get enough slots to send Gratuitous Address Resolution Protocol (GARP) messages for all its IP addresses on the network.
  [From Build 56.20]
  [# 692922]

• In a partitioned NetScaler appliance with Shared VLAN configuration, the incoming packets received on a shared VLAN and destined to a partition get dropped if the partition's partitioned MAC (PMAC) address is learnt from the NetScaler Bridge table.
  [From Build 58.18]
  [# 703325, 694214, 704386]

• In a rare scenario, the secondary appliance of a high availability setup fails during an HA force sync operation. The appliance fails because of a memory allocation failure in an admin partition.
  [From Build 58.18]
  [# 703522, 690223, 710986]

Analytics

• The NetScaler Gateway login page fails to load if you have enabled client side measurements in the AppFlow action.
  [From Build 57.24]
  [# 694892]

• In some cases, the NetScaler Gateway appliance dumps core during the authentication if the following conditions are met:

  - The NetScaler appliance is configured for nFactor authentication.

  - The Gateway Insight feature is enabled for the appliance.
  [From Build 59.8]
  [# 713011, 713168]

AppExpert

• When a NetScaler appliance receives a client request for evaluating a responder policy, it might not log the responder data. Before evaluation, the appliance sets the ns_auditlog_module_id global variable and uses the data for log processing. If during the evaluation you block the log action and wait for more data, and while you are waiting the appliance receives another client request to evaluate a different policy, the responder log data is not recorded for the responder module.
  [From Build 51.24]
  [# 687140]

AppFlow

• The NetScaler appliance crashes, dumps core, and restarts if a certificate is unbound from an SSL virtual server while an SSL transaction is in progress.
  [From Build 51.24]
  [# 679995]

• When ClientSide Measurements is enabled, and you access the NetScaler Gateway, then the Microsoft Internet Explorer browser displays an error.
  [From Build 51.24]
  [# 680567, 688758]

• A NetScaler appliance crashes and dumps core if an ECDSA certificate is bound to the SSL virtual server that processes an SSL transaction.
  [From Build 51.24]
  [# 683567, 686195]

• A NetScaler appliance does not generate AppFlow records if an action is set to RESET in an SSL or responder policy.
  [From Build 53.22]
  [# 685920]

• When both Logstream and IPFIX (AppFlow) collectors are configured on a NetScaler instance, NSBs leak while trying to send an IPFIX msg on a Logstream collector.
  [From Build 51.24]
  [# 687908, 686407]

• A NetScaler appliance might become unresponsive if an AppFlow action has client-side measurements enabled and the appliance receives a corrupted request.
  [From Build 56.20]
  [# 691229]

• A NetScaler appliance might become unresponsive if an AppFlow action has client-side measurements enabled and the appliance receives an HTTP server response before the full client request.
  [From Build 56.20]
  [# 692649]

• In a NetScaler appliance, the Appflow data does not include values for TCP parameters such as SACK enabled, WS Factor, and RST Ended. As a result, AppFlow consumers do not receive data to make use of these parameters.

  - SACK enabled

  - WS Factor sent by NS

  - RST Ended
  [From Build 58.18]
  [# 703437]

• When client side measurement option is enabled in a AppFlow action, in certain scenarios, a response of size greater than 16 MB fails to load.
  [From Build 58.18]
  [# 704293]

• The NetScaler appliance crashes while exporting data to SSL insight if both of the following conditions are met:

  -AppFlow is enabled.

  -You update or unbind an SNI certificate during the SSL transaction.
  [From Build 58.18]
  [# 704352, 706626, 708996, 706397]

• When Client Side Measurements is enabled and the AppFlow feature is disabled with the transaction running, NetScaler appliance fails to respond.
  [From Build 58.18]
  [# 704480, 706076, 706079]

• An issue observed in MSISDN reporting logic causes AppFlow records to incorrectly populate the same MSISDN value for concurrent connections of different subscribers. The issue resulted in a potential memory leak on an HTTP virtual server.
  [From Build 58.18]
  [# 705879]

Application Firewall

• On a NetScaler appliance running release 11.1 build 64, SQL and cross-site scripting relaxations might not work for application or json content types. The AppFW logs display the following message, even when the relaxation rules are applied for User-Agent:

  SQL Keyword check failed for header User-Agent.
  [From Build 51.24]
  [# 651054]

• A large number of DHT operations causes high CPU usage when StartURLClosure is enabled. Packet per engine (PPE) operations consume over 95% of the CPU cycles after an upgrade to NetScaler 11.1.
  [From Build 51.24]
  [# 672807, 672753]

• Form based NetScaler AppFirewall checks can be bypassed by a multipart POST request in which the Content-type header has been tampered with.
  [From Build 51.24]
  [# 674658]

• The NetScaler AppFirewall appliance crashes while copying form data if the form field consistency check is enabled.
  [From Build 51.24]
  [# 678297, 689073]

• A NetScaler appliance running release 11.1 and build 52 might fail because of a mismatch during memory allocation and display the following error message:

  userspace_panic as_free().
  [From Build 51.24]
  [# 681746, 683564, 684632]

• Since release 11.1 build 41, the ImportSizeLimit parameter in the AppFW settings can be set to limit the size of the objects that are imported to the NetScaler appliance. This limit is now extended from 128 MB to 256 MB. Execute the following set command from the CLI to change the value to meet your requirement:

  set appfw setting -importsizelimit

  Maximum value: 268435456

  Minimum value: 1

  Default: 134217728

  Example

  > set appfw setting -importsizelimit 268435457
  [From Build 51.24]
  [# 682219]

• The application firewall signature-update warning messages are not delivered in standard syslog message format. Therefore, NetScaler MAS does not process them. The warning messages do not include the module name or a time stamp, both of which are part of the syslog standard. Signature update messages are also not in standard syslog format.
  [From Build 51.24]
  [# 682416]

• Applying cross-site scripting checks to complete URLs causes applications to stop after an upgrade. With this fix, cross-site scripting checks run only on the URL's base path if the CrossSiteScriptingCheckCompleteURLs option is enabled in the AppFw profile.
  [From Build 51.24]
  [# 682770]

• Application firewall log messages generated when data is dropped because of Unknown Content-Type do not include the Content-Type Header value, which would facilitate tracking and monitoring.

  Feature: Application Firewall

  Application firewall log messages generated when data is dropped because of Unknown Content-Type do not include the Content-Type Header value, which would facilitate tracking and monitoring. The application firewall logs requests which have multiple charsets with same value in the content-type header.
  [From Build 51.24]
  [# 682778]

• On a NetScaler AppFirewall appliance, URL global pages cause memory buildup on the secondary node when the URL closure protection feature is enabled.
  [From Build 51.24]
  [# 683366]

• When you attempt to export learned data for an application firewall profile, the appliance fails because of improper initialization of a stack variable. The Aslearn process restarts continuously because of connection failure.
  [From Build 51.24]
  [# 684988]

• Traffic to a back-end application is blocked by the HTML cross-site scripting check when the profile type is XML. The cross-site scripting check fails for field with following tags; &lt;?xml version="Bad tag: ?xml" <blocked>.

  When you have cross-site scripting enabled, the application firewall makes the following changes to requests that match the HTML Cross-Site Scripting check:

  Left angle bracket (<) to HTML character entity equivalent (&lt;) Right angle bracket (>) to HTML character entity equivalent (&gt;) This prevents browsers from interpreting unsafe html tags, such as <script>, and thereby executing malicious code. If you enable both request-header checking and XSS transformation, any special characters found in request headers are also modified as described above. If scripts on your protected web site contain cross-site scripting features, but your web site does not rely upon those scripts to operate correctly, you can safely disable blocking and enable transformation. This configuration allows legitimate web traffic while stopping any potential cross-site scripting attacks.
  [From Build 51.24]
  [# 685775]

• If you use the CLI of a NetScaler AppFirewall appliance to display an enum definition, the AS_CCARD_DEFAULT_CARD_TYPE default value for credit card options is not included.
  [From Build 53.22]
  [# 686540]

• If you use the CLI of a NetScaler AppFirewall appliance to display an enum definition, the AS_CCARD_DEFAULT_CARD_TYPE default value for credit card options is not included.
  [From Build 56.20]
  [# 686540]

• The NetScaler packet processing engine fails to start when URL transform regression scripts are executed during a low-memory condition.
  [From Build 51.24]
  [# 687625]

• The NetScaler appliance crashes when security insight is enabled and the application firewall detects a violation of the maximum limit for fld_name length.

  Set the fld_name length limit to the same value as MAX_AS_NAME_LEN.
  [From Build 53.22]
  [# 690028, 690556, 690467]

• After an upgrade from an earlier release 11.0 build to release 11.1 build 55.4, the 'APPFW_RESET' and 'APPFW_DROP' AppFw profiles do not appear when you run the sh appfw profile command with the "more" option.

  For example:

  sh appfw profile | more

  1) Name: APPFW_BYPASS LogEveryPolicyHit: OFF

  2) Name: APPFW_RESET LogEveryPolicyHit: ON

  3) Name: APPFW_DROP LogEveryPolicyHit: ON

  4) Name: APPFW_BLOCK UseHTMLErrorObject: OFF

  This issue does not occur after upgrading a NetScaler AppFirewall appliance to release 11.1 build 55.8.
  [From Build 53.22]
  [# 690261, 689327]

• A NetScaler Application Firewall appliance running release 10.5 build 66.6, 11.0, or 11.1 fails because of a packet-engine crash while applying an AppFirewall policy to the load balancing virtual server.
  [From Build 57.24]
  [# 691211, 692817, 695869, 701193, 691219, 700413]

• A NetScaler AppFirewall appliance running release 10.5 build 66.6, 11.0, or 11.1 fails because of a packet-engine crash while applying an AppFirewall policy to the load balancing virtual server.
  [From Build 57.24]
  [# 691219]

• A NetScaler AppFirewall custom signature request for field name value parsing does not clear the field name pattern match buffer.
  [From Build 56.20]
  [# 691268]

• The Application Firewall auto-update feature does not work and the ‘https://s3.amazonaws.com/NSAppFwSignatures/SignaturesMapping.xml" file fails to download.
  [From Build 57.24]
  [# 692155]

• In some cases, when a credit card number is split across multiple packets, the learned data rules of a NetScaler application firewall report incorrect credit card information.
  [From Build 56.20]
  [# 692814]

• On a NetScaler application firewall appliance in a high-availability mode, the DUT might crash when performing application security check because of memory resource constraints for the NetScaler appliance.
  [From Build 56.20]
  [# 694195]

• If a signature rule is configured on POST body with the content-type “application/xml”, the NetScaler application firewall appliance might not apply the associated rule actions to a traffic even after the rule matches the traffic.
  [From Build 56.20]
  [# 694727]

• On a NetScaler AppFW profile, when the charset is set to Japanese(SJIS), enabling SQL transform on AppFW profile transforms Japanese data containing Yen symbols
  [From Build 56.20]
  [# 694764]

• Application firewall truncates html error page response, if the configured html error page is more than 8 KB in size.
  [From Build 57.24]
  [# 695591]

• The error message “Cannot deploy CSS relaxation with empty value” appears when you attempt to deploy CSS learned rules with value type as "$" on a NetScaler application firewall appliance.
  [From Build 56.20]
  [# 695903]

• On a NetScaler appliance, traffic is impacted due to high bandwidth utilization when binding AppFW policy to the load balancing virtual server.
  [From Build 58.18]
  [# 698026, 699863, 705637, 706371, 708954]

• When the cookie proxy feature is enabled, the NetScaler application firewall appliance might crash while updating cookies.
  [From Build 57.24]
  [# 698829]

• After an upgrade, the Form Field Consistency Check blocks content even if the AppFW policy rules are properly configured.
  [From Build 58.18]
  [# 698952]

• The NetScaler appliance crashes when the Application Firewall feature is enabled.
  [From Build 58.18]
  [# 699165, 700528, 706388, 706342]

• After an upgrade, the NetScaler appliance enabled with the application firewall feature crashes and dumps core memory.
  [From Build 58.18]
  [# 699564, 703832, 700422, 706353, 704910, 708919, 710243]

• The NetScaler application firewall allows SQL injection attack if the Content-Type of the HTTP header is modified.
  [From Build 58.18]
  [# 700289]

• NetScaler appliance resets the HTTP connection and does not upload large files when application firewall is configured.
  [From Build 58.18]
  [# 701164, 702124]

• While viewing logs for the NetScaler AppFW profile for a particular security check, the NetScaler GUI Syslog Viewer does not apply the following filters:

  "Module" as "APPFW"

  "Event Type" as APPFW Security Check.

  Instead, the Syslog Viewer displays all logs from the ns.log file.
  [From Build 58.18]
  [# 701297]

• The application firewall referer header check fails even after you manually add the referer URL to the relaxation rule.
  [From Build 58.18]
  [# 701604]

• The HTML response page does not render properly if you enable URL transformation, and if the page attribute values contain non-breaking space ("&nbsp").
  [From Build 59.8]
  [# 703641]

• In the NetScaler Application Firewall GUI, the newly added counter in the Imports tab does not correctly retrieve the imported files because the entries for the imported objects require additional processing. The Application Firewall now allows you to import and perform additional processing in order to produce the correct number of file entries.
  [From Build 58.18]
  [# 704430]

• When you deploy CSRF learned rules from the application firewall GUI, the rules do not get deleted and the following error "The CrossSiteRequestForgery check is already in use" is displayed if you try to redeploy the rules.
  [From Build 59.8]
  [# 704487]

• NetScaler software release 12.0 had a restriction to import with multiple <injection> or <xss> in the signature files. As a result, importing or upgrading signatures files earlier to NetScaler 12.0 failed. With this fix, the restriction on importing or upgrading the signature files is removed.
  [From Build 57.24]
  [# 706071]

• NetScaler software release 12.0 had a restriction to import with multiple <injection> or <xss> in the signature files. As a result, importing or upgrading signatures files earlier to NetScaler 12.0 failed. With this fix, the restriction on importing or upgrading the signature files is removed.
  [From Build 58.18]
  [# 706071]

• A high availability setup that has an application firewall profile with starurl closure enabled, experiences high CPU usage and system failover. The issue occurs if response pages contain many URLs.
  [From Build 59.8]
  [# 706088, 706156, 713509]

• After a software upgrade, the NetScaler appliance crashes due to memory allocation failure when the Application Firewall feature is enabled.
  [From Build 58.18]
  [# 706607]

• When you attempt to add an expression under Signature Rules Pattern in the Signature Editor, the expression is not displayed in the Name (Expression) field. The rule pattern option is reverted to Any. The same behavior is observed even if you select the URL or Name options, and specify an expression.
  [From Build 58.18]
  [# 706637]

• After an upgrade to NetScaler release 12.0 version 57 build 19, the GUI fails to display the AppFW Learned Data, and the following error message appears.

  Invalid filter in query parameters
  [From Build 57.24]
  [# 707907]

• The leading TCP window size is rounded off when the post body limit is set to 4294967295(2^32-1). The fix ensures that the limit max TCP window set by Application Firewall is 100 MB in non-streaming data and 20 MB for streaming data.

  As a workaround, please add the post body limit on profile to values <=512MB, preferably to value 100MB. Also when requests are of larger sizes, please ensure that the profile has streaming enabled. Enable streaming only if backend server is able to accept chunked requests.
  [From Build 58.18]
  [# 708394, 708678, 707955, 708851, 711014]

• When you use special characters in AppFW SessionCookieName, the AppFirewall policy resets website URLs. The issue is resolved, if you remove special characters and use alphabets in the cookie name.
  [From Build 59.8]
  [# 708601]

• After an upgrade to NetScaler 11.1 build 57.13, the URL transformation policy for cookie domains is not applied to application secure cookies.
  [From Build 59.8]
  [# 708975]

• A NetScaler appliance crashes if you canonicalize (percent-decoding & other normalizations) header names and values only once instead of multiple times before running Application Firewall signature protections.
  [From Build 59.8]
  [# 709465, 710841, 713841]

• After a software upgrade, the NetScaler appliance crashes with AppFW violation data record when the AppFlow feature is disabled.
  [From Build 59.8]
  [# 710491]

• A NetScaler appliance crashes if you canonicalize (percent-decoding & other normalizations) header names and values only once instead of multiple times before running Application Firewall signature protections.
  [From Build 59.8]
  [# 710596]

• After an upgrade, if Applicable Firewall is enabled on a NetScaler appliance, it causes memory leak leading to a high memory usage.
  [From Build 59.8]
  [# 712290, 711993, 715276]

• After an upgrade, if Applicable Firewall is enabled on a NetScaler appliance, it causes memory leak leading to a high memory usage.
  [From Build 58.18]
  [# 712290, 711993]

CLI

• If a user tries to log on to a NetScaler appliance through any console, the system displays a log message with an incorrect client type. For example, if the user logs on to the appliance through the XenServer console, the system displays the log message as follows:

  "Apr 9 12:27:02 <local0.info> 10.102.201.11 04/09/2018:06:57:02 GMT 0-PPE-0 : d

  efault UI CMD_EXECUTED 502 0 : User nsroot - Remote_ip 127.0.0.1 - Command "log

  in nsroot "********"" - Status "Success"
  [From Build 59.8]
  [# 701582]

Cache Redirection

• Counters for classic cache redirection policies are not incremented for HTTPS traffic.
  [From Build 56.20]
  [# 657190]

• The NetScaler appliance crashes if both of the following conditions are met:

  - You have configured a reverse content switching or a cache redirection virtual server and specified a target load balancing virtual server with *: 80

  - You have bound a map policy to the virtual server
  [From Build 58.18]
  [# 701363]

• The NetScaler packet processing engine might crash when both of the following conditions are met:

  - The NetScaler appliance is configured as a forward proxy.

  - A request is made to an invalid IP address.
  [From Build 58.18]
  [# 707795]

NetScaler SDX Appliance

• The VPX instance restarts by itself in the following case.

  - You change the admin profile associated with a NetScaler VPX instance with channel configuration; and

  - The NetScaler VPX instance is running on NetScaler SDX 26XXX and 15XXX appliances.
  [From Build 59.8]
  [# 714041]

Unified Gateway

• When IPv6 is disabled globally, the connection reset is mandated, if the IPv6 packet arrives on MUX channel.
  [From Build 59.8]
  [# 709903]

• If StoreFront is load balanced using an internal load balanced virtual server, IPv6 clients is not evenly load balanced.
  [From Build 59.8]
  [# 710351]

• Authentication fails when Unified Gateway is configured with advanced policies, that is nFactor, and the client is configured only for certificate authentication.
  [From Build 59.8]
  [# 710801]

NetScaler Secure Web Gateway

• Support for new SWG platforms

  NetScaler Secure Web Gateway (SWG) is supported on Citrix SWG MPX 5900/8900 and Citrix SWG SDX 8900 platforms.

  For more information, see https://docs.citrix.com/en-us/netscaler-secure-web-gateway/12-1/supported-hardware-software-platforms.html.
  [From Build 58.18]
  [# 704727]

Clustering

• When secure connection is enabled on CCO, config sync doesn't work.
  [From Build 51.24]
  [# 525671]

• The NetScaler appliance might fail to reestablish a connection if both of the following conditions are met:

  • The policy engine (PE) receiving the traffic is in the DOWN state.

  • The NetScaler buffer (NSB) is kept on hold by a recovery mechanism.
  [From Build 53.22]
  [# 685979, 687732]

• In a layer 3 cluster deployment, fragmented traffic steered through a GRE tunnel might cause packet loops, which result in high traffic load.
  [From Build 58.18]
  [# 692350]

• If a node in layer 2 cluster deployment does not receive jumbo frames, the NetScaler appliance displays a warning error message “Jumbo frames are not supported on this node. To support jumbo frames, set the MTU for interfaces of the backplane switch to greater than or equal to 1,532 bytes”.
  [From Build 58.18]
  [# 705457]

Content Switching

• In some cases, the NetScaler appliance might fail after a set command is run on a content switching virtual server.
  [From Build 53.22]
  [# 687467, 688523, 688071, 692366, 693777]

DNS

• In a cluster setup, the default DNS policy is not made available to packet engines. With this fix, the default DNS policy is loaded into the packet engine.
  [From Build 51.24]
  [# 669829]

• If a NetScaler appliance receives a CNAME chain that includes some entries that are currently cached, the appliance returns a valid address record instead of reporting that the bailiwick check failed.
  [From Build 51.24]
  [# 675553]

• When a NetScaler appliance in resolver mode receives a DNS response from a name server and forwards it to an alternative name server, the NetScaler appliance goes DOWN.
  [From Build 51.24]
  [# 682730, 683138, 680141]

• The NetScaler appliance returns incorrect NODATA responses for records that are configured by using the NetScaler CLI and if DNS queries with EDNS Client Subnet Option are sent for such records.
  [From Build 56.20]
  [# 693310]

• When a NetScaler appliance receives a DNS query, the NetScaler appliance does not forward the query to the back-end server. Instead, the appliance responds with a SERVFAIL error.
  [From Build 56.20]
  [# 693315]

• If the response to a proactive update contains an invalid query ID from the back-end service, the NetScaler appliance handles this response erroneously. A subsequent response with a valid query ID results in the appliance crash.
  [From Build 58.18]
  [# 699318]

• The NetScaler appliance returns incorrect SERVFAIL responses for records that are configured by using the NetScaler CLI and if DNS queries with EDNS Client Subnet Option are sent for such records over a content switching virtual server.
  [From Build 57.24]
  [# 700049]

• While evaluating the responder policy, the primary virtual server and the policy bound to the primary virtual server are always used, irrespective of the state of the primary virtual server.
  [From Build 58.18]
  [# 700813]

• The NetScaler appliance crashes when the following conditions are met:

  - The NetScaler appliance is configured as a Forwarder.

  - For a particular domain name and CNAME record type, the appliance returns a NODATA response and the response is cached.

  - Subsequent queries are sent to the same domain name and any other record type.
  [From Build 57.24]
  [# 701051]

• The NetScaler appliance might crash if DNS logging is enabled and a service is directly accessed through the NetScaler.
  [From Build 58.18]
  [# 702087]

• A NetScaler appliance crashes when negative responses for root domain are cached.
  [From Build 59.8]
  [# 710624]

DataStream

• The NetScaler appliance sends an incorrect version (MSSQL 2012) for the MSSQL version 2014 load balancing configuration.
  [From Build 58.18]
  [# 686388]

• The NetScaler appliance might fail and dump core memory if a load balancing virtual server of type ORACLE is configured with SOURCEIP persistence.
  [From Build 57.24]
  [# 700294]

Front End Optimization

• The NetScaler appliance dumps core when the front end optimization (FEO) feature is enabled for one virtual server and an AppFlow action with client-side measurement is enabled for another virtual server.
  [From Build 51.24]
  [# 686146]

GSLB

• When a remote GSLB service is configured with an external monitor on a GSLB site node, the state of this service might become inconsistent across packet engines, because of core-to-core message failures. In that case, the NetScaler appliance might generate incorrect replies to GSLB domain queries.
  [From Build 56.20]
  [# 658108, 679822, 692324, 692737, 695765]

• In a new cluster deployment or when the NetScaler firmware in a cluster deployment is upgraded to build 11.1-53.11, management CPU usage spikes to up to 99% on every cluster node. This issue occurs in the absence of any additional configuration, management, or data traffic.
  [From Build 41.24]
  [# 682766, 683601, 685391]

• In a new cluster deployment or when the NetScaler firmware in a cluster deployment is upgraded to build 11.1-53.11, management CPU usage spikes to up to 99% on every cluster node. This issue occurs in the absence of any additional configuration, management, or data traffic.
  [From Build 51.24]
  [# 682766, 683601, 685391]

• GSLB auto synchronization might fail if the GSLB virtual server's status appears different on the sites participating in GSLB.
  [From Build 56.20]
  [# 692943]

• When a responder policy with a rate limiting expression is bound to a DNS bindpoint, and DNS views are configured, the NetScaler appliance might fail to return an expected response to a GSLB domain query.
  [From Build 56.20]
  [# 696496]

• In a GSLB setup, uneven load balancing is observed when both of the following conditions are met:

  - The primary GSLB method is configured as Static Proximity with the backup method as Round Robin.

  - Multiple service location matches exist for multiple incoming requests.
  [From Build 58.18]
  [# 700134]

• If a large number of GSLB services are configured, a NetScaler appliance might fail to send MEP updates for some of the services if the TCP window is not available. The unavailability of TCP window can result in inconsistencies in the states of the GSLB services between GSLB sites.
  [From Build 58.18]
  [# 700614, 701735, 702307, 693765, 710204]

• If a large number of GSLB services are configured, a NetScaler appliance might fail to send MEP updates for some of the services if the TCP window is not available. The unavailability of TCP window can result in inconsistencies in the states of the GSLB services between GSLB sites.
  [From Build 57.24]
  [# 700614, 693765, 701735, 702307]

• In a GSLB setup, the NetScaler appliance might not provide correct responses based on the source IP address, if all the following conditions are met:

  DNS policy with DNS view as action is configured and bound globally.

  DNS policy with preferred location as action is configured and bound globally.

  DNS request is sent to an ADNS service that hits both these policies and policy evaluation is positive for both.
  [From Build 58.18]
  [# 701276]

• The GSLB service and GSLB service group honor the load balancing parameter monitorConnectionClose to terminate the monitor probes.
  [From Build 58.18]
  [# 701864]

• In a GSLB setup, the GSLB configuration sync operation is aborted when all of the following conditions are met:

  - NetScaler appliance is configured for GSLB in an admin partition.

  - The slave site is a high availability setup.
  [From Build 58.18]
  [# 703753]

• Metrics exchange protocol (MEP) between GSLB sites might flap in some cases if you enable the Secure option on the remote procedure call (RPC) node.
  [From Build 58.18]
  [# 707182, 707355, 709032, 708973, 710176, 709593]

• GSLB configuration synchronization failed because the "set ssl servicegroup"command was also synchronized. With this fix, the command is not synchronized. As a result, the GSLB configuration is synchronized successfully.
  [From Build 59.8]
  [# 709722]

• You might find GSLB service state inconsistencies among the cores when the MEP connection goes DOWN and the connection is back UP within a short time.
  [From Build 59.8]
  [# 712842, 712454]

GUI

• An issue occurs in the NetScaler GUI if you attempt to edit an authentication policy bound to an AAA group. For example, if you have three policies, auth pol1, auth pol2, and auth pol3 bound to AAA group and if you select auth pol3 to edit the policy details, the system opens the auth pol1 policy page.
  [From Build 58.18]
  [# 707017]

• A NetScaler appliance might crash if some entity names in the database have quotations and if a closing quotation is found missing. The issue is resolved if you upgrade your appliance to the latest version.
  [From Build 59.8]
  [# 707993]

Gateway Insight

• Receivers which are not white-listed fail to launch apps using NetScaler Gateway with HDX Insight feature enabled.
  [From Build 58.18]
  [# 710678, 712929]

• Receivers which are not white-listed fail to launch apps using NetScaler Gateway with HDX Insight feature enabled.
  [From Build 59.8]
  [# 710678, 712929]

• In some cases, the NetScaler Gateway appliance dumps core during the authentication if the following conditions are met:

  - The NetScaler appliance is configured for nFactor authentication.

  - The Gateway Insight feature is enabled for the appliance.
  [From Build 58.18]
  [# 713011, 713168]

Integrated Cache

• The NetScaler Integrated Cache might delay processing of client requests if you enable the flash cache.
  [From Build 51.24]
  [# 681664]

Integrated Caching

• When a request is sent and if the back-end server responds with a 301 status code, the cache stores the response meaning the URL is permanently moved and Cache is trying to serve range request. This causes the NetScaler appliance to crash.
  [From Build 41.24]
  [# 673506, 684404]

• The integrated cache does not have enough memory to accommodate the policy updates required when all policies bound to a content group have to be updated because of a change in the cache configuration.
  [From Build 51.24]
  [# 675025, 675504]

• If the response from the Integrated Caching (IC) module has trailing spaces in the content-length header, the HTTP/2 connection times out.
  [From Build 56.20]
  [# 688274]

• A NetScaler appliance might become unresponsive when the Integrated Cache (IC) module processes a byte range request for a large content.
  [From Build 57.24]
  [# 695002]

• The NetScaler appliance might fail to respond if the buffer size of a TCP profile is set to a high value with Integrated Caching (IC) being configured.
  [From Build 57.24]
  [# 695083]

• A NetScaler appliance might crash when stored static objects cause the buffer to overflow and overwrite the pointer to the adjacent buffer.
  [From Build 56.20]
  [# 696001, 697526, 696597, 697716, 697718, 697268, 697535, 698707, 700083, 700414]

• The NetScaler appliance might fail to respond when serving content from the Integrated Cache (IC) module.
  [From Build 57.24]
  [# 698208]

Licensing

• When the connection between a NetScaler appliance (MPX, SDX, or VPX) and the NetScaler MAS licensing server is lost, the NetScaler appliance revokes the licensing capacity immediately. As a result, the throughput drops.

  After the connection with the MAS licensing server is established, you must manually reconfigure the license to restore.
  [From Build 59.8]
  [# 712434]

Load Balancing

• The NetScaler appliance resets a client-side TCP connection if a virtual server with spillover (SO) persistence enabled is bound to the load balancing group. With this fix, the client-side TCP connection is not reset.
  [From Build 53.22]
  [# 589363]

• The NetScaler appliance crashes, because an issue in the internal timer logic in stream analytics causes the system to spend more time than expected for ageing tasks.
  [From Build 51.24]
  [# 672899]

• In a high availability (HA) setup, if domain-based services are configured and the secondary node does not receive any Service State Sync (SSS) update for the services for more than 247 days, a packet engine might crash when this node becomes the primary node.
  [From Build 53.22]
  [# 673446, 684550, 688305]

• A spillover trap might be sent even though a backup virtual server is not configured.

  With this fix, a spillover trap is sent only if one of the following conditions applies:

  - A spillover method or policy is configured.

  - No spillover method or policy is configured, but a backup virtual server is configured to accept the traffic when the primary virtual server is DOWN.
  [From Build 51.24]
  [# 679991]

• NetScaler: AAA-TM

  A cached ticket is expired before server receives it. This happens when a NetScaler is used as a kerberos SSO to backend servers. This usually happens just around the time ticket expires, which is typically 10 hours.
  [From Build 51.24]
  [# 681026]

• When you rename an HTTPS virtual server that is associated with an internal HTTP virtual server, the internal virtual server's name is not changed correctly.
  [From Build 51.24]
  [# 681559, 674427]

• The maximum string size of Target Vserver Expression is 1500. If the configuration includes an expression greater than 1500, the NetScaler appliance crashes. With this fix, the maximum string size of Target Vserver Expression is limited to 1499.
  [From Build 51.24]
  [# 684131]

• In a high availability (HA) setup, an unusually large spike in the number of persistent connections might result in underperformance of the Secure Socket Funneling (SSF) channel between the primary node and the secondary node. The underperformance can eventually lead to session buildup on the primary node and cause persistence to fail.
  [From Build 53.22]
  [# 685179, 684834]

• Resetting a server connection resets the connections to all services configured with the same IP address and port number. As a result, connections to the service group members are also reset. With this fix, deleting a service that has the same IP address and port number as that of other service group members does not affect the service group connections.
  [From Build 53.22]
  [# 685707]

• If an add lb monitor command specifies an httprequest argument value of more than 77 characters, a subsequent show command shows an incorrect httprequest value for the HTTP requests that the monitor sends to the CLIP address. The NetScaler appliance's ns.conf file also contains the incorrect httprequest value for the monitor. Also, the other nodes (non-CCO) in the cluster are updated with the incorrect httprequest value by the configsync process.
  [From Build 53.22]
  [# 685856, 687784]

• The RADIUS shared secret key is now an optional configuration for all RADIUS load balancing and RADIUS Listener deployments. All existing configurations continue to function as they did before.

  The validation of the RADIUS shared secret key happens in the following scenarios:

  - RADIUS shared secret key is configured for both the radius client and the radius server: The NetScaler appliance uses the RADIUS secret key for both the client side and the server side. If the verification succeeds, the appliance allows the RADIUS message to go through. Otherwise, it drops the RADIUS message.

  - RADIUS shared secret key is not configured for either the radius client or the radius server: The NetScaler appliance drops the RADIUS message, because shared-secret-key validation cannot be performed on a node that has no radkey configured.

  - RADIUS shared secret key is not configured for both the RADIUS client and the RADIUS server: The NetScaler appliance bypasses the RADIUS secret key validation and allows the RADIUS messages to go through.
  [From Build 51.24]
  [# 687326, 688713, 690164]

• In a cluster setup, you cannot disable a service group if there are no services bound to it.
  [From Build 58.18]
  [# 690943]

• The NetScaler appliance might crash if deletion of a service item and display of the service item are executed in parallel.
  [From Build 56.20]
  [# 691507]

• A packet engine crashes because of an invalid memory reference when memory allocation for Call ID persistence session fails. With this fix, the packet engine checks for memory allocation failure before accessing the persistence session.
  [From Build 56.20]
  [# 694655]

• The NetScaler appliance crashes if a delinked TCP connection is logged incorrectly.
  [From Build 56.20]
  [# 695326]

• In rare cases, if IPv6-IPv4 mapping is missing and persistence is enabled on the load balancing virtual servers, the secondary appliance might crash In a high availability setup.
  [From Build 58.18]
  [# 700152, 700343]

• The NetScaler packet processing engine crashes when both of the following conditions are met:

  - Delete a server bound to a node group without unbinding the associated service.

  - Access the service associated with the deleted server.
  [From Build 58.18]
  [# 704052]

• In a high availability setup, a condition of missing service group bindings and loss of configuration occurs if both of the following conditions are met:

  - A monitor is bound to a service group and that service group has no servers bound to it.

  - The service group that was added previously had a name longer than the current service group name.
  [From Build 58.18]
  [# 706636, 707655, 708598, 711604]

• In a high availability setup, a condition of missing service group bindings and loss of configuration occurs if both of the following conditions are met:

  - A monitor is bound to a service group and that service group has no servers bound to it.

  - The service group that was added previously had a name longer than the current service group name.
  [From Build 57.24]
  [# 706636, 707655]

• A NetScaler appliance crashes if you add a Rate-Limiting expression to a DNS responder policy.
  [From Build 58.18]
  [# 708722]

• Traffic disruptions might occur if the encoded redirect URL is greater than 2048 bytes.
  [From Build 59.8]
  [# 709311]

• If the REGISTER request processing for a specific service fails during the Session Initiation Protocol (SIP) call, the memory usage of the NetScaler appliance starts building up.
  [From Build 59.8]
  [# 710763]

• The following error message appeared after an incomplete response was received in response to a TCP-ECV monitor probe.

  “TCP Connection Established but Application timeout.” As a result, subsequent monitor probes failed.

  With this fix, the error message does not appear and subsequent probes pass.
  [From Build 59.8]
  [# 710807]

• The “Operation not permitted” error appears when you try to execute the set operation on domain name based service group member.
  [From Build 59.8]
  [# 712840]

Logstream

• Upgrading NetScaler MAS high availability pair might cause the system to fail.
  [From Build 58.18]
  [# 700450, 699829, 705447, 708847]

• Upgrading NetScaler MAS high availability pair might cause the system to fail.
  [From Build 57.24]
  [# 700450, 699829]

NITRO

• The .NET SDK GET call fails with the following exception if it is made with a parameter that accepts boolean values:

  Invalid argument value [<attribute>].

  Example:

  When the “internal” attribute of service_args is set to “true”, a get on service_args yields the following exception:

  Invalid argument value [internal]
  [From Build 53.22]
  [# 595938]

• If you make multiple NITRO API calls in parallel, the responses might return incorrect results.
  [From Build 53.22]
  [# 684543]

• Restarting a NetScaler appliance after upgrading it to release 12.0 might cause the appliance to fail to respond to NITRO requests.
  [From Build 53.22]
  [# 686434, 672544, 689415, 690265]

• In a partitioned NetScaler appliance, you can add authentication loginschemas with inbuilt schemas through the NetScaler command line interface only.

  To add authentication login schemas through the NetScaler CLI, use the switch partition command. For example:

  > switch partition p1

  Done

  p1> add loginSchema ls1 -authenticationSchema LoginSchema/DualAuth.xml

  Done
  [From Build 51.24]
  [# 687133]

• The Java NITRO SDK of the NetScaler release 12 build 56.20 does not include some feature modules, for example, Networking and SSL.
  [From Build 58.18]
  [# 702797]

NS-Gateway

• NetScaler: AAA-TM

  After an upgrade from an earlier release 10.5 build 60.7 to release 11.1 build 52.32, if the client sends an invalid basic authorization header as "Authorization: Basic (null)", then NetScaler appliance does not perform single sign-on (SSO) to access the backend.
  [From Build 53.22]
  [# 689265]

NetScaler 1000V Appliance

• TCP services that go through tagged VLAN interfaces might go down.
  [From Build 51.24]
  [# 683196]

NetScaler GUI

• Certificate bundles are not supported in cluster setups.
  [From Build 51.24]
  [# 644199]

• When using the XenApp and XenDesktop wizard, the Retrieve Stores functionality intermittently fails on the first click.
  [From Build 53.22]
  [# 655159]

• A NetScaler appliance might crash or become unresponsive if you restart the appliance when it is under memory stress.
  [From Build 56.20]
  [# 684653]

• The NetScaler GUI displays an integer value instead of a security rating (critical, important, moderate, or low) if you configure an End Point Analysis (EPA) scan for the windows update.
  [From Build 56.20]
  [# 694638]

• After an upgrade, the NetScaler GUI randomly displays the management usage of a NetScaler appliance as high.
  [From Build 58.18]
  [# 704054]

• In rare cases, a NetScaler appliance displays an ‘Error in retrieving Certificate-key pair. Unable to get property match of undefined or null reference’ error message if you update certkey from the Certificates tab.
  [From Build 58.18]
  [# 706444, 715207]

• HTML files imported to a NetScaler appliance cannot be edited after upgrading the appliance from release 12.0.56.20 to 12.0 57.19.
  [From Build 57.24]
  [# 706779]

• HTML files imported to a NetScaler appliance cannot be edited after upgrading the appliance from release 12.0.56.20 to 12.0 57.19.
  [From Build 58.18]
  [# 706779]

NetScaler Gateway

• The users connected to the NetScaler Gateway appliance are unable to ping each other using the Intranet IP (IIP).
  [From Build 59.8]
  [# 470679, 565941]

• The users connected to the NetScaler Gateway appliance are unable to ping each other using the Intranet IP (IIP).
  [From Build 58.18]
  [# 470679, 565941]

• When encryption is enabled for client security expressions (in the VPN session action parameter), the device might fail occasionally.
  [From Build 51.24]
  [# 607555, 616311]

• The NetScaler Gateway appliance dumps core intermittently while validating an STA ticket in FrameHawk channel, if either of the following conditions is met:

  - ICA Session Timeout is set ON in global settings.

  - An ICA policy is bound to the appliance.
  [From Build 58.18]
  [# 638859, 685618, 701704]

• Under the following set of conditions, the wrong error message appears:

  A VPN traffic action is configured with SSO OFF.

  A samlSSOProfile is configured.

  The user tries to set this samlSSOProfile to the VPN traffic action.
  [From Build 56.20]
  [# 643029]

• When HTTP Strict Transport Security (HSTS) is enabled on a virtual server and on a NetScaler appliance, the appliance adds an STS header to the response. An HSTS-enabled response advertises that the appliance accepts only HTTPS requests. It does not accept plain-text HTTP. This option prevents privacy leaks and downgrade attacks and uses trusted certificates to establish a secure connection to the server.

  When HSTS is enabled on a NetScaler appliance, a browser that supports HSTS does the following:

  - Automatically redirects the HTTP requests to HTTPS for the target domain. For example, http://example.com/some/page/ is changed to https://example.com/some/page/ before the appliance accesses the server.

  - Does not allow access to the server unless the connection is secure. For example, the server's TLS certificate must be valid, trusted, and not expired.
  [From Build 51.24]
  [# 654092]

• The NetScaler appliance becomes unresponsive if you change the NTLM path from HTTP to HTTPS.
  [From Build 51.24]
  [# 657633]

• The Certificate Revocation Lists (CRL) checks and Online Certificate Status Protocol (OCSP) validation are not done on a NetScaler appliance through an SSL renegotiation as part of certificate based authentication.
  [From Build 51.24]
  [# 658120, 684909]

• In rare cases, a NetScaler appliance dumps core if the server-side connection closes while NTLM Authentication is in progress..
  [From Build 51.24]
  [# 670062, 657633, 684467, 686139, 672074, 681078]

• When you run the "sh icaconnection summary" command, the columns in the output are misaligned.
  [From Build 51.24]
  [# 670277]

• Memory leak in SSLVPN pool is encountered when connection to AAAD daemon is closed at the time of authentication.
  [From Build 51.24]
  [# 670586, 683809, 671944]

• If you configure TACACS authentication in “password*OTP” format, and a user types an invalid credential, the following incorrect error message appears:

  Error in retrieving Versions. Cannot read property ‘replace’ of undefined.

  You can ignore the message.
  [From Build 51.24]
  [# 672001]

• With this enhancement, Storefront server can be used to validate user credentials instead of Active Directory server. This simplifies Gateway configuration in XA/XD deployments where StoreFront server is mandatory.

  This is applicable only for end user login with password. This feature cannot be used for group extraction without user password. Please check documentation for details.
  [From Build 51.24]
  [# 672398]

• User session exists on NetScaler appliance after client machine logs out of VPN because of SmartCard removal.
  [From Build 51.24]
  [# 675596]

• In rare cases, upon accessing NetScaler Gateway using Clientless Virtual Private Network (CVPN), NetScaler Gateway dumps core if SSO and Proxy are configured in Traffic policy.
  [From Build 51.24]
  [# 676545]

• In rare cases, upon accessing NetScaler Gateway using Clientless Virtual Private Network (CVPN), NetScaler Gateway dumps core if SSO and Proxy are configured in Traffic policy.
  [From Build 53.22]
  [# 676545]

• NetScaler Gateway dumps core in case SingleSignOn (SS0) is disabled and the connection to server is removed or gatetimeout happens during TCP handshake with the back-end server.
  [From Build 41.24]
  [# 678251]

• NetScaler Gateway dumps core in case SingleSignOn (SS0) is disabled and the connection to server is removed or gatetimeout happens during TCP handshake with the back-end server.
  [From Build 51.24]
  [# 678251]

• ShoreTel Sky Softphones do not work on Windows clients accessing enterprise VPN through NetScaler Gateway.
  [From Build 56.20]
  [# 678701]

• The NetScaler appliance dumps core when a user connected, through Unified Gateway, to a VPN virtual server bound to an AppFlow policy does the following:

  1. Changes the content switching (CS) action to connect to another VPN virtual server, which is not bound to an Appflow policy.

  2. Then removes the first VPN virtual server.

  3. Continues to access resources over the initial VPN session.
  [From Build 51.24]
  [# 678847]

• Intermittently, a NetScaler Gateway appliance dumps core if a connection is reset during data transfer between a client and a VPN server.
  [From Build 56.20]
  [# 678885, 674356, 676859, 676857, 684178, 692683]

• DTLS feature must not be enabled on a virtual server configured with "listen" policy. Using command "add vpn vser" on a virtual server with the DTLS feature enabled and "listen" policy configured returns success but the DTLS feature does not get enabled on the virtual server.
  [From Build 51.24]
  [# 679025]

• In rare scenarios, NetScaler dumps core while accessing virtual server information when the RDP traffic is handled by separate RDP listener on NetScaler and the virtual server information is not present.
  [From Build 51.24]
  [# 679360]

• In rare situations, the Windows plug-in fails during VPN session logout.
  [From Build 51.24]
  [# 679570]

• Upon accessing NetScaler Gateway using Clientless Virtual Private Network (CVPN), back-end sites take too long to open.
  [From Build 51.24]
  [# 679582]

• In rare cases, a NetScaler Gateway appliance in a Unified Gateway (UG) deployment dumps core if the traffic management (TM) virtual server behind the UG is configured for SAML with advanced policies and the content switching (CS) policies are not properly configured to route SAML responses to TM.
  [From Build 51.24]
  [# 679768]

• Intermittently, a NetScaler Gateway appliance becomes unresponsive when multiple STA servers are bound to VPN virtual server (or VPN global) and IPv6 communication protocol is used between client and Gateway virtual server in Gateway deployment with XenApp/XenDesktop.
  [From Build 57.24]
  [# 680435, 684833, 695681]

• If you log on to SharePoint 13 through a Clientless Virtual Private Network (CVPN) and the Gantt chart option under Tasks is selected, some of the options in the Tasks section (for example, Completed, and Late Task) are not accessible.
  [From Build 51.24]
  [# 681689]

• If Gateway is configured for certificate authentication in primary cascade with ldap group extraction in secondary, Gateway is disregarding errors from aaad when group extraction is attempted.
  [From Build 51.24]
  [# 681913]

• In rare scenarios, blue screen appears (BSOD) when NetScaler VPN plug-in is installed along with Pulse Secure plug-in.
  [From Build 51.24]
  [# 683009]

• If you log on to SharePoint 13 through a Clientless Virtual Private Network (CVPN), you can't access the "OneDrive" and "Sites" options on the home page if Clientless Mode URL Encoding is set to ENCRYPT.
  [From Build 51.24]
  [# 683390]

• In rare cases, the NetScaler appliance dumps core when a client sends a FIN event without an HTTP body.
  [From Build 51.24]
  [# 683452]

• HTML5 Receiver app launch fails while accessing a NetScaler Gateway bound with RfWebUI theme portal.
  [From Build 51.24]
  [# 683987]

• In rare scenarios, NetScaler Gateway dumps core if you have an SSL-Proxy configured at NetScaler Gateway and you access the intranet web application through a Clientless Virtual Private Network (CVPN) via Gateway that has proxy-authentication configured at proxy.
  [From Build 53.22]
  [# 684488]

• In rare scenarios, after rebooting the system, AlwaysON enabled VPN plugin fails to connect to Gateway.
  [From Build 51.24]
  [# 684709]

• When hundreds of users try to log on to NetScaler Gateway at about the same time, the logon page might stop loading, or it might load very slowly, in which case the logon process takes a very long time to complete.
  [From Build 51.24]
  [# 684774]

• Mail synchronization fails on iOS and Android devices if secure mail is configured to use secure ticket authority (STA).

  As written in the XenMobile Server known issue doc: http://docs.citrix.com/en-us/xenmobile/server/known-issues.html

  With NetScaler 12.0.41.16, when Secure Mail is configured with STA, mail sync fails on iOS and Android devices. The issue is fixed in NetScaler 10.0 build 41.22. For details and updates, see this Support Knowledge Center article. [#685075]
  [From Build 51.24]
  [# 685075]

• Mail synchronization fails on iOS and Android devices if secure mail is configured to use secure ticket authority (STA).
  [From Build 41.24]
  [# 685075]

• If you log on to SharePoint 13 through a Clientless Virtual Private Network (CVPN) and upload a form that has a post body exceeding 8 KB, NetScaler rewrite policies do not decode the form content beyond 8 KB.
  [From Build 51.24]
  [# 685215]

• In rare cases, a NetScaler Gateway appliance dumps core when the single-sign-on feature tries to access an authentication resource that has been removed.
  [From Build 51.24]
  [# 685389]

• A secure load balancing virtual server on a NetScaler appliance processes both secure and insecure cookies.
  [From Build 51.24]
  [# 685421]

• A secure load balancing virtual server on a NetScaler appliance processes both secure and insecure cookies.
  [From Build 56.20]
  [# 685421]

• In rare scenarios, NetScaler dumps core while binding Classic session polices to an existing binding entity, when you have multiple VPN policies configured to the NetScaler.
  [From Build 53.22]
  [# 685463, 670544, 691767]

• If you use the NetScaler Gateway plug-in for Windows, a simultaneous download of 128 or more files fails upon accessing NetScaler Gateway.
  [From Build 53.22]
  [# 685971]

• In rare situations, a NetScaler Gateway appliance dumps core if it receives incorrect SOCKS requests from clients.
  [From Build 53.22]
  [# 686160, 689726, 690771]

• The client detection logic for Citrix Receiver does not work in Firefox, because the browser no longer supports NPAPI plug-ins.
  [From Build 51.24]
  [# 686337]

• In a double-hop deployment, a NetScaler Gateway appliance intermittently dumps core when the first-hop server receives a TCP RST event from the second-hop server.
  [From Build 53.22]
  [# 686508]

• When a user configures a NetScaler appliance for SAML Authentication, duplicate apps appear on the home page if the RfWeb UI portal theme is bound to the appliance.
  [From Build 56.20]
  [# 686516, 660563]

• NetScaler Gateway does not comply with RFC7230 for POSTLOGINFLAGS headers.
  [From Build 53.22]
  [# 686632]

• The NetScaler Gateway VPN plug-in fails to launch when you enter the logon credentials by using Google Chrome browser if the post-auth End-point Analysis(EPA) functionality is enabled and the "Client Choices" option is disabled.
  [From Build 56.20]
  [# 686642]

• The NetScaler appliance fails to access the gateway home page after an upgrade to software release 11.1 build 51.21. The cause of the failure is the presence of an unexpected parameter (/ilearn).
  [From Build 51.24]
  [# 686715, 687092]

• Some traffic patterns cause application launch through NetScaler Gateway to fail if EDT is enabled on virtual desktop applications.
  [From Build 53.22]
  [# 686774, 686960, 687587]

• In rare cases, while accessing Gateway via proxy, NetScaler dumps core if KCD based Single Sign-On is attempted to back-end servers.
  [From Build 51.24]
  [# 686858]

• In rare situations, VPN plug-in installation fails and a "Citrix Access Gateway is not supported on this platform" error message appears on a machine running a 64-bit operating system.
  [From Build 51.24]
  [# 687139]

• The NetScaler appliance dumps core during Core2Core communication as resetting the TCP connection closes the connection without cleaning the connection structure.
  [From Build 51.24]
  [# 687211]

• The NetScaler Gateway plug-in incorrectly displays a “green bullet” icon suggesting a connected VPN virtual server session status even after the session is disconnected. The plug-in UI display is not in sync with the plug-in tray icon status.
  [From Build 56.20]
  [# 688111]

• The NetScaler appliance fails when it tries to authenticate an invalid incoming HTTP packet.
  [From Build 51.24]
  [# 688215]

• In rare situations, a NetScaler Gateway appliance dumps core when processing forms based SSO to URLs larger than 4 KB.
  [From Build 53.22]
  [# 688842]

• The NetScaler appliance deletes the JSESSIONID cookie from the HTTP request before sending the request to the origin server.
  [From Build 53.22]
  [# 689472]

• NTLM Single sign-on (SSO) fails because of invalid signature of type-3 NTLM message.
  [From Build 56.20]
  [# 689538]

• Both of the following issues are fixed:

  - A NetScaler Gateway appliance becomes unresponsive because the Gateway plug-in continuously tries to connect to the Gateway server.

  - The VPN plug-in displays the Connect button instead of automatically logging on, even when the client certificate is cached and the AlwaysON feature is enabled.
  [From Build 53.22]
  [# 689570, 689622, 653527, 674320, 688142]

• A single sign-on (SSO) attempt might use the wrong domain in a configuration that has parent and child domains. If SSO expressions are used to compute the correct domain, the NetScaler appliance uses the domain obtained at the time of logon instead of the one computed with the expression.
  [From Build 53.22]
  [# 689684, 689721]

• If a NetScaler Gateway appliance that has partitions is configured with an intranet IP address, traffic from one of the partitions to the default partition loops back to the sender instead of treating the partitioned appliance as two independent appliances.
  [From Build 56.20]
  [# 689907]

• A user of Internet Explorer version 8 or 9 can't establish a VPN connection through a NetScaler Gateway appliance that uses the RfWebUI portal theme. The VPN virtual server doesn't respond.
  [From Build 53.22]
  [# 691752]

• End-point Analysis (EPA) scan fails on the client computer, even though the logs indicate otherwise, if the connection between the computer running on Mac OS and the NetScaler appliance is relatively slow (for example, if there's a client-side proxy).
  [From Build 56.20]
  [# 692771, 687892]

• End-point analysis (EPA) scan becomes unresponsive if the EPA plug-in is installed for the first time on the user machine that accesses the NetScaler appliance bound to the RfWeb UI portal theme.
  [From Build 56.20]
  [# 692821, 696260]

• In some cases, the NetScaler appliance becomes unresponsive while back-end authentication cookies are cached when a proxy server is configured between the NetScaler appliance and a back-end server.
  [From Build 56.20]
  [# 693284]

• When you configure the Gateway server in ICA Proxy mode, the server occasionally becomes unresponsive if the Secure Ticket Authority (STA) servers do not respond in time or the client connection is closed.
  [From Build 56.20]
  [# 693522, 697088]

• "Authentication" submenu under "System" cannot be expanded.
  [From Build 56.20]
  [# 693573]

• An IP address that is unable to establish a connection to NetScaler Gateway appliance rejects the Remote Desktop Protocol (RDP) as well.
  [From Build 57.24]
  [# 694219]

• A NetScaler Gateway appliance stops responding after authentication, if it is configured for post-auth End-point Analysis (EPA) and is bound to an RfWebUI persona.
  [From Build 56.20]
  [# 694290]

• In case the Split tunnel ON, the Automatic detect settings checkbox (under LAN Settings) in the Internet Explorer settings was being modified after connecting to VPN, because of which external traffic wasn't reachable.
  [From Build 56.20]
  [# 694328]

• Upon dual refresh of the logon page, the following error message is displayed "Error 404, object not found". The error appears because "NS_TMAC" cookie is missing in the request.
  [From Build 56.20]
  [# 694417]

• The NetScaler appliance sends a huge quantity of "auditlog" messages to the Syslog server when a duplicate server connection is found.
  [From Build 56.20]
  [# 694606]

• The NetScaler Gateway plug-in fails to list a device certificate under the Certificate drop-down menu if the Subject field inside the certificate has no value.
  [From Build 56.20]
  [# 695035]

• When you have Windows AutoLog-ON feature enabled on your NetScaler Gateway appliance, during logon the client is unable to find the "nsauto.exe" file because the path to the file is incorrectly truncated.

  The issue is noticed when you modify the following registry entry:

  NtfsDisable8dot3NameCreation

  This registry entry truncates the applications file path in Windows.
  [From Build 53.22]
  [# 695209]

• When you have Windows AutoLog-ON feature enabled on your NetScaler Gateway appliance, during logon the client is unable to find the "nsauto.exe" file because the path to the file is incorrectly truncated.

  The issue is noticed when you modify the following registry entry:

  NtfsDisable8dot3NameCreation

  This registry entry truncates the applications file path in Windows.
  [From Build 56.20]
  [# 695209]

• In some cases, the NetScaler appliance cannot load the background image when the VPN virtual server has custom theme and DFA policy bound to it.
  [From Build 56.20]
  [# 695413]

• Client and server IP addresses are not displayed if a VPN session is disconnected before a successful logon.
  [From Build 56.20]
  [# 695444, 697635]

• In some cases, the connection from a client computer to the NetScaler appliance is aborted.
  [From Build 56.20]
  [# 695560, 696270, 697255]

• Endpoint analysis (EPA) scan fails on the client machine, because the EPA package does not get installed on the machine properly.
  [From Build 56.20]
  [# 695795]

• Citrix Virtual Adapter icon is not displayed in the network connections list if you logon to VPN virtual server using intranet IP.
  [From Build 56.20]
  [# 695986, 703246, 357122]

• Citrix Virtual Adapter icon is not displayed in the network connections list if you logon to VPN virtual server using intranet IP.
  [From Build 57.24]
  [# 695986, 703246]

• In some cases, the NetScaler Gateway appliance is unable to block access to the Internet and the intranet. This happens if you enable the AlwaysOn feature with NetworkAccessOnVPNFailure parameter set to onlyToGateway and if the FQDN of the virtual server is not accessible by client over the intranet.
  [From Build 57.24]
  [# 696805]

• In some cases, users using Outlook Web Application (OWA) 10 are not able to access the ECP folder.
  [From Build 56.20]
  [# 697356]

• False SNMP alarms for SYN flood are reported when the NetScaler Gateway appliance is deployed in an ICA Proxy mode and session reliability functionality is enabled.
  [From Build 57.24]
  [# 697457]

• In rare cases, the NetScaler appliance configured for Session Reliability (SR) and High Availability (HA) becomes unresponsive as it misses initialization of some of the ICA context fields.
  [From Build 56.20]
  [# 697700]

• In a multi-core NetScaler appliance, Enlightened Data Transport (EDT) application fails to launch on a NetScaler instance deployed on VMware ESX, and configured to use VMXNET3 NIC.
  [From Build 56.20]
  [# 697771]

• In case of an End-point Analysis (EPA) failure, debugging fails because of different values of the same case ID in client-side VPN logs and in the NetScaler appliance logs. The case ID always reflects “a4a42” in the client-side logs which is not in sync with the NetScaler Case ID value.
  [From Build 56.20]
  [# 698336]

• A NetScaler appliance using classic policies over VPN or NetScaler AAA traffic management sessions might occasionally become unresponsive.
  [From Build 58.18]
  [# 699529, 708184, 709484]

• In some cases, XenApp and XenDesktop applications fail to reconnect when a NetScaler Gateway appliance is configured for high availability and a failover happens. The reconnection failure is caused because of the network delay between the NetScaler Gateway appliance and the StoreFront server, owing to the failover.
  [From Build 57.24]
  [# 699575]

• Group information is lost when a native client is used for nFactor authentication and "password change" is enabled for the active directory of the second factor.
  [From Build 57.24]
  [# 699873]

• In rare cases, a NetScaler Gateway appliance does not assign Intranet IP (IIP), when the transfer login is started and the previous session is dropped.
  [From Build 58.18]
  [# 699996]

• A client machine cannot access the StoreFront applications if both of the following conditions are met:

  - A VPN virtual server and a load balancing (LB) virtual server are configured on the same NetScaler appliance.

  - The VPN virtual server is accessed from an IPv6 address.

  The client connection fails because use source IP (USIP) address is enabled internally on the loopback connection between the VPN virtual server and the LB virtual server.
  [From Build 57.24]
  [# 700034, 699530]

• The title message on the logon page is missing if the VPN virtual server is configured for the n-Factor authentication.
  [From Build 57.24]
  [# 701163]

• A NetScaler Gateway appliance crashes or becomes unresponsive if HTTP/0.9 or HTTP/1.0 requests are sent without a host header.
  [From Build 57.24]
  [# 701273]

• The Enlightened Data Transport (EDT) application fails to launch if the application is accessed using a second hop VPN virtual server in a double-hop deployment.
  [From Build 57.24]
  [# 701292]

• In some cases, the NetScaler Gateway appliance dumps core due to memory corruption caused by the CVPN module.
  [From Build 57.24]
  [# 701624, 702311]

• Unified Gateway appliance dumps core upon freeing the NSB memory twice.
  [From Build 59.8]
  [# 701843]

• CVPN rewrite of a file caused the java script to run out of memory.
  [From Build 58.18]
  [# 702189, 704796]

• If a client tries to access the NetScaler Gateway appliance using the VPN plug-in, the EPA scan prompt appears even if the trustAlways feature is enabled for the client connection. 
  [From Build 57.24]
  [# 702212]

• In certain cases, if a NetScaler Gateway appliance tries to connect to a VMware Horizon View Connection Server, the connection server responds with an invalid session ID.
  [From Build 58.18]
  [# 702689]

• In rare cases, the NetScaler appliance dumps core because of memory corruption.
  [From Build 57.24]
  [# 702706, 702727, 706528]

• In rare cases, the NetScaler appliance dumps core because of memory corruption.
  [From Build 58.18]
  [# 702706, 702727, 706528]

• In a High Availability (HA) setup, the secondary node does not respond because it receives an incorrect virtual server IP address from the primary node.
  [From Build 58.18]
  [# 703007]

• In rare cases, in a High Availability (HA) setup, secondary node dumps core during session creation because of memory outage.
  [From Build 58.18]
  [# 704028, 706450]

• If a NetScaler appliance is proxied over PC-over-IP (PCoIP) protocol, the appliance slows down the network connection when accessing VMware Horizon View virtualized applications or desktops.
  [From Build 58.18]
  [# 704129]

• If a NetScaler appliance is proxied over PC-over-IP (PCoIP) protocol, the appliance slows down the network connection when accessing VMware Horizon View virtualized applications or desktops.
  [From Build 57.24]
  [# 704129]

• In rare cases, the NetScaler Gateway packet engine dumps core when an allocated memory is released in the event of a double free error.
  [From Build 57.24]
  [# 704346, 704228, 703747, 706787]

• In rare cases, the NetScaler Gateway packet engine dumps core when an allocated memory is released in the event of a double free error.
  [From Build 58.18]
  [# 704346, 704228, 703747, 706787]

• If you install a VPN plug-in on a client machine, the system displays the following warning message, “Windows can't verify the publisher of this driver software".
  [From Build 58.18]
  [# 704655]

• If you install a VPN plug-in on a client machine, the system displays the following warning message, “Windows can't verify the publisher of this driver software".
  [From Build 57.24]
  [# 704655]

• The VPN plug-in displays an upgrade prompt if the following conditions are met:

  • User login is from a browser to a NetScaler Gateway appliance.

  • VPN plug-in cannot connect to a VPN gateway.
  [From Build 57.24]
  [# 704718, 707228]

• The VPN plug-in displays an upgrade prompt if the following conditions are met:

  • User login is from a browser to a NetScaler Gateway appliance.

  • VPN plug-in cannot connect to a VPN gateway.
  [From Build 58.18]
  [# 704718, 707228]

• If you access an HTTP request URL of length greater than 1024 characters, the Citrix VPN module causes memory corruption.
  [From Build 58.18]
  [# 704872]

• Mac OS X does not support DNS responses larger than 512 bytes.
  [From Build 58.18]
  [# 705278]

• If the policy expression contains “member of”, Smartcontrol is not enforced for certain rules in ICA policy evaluation.
  [From Build 58.18]
  [# 705360]

• In some cases, the NetScaler Gateway appliance dumps core upon changing the default virtual server of a context switching virtual server.
  [From Build 58.18]
  [# 705426, 707800, 707825, 707839, 711798]

• In GSLB deployments, a Windows VPN plug-in remains assigned to one NetScaler Gateway IP address for the entire session (from authentication log on to logout).
  [From Build 57.24]
  [# 705869]

• Arrow icon next to Domain list drown-down menu is not displayed upon using Internet Explorer browser to access the NetScaler Gateway appliance.
  [From Build 58.18]
  [# 705966]

• The OPSWAT EPA plug-in configured on a NetScaler Gateway fails to scan the following expressions on client machines:

  • VIRDEF-FILE-TIME

  • SCAN-TIME

  • ENGINE-VERSION

  • VIRDEF-FILE-VERSION
  [From Build 57.24]
  [# 706237, 706246]

• The OPSWAT EPA plug-in configured on a NetScaler Gateway fails to scan the following expressions on client machines:

  • VIRDEF-FILE-TIME

  • SCAN-TIME

  • ENGINE-VERSION

  • VIRDEF-FILE-VERSION
  [From Build 58.18]
  [# 706237, 706246]

• The NetScaler Gateway appliance dumps core if the following conditions are met:

  • HTTP websites are accessed.

  • Memory allocation is low.

  • Memory allocation for code compression feature fails.
  [From Build 59.8]
  [# 706402]

• The OPSWAT EPA plug-in configured on a NetScaler Gateway fails to scan "SCAN-ITME" expression on client machines.
  [From Build 58.18]
  [# 706583, 707823]

• The OPSWAT EPA plug-in configured on a NetScaler Gateway fails to scan "SCAN-ITME" expression on client machines.
  [From Build 57.24]
  [# 706583, 707823]

• A NetScaler Gateway appliance displays the "File does not exist" error message when you try to create a custom theme with base portal theme as RfWebUI.
  [From Build 58.18]
  [# 706683, 706863]

• A NetScaler Gateway appliance displays the "File does not exist" error message when you try to create a custom theme with base portal theme as RfWebUI.
  [From Build 57.24]
  [# 706683, 706863]

• In rare cases, a NetScaler Gateway appliance configured for EDT becomes unresponsive because of memory corruption.
  [From Build 58.18]
  [# 706704, 709305, 709349, 706229, 705896, 710041, 710117, 707924, 709493, 709911, 710415, 710907, 710891, 711509, 711523, 710808]

• A script error message is displayed upon accessing the NetScaler Gateway appliance using Workspace Environment Management (WEM).
  [From Build 58.18]
  [# 707070]

• A script error message is displayed upon accessing the NetScaler Gateway appliance using Workspace Environment Management (WEM).
  [From Build 57.24]
  [# 707070]

• If the content switching virtual server is configured to front-end VPN virtual server, the binding of netprofile to VPN virtual server does not take effect.
  [From Build 58.18]
  [# 707492]

• The NetScaler Gateway users using RfWebUI for logon are prompted for a transfer logon but the transfer logon displays the data of a different user.
  [From Build 58.18]
  [# 707956]

• A NetScaler Gateway appliance displays an error message upon accessing services using SAML based authentication. This happens when the appliance is bound to RFWebUI portal theme and has been successfully validated to the NetScaler appliance.
  [From Build 58.18]
  [# 707997]

• A NetScaler Gateway appliance does not fallback to the LDAP policy if the following conditions are met:

  - Certificate authentication and LDAP are configured as the first factor and LDAP checks data from login Schema.

  - The certificate authentication fails.
  [From Build 58.18]
  [# 708140]

• In some cases, the NetScaler Gateway appliance dumps core if the following conditions are met:

  - The NetScaler Gateway appliance hosts connections to Citrix XenDesktop 7.16 and above the supports UDT.

  - A DTLS service with the same IP:PORT as the VDA is added.
  [From Build 59.8]
  [# 708188]

• The Endpoint Analysis (EPA) scan plug-in and the VPN plug-in for Mac OS crash if the machine running the OS has a certificate without a common name (CN) for the issuer. The crash is observed when a client certificate authentication or a device certificate authentication is configured.
  [From Build 58.18]
  [# 708283]

• If you restart the NetScaler Gateway appliance after an EPA package upgrade, the EPA package version file reverts to the default version.
  [From Build 58.18]
  [# 708493]

• In a unified Gateway deployment, the log out operation for Outlook Web Access (OWA) application intermittently fails.
  [From Build 58.18]
  [# 708643, 710636, 709652]

• In rare cases, the NetScaler Gateway appliance dumps core when DTLS is enabled on a VPN virtual server.
  [From Build 59.8]
  [# 708703, 709315, 711421, 710131]

• In rare cases, the NetScaler Gateway appliance dumps core when DTLS is enabled on a VPN virtual server.
  [From Build 58.18]
  [# 708703, 709315, 711421, 710131]

• POST request has some non-required fields.
  [From Build 59.8]
  [# 709243]

• Connectionlist corruption occurs if VMware horizon client reuses the same SPI for UDP connections, resulting in eventual crashes when show or kill command is executed.
  [From Build 58.18]
  [# 709325]

• Connection to file-shares at times requires authentication with Domain Controller.
  [From Build 59.8]
  [# 709664]

• In case of network errors, cached client certificates were removed, prompting user to select the certificate from the drop-down menu manually.
  [From Build 58.18]
  [# 709689]

• In rare cases, the VPN plug-in crashes.
  [From Build 59.8]
  [# 709695]

• A NetScaler Gateway appliance dumps core if a Regex in a patset takes a long time to execute.
  [From Build 59.8]
  [# 709923, 710642]

• In rare cases, the NetScaler Gateway appliance dumps core when a client machine tries to open more than one DTLS connection.
  [From Build 59.8]
  [# 710131]

• VPN tunneling is ceased because Windows firewall on Citrix virtual adapter drops the packets. The packet drop is caused because of cross firewall profile switch (profile switch from domain to public) for any inbound connection.
  [From Build 59.8]
  [# 710165, 707791, 704144]

• The session through a NetScaler Gateway appliance using RfWebUI goes to unresponsive mode after you click cancel on the "Change Password" error window.
  [From Build 58.18]
  [# 710220]

• The NetScaler Gateway appliance does not display the right logon form when the user clicks the "Go Back" button in the following case:

  The session initialization fails because the user does not belong to any of the groups configured on the NetScaler.
  [From Build 58.18]
  [# 710342]

• The NetScaler Gateway VPN plug-in does not detect some captive portal (CP) networks.
  [From Build 59.8]
  [# 710345]

• Accessing a NetScaler Gateway appliance results in 404 error, if the NetScaler Gateway and AAA-TM are deployed on the same NetScaler appliance in the same domain but outside of Unified Gateway domain.
  [From Build 59.8]
  [# 711330]

• The VPN plug-in for NetScaler Gateway becomes unresponsive once the client machine moves to active mode from standby mode.
  [From Build 59.8]
  [# 711434, 710161, 716058]

• Upon using the NetScaler Gateway plug-in to logon to VPN, the RADIUS challenge message is displayed on Citrix Receiver instead of the NetScaler Gateway plug-in.
  [From Build 59.8]
  [# 711570]

• In a multi-core environment, device certificate failed intermittently due to syncing issues.
  [From Build 59.8]
  [# 711654]

• Pre-authentication EPA check fails when total length of single EPA expression (not separated by any logical operators) is greater than 1024 characters.
  [From Build 59.8]
  [# 711678]

• Windows Gateway Plugin displays incorrect message on the user interface when the VPN virtual server with Unified Gateway is in disabled or in out of order state.
  [From Build 59.8]
  [# 711715]

• In some cases, the NetScaler Gateway appliance with multiple core crashes if the HDX Insight feature is enabled.
  [From Build 58.18]
  [# 711720, 712124, 712553, 714141]

• Allowed login groups parameters in session action do not take effect with advanced session policies.
  [From Build 59.8]
  [# 712705]

• A NetScaler Gateway appliance does not allow post body expressions for relaystateRule parameter when sending SAML assertions.
  [From Build 59.8]
  [# 712790, 715613]

• A NetScaler Gateway appliance does not allow post body expressions for relaystateRule parameter when sending SAML assertions.
  [From Build 58.18]
  [# 712790]

• While repairing the NetScaler Gateway plug-in, a re-installation for the plug-in is initiated without checking if the plug-in is already installed. This creates a new virtual adapter instance.
  [From Build 59.8]
  [# 712856]

• The NetScaler Gateway appliance displays incorrect http content for STA ticket refresh request.
  [From Build 59.8]
  [# 713473]

• In rare cases, the NetScaler Gateway appliance dumps core when a proxy server is configured.
  [From Build 59.8]
  [# 713474]

• For a non-admin user, NetScaler Gateway service is not able to get the admin privileges.
  [From Build 59.8]
  [# 714332]

• Windows can add a best route for any On-link interface to route traffic. The addition of a new route for the internal network address on the virtual adapter's interface results in connectivity issues over VPN connection.
  [From Build 59.8]
  [# 715217]

• A NetScaler Gateway appliance configured for nFactor authentication becomes unresponsive when the following conditions are met.

  - SAML is configured as the first factor of authentication.

  - EPA is configured as the last factor of authentication.
  [From Build 59.9]
  [# NSHELP-2137, TSK0715167]

NetScaler ICA

• When session reliability is enabled for the high availability feature, memory usage by the NetScaler appliance spikes and causes a failover.
  [From Build 56.20]
  [# 671918, 673784, 656996, 672949, 676413]

• When session Reliability on HA Failover is enabled on a NetScaler high availability pair, the primary NetScaler has a buffer to maintain CGP sequence updates, which will be sent to secondary. After a reconnect, buffer updates wrong offset, resulting in corruption. Once the buffer corruption happens, wrong addresses will be accessed which can lead the NetScaler instance to become unresponsive.
  [From Build 41.24]
  [# 679494, 684204]

NetScaler Insight Center

• Under certain network traffic conditions, if you have enabled AppFlow for ICA, the NetScaler appliance does not respond.
  [From Build 56.20]
  [# 687084, 689052, 696701]

• When you launch the ICA application that is enabled with advanced encryption in XenApp or XenDesktop, in some cases, NetScaler does not respond while handling the advanced encryption handshake.
  [From Build 56.20]
  [# 689491, 696819]

• AppFlow logging is enabled by default in VPN virtual servers from NetScaler appliance 12.0 57.x version.
  [From Build 57.24]
  [# 690220]

• The NetScaler appliance does not respond if AppFlow for ICA is enabled under certain network traffic conditions.
  [From Build 56.20]
  [# 692326, 692554, 698557]

• You cannot see analytics data in the day, week, or month report on Insight Center.
  [From Build 56.20]
  [# 693359]

• HDX Insight does not display ICA channel data when Logstream transport is enabled for the AppFlow feature in the NetScaler appliance and if “smartctl” is enabled for ICA HDX Insight.
  [From Build 56.20]
  [# 693672]

• When HDX Insight is enabled, the communication between NetScaler and NetScaler MAS is achieved through a set of ICA status codes. These status code values are maintained both in NetScaler and NetScaler MAS and are always in sync. Due to a new ICA status code introduced in NetScaler 12.0 release, there is a mismatch between some of the code values.

  When you enable SmartAccess in NetScaler and export it to NetScaler MAS, NetScaler MAS interprets it as code. An ICA session is logged as skip parse due to which records are not seen.
  [From Build 56.20]
  [# 694703]

• If AppFlow for ICA is enabled, in an error scenario for ICA parser with a particular network traffic condition, the NetScaler appliance can go down.
  [From Build 56.20]
  [# 696552]

• When HDX Insight is enabled in NetScaler Appliance. In a rare scenario, due to a negative length saved in one of the structures used for logging mechanism, the NetScaler Appliance fails.
  [From Build 57.24]
  [# 697800, 698444, 650103]

• If AppFlow is enabled globally or in any VPN virtual server, NetScaler Gateway might fail, if a user logs in to VPN and launches an application.
  [From Build 57.24]
  [# 698664, 698699, 697366]

• The NetScaler appliance might fail when you delete and re-apply the AppFlow configuration while the ICA applications are launched after the AAA sessions are created for approximately 5000 users.
  [From Build 58.18]
  [# 701300]

• NetScaler Gateway fails after a duplicate memory-free operation if you have enabled HDX Insight for ICA applications.
  [From Build 58.18]
  [# 701320, 700412, 703435, 702111, 704081, 704573, 708353, 710084, 709994]

• When HDX Insight is enabled, NetScaler appliance might fail while accessing apps or desktops from VDA 7.16 (or higher version) with some specific receivers such as, Windows 4.10 or higher and MAC 12.8 or higher.
  [From Build 57.24]
  [# 706508, 707056]

• When HDX Insight is enabled, NetScaler appliance might fail while accessing apps or desktops from VDA 7.16 (or higher version) with some specific receivers such as, Windows 4.10 or higher and MAC 12.8 or higher.
  [From Build 58.18]
  [# 706508, 707056]

• When NetScaler Gateway appliance is used with NSAP enabled for VDAs (7.16 and above) and if HDX Insight is configured, the NetScaler Gateway might fail.
  [From Build 59.8]
  [# 710363, 704912]

• In certain scenarios, if SR-HA feature is enabled for ICA AppFlow, the secondary NetScaler appliance in the high-availability deployment might fail.
  [From Build 59.8]
  [# 713607]

• In certain scenarios, if SR-HA feature is enabled for ICA AppFlow, the secondary NetScaler appliance in the high-availability deployment might fail.
  [From Build 58.18]
  [# 713607]

• When Session Reliability on NetScaler high availability pair is enabled. The output throughput on the primary NetScaler appliance is comparatively higher than the input throughput of the appliance.
  [From Build 59.8]
  [# 714250]

• A NetScaler appliance might become unresponsive in a multi-core environment if ICA AppFlow or SmartControl feature is enabled.
  [From Build 59.9]
  [# 716479]

NetScaler MPX Appliance

• If you execute the “unset interface lacpkey” command on a NetScaler command line interface, the following error message appears, “LACP key not set”.
  [From Build 58.18]
  [# 544037]

• In a NetScaler MPX appliance, the GUI and command interface is unable to distinguish between Mellanox 100G and 50G interfaces. As a result, the interfaces allow you to set 50G on 100G interface.
  [From Build 58.18]
  [# 707811]

NetScaler NITRO

• NetScaler logon credentials are locked and the error message “connection limit CFE exceeded” appears if the following conditions are met:

  - The “show ns runningconfig” command takes a long time to execute

  - The same command is re-run multiple times while the first command is still running at the background.

  The NetScaler appliance remains locked until the command completes.
  [From Build 53.22]
  [# 689426]

• The HTTP daemon on a NetScaler appliance might fail if the “probe server” NITRO call to the appliance fails.
  [From Build 56.20]
  [# 693286]

NetScaler SDX Appliance

• If an LACP channel is bound to nine or more interfaces and is a member of a tagged VLAN, deleting the channel from a service VM can cause the NetScaler appliance to fail intermittently.
  [From Build 58.18]
  [# 524320, 630772]

• When you create or delete a 10G LACP or static channel, transmission stalls on the member interfaces of the channel, and therefore those interfaces stop processing traffic.
  [From Build 59.8]
  [# 600152, 697276, 704954]

• You can only assign 22 partition MAC addresses to the following SDX platforms and the virtual machine will not start, if you assign more than 22 partition MAC addresses:

  * 11500

  * 13500

  * 14500

  * 16500

  * 18500

  * 20500

  * 115xx series
  [From Build 57.24]
  [# 647534]

• When you use a single-bundle image file to upgrade a NetScaler SDX appliance, the upgrade-progress page might become unresponsive.
  [From Build 51.24]
  [# 672042, 686510]

• A NetScaler SDX appliance does not propagate a global MAC address to the VPX instances if you do both of the following:

  - Assign a global base MAC address in generated mode to a manual channel or an LACP channel.

  - Reset the global base MAC address.
  [From Build 51.24]
  [# 682573]

• If system logs are not rotated properly, over time they consume too much disk space. This causes the XenServer server to run out of disk space and creates unexpected system behavior.
  [From Build 51.24]
  [# 683171, 684959, 685535]

• A NetScaler VPX instance's configuration is deleted if you use the Management Service to force a reboot of the instance.
  [From Build 51.24]
  [# 683743]

• If a channel configuration that is created by using the Management Service is pushed to an existing VPX instance, the channel name on the VPX instance might differ from the channel name on the Management Service.

  Because of this behavior the channel name might differ on two VPX instances of an HA pair, running on two different SDX appliances. This causes a NetScaler VPX HA pair to break after a failover.

  With this fix, Management Service creates channels on VPX instances with the same names provided the LA IDs are available on the VPX instances.

  For example, if channel LA/3 is created on Management Service, the same is created on the VPX instance, provided LA/3 ID is available on the VPX instance.

  However, for example, if LA/9 is created on Management Service, the channel is created with the first available LA ID on the VPX instance, because a VPX instance can support channels only up to LA/8.

  Note: Upon upgrade to this version, the existing LA configurations on the SDX Management Service or on the VPX instance do not change.
  [From Build 56.20]
  [# 684428]

• Jumbo MTU Support for CLAG

  In a cluster setup that involves one or more NetScaler SDX appliances, you get confirm messages when you perform the following actions:

  - When you click Create to configure a CLAG in one of NetScaler SDX appliances in the cluster setup, a message prompts you to refresh the CLAG settings in the other SDX appliances. At the prompt, select Yes to continue. If you select No, the CLAG is not configured. Note that you must manually refresh the CLAG settings in the other SDX appliances.

  - If you change the MTU setting in one of the SDX appliances, a message prompts you to change the setting in the other SDX appliances. At the prompt, select Yes to continue. If you select No, the MTU is not set. Note that you must manually change the MTU setting in the other SDX appliances.

  For more information about how to configure CLAG on SDX appliances, see https://docs.citrix.com/en-us/sdx/12/configuring-management-service/configure_cluster_link_aggregation.html
  [From Build 58.18]
  [# 689767]

• In a VPX instance (standalone or part of an HA setup) running on a SDX-21550/SDX-20500 platform, TX stalls are observed and the state of the configured load balancing services in the VPX instance flaps.
  [From Build 56.20]
  [# 690647, 697369, 694571]

• When you upgrade the NetScaler SDX Management Service from release 11.0 or lower to release 11.1 or higher, some anomalies might occur such as:

  - Management Service does not display the VPX instances running on the SDX appliance.

  - The NetScaler VPX instances fail to come up.

  - Management Service becomes unreachable.

  - XenServer upgrade is incomplete.

  These issues occur if the NetScaler database contains large sets of NetScaler events-related historical data. With this fix, reports of historical data is lost; however, reports collected after upgrade is retained.
  [From Build 57.24]
  [# 693526, 694388]

• In a VPX instance (standalone or part of an HA setup) running on a SDX-21550/SDX-20500 platform, TX stalls are observed and the state of the configured load balancing services in the VPX instance flaps.
  [From Build 56.20]
  [# 694571]

• The "Version-Bit" field displays no information when you perform any of the following actions:

  - Click a backup file and fetch its details.

  - Add instances for instance restore.
  [From Build 57.24]
  [# 696131]

• The “Date” field in the Events detail page displays no information. To see the Events details, navigate to Configuration > System > Events on the NetScaler SDX GUI.
  [From Build 56.20]
  [# 696706]

• Upon restart of a NetScaler SDX appliance that has a cluster setup configured with a cluster link aggregation group (CLAG) with jumbo MTU, the cluster nodes whose interfaces are part of the CLAG might not restart properly.
  [From Build 56.20]
  [# 699274]

• An attempt to log on to the NetScaler SDX appliance running software release 12.0 by using the GUI or CLI might fail under one of the following conditions

  - Single Bundle upgrade is attempted.

  - The appliance is restarted.

  - The SDX Management Service is restarted through XenServer.

  In all the above situations, the SDX Management Service database gets corrupted, which causes the logon failure.
  [From Build 56.20]
  [# 699426, 696477]

• On a NetScaler SDX appliance, access to GUI using HTTPS might fail if a FIPS card virtual-function (VF) is assigned to that instance. The appliance might also intermittently fail to process HTTPS traffic received on the management interface.
  [From Build 57.24]
  [# 701070]

• On a NetScaler SDX appliance, access to GUI using HTTPS might fail if a FIPS card virtual-function (VF) is assigned to that instance. The appliance might also intermittently fail to process HTTPS traffic received on the management interface.
  [From Build 58.18]
  [# 701070]

• The NetScaler SDX GUI freezes and stops responding after you save a configuration under Configuration > NetScaler > NetScaler Configuration > Save Configuration.
  [From Build 57.24]
  [# 702792]

• IPv6 traffic to the NetScaler SDX Management Service is blocked if you enable the ACL feature.
  [From Build 58.18]
  [# 704847]

• Upon upgrade to release 11.0 72.x, on an SDX appliance, you cannot add a new virtual router ID (VRID) configuration or modify an existing VRID configuration on a static or a link aggregation control protocol (LACP) channel.
  [From Build 58.18]
  [# 708950]

• The virtual router ID (VRID) configuration on a static or a link aggregation control protocol (LACP) channel does not work on SDX 26000 and SDX 15000-50G platforms.
  [From Build 58.18]
  [# 709182]

• On NetScaler SDX 26000 and SDX 15000-50G platforms, the virtual router ID (VRID) configuration on a static or a link aggregation control protocol (LACP) channel does not work if any one of the following conditions is met:

  - The VPX instance configured with the VRID restarts.

  - The SDX appliance on which the VPX instance is running restarts.
  [From Build 59.8]
  [# 710320]

NetScaler SDX appliance

• If an LACP channel is bound to nine or more interfaces and is a member of a tagged VLAN, deleting the channel from a service VM can cause the NetScaler appliance to fail intermittently.
  [From Build 57.24]
  [# 524320, 630772]

• The management IP (NSIP) of a NetScaler VPX instance running on SDX 14000 platform becomes unreachable when the following conditions are met:

  - An LACP channel comprising 10G or 40G interfaces is assigned as VPX management NIC.

  - One of the member interfaces in the LACP channel goes down.
  [From Build 58.18]
  [# 707600]

NetScaler Secure Web Gateway

• If you try to add multiple URL sets that contain one million or more entries, memory is exhausted and the appliance fails.
  [From Build 56.20]
  [# 685181]

• A NetScaler Secure Web Gateway appliance does not support the URL List feature in a high availability setup.
  [From Build 53.22]
  [# 690428]

• If you run the auto_update_urlset script during an URL Set import or update process, the script generates temporary folders in the file system. As a result, the folders inadvertently fill the file system causing multiple job failures.
  [From Build 57.24]
  [# 698694]

• A NetScaler SWG appliance crashes or becomes unresponsive if the vendor configuration file gets corrupted during an URL categorization database update.
  [From Build 57.24]
  [# 698948]

NetScaler VPX Appliance

• In a NetScaler cluster, the configuration coordinator (CCO) node does not support the set ns vpxparam -cpuyield command for controlling CPU-usage behavior.
  [From Build 51.24]
  [# 678401]

• A NetScaler VPX instance running on a NetScaler SDX appliance does not receive any traffic under the following set of conditions:

  - The Intel 710 series NICs of the NetScaler SDX appliance are connected to a switch with an LLDP-enabled port.

  - That port has been disabled and then enabled.
  [From Build 58.18]
  [# 684860, 703400, 708796]

• After a failover of a NetScaler VPX HA setup running on AWS, the interfaces from both the nodes do not attach and detach properly. This happens if the stack name of the Citrix CloudFormation template exceeds 25 characters.

  With the fix, the stack name of the Citrix CloudFormation template supports up to 90 characters.
  [From Build 53.22]
  [# 689356]

• After a failover of a NetScaler VPX HA setup running on AWS, the interfaces from both the nodes do not attach and detach properly. This happens if the stack name of the Citrix CloudFormation template exceeds 25 characters.

  With the fix, the stack name of the Citrix CloudFormation template supports up to 90 characters.
  [From Build 56.20]
  [# 689356]

• DNS resolution for existing DNS configurations fails after you upgrade a NetScaler VPX instance running on AWS to release 12.0 build 53.20.
  [From Build 56.20]
  [# 693877]

• DNS resolution for existing DNS configurations fails after you upgrade a NetScaler VPX instance running on AWS to release 12.0 build 53.20.
  [From Build 53.22]
  [# 693877]

• A NetScaler VPX instance configured with VMXNET3 interfaces and running on VMware ESX server might crash if the ESX server sends a zero-length packet through these interfaces.
  [From Build 58.18]
  [# 695358, 706660, 707542]

• A NetScaler VPX instance configured with VMXNET3 interfaces and running on VMware ESX server might crash if the ESX server sends a zero-length packet through these interfaces.
  [From Build 59.8]
  [# 695358, 706660, 707542]

• A NetScaler VPX instance running on a VMWare ESX hypervisor becomes unreachable if you select "Register with NetScaler MAS for manageability" while configuring pooled licensing in the instance GUI.
  [From Build 56.20]
  [# 695516]

• A VPX instance running on VMware ESX server might lose network connection intermittently when the following conditions are met:

  - The VPX instance is upgraded to release 12.0, any build

  - Adapter type on the ESX server is E1000

  - The interface link on the adapter is down
  [From Build 58.18]
  [# 705093]

• Memory leaks in NetScaler VPX instances running versions prior to 12.0 56.20, affecting the performance of the instance or causing the instance to fail if it runs for a longer time.
  [From Build 58.18]
  [# 710130]

NetScaler VPX appliance

• In a NetScaler VPX HA deployment running on AWS, when a failover makes the secondary node primary, the network interfaces are attached to the new primary in the wrong order.

  For example, if the primary node has NICS 1/2 (AA:BB:CC:DD:EE:FF), 1/3 (12:34:56:78:90:12), and 1/4 (1A:2B:3C:4D:5E:6F), upon failover the new primary would have 1/2 (1A:2B:3C:4D:5E:6F), 1/3(AA:BB:CC:DD:EE:FF), 1/4(12:34:56:78:90:12). Here, the interface MAC order has changed. However, this behavior does not apply to the NIC that's configured with the NetScaler management IP address.
  [From Build 51.24]
  [# 675746]

Networking

• In FTP passive proxy mode, the NetScaler appliance allocates the same port to more than one client.
  [From Build 57.24]
  [# 642271]

• A NetScaler appliance might become unresponsive or a high CPU is observed during the following scenario:

  * The appliance resolves a domain into two IP addresses, one of the IP addresses is a NetScaler owned IP address and the other is an external IP address.

  * The appliance sends a packet destined to the external IP address from LO/1.

  * The response packet keeps looping after the appliance receives it.
  [From Build 51.24]
  [# 669754, 669977, 687943]

• In a high availability setup, when a critical interface goes to DOWN state because of TX stall, HA failover might not happen.
  [From Build 51.24]
  [# 677815, 679068, 680001]

• In a high availability setup, when a critical interface goes to DOWN state because of TX stall, HA failover might not happen.
  [From Build 51.24]
  [# 679068]

• A NetScaler appliance logs an IP conflict error when it receives any unsolicited ARP message from a network device such as Check Point Firewall for a NetScaler appliance-owned IP address. The appliance logs an IP address conflict error even if the IP address to MAC address mapping is correct in the ARP message.
  [From Build 56.20]
  [# 679490, 689372]

• Memory allocated for a TCP session might not get free after a failure in reassembling fragments of a size of more than 1500 bytes. This accumulation over a period of time depletes available memory.
  [From Build 51.24]
  [# 680185, 680186]

• Interfaces in MUTED state might drop the LLDP packets instead of processing them.
  [From Build 51.24]
  [# 682769]

• The NetScaler appliance drops ND6 solicitation packets received on interfaces that are in muted state.
  [From Build 51.24]
  [# 684119]

• The NetScaler appliance updates the ND entry of a next hop router with its MAC address after learning it from the router advertisement packets received from the router. The appliance might not update the state of the ND entry from INCOMPLETE to STALE. This update failure results in looping the outgoing packets ( destined through the next hop router) in the NetScaler queue. As a result, the NetScaler appliance becomes unresponsive.
  [From Build 51.24]
  [# 684126]

• The NetScaler appliance does not process the BGP remote-as configuration for an IPv6 peer after a reboot resulting in the loss of BGP configuration for this peer.
  [From Build 58.18]
  [# 685123]

• The NetScaler appliance does not process the BGP remote-as configuration for an IPv6 peer after a reboot resulting in the loss of BGP configuration for this peer.
  [From Build 51.24]
  [# 685123]

• In a NetScaler telco deployment, the NetScaler appliance reuses the outgoing probe connection information for two different incoming connections with the same 4-tuple that are destined to the same server. This reuse of probe connection might cause the NetScaler appliance to become unresponsive.
  [From Build 51.24]
  [# 685344]

• When you remove a static route, the NetScaler appliance does not advertise the connected route that has the same prefix as that of the removed static route and for which the DRADV mode is enabled.
  [From Build 53.22]
  [# 686058]

• When the process that invoked vtysh process is terminated, the vtysh process might cause high CPU usage.
  [From Build 58.18]
  [# 689216]

• The NetScaler appliance does not accept routes that have 0.0.0.0 prefix and non-zero prefix length.

  With this fix, the NetScaler appliance accepts routes with 0.0.0.0 prefix and prefix length less than eight. But routes belonging to 0.0.0.0/8 block are not accepted as they belong to the reserved IPv4 address range.
  [From Build 56.20]
  [# 689441]

• If the IP address (type VIP) of a virtual server is bound to a net profile, deleting the virtual server also removes the IP address from the net profile.
  [From Build 53.22]
  [# 690082]

• The NetScaler appliance might not properly processes the ND6 unsolicited neighbor advertisement messages and update its routing table.
  [From Build 56.20]
  [# 693472]

• In a high availability configuration, synchronization of session information to the secondary node happens only when the state of the secondary node is UP. When the state of the secondary node is other than UP state for a long time, session information that are to be synchronized are build up on the primary node. This results in memory crunch or session hitting maximum limits in the primary node.
  [From Build 56.20]
  [# 693995]

• A NetScaler appliance might become unresponsive after applying the ACLs if the appliance has more than 1,100 ACL rules and some of these rules have overlapped conditions.
  [From Build 56.20]
  [# 694203]

• Netprofile source IP persistency for a load balancing configuration might not work for a set of clients if the NetScaler appliance connects these clients to the same service.
  [From Build 58.18]
  [# 698942]

• Adding an extended ACL/extended ACL6/PBR/PBR6 rule fails if the rule has the same set of conditions as that of a removed extended ACL/extended ACL6/PBR/PBR6 rule.
  [From Build 57.24]
  [# 699886]

• A NetScaler appliance does not use the associated net profile for server side connections for any load balancing configurations of protocol type other than TCP, UDP or ICMP.
  [From Build 58.18]
  [# 702321]

• In a High Availability setup with HA MON disabled on all interfaces, HA failover occurs when all the interfaces are reset.

  With this fix, HA failover does not occur when all the interfaces are reset.
  [From Build 58.18]
  [# 702685]

• When the state of a VLAN becomes DOWN (due to all bound interfaces in DOWN state), the NetScaler appliance might remove some ECMP routes learnt through other UP VLANs.
  [From Build 58.18]
  [# 703541]

• If ECMP routes are present in a NetScaler appliance and a new route is added for the same prefix with a lower metric or a distance, not all existing connections are updated with the new route. Only connections pointing to the first route of the ECMP set are updated with the new route.
  [From Build 58.18]
  [# 703782]

• After a failover in a high availability setup, the new primary node might become unresponsive if the MAC address of the upstream switch changes.
  [From Build 58.18]
  [# 705913]

• In some deployments, ICMP error packets, sourced from the NSIP address and destined to 127.0.0.2 address, might go in loops within the NetScaler appliance causing high CPU usage in the appliance.
  [From Build 59.8]
  [# 707489]

• Netscaler appliance by default, was sending 14 redundant bytes in the BFD message.
  [From Build 58.18]
  [# 708011]

• In a high availability setup, the NetScaler appliance does not send jumbo frames on interfaces that are Jumbo enabled. This issue cause the state of the LACP channels and interfaces to flap, which in turn results in repetitive HA failover in the setup.
  [From Build 59.8]
  [# 708050]

• In a high availability configuration in INC mode, dynamic routing parameters might not get set properly because of the conversion errors.
  [From Build 59.8]
  [# 708496]

• In a NetScaler appliance, BGP daemon fails when a routemap, which includes a 'match ip peer' command entry, is applied to the kernel routes.
  [From Build 59.8]
  [# 709231]

• A netprofile configuration is lost for a VIP address, which is added as part INAT or load balancing configurations, after the appliance is restarted or after the appliance is made part of a cluster.
  [From Build 59.8]
  [# 709306]

• If a NetScaler appliance has ECMP routes with gateways in the same subnet as of the source IP address, the appliance uses only the first route for sending out the appliance originated traffic.
  [From Build 59.8]
  [# 709350]

• If a NetScaler appliance has ECMP routes with gateways in the same subnet as of the source IP address, the appliance uses only the first route for sending out the appliance originated traffic.
  [From Build 58.18]
  [# 709350]

• The NetScaler appliance skips policy-based routes (PBR) lookup for outgoing monitor packets of type UDP and ICMP.
  [From Build 59.8]
  [# 709977]

• The NetScaler appliance might not remove monitors, which have a netprofile bound to a route, during a clear config extended+ operation. These monitors point to the associated netprofile, which was removed during the during a clear config extended+ operation, causing the NetScaler appliance to crash.
  [From Build 59.8]
  [# 710015]

• In a cluster setup, a node has the following entities in the same traffic domain:

  - a VIP address and,

  - a load balancing virtual server with the same VIP address.

  When the traffic domain is removed, virtual server configuration is removed but the VIP address is not removed. The node crashes when it sends out a GARP message for this VIP address.
  [From Build 59.8]
  [# 710326, 711605]

• HTTPS access to a SNIP address in a traffic domain fails because the appliance performs port allocation in non-default traffic domain when accessing the NSIP address internally from underlying FreeBSD operating system.
  [From Build 59.8]
  [# 710982]

• BGP IPv6 address family configuration might not get saved in a cluster setup.
  [From Build 59.8]
  [# 711033]

• Trivial File Transfer Protocol (TFTP) might not work in Citrix VPX instances running on VMware ESX server with VMXNET3 network interfaces.
  [From Build 59.8]
  [# 711445, 713549]

• The NetScaler appliance might not completely remove the RNAT global configuration during a clear config operation.
  [From Build 59.8]
  [# 712215]

• The appliance might fail in unbinding NAT rules, with 32-bit netmask, from a netprofile.
  [From Build 59.8]
  [# 715128]

Optimization

• The Video Optimization feature is supported on 32-bit NetScaler platforms only. If you deploy the feature on a 64-bit platform, the appliance displays an error message and crashes.
  [From Build 53.22]
  [# 676593, 677838, 679578, 681853]

• With this fix, the built-in video detection policies have new names, which more clearly represent the purposes of the policies.
  [From Build 41.24]
  [# 681308]

• With this fix, the built-in video detection policies have new names, which more clearly represent the purposes of the policies.
  [From Build 51.24]
  [# 681308]

• When configuring the NetScaler video optimization feature, you cannot bind built-in detection policies or custom optimization policies to multiple virtual servers. An attempt to do so produces the following error message, "ERROR: CVPN Policies cannot be bound to multiple entities."

  For example:

  > bind lb vserver IPv4_TCP_80-ABR -policyName ns_videoopt_http_abr_netflix -priority 600 -gotoPriorityExpression 3300 -type RESPONSE

  > bind lb vserver IPv6_TCP_80-ABR -policyName ns_videoopt_http_abr_netflix -priority 601 -gotoPriorityExpression 3301 -type REQUEST

  ERROR: CVPN Policies cannot be bound to multiple entities
  [From Build 51.24]
  [# 682864]

• When configuring the NetScaler video optimization feature, you cannot bind built-in detection policies or custom optimization policies to multiple virtual servers. An attempt to do so produces the following error message, "ERROR: CVPN Policies cannot be bound to multiple entities."

  For example:

  > bind lb vserver IPv4_TCP_80-ABR -policyName ns_videoopt_http_abr_netflix -priority 600 -gotoPriorityExpression 3300 -type RESPONSE

  > bind lb vserver IPv6_TCP_80-ABR -policyName ns_videoopt_http_abr_netflix -priority 601 -gotoPriorityExpression 3301 -type REQUEST

  ERROR: CVPN Policies cannot be bound to multiple entities
  [From Build 41.24]
  [# 682864]

• A NetScaler appliance crashes if you generate AppFlow or ULFD records for clear-text video transactions.
  [From Build 41.24]
  [# 682947]

• A NetScaler appliance crashes if you generate AppFlow or ULFD records for clear-text video transactions.
  [From Build 51.24]
  [# 682947]

• If a response from the StoreFront server does not have a Content Type field in the header, but the appliance expects a value in the Content Type field, the appliance crashes.
  [From Build 56.20]
  [# 688412]

• A NetScaler appliance fails when media classification mode is enabled and if there is a memory failure.
  [From Build 56.20]
  [# 690975, 695683]

• In certain cases, a NetScaler appliance might crash or become unresponsive, if the appliance fails to serve a range request from the cached content.
  [From Build 57.24]
  [# 699392, 692176, 701481]

• A NetScaler appliance crashes if you execute an unsupported operation using Selectors in contentgroup for observing cache objects.
  [From Build 57.24]
  [# 700581, 692600]

Platform

• You might see a Tx stall issue on MPX platforms that contain Intel XL710 NICs.
  [From Build 59.8]
  [# 712779]

Policies

• The HTTP.REQ.TXID and HTTP.RES.TXID policy expressions return the same "universally unique identifier" (UUID) for different transactions.
  [From Build 53.22]
  [# 663414, 675873]

• The NetScaler appliance can sometimes time out while processing data with rewrite actions.
  [From Build 56.20]
  [# 675347]

• In some cases, the system encounters a fault if, when adding an entry to a pattern set, you experience errors such as too long patset strings, bad UTF-8 characters, or bad regular expressions.
  [From Build 51.24]
  [# 675677]

• A log message is not logged for the Responder module when the NetScaler appliance receives a request and processes policies for a different module while a client request sent to the Responder module awaits log processing.
  [From Build 53.22]
  [# 685375]

• When an Advanced expression function in an ALT expression blocks the current evaluation of the expression, then upon resumption it may cause the NetScaler appliance to crash.
  [From Build 51.24]
  [# 687345]

• Clearing a NetScaler system configuration causes the appliance to fail if an HTTP profile references a patset configuration entity.
  [From Build 53.22]
  [# 691227]

• The audit log action in a responder policy resets when modifying a responder action bound to the same responder policy.
  [From Build 56.20]
  [# 693791]

• The available memory on a NetScaler appliance can be exhausted, degrading the performance of the appliance, when an authorization policy with a default syntax/advanced/not classic rule is bound to a AAA user or group, or when an authentication policy with a default/syntax/advanced/not classic rule is bound to an authentication service with a nextFactor parameter.
  [From Build 58.18]
  [# 701044, 706078, 707776]

• The nspepi tool for converting classic policy expressions to advanced policy expressions fails when the following set of conditions are met:

  - Advanced policy expressions are parsed in command line configurations.

  - Add policy expression conversion is incorrectly handled if the command line configurations contain comments.
  [From Build 58.18]
  [# 704541, 706084]

• If a policy expression contains the HMAC(key) or ENCRYPT(Key) function, the expression disappears after a reboot.
  [From Build 58.18]
  [# 706331]

• An error is encountered when you convert a classic policy expression with domain option to advanced policy expression using NSPEPI tool.
  [From Build 59.8]
  [# 710610]

SSL

• In rare cases, on the MPX 22040/22060/22080/22100/22120 and MPX 11515/11520/11530/11540/11542 platforms, TLS renegotiation with a different cipher is not

  supported.
  [From Build 58.18]
  [# 484616]

• The name of the PFX files does not appear correctly.
  [From Build 58.18]
  [# 571273]

• Even though TLS protocol versions 1.1 and 1.2 are not supported by firmware version 1.1, the protocols appear as enabled by default on an SSL virtual server.
  [From Build 51.24]
  [# 576274]

• After you upgrade to this build, the priority of the cipher groups changes in the default profile.
  [From Build 41.24]
  [# 579059, 679085]

• In a cluster setup, a certificate update fails, with the following error, if the certificate is in DER format.

  Error :: No such resource
  [From Build 53.22]
  [# 583715]

• A configuration loss, such as the ECC curve and ciphers unbinding from an SSL virtual server or service, might occur after you upgrade to this build.
  [From Build 51.24]
  [# 613912, 643135, 647100]

• The cipher description for a back-end service differs for different nodes of a cluster.
  [From Build 56.20]
  [# 632280, 631258, 674672]

• While using dynamic services, some SSL counters were not cleared properly when you cleared the configuration. As a result, new connections to the same dynamic services were not accepted.

  With this fix, new connections to the dynamic services are accepted even if the configuration is cleared.
  [From Build 56.20]
  [# 654034, 678140, 666679]

• If you run the "sh ssl service group" command on the cluster IP (CLIP) address and on nodes of a cluster setup, ECC curves are displayed as unbound from the CLIP.
  [From Build 57.24]
  [# 660257]

• If you run the "sh ssl service group" command on the cluster IP (CLIP) address and on nodes of a cluster setup, ECC curves are displayed as unbound from the CLIP.
  [From Build 58.18]
  [# 660257]

• If you add a partition and later remove it, the state of all the SSL virtual servers configured on the appliance changes to DOWN.
  [From Build 51.24]
  [# 660319, 667130, 671887]

• The service group members do not appear in the output of the "show lb vserver <name>" command if it is run on a cluster IP address.
  [From Build 53.22]
  [# 668935, 642802, 463835, 684073, 684892, 691890]

• A NetScaler appliance might dump core and restart if you have configured policy based SSL renegotiation and a client sends multiple SSL records before renegotiation is initiated.
  [From Build 51.24]
  [# 673348, 682192, 682160, 684547, 684992, 687515]

• In rare cases, a NetScaler appliance might dump core and restart if you add a certificate revocation list (CRL) larger than 256 KB.
  [From Build 51.24]
  [# 674278, 678890]

• The NetScaler appliance might occasionally send a wrong certificate if SNI is enabled.
  [From Build 51.24]
  [# 675158]

• Some client authentication connections might be dropped if OCSP check is set to mandatory and an OCSP domain name entry is not found in the NetScaler DNS cache.
  [From Build 53.22]
  [# 675882, 677473]

• If an OCSP responder URL incorrectly resolves to a NetScaler reserved IP address, the appliance dumps core memory and restarts.
  [From Build 41.24]
  [# 675887]

• If an OCSP responder URL incorrectly resolves to a NetScaler reserved IP address, the appliance dumps core memory and restarts.
  [From Build 51.24]
  [# 675887]

• For requests less than 255 bytes long, you can configure the HTTP GET method for queries to an OCSP server. If you specify the GET method but the length is greater than 255 bytes, the appliance uses the POST method by default.

  To set the method by using the NetScaler CLI

  At the command prompt, type;

  set ssl ocspResponder <name> -httpMethod GET
  [From Build 53.22]
  [# 676942]

• If the destination IP address in an OCSP request is an IPv6 address, the NetScaler appliance dumps core memory and restarts.
  [From Build 41.24]
  [# 678474]

• If the destination IP address in an OCSP request is an IPv6 address, the NetScaler appliance dumps core memory and restarts.
  [From Build 51.24]
  [# 678474]

• Session ticket parameters are saved in the configuration (ns.conf) file even though session tickets are not enabled in the SSL profile. As a result, if you upgrade to release 12.0 builds 41.x or build 51.x, you might observe a loss in configuration.
  [From Build 53.22]
  [# 678514, 677813]

• If both OCSP stapling and session ticket are enabled on an SSL virtual server, and a client sends a session reuse request that contains an OCSP stapling status extension, the appliance dumps core memory and restarts.
  [From Build 51.24]
  [# 678743, 678740]

• If both OCSP stapling and session ticket are enabled on an SSL virtual server, and a client sends a session reuse request that contains an OCSP stapling status extension, the appliance dumps core memory and restarts.
  [From Build 41.24]
  [# 678743, 678740]

• You cannot modify the internal OCSP responder parameters in this build. This is a temporary limitation.
  [From Build 41.24]
  [# 679708]

• You cannot modify the internal OCSP responder parameters in this build.
  [From Build 51.24]
  [# 679708]

• The value for days to expiration of a certificate appears incorrectly on a cluster IP (CLIP) address.
  [From Build 51.24]
  [# 682493]

• In a cluster setup, if you remove a service group, the corresponding entries on the CCO node are not deleted.
  [From Build 51.24]
  [# 682767]

• The NetScaler appliance dumps core and restarts if a wildcard SSL virtual server has the -m mac option enabled.
  [From Build 51.24]
  [# 682775]

• In a cluster setup, if you rename a service group, the corresponding entries on the CCO node are not updated.
  [From Build 51.24]
  [# 682784]

• On a NetScaler MPX or SDX 14000 FIPS appliance, requests are not forwarded to the back-end server if virtual-server based transparent access with a wildcard IP address (*:443) is configured in a transparent SSL acceleration setup.
  [From Build 51.24]
  [# 684413]

• Memory usage might continuously increase on a partitioned NetScaler VPX appliance processing SSL traffic. As a result, the appliance might become unresponsive after some time.
  [From Build 51.24]
  [# 685669]

• An SSL handshake might take a long time (many retries) to complete after you restart a NetScaler appliance.
  [From Build 56.20]
  [# 686713]

• The connection with the back-end server is terminated if OCSP validation for the server certificate fails, even though OCSP validation is optional.
  [From Build 53.22]
  [# 686998]

• The NetScaler appliance dumps core and restarts if it receives a request while both session-ticket and SSL-session persistence are enabled.
  [From Build 51.24]
  [# 687575]

• The NetScaler appliance dumps core and restarts if both client authentication and session ticket are enabled and a session ticket reuse request is continuously received on the appliance.
  [From Build 51.24]
  [# 687777]

• In some cases, a pipeline HTTP request is not forwarded to the back-end server if the back-end server sends a response before receiving the full request from a client.
  [From Build 56.20]
  [# 688100]

• If you try to add a certificate-key pair containing an unsupported OID in the Subject Alternative Name (SAN) field of the certificate, the following error message appears:

  ERROR: Invalid OID for SAN entry in certificate
  [From Build 53.22]
  [# 688416]

• A certificate without a common name field in the subject name fails to load.
  [From Build 53.22]
  [# 688811]

• "Duplicate certificate error" appears when you try to bind a certificate containing a specific domain name to an SSL virtual server, if a certificate with a matching wildcard SAN entry is bound to the same virtual server.
  [From Build 56.20]
  [# 691769]

• After you restart a NetScaler appliance, all the ECC curves might be bound a virtual server or service even though they were unbound from that virtual server or service before the appliance was restarted.
  [From Build 56.20]
  [# 691889]

• In a cluster setup, the CRL distribution points in a CA certificate-key pair configured on the cluster IP address do not appear when you run the show ssl certkey command.
  [From Build 58.18]
  [# 691929]

• A NetScaler appliance crashes when session ticket is enabled and continuous session ticket reuse requests are received.
  [From Build 56.20]
  [# 692481, 692823, 694291, 696851]

• An OCSP responder URL is not added to an OCSP HTTP GET request. This causes OCSP failure if GET httpMethod is enabled.
  [From Build 56.20]
  [# 693312]

• If Qualys scan is run on NetScaler IP (NSIP) address, subsequent SSL transactions with Thales HSM will fail.
  [From Build 56.20]
  [# 693356]

• A NetScaler appliance might crash during a DHE based key exchange when an allocation failure occurs because of high memory consumption.
  [From Build 56.20]
  [# 694078]

• If two certificates issued by two different CAs have the same OCSP URL, addition of one of the certificate-key pairs might fail.

  Example

  1. CA certificate C1 is used to issue certificate S1, which contains OCSP_URL1.

  2. Certificate-key pairs for both C1 and S1 are added successfully on the NetScaler appliance.

  3. CA certificate C2 is used to issue certificate S2, which also contains OCSP_URL1.

  4. If you first add a certificate-key pair for S2, it is successful but adding a certificate-key for CA2 fails. If you reverse the order, adding a certificate-key for CA2 is successful but adding a certificate-key for S2 fails.
  [From Build 53.22]
  [# 694395]

• If two certificates issued by two different CAs have the same OCSP URL, addition of one of the certificate-key pairs might fail.

  Example

  1. CA certificate C1 is used to issue certificate S1, which contains OCSP_URL1.

  2. Certificate-key pairs for both C1 and S1 are added successfully on the NetScaler appliance.

  3. CA certificate C2 is used to issue certificate S2, which also contains OCSP_URL1.

  4. If you first add a certificate-key pair for S2, it is successful but adding a certificate-key for CA2 fails. If you reverse the order, adding a certificate-key for CA2 is successful but adding a certificate-key for S2 fails.
  [From Build 56.20]
  [# 694395]

• In a cluster setup, a custom cipher group bound to an SSL profile is lost after the "force cluster sync" command is run. As a result, there will be a configuration loss after the cluster node restarts.
  [From Build 56.20]
  [# 694545]

• A NetScaler appliance might crash if it receives a malformed signature from a client in the Client Certificate Verify message.
  [From Build 56.20]
  [# 694834]

• In some cases, a NetScaler appliance might crash if it finds invalid data while parsing the binary certificate.
  [From Build 56.20]
  [# 694904]

• In some cases, a NetScaler appliance might crash if it finds invalid data while parsing the binary certificate.
  [From Build 53.22]
  [# 694904]

• An SSL handshake fails if both of the following conditions are met:

  - OCSP stapling is configured.

  - Multiple clients request the status of the server certificate in parallel.
  [From Build 56.20]
  [# 696422, 696993]

• On the MPX 5900/8900 and SDX 8900 platforms memory allocation fails in some partitions when the memory allocated from one partition is freed in another partition. This results in incorrect memory accounting across partitions causing memory allocation failures.
  [From Build 57.24]
  [# 697089]

• When the default SSL profile is enabled, ECC curves are not bound to it.

  Work around: Explicitly bind the ECC curves to the default SSL backend profile.
  [From Build 58.18]
  [# 697779]

• The NetScaler appliance becomes unresponsive if after an SNI handshake is complete, an HTTP/1.1 request is received and the SNI certificate is unbound from the virtual server simultaneously.
  [From Build 57.24]
  [# 697789, 697902, 698125, 699526]

• An SSL handshake fails if all of the following conditions are met:

  - Both OCSP stapling and session ticket are enabled on the SSL virtual server.

  - Server certificate is linked to its issuer certificate.

  - Client sends a status_request extension in the ClientHello message.
  [From Build 57.24]
  [# 698066]

• If two SSL connections use the same SSL session ID, session reuse fails if one of the connections renegotiates the session.
  [From Build 58.18]
  [# 698207]

• The message “FIPS Card is not configured” appears if a NetScaler appliance performs a warm restart after the packet engine crashes.
  [From Build 57.24]
  [# 699865, 700588]

• If your deployment uses ECDHE ciphers, ECC curves are not bound by default to a NetScaler CPX instance.
  [From Build 58.18]
  [# 700363, 701991]

• In some cases, the NetScaler appliance terminates the VPN connection because of SNI and HTTP host-header mismatch. As a result, VDI might fail to launch.
  [From Build 58.18]
  [# 702182]

• In some cases, the NetScaler appliance terminates the VPN connection because of SNI and HTTP host-header mismatch. As a result, VDI might fail to launch.
  [From Build 59.8]
  [# 702182]

• A NetScaler MPX 5900, MPX 8900, or SDX 8900 appliance might crash if you enable policy based renegotiation.
  [From Build 58.18]
  [# 702328]

• In a NetScaler Gateway setup, clients cannot connect to the back end server after restarting the appliance if the server supports only ECDHE ciphers.

  The issue occurs because ECC curves are not bound to dynamically created backend services after you restart the appliance. As a result, the NetScaler appliance does not send ECDHE ciphers in the client hello to the backend server and therefore clients are unable to connect.
  [From Build 58.18]
  [# 705313, 709151, 709496]

• In a cluster setup, cipher suites bound to a custom cipher group are lost from the CLIP node after you upgrade the setup.
  [From Build 59.8]
  [# 707738, 708168]

• The symmetric operations fail because the SSL card becomes unresponsive.
  [From Build 58.18]
  [# 708375, 709406, 708978, 708923, 711264, 711404]

• In an SSL reuse handshake, the NetScaler appliance crashes due to memory allocation failure.
  [From Build 58.18]
  [# 708542]

• A NetScaler appliance might crash if an OCSP responder is configured with nonce disabled and the integrated caching feature is enabled so that OCSP objects are cached.
  [From Build 59.8]
  [# 709491, 707452, 710458, 707610]

• The “No Certificates present in the certificate bundle file" error appears when you try to add a PFX file using the NetScaler GUI.
  [From Build 58.18]
  [# 710202]

• GSLB virtual servers are not accessible if you make any changes to the enabled default SSL profile.

  With this fix, any change to the SSL profile does not affect the state of the GSLB virtual servers.
  [From Build 59.8]
  [# 710207, 710428]

• Ciphers bound to an SSL service group are not included in the running config if the following commands are run in a sequence:

  1. set ssl servicegroup <servicegroup name> -sslprofile <profile name>

  2. bind ssl servicegroup <servicegroup name> -ciphername <profile name>

  As a result, after you save the config and restart your appliance, the ciphers are not bound to the service group.

  With this fix, the commands are included in the running config. However, you must run the bind command once after upgrading your appliance to include the command in the running and saved configuration files.
  [From Build 59.8]
  [# 710573]

• In rare cases, an attempt to install a new certificate on an MPX 9700/10500/12500/15500 appliance might fail with the “bad pkcs error” counter incremented if the private key “CRT Params” size is not equal to the maximum size allowed.
  [From Build 59.8]
  [# 711066, 706981]

• If you configure an MPX/SDX 14000 FIPS appliance for the first time, the appliance restarts after you run the "reset fips" command.
  [From Build 59.8]
  [# 713370]

• On a NetScaler VPX appliance, memory leak is observed when policy-based renegotiation happens.
  [From Build 59.8]
  [# 714186, 706370]

• On an SDX 14000 FIPS appliance, the FIPS card resets if all of the following conditions are met:

  - You created a partition in release 11.x.

  - The partition name is greater than 12 characters.

  - You upgrade the appliance to release 12.x.
  [From Build 59.8]
  [# 714338]

Secure Web Gateway

• You cannot add an SSL interception or a URL categorization policy by using the NetScaler GUI because the list of categories is missing.
  [From Build 57.24]
  [# 705340, 706317]

• You cannot add an SSL interception or a URL categorization policy by using the NetScaler GUI because the list of categories is missing.
  [From Build 58.18]
  [# 705340, 706317]

System

• A logon issue is observed if you try to insert and delete cookies at the same offset and if the AppFlow and client-side measurement features are enabled on a NetScaler appliance.
  [From Build 56.20]
  [# 633371, 682640, 672615, 639767, 387117, 232011]

• Enabling both the AppFlow option and the AppQoE option might cause a memory leak, which can degrade performance and eventually cause the appliance to fail.
  [From Build 51.24]
  [# 640545, 685334, 686832, 687603]

• If the integrated cache (IC) memory limit is set to a value greater than 4 GB and front end optimization (FEO) is enabled, the NetScaler appliance crashes.
  [From Build 51.24]
  [# 666208]

• A NetScaler appliance fails if multiple vulnerabilities are observed in the Network Time Protocol (NTP) daemon and if it is exploited by an external or local user authentication.
  [From Build 56.20]
  [# 669821, 670476, 688886, 685045]

• In an SSL connection with a client, the NetScaler appliance does not evaluate the SSL policies for HTTP/2 streams.
  [From Build 53.22]
  [# 670556, 660674, 672227, 689849]

• A NetScaler appliance adds an SNMP trap for TCP-level synflood if the Varbindings are incorrect for the synflood trap.
  [From Build 51.24]
  [# 671128]

• Snmpd communicates with nsaggregatord to process the requests it receives. The SNMP Code also maintains a cache of the responses from aggregator in the form of a CacheTable. If the CacheTable is corrupted, a crash might result.
  [From Build 51.24]
  [# 675631]

• In a non-end-point mode, for every out-of-order packet, NetScaler generates a duplicate acknowledgment (DUP_ACK). In a rare case of sack disabled packets, after generating a duplicate acknowledgment, the appliance does not reset the counter which results in unnecessary duplicate acknowledgments causing the connection to disconnect.
  [From Build 56.20]
  [# 676598, 690857]

• If the session ID maintained for clients exceeds the threshold of 16 million entries, the configuration engine might crash. That affects the management traffic. As a result, the management connection closes and the manager must log back on to the NetScaler appliance.
  [From Build 53.22]
  [# 676599, 692553]

• If you enable Front End Optimization (FEO) and configure Integrated Cache (IC) with cache selectors, the NetScaler appliance might crash.
  [From Build 51.24]
  [# 677943]

• The NetScaler appliance crashes if the total number of TimeWait connections exceeds 7000 while the MPTCP feature is enabled.
  [From Build 53.22]
  [# 678015]

• In a high availability setup, the following command-propagation warning message appears when a backup is created for a large configuration file on the primary node: "Warning: There is no response from secondary. Propagation Timed out” However, propagation of the backup file succeeds after some time.
  [From Build 51.24]
  [# 679376]

• A NetScaler appliance crashes if the content-type header is missing from an HTTP responder.
  [From Build 51.24]
  [# 681284]

• If a client sends an HTTP/2 header continuation frame, the NetScaler appliance dumps core.
  [From Build 51.24]
  [# 681361, 683274]

• An attempt to configure a NetScaler appliance that uses Cloudstack can cause the appliance to fail. If the Cloudstack AutoScale feature or an AutoScale policy is configured with the IP address a server, an attempt to configure the appliance through the NetScaler CLI instead of through CloudPlatform or Cloudstack binds the IP-address based server to the AutoScale Policy service group. This causes the appliance to crash.
  [From Build 53.22]
  [# 681426]

• If a load balancing virtual server configured with a backup server is down, the si_cur_Client counter underflows, causing client connections for the virtual server to display abnormal values in the NetScaler GUI.
  [From Build 51.24]
  [# 682762]

• A NetScaler appliance might crash, if a particular sequence of white space and CR-LF characters is sent to an HTTP or SSL virtual server instead of a valid HTTP request.
  [From Build 53.22]
  [# 683512, 699684]

• If multiple trap destinations have the same IP address but different SNMP versions, one of which is SNMPv3, modifying an SNMPv3 trap message leads to an appliance failure.
  [From Build 51.24]
  [# 683622, 683806]

• If the MSS value in a client TCP handshake with a NetScaler appliance is from 1322 to 1329, the appliance sends 1330-byte segments, which cause packet drops, and the TCP connection fails.
  [From Build 51.24]
  [# 684148, 687638]

• Some packets become invalid and are dropped when policies are applied. If HTTP/2 packets are dropped, the NetScaler appliance fails to send a rst_stream frame to the client, which causes the appliance to crash when new packets arrive.
  [From Build 53.22]
  [# 684370]

• A NetScaler device might fail if it sends FIN packets on a Multipath TCP (MPTCP) fallback connection and the global state variable has not been cleared.
  [From Build 56.20]
  [# 684574, 685357, 687357, 696622]

• The NetScaler appliance does not include the latest DATA_ACK packet in the retransmitted data segments. It reuses DATA_ACK packets that were sent in the original data segment.
  [From Build 53.22]
  [# 684908]

• Connections can become unresponsive because of data loss that occurs under the following set of conditions:

  * Different traffic domains are configured on the virtual server and the service.

  * Data insertion causes the NetScaler appliance to split packets.
  [From Build 56.20]
  [# 685510]

• A NetScaler appliance in a high availability configuration crashes when using TCP transport to send log messages.
  [From Build 51.24]
  [# 685898]

• When a client times out and sends a message longer than one packet, TCP sends a FIN packet to the application handler (for example, SSL). When TCP receives the second packet, it directly sends the packet to the application handler. As a result, the application handler generates a close notify alert for the first packet and an RST alert for the second packet.
  [From Build 53.22]
  [# 686390]

• The NetScaler appliance does not send buffered log messages when the SYSLOG server is ready to accept them.
  [From Build 51.24]
  [# 686751]

• In a SYSLOG action, setting the netProfile parameter during a log transfer causes multiple SYSLOGTCP connections to be established but only one connection serves the log traffic.
  [From Build 53.22]
  [# 687042]

• A NetScaler appliance might crash if it receives a FIN packet with multiple invalid SACK blocks from the origin server and tries to forward the packet to an MPTCP client.
  [From Build 53.22]
  [# 687118, 687352, 687351]

• The user is not able to log on to NetScaler Gateway as there is a high-utilization of memory.
  [From Build 56.20]
  [# 687462, 686135, 692657, 699960, 698852]

• The user is not able to log on to NetScaler Gateway as there is a high-utilization of memory.
  [From Build 53.22]
  [# 687462, 686135, 692657]

• If a NetScaler-inserted cookie is deleted from the end of a cookie header, the appliance does not remove the preceding semicolon. As a result, an extra semicolon is sent at the end of the cookie header when forwarding it to the back-end server.
  [From Build 53.22]
  [# 687612]

• A NetScaler appliance can become unresponsive if it hosts a wildcard load balancing virtual server that has the use source IP option enabled and the use proxy port option disabled. The failure occurs if the virtual server associates the outgoing probe connection information with different incoming connections destined to the same server.
  [From Build 53.22]
  [# 689915]

• HTTP headers can be corrupted by the following series of events:

  * The rewrite feature inserts an end-of-header mark, but the next packet contains more header bytes.

  * The compression (CMP) feature interprets the incorrectly marked HTTP header-end as the actual end of the header, and tries to insert a content-encoding header.
  [From Build 56.20]
  [# 691308]

• If a NetScaler appliance performs window management for Transparent connections with Dynamic Window Management option enabled in the TCP profile, it results in a window update acknowledgment. This causes a wrong mapping of sequence and acknowledgment numbers and connection to disconnect.
  [From Build 56.20]
  [# 692149]

• In a high availability (HA) setup, if you use the NetScaler GUI to modify the Responder policy configuration, the system displays the following error message, "Command failed on a secondary node but succeeded on the primary." However, the changes get synchronized from primary to secondary NetScaler.
  [From Build 58.18]
  [# 692261]

• When a NetScaler appliance completely closes an active TCP connection, if the back-end server has its connection in TIME_WAIT state, the server silently drops the connection. When dropping the connection, the server uses the same 4tuple unless the initial sequence number of the connection is greater than the current running sequence number of an existing connection. As a result, the appliance keeps retrying to establish the connection but the transaction fails.
  [From Build 58.18]
  [# 692473]

• When you access NetScaler Gateway, the log message, "default AAA message" repeatedly appears in the Netscaler log file and overloads it. The issue occurs if you set log message at the default informational level.
  [From Build 58.18]
  [# 692563]

• If a client using the NITRO API over HTTPS to connect to a NetScaler appliance reuses the same source IP address and port within two TCP maximum segment lifetime (MSL) timeout intervals, the connection might be dropped with a TCP reset. Similarly, client TCP connections might be dropped under the following set of conditions:

  * Source IP address is enabled and proxy port disabled in the client's connection request.

  * A previous server connection still exists on the appliance and has persisted for two TCP MSL timeout intervals.
  [From Build 56.20]
  [# 692613]

• A NetScaler appliance might become unresponsive if an incorrect nstrace logic is applied for collecting packets in TXB mode.
  [From Build 56.20]
  [# 694368]

• The HTTP state machine causes a NetScaler appliance to crash. The issue occurs during an unexpected state transition for collecting necessary data for further analysis. The issue also leads to an unexpected outage.

  A NetScaler administrator can run the command, "nsapimgr_wr.sh -ys invalidwaitqdbg=0 -ys actvtransdbg=0" to change the default panic behavior of the appliance.
  [From Build 58.18]
  [# 694410]

• The NetScaler appliance does not initiate subflows (MP_JOIN's). The appliance expects the client to initiate subflows.
  [From Build 57.24]
  [# 694416]

• For HTTP 2 streams, the stat counters does not increment correctly. For example, when a new stream of data arrives, the counts fails to increment, but decrements correctly, when the stream is closed. This incorrect operation leads to a wrong count of action performed on the HTTP2 streams.
  [From Build 59.8]
  [# 694684, 683374, 694695, 678994]

• A NetScaler appliance crashes if an HTTP/2 stream that is in Closed state and the system tries to process the HTTP/2 stream's final data.
  [From Build 58.18]
  [# 695601]

• A memory leak occurs if Content Filtering feature is configured with either an add prebody or an add postbody action.
  [From Build 56.20]
  [# 696218, 699644]

• A NetScaler appliance might crash if it receives original and retransmitted MP_JOIN SYN packets in succession.
  [From Build 57.24]
  [# 697267]

• A NetScaler appliance is unable to handle an 'HTTP Response before Request' case. The issue occurs, if the back-end server sends a 204 or 304 response before receiving an HTTP request body.
  [From Build 58.18]
  [# 697525]

• A NetScaler appliance might crash if it selects a MP_JOIN subflow that is not fully established to send a FASTCLOSE packet.
  [From Build 57.24]
  [# 698360]

• Strong ciphers are not enabled on a VPX appliance with Telco licenses. As a result, the VPX-T platform supports only export ciphers and denies HTTPS access. This fix addresses the issue by enabling strong ciphers for Telco platform licenses thereby enabling HTTPS access and SSL use cases for VPX-T platform.
  [From Build 56.20]
  [# 698725]

• A NetScaler appliance aborts a websocket connection that tracks failed websocket upgrade attempts. This leads to a connection closure with App Flow feature or "Drop invalid requests" option enabled on the HTTP profile.
  [From Build 58.18]
  [# 699831]

• A NetScaler appliance might crash if it sends messages from one processor to another processor, for deleting a steering session in some error cases.
  [From Build 58.18]
  [# 700423]

• A NetScaler appliance might crash with different backtraces if any one of the following conditions is met:

  • Memory is freed to wrong pool.

  • AppQoE or HTMLInjection feature is enabled.

  • AppFlow feature is enabled with clientSideMeasurements option enabled in the AppFlow action.
  [From Build 56.20]
  [# 700529]

• In high memory condition, a NetScaler appliance crashes and dumps core memory because of a memory allocation issue.
  [From Build 58.18]
  [# 701323]

• A NetScaler appliance might crash if the following set of conditions are met:

  * Either the Compression policy or its actions are changed.

  * AddVaryHeader is enabled when configuring the compression parameters.
  [From Build 58.18]
  [# 702081]

• The browser displays a parsing error (ERR_SPDY_PROTOCOL_ERROR), if both of the following conditions are met:

  HTTP/2 feature on a NetScaler appliance is enabled.

  HTTP response code 422 is configured on the back-end service.

  However, if you change the response code from 422 to 404 or other or if you disable the HTTP/2 feature, the browser does not display an error.
  [From Build 58.18]
  [# 702275]

• The NetScaler appliance might fail in responding to SNMP requests because of an internal buffer issue.
  [From Build 58.18]
  [# 702683, 698872, 705377]

• A NetScaler appliance gives priority to a TCP Cookie option instead of an MPTCP MP_CAPABLE option when responding with an SYN/ACK (synchronize-acknowledgment) to the client. The issue occurs if the appliance does not have sufficient space to fit both the options in the TCP options space.
  [From Build 58.18]
  [# 702766]

• The HTTP state machine causes a NetScaler appliance to crash. The issue occurs during an unexpected state transition for collecting necessary data for further analysis. The issue also leads to an unexpected outage.

  A NetScaler administrator can run the command, "nsapimgr_wr.sh -ys invalidwaitqdbg=0 -ys actvtransdbg=0" to change the default panic behavior of the appliance.
  [From Build 58.18]
  [# 703098]

• The show techsupport command fails if a NetScaler appliance uses a proxy server to upload the tech support bundle to the Citrix Insight Services (CIS) platform.
  [From Build 58.18]
  [# 703520]

• After an upgrade, instead of initiating a new TCP connection to the back-end server for CONNECT Requests, the NetScaler appliance reuses a client connection from the reuse pool. The client connection reuse might not be accepted by some back-end servers.
  [From Build 58.18]
  [# 704304]

• A NetScaler appliance crashes because of a timer issue. The issue occurs if the stats are collected after the SYSLOGUDP connection is deleted, but before the appliance deletes the SYSLOGUDP service.
  [From Build 58.18]
  [# 705574]

• After an upgrade, a NetScaler appliance is unable to handle data for a CONNECT request that does not have a Content-Length or a Transfer-Encoding header.
  [From Build 58.18]
  [# 705625]

• A NetScaler appliance crashes after an upgrade from build 11.1 54.14 to build 12.0 57.19.
  [From Build 58.18]
  [# 705813]

• In a high availability setup, if you apply a forced failover command, the ICA sessions move to the new primary appliance but the new secondary appliance crashes.
  [From Build 58.18]
  [# 705978]

• A NetScaler appliance might crash if it tries to reoptimize object that is already cached. The issue occurs when you change the Front End Optimization (FEO) action or enable FEO feature after some objects have already been cached on the appliance.
  [From Build 58.18]
  [# 706285]

• In NetScaler GUI, an issue is observed if a checkbox does not have a label associated with it. According to 504 compliance, each GUI element must have a label.
  [From Build 58.18]
  [# 706314]

• In NetScaler GUI, an issue is observed if a checkbox does not have a label associated with it. According to 504 compliance, each GUI element must have a label.
  [From Build 57.24]
  [# 706314]

• If you collect a packet trace with '-capsslkeys' option enabled, all the keys captured in the nstrace.sslkeys file are zeros. The issue is observed only on NetScaler MPX 5900/8900, MPX 26000-100G, and MPX 15000-50G platforms.
  [From Build 58.18]
  [# 707793]

• In a NetScaler appliance, if you enable Single sign on and HTTP/2 on the back-end service then, the output handler to send out packets for HTTP/2 clear text upgrade is not set properly.
  [From Build 59.8]
  [# 707964]

• In a NetScaler appliance, the maximum number of requests that can be sent on a connection to the back-end server fails under the following conditions:

  - HTTP profile is bound to a service group.

  - maxReq option is set to 1.
  [From Build 58.18]
  [# 708447]

• If you configure an HTTP type load balancing virtual server with HTTP/2 option enabled on the HTTP profile, the appliance fails to load balance gRPC traffic.
  [From Build 58.18]
  [# 709214]

• If you configure an HTTP type load balancing virtual server with HTTP/2 option enabled on the HTTP profile, the appliance fails to load balance gRPC traffic.
  [From Build 59.8]
  [# 709214]

• If the trace aggregator processor leak opens a file descriptors every time you execute the nstrace command, the NetScaler appliance might display the following error message: "kern.maxfiles limit exceeded".
  [From Build 58.18]
  [# 709430]

• The "sh audit messages" command does not display log messages in the following case:

  If you configure the log facility parameter with a value other than LOCAL0 in the "syslogparams" or "syslogaction" command.
  [From Build 59.8]
  [# 709464]

• During a TCP handshake, if the server responds with a TCP window size of 0 bytes, the appliance keeps the connection in TCP persist mode. Later, if the server opens the TCP window, the connection remains in persist mode and is not removed. As a result, the persist and keep-alive lists get mixed up and the appliance crashes when it tries to free the connection.
  [From Build 59.8]
  [# 711131]

• A NetScaler appliance might crash if an external authentication server takes more than 20 seconds to respond.
  [From Build 59.8]
  [# 711282]

• If flash cache option is enabled on a NetScaler appliance and also receives client requests to the same resource, the appliance resets the connection before it sends the response to the client.
  [From Build 59.8]
  [# 711508]

• Service state synchronization is not happening in a cluster node deployment, if the following conditions are observed:

  - Cluster setup is upgraded from 11.1 builds.

  - Audit log action (SYSLOG or NSLOG) is configured with SYSLOG or NSLOG server's domain name.
  [From Build 59.8]
  [# 711841]

Telco

• In NetScaler T-13xx platform, the NetScaler software incorrectly calculates the minimum memory required for large scale NAT (LSN) configurations. The NetScaler appliance might become unresponsive if the memory limit is set to a value lower than the incorrectly calculated minimum required memory displayed in “show extendedmemory” output.
  [From Build 53.22]
  [# 689375]

• The NetScaler appliance might translate the subscriber’s packets related to an LSN configuration with the NAT IP of the other LSN configuration if both of the following conditions are met:

  - the same subscriber IP address is present as part of these two LSN configurations

  - the first LSN configuration’s IP pooling type is paired
  [From Build 58.18]
  [# 700934]

• In a large scale NAT deployment of a NetScaler appliance with SIP ALG configured, SIP service registration might fail. This registration fails because of an internal issue related to paired IP retrieval.
  [From Build 58.18]
  [# 709643]

Telco GUI

• The libqos actions are displayed in the QOS action page of the NetScaler T-series platform GUI.
  [From Build 59.8]
  [# 697178]

Telco System

• The NetScaler appliance is unable to retain "DropEstConnOnTimeout" parameter of the custom TCP profile, after a reboot.
  [From Build 58.18]
  [# 707007]

Telco URL Filtering

• The NetSTAR Software Development Kit (SDK) is now upgraded to version 1.6.2-18 to support URL Filtering feature.
  [From Build 56.20]
  [# 692666, 695092]

• After you upgrade the NetSTAR seed database, you must flush the cache database so that it synchronizes with the new seed database.
  [From Build 56.20]
  [# 694947]

• The NetScaler URL Filtering feature now enables you to download NetSTAR seed database, in different sizes. For instructions on how you can increase the seed database size, refer to https://support.citrix.com/article/CTX2293.
  [From Build 56.20]
  [# 695350]

• In a NetScaler appliance, for efficient logging, the URL Filtering log messages are now logged in the /var/log/ns.log file.
  [From Build 56.20]
  [# 695621]

• The URL matching algorithm does not work as expected for second or higher level domains. For example, if an incoming URL is www.bbc.co.uk and the pattern stored in the URL set is bbc.co.uk (without www), the algorithm does not match an entry in the URL set.
  [From Build 58.18]
  [# 704456]

• When a NetScaler appliance filters an incoming URL using URL Categorization policy, the appliance includes an "http:/" prefix in the AppFlow data. As a result, the appliance overwrites the prefix with the key word “ILLEGAL” in the detected domain field. The issue occurs only if a URL Categorization policy is used.
  [From Build 59.8]
  [# 704641]

• A NetScaler appliance becomes unresponsive when you set the URL Filtering parameters. The issue occurs if the appliance receives heavy traffic with many URL categorization requests.
  [From Build 58.18]
  [# 705897, 705973]

URL Categorization

• If you execute the command "show urlset <urlset_name>", the NetScaler appliance returns information for the requested urlset and any other urlsets added after it.
  [From Build 59.8]
  [# 709042]

Upgrade and Downgrade

• Repetitive messages appear in log files when you restart the NetScaler appliance after upgrading the firmware. The messages appear regardless of whether you use the GUI or the CLI to perform the upgrade. The repetitive logging stops when you log back on to the appliance.
  [From Build 56.20]
  [# 690534]

User Interface

• When secure connection is enabled on CCO, config sync doesn't work.
  [From Build 41.24]
  [# 525671]

• When a non-nsroot system user logs on to the NetScaler GUI, the set system parameter command is executed internally. This command fails because the user is not authorized to run this command. The appliance creates entries in the ns.log files for this command failure for this user. These log entries introduce an ambiguity regarding whether the user requires specific permission for this command.

  With this fix, this internally run command is no longer logged in the ns.log file.
  [From Build 58.18]
  [# 665454]

• In a cluster setup, the “bind vlan” command and the management connection to the NetScaler appliance might fail if the length of both IP address and subnet mask is 15 characters each (including the decimal.)

  For example, bind vlan 100 192.168.250.196 255.255.255.204
  [From Build 57.24]
  [# 699032, 702822]

• In a cluster setup, the nodes become unresponsive if you run any configuration command on the CLIP while sync is in progress on a non-CCO node.
  [From Build 57.24]
  [# 700626]

• In a cluster deployment, you cannot set or reset the rsskey on each node.
  [From Build 57.24]
  [# 701078]

Video Optimization

• The Dashboard and Reporting tabs in the NetScaler GUI do not display the video optimization statistics.
  [From Build 56.20]
  [# 692757, 678095]

• The NetScaler appliance does not display an error message if you have configured a negative integer for the QUIC Video Pacing Rate parameter.
  [From Build 56.20]
  [# 693423]

• A NetScaler appliance does not correctly regulate retransmitted TCP packets.
  [From Build 56.20]
  [# 698919]

• During video optimization, buffering occurs because of a conflict between the Nile congestion handler and the pacing scheduler.
  [From Build 59.8]
  [# 705099]

• In a NetScaler appliance, if you enable Video Optimization feature, the appliance introduces increased video buffering that affects end-user video experience. The issue occurs because the Video Optimization packet scheduler does not send packets at regular intervals and packets are dropped at regulated rates.
  [From Build 58.18]
  [# 708468]

• In a rare case, a NetScaler appliance crashes in an internal function that extracts the SSL Detected Domain. The issue randomly occurs when the policy infrastructure framework evaluates a Policy expression that is blocking.
  [From Build 59.8]
  [# 710894]

Web App Firewall

• A NetScaler appliance crashes when it attempts to access the return address of a stack frame which is not present in an XML payload.
  [From Build 59.8]
  [# 703461, 712938, 714297]

• In rare cases, the file upload feature does not work if older requests have multiple content-disposition headers in the payload.
  [From Build 59.8]
  [# 711048]

• In a cluster setup, when you deploy a Learned Rule for HTML Cross-Site Scripting check, the NetScaler appliance displays an error, "The CrossSiteScripting Check is already in use".
  [From Build 59.8]
  [# 714392, 688279, 633031]

Web Application Firewall

• A NetScaler appliance might crash, if you enable the Web Application Firewall or Clientless Access (CVPN) or URL transformation feature and if you turn on the Security Insight feature along with "x-forwarded-for" AppFlow parameters.
  [From Build 59.8]
  [# 699564, 703832, 700422, 706353, 704910, 708919, 710243, 711918, 711649, 715371, 716864]

Release history