Release Notes for Citrix ADC 13.0-89.7 Release
This release notes document describes the enhancements and changes, fixed and known issues that exist for the Citrix ADC release Build 13.0-89.7.
Notes
- 这个版本notes文档不包括安全内核ity related fixes. For a list of security related fixes and advisories, see the Citrix security bulletin.
What’s New
The enhancements and changes that are available in Build 13.0-89.7.
Citrix ADC SDX Appliance
“Gateway” and “Nexthop” fields are optional while provisioning or editing the VPX
在a Citrix ADC SDX appliance Management Service, the “Gateway” and “Nexthop” fields are no longer mandatory for provisioning, editing, taking backup, or restoring VPX when the following conditions are met:
- Either of the following options is true:
- “Manage through the internal network” is enabled for VPX.
- VPX IP address is in the same subnet as the Management Service IP address.
- VPX is provisioned with version 13.0-88.9 or 13.1-37.8, and their higher versions.
For more information, seeProvision Citrix ADC instances.
[ NSSVM-5307 ]
- Either of the following options is true:
Enhancements to show the presence of the disk correctly
Enhancements are made to determine the state of the disk on a Citrix ADC SDX appliance. The state of the disk is now shown correctly when the disk is present.
[ NSSVM-5252 ]
Citrix Gateway
Support for HttpOnly flag on authentication cookies
The HttpOnly flag is now supported on the authentication cookies of VPN scenarios that is, NSC_Authentication, authorization, and auditingC and NSC_TMAS cookies. The NSC_TMAS authentication cookie is used during the nFactor authentication and the NSC_Authentication, authorization, and auditingC cookie is used for the authenticated session. The HttpOnlyflag on a cookie restricts the cookie access using the JavaScript document cookie option. This helps in preventing cookie theft due to cross-site scripting.
[ CGOP-14004 ]
User Interface
8 MB upload limit support for
systemfile
NITRO APIThe maximum upload limit for the
systemfile
NITRO API has been increased from 2 MB to 8 MB.[ NSCONFIG-7089 ]
Fixed Issues
The issues that are addressed in Build 13.0-89.7.
AppFlow
With AppFlow configured, the Citrix ADC appliance resets a TCP connection if the appliance receives an empty HTTP chunked response from the back-end server.
This issue occurs when the “clientSideMeasurements” parameter is enabled for the related AppFlow action.
[ NSHELP-32250 ]
Authentication, authorization, and auditing
在a Citrix Gateway GSLB setup, a proxy connection looping between the GSLB sites might be detected if the following conditions are met:
- All the GSLB sites are not on the same version.
- Citrix Gateway is configured with advanced authentication.
[ NSHELP-32487 ]
If both LDAP and SAML authentication are configured in cascade, an error page is displayed during log on.
[ NSHELP-32378 ]
You might experience issues during logout if SAML authentication is configured.
[ NSHELP-31962 ]
The Citrix ADC GUI does not display the default cache policies bound to a VPN virtual server.
[ NSHELP-26874 ]
Citrix Gateway
Some of the VPN sessions might get cleared or removed from the secondary ADC appliance after a failover.
[ NSHELP-33125 ]
Applications might fail to launch through Citrix Gateway because of port exhaustion in the Citrix Gateway appliance.
[ NSHELP-32418 ]
The Citrix Gateway appliance configured for clientless VPN access might crash while processing a dummy session.
[ NSHELP-32399 ]
The Citrix Gateway appliance might crash if HDX Insight is enabled.
[ NSHELP-32120 ]
Gateway Insight authentication failure records display the user name as “Anonymous” when NOAUTH is configured as the first factor and second factor authentication fails due to invalid credentials. This issue occurs only if the configuration is performed by using the nFactor visualizer because the first factor is configured as NOAUTH, by design in nFactor visualizer.
[ NSHELP-31795 ]
Citrix EPA插件macOS GSLB时崩溃enabled on a Citrix ADC appliance.
[ CGOP-22722 ]
The “show vpn icaconnection” command does not display the serial numbers of the ICA connections correctly. This issue occurs because the serial number is reset arbitrarily when the “show vpn icaconnection” command is run.
[ CGOP-22205 ]
Citrix Web App Firewall
内存leak occurs in a Citrix ADC appliance when you set
cookieHijackingAction
to block, log, or stats.[ NSHELP-33187 ]
Load Balancing
The Citrix ADC appliance does not respond with the correct service IP address for GSLB domain query if the following settings are configured on the GSLB virtual server:
- ECS option is enabled.
- Static proximity is configured as the load balancing method.
[ NSHELP-32879 ]
A Citrix ADC appliance might crash during clear configuration if persistence entries are present, and a large number of dummy load balancing virtual servers and group virtual servers are configured.
[ NSHELP-30051 ]
在a high availability setup, the secondary node might crash if the following conditions are met:
- The amount of physical memory on both the nodes is different from each other.
- The data sessions are not synchronized properly.
[ NSHELP-26503, NSHELP-34114 ]
Networking
在a Citrix ADC BLX cluster setup, VTYSH might fail to start if the following condition is met:
- The Linux host is restarted causing order looping of the Citrix ADC BLX Route Health Injection (RHI) process.
[ NSHELP-32473 ]
When you remove a virtual server, the Citrix ADC appliance incorrectly sets the related VIP RHI state to DOWN if the following conditions are met:
- The virtual server has backup virtual servers.
- The virtual server is in DOWN state and at least one backup virtual server is in UP state.
[ NSHELP-29972 ]
SSL
The Citrix ADC GUI, accessed through a Cluster IP (CLIP) address, does not display server certificate bindings to an SSL virtual server.
[ NSHELP-31602 ]
OCSP response verification might fail during SSL interception if a valid CA certificate is not present in the default certificate bundle. The failure happens because the OCSP response verification was incorrectly done using the default certificate bundle instead of the configured certificate bundle.
[ NSHELP-30594 ]
System
A Citrix ADC appliance might crash when it tries to access resources on the freed ICAP. This condition happens when the ICAP is in response modification (RESPMOD) mode.
[ NSHELP-33403 ]
The Citrix ADC appliance is unable to send Logstream data from partitions consistently.
[ NSHELP-33237 ]
The Citrix ADC appliance aborts the connection when it fails to parse the chunked value. This issue occurs when the Transfer-Encoding header has multiple values and Chunked is not the first value.
[ NSHELP-32420 ]
The Citrix ADC appliance configured with an SSL service crashes when the appliance receives a TCP FIN control packet followed by a TCP RESET control packet.
[ NSHELP-31656 ]
A Citrix ADC appliance is unable to trace an ICA connection. The reason for this issue is, during the packet capture, “nstrace” excludes some packets when IP or PORT filters are used with “start nstrace”.
[ NSHELP-29009 ]
User Interface
The Management Service license page does not refresh the pooled license information when you visit the license node or refresh it. Instead, the pooled license information is refreshed only when you log out and log in again.
[ NSHELP-33203 ]
When a user views the binding on a content switching policy, the content switching virtual server details are not displayed in the same row underShow Bindings.
[ NSHELP-33149 ]
Support for power off option in the shutdown NITRO API
The
shutdown
NITRO API now supports the “-p now” option to shut down and power off a Citrix ADC appliance.Example:
在the following example of a curl request, the
shutdown
NITRO API is used with the “-p now” option to shut down and power off a Citrix ADC appliance having the IP address 192.0.0.33.curl -v -X POST -H Content-Type: application/json -u nsroot:examplepassword [http://192.0.0.33/nitro/v1/config/install?warning=yes](http://192.0.0.33/nitro/v1/config/install?warning=yes) -d '{"shutdown": {"args":"-p now"}}'
[ NSHELP-32915 ]
When a user binds a traffic policy to a content switching or a load balancing virtual server, the binding details do not appear in the GUI.
[ NSHELP-32751 ]
在a Citrix ADC appliance with admin partitions, the “ns” parameter setting inside the partition is lost after a reboot. This condition occurs due to the wrong built-in configuration.
[ NSHELP-32486 ]
在the Citrix ADC GUI, if there is an existing SNMP trap destination underSystem>SNMP>Traps, editing that destination fails with the following error message:
- “Error in retrieving SNMP trap”
[ NSHELP-31661 ]
在a high availability setup, the encrypted configurations are lost on the secondary node after HA configuration synchronization.
[ NSHELP-30897 ]
Known Issues
The issues that exist in release 13.0-89.7.
Authentication, authorization, and auditing
Single sign-on (SSO) fails if SSO is enabled for the traffic that does not have the required bearer token to handle SSO.
[ NSHELP-31362 ]
Non-ASCII characters are recorded in nsvpn.log when LDAP action is configured to an FQDN instead of an IP address.
[ NSHELP-27281 ]
在certain scenarios, the Bind Authentication, authorization, and auditing group command might fail if policy name is longer than intranet application name.
[ NSHELP-25971 ]
The Citrix ADC appliance dumps core when NOAUTH is configured as the first factor and Negotiate as the subsequent factor in the 401 based authentication flow.
[ NSHELP-25203 ]
如果LDAP管理员密码,半径或TACACS年代ervices contains the double quotes (“) character, the Citrix ADC appliance strips it during the “Test Connectivity” check, resulting in connection failure.
[ NSHELP-23630 ]
DUO authentication fails if the Content Security Policy (CSP) feature is enabled on the Citrix ADC appliance.
[ NSAUTH-12687 ]
Administrators cannot perform custom logging for authentication failures that happen due to invalid credentials. This issue occurs because the Citrix ADC responder policies fail to detect errors for login failures.
[ NSAUTH-11151 ]
ADFS proxy profile can be configured in a cluster deployment. The status for a proxy profile is incorrectly displayed as blank upon issuing the following command.
show adfsproxyprofile
Workaround: Connect to the primary active Citrix ADC in the cluster and run the
show adfsproxyprofile
command. It would display the proxy profile status.[ NSAUTH-5916 ]
Citrix ADC SDX Appliance
When you upgrade a Citrix ADC SDX appliance, in rare cases the following incorrect event appears in the Management Service GUI:
“SVM version and Hypervisor version are not compatible”
[ NSHELP-32949 ]
On a Citrix ADC SDX GUI, displaying the NTP servers can freeze the user interface if the NTP configuration file (ntp.conf) has only spaces in any of the lines.
[nshelp - 31530]
Citrix Gateway
When Citrix Secure Access related registry values are greater than 1500 characters, then the log collector fails to gather the error logs.
[ NSHELP-33457 ]
The Citrix Secure Access client, version 21.7.1.2 and later, fails to upgrade to later versions for users with no administrative privileges. This issue is applicable only if the Citrix Secure Access client upgrade is done from a Citrix ADC appliance.
[ NSHELP-32793 ]
When users click the Home Page tab on the Citrix Secure Access screen for Windows, the page displays the connection refused error.
[ NSHELP-32510 ]
On a Mac device using Chrome, the VPN extension crashes while accessing two FQDNs.
[ NSHELP-32144 ]
Debug logging control for Citrix Secure Access client is now independent of Citrix Gateway and it can be enabled or disabled from the plug-in UI for both machine and user tunnel.
[ NSHELP-31357, CGOP-21192 ]
When Always on is configured, the user tunnel fails because of the incorrect version number (1.1.1.1) in the aoservice.exe file.
[ NSHELP-30662 ]
Users cannot connect to the Citrix Gateway appliance after changing the ‘networkAccessOnVPNFailure’ always on profile parameter from ‘fullAccess’ to ‘onlyToGateway`.
[ NSHELP-30236 ]
The gateway home page is not displayed immediately after the gateway plug-in establishes the VPN tunnel successfully. To fix this issue, the following registry value is introduced.
HKLMSoftwareCitrixSecure Access ClientSecureChannelResetTimeoutSeconds
Type: DWORDBy default, this registry value is not set or added. When the value of “SecureChannelResetTimeoutSeconds” is 0 or not added, the fix to handle the delay does not work, which is the default behavior. Admin has to set this registry on the client to enable the fix (that is to display the home page immediately after the gateway plug-in establishes the VPN tunnel successfully).
[ NSHELP-30189 ]
The Windows VPN client does not honor the ‘SSL close notify’ alert from the server and sends the transfer login request on the same connection.
[ NSHELP-29675 ]
Client certificate authentication fails for Citrix SSO for macOS if there are no client certificates in the macOS Keychain.
[ NSHELP-28551 ]
Sometimes, a user is logged out of Citrix Gateway within a few seconds when the client idle timeout is set.
[ NSHELP-28404 ]
The Citrix Gateway appliance might crash while processing server-initiated UDP traffic.
[ NSHELP-27611 ]
The Citrix Gateway appliance might crash if async is blocked and you modify the content switching policy configuration.
[ NSHELP-27570 ]
The Citrix Gateway appliance might crash if an unknown VPN client option is set in the session policy.
[ NSHELP-27380 ]
While creating an RDP client profile using the Citrix ADC GUI, an error message appears when the following conditions are met:
- A default pre-shared key (PSK) is configured.
- You try to modify the RDP cookie validity timer in the RDP Cookie Validity (seconds) field.
[ NSHELP-25694 ]
The Gateway Insight does not display accurate information on the VPN users.
[ NSHELP-23937 ]
The “show tunnel global” command output includes advanced policy names. Previously, the output did not display the advanced policy names.
Example:
New output:
show tunnel global
Policy Name: ns_tunnel_nocmp Priority: 0Policy Name: ns_adv_tunnel_nocmp Type: Advanced policy
Priority: 1
全球bindpoint: REQ_DEFAULTPolicy Name: ns_adv_tunnel_msdocs Type: Advanced policy
Priority: 100
Global bindpoint: RES_DEFAULT
DonePrevious output:
show tunnel global
Policy Name: ns_tunnel_nocmp Priority: 0 DisabledAdvanced Policies:
全球bindpoint: REQ_DEFAULT
Number of bound policies: 1Done
[ NSHELP-23496 ]
Sometimes while browsing through schemas, the error message “Cannot read property ‘type’ of undefined” appears.
[ NSHELP-21897 ]
The Windows OS option is not listed in the Expression Editor drop-down list for pre-authentication policies and authentication actions on the Citrix ADC GUI. However, if you have already configured the Widows OS scan on a previous Citrix ADC build using the GUI or the CLI, the upgrade does not impact the functionality. You can use the CLI to make changes, if required.
Workaround:
Use the CLI commands for the configuration.
- To configure advanced EPA action in nFactor authentication, use the following command.
add authentication epaAction adv_win_scan -csecexpr “sys.client_expr(“sys_0_WIN-OS_NAME_anyof_WIN-10[COMMENT: Windows OS]”)” - To configure a classic pre-authentication action, use the following commands.
add aaa preauthenticationaction win_scan_action ALLOW
add aaa preauthenticationpolicy win_scan_policy “CLIENT.SYSTEM(‘WIN-OS_NAME_anyof_WIN-10[COMMENT: Windows OS]’) EXISTS” win_scan_action
[ CGOP-22966 ]
- To configure advanced EPA action in nFactor authentication, use the following command.
在a Citrix ADC cluster setup, HDX Insight and Gateway Insight cannot be enabled simultaneously.
[ CGOP-22849 ]
Application launch failure due to invalid STA ticket is not reported in Gateway Insight.
[ CGOP-13621 ]
The Gateway Insight report incorrectly displays the value “Local” instead of “SAML” in the Authentication Type field for SAML error failures.
[ CGOP-13584 ]
在a high availability setup, during Citrix ADC failover, SR count increments instead of the failover count in Citrix ADM.
[ CGOP-13511 ]
While accepting local host connections from the browser, the Accept Connection dialog box for macOS displays content in the English language irrespective of the language selected.
[ CGOP-13050 ]
The text “Home Page” in the Citrix SSO app > Home page is truncated for some languages.
[ CGOP-13049 ]
An error message appears when you add or edit a session policy from the Citrix ADC GUI.
[ CGOP-11830 ]
在Outlook Web App (OWA) 2013, clickingOptionsunder the Setting menu displays aCritical errordialog box. Also, the page becomes unresponsive.
[ CGOP-7269 ]
Load Balancing
在a high-availability setup, subscriber sessions of the primary node might not be synchronized to the secondary node. This is a rare case.
[ NSLB-7679 ]
在certain scenarios, servers bound to a service group display an invalid cookie value. You can see the correct cookie value in the trace logs.
[ NSHELP-21196 ]
在a cluster setup, the GSLB service IP address is not displayed in GUI when accessed through GSLB virtual server bindings. This is only a display issue, and there is no impact on the functionality.
[ NSHELP-20406 ]
Miscellaneous
The Citrix ADC appliance sets the buffer size for the web server logging feature to an incorrect default value of 3MB instead of 16MB.
[ NSHELP-32429 ]
AlwaysOnAllow list registry does not work as expected if the registry value is greater than 2000 bytes.
[ NSHELP-31836 ]
Citrix ADC CPX instance, running on a Linux system with 64-bit architecture and 1 TB of file storage, can load certificate and key files now.
[ NSHELP-28986 ]
Networking
在a Citrix ADC BLX appliance, NSVLAN bound with tagged non-dpdk interfaces might not work as expected. NSVLAN bound with untagged non-dpdk interfaces works fine.
[ NSNET-18586 ]
The following interface operations are not supported for Intel
X710 10G (i40e)
interfaces on a Citrix ADC BLX appliance with DPDK:- Disable
- Enable
- Reset
[ NSNET-16559 ]
On a Debian based Linux host (Ubuntu version 18 and later), a Citrix ADC BLX appliance is always deployed in shared mode irrespective of the BLX configuration file (“/etc/blx/blx.conf”) settings. This issue occurs because “mawk”, which is present by default on Debian based Linux systems, does not run some of the awk commands present in the “blx.conf” file.
Workaround: Install “gawk” before installing a Citrix ADC BLX appliance. You can run the following command in the Linux host CLI to install “gawk”:
- apt-get install gawk
[ NSNET-14603 ]
在stallation of a Citrix ADC BLX appliance might fail on a Debian based Linux host (Ubuntu version 18 and later) with the following dependency error:
“The following packages have unmet dependencies: blx-core-libs:i386 : PreDepends: libc6:i386 (>= 2.19) but it is not installable”
Workaround: Run the following commands in the Linux host CLI before installing a Citrix ADC BLX appliance:
- dpkg –add-architecture i386
- apt-get update
- apt-get install libc6:i386
[ NSNET-14602 ]
在a large scale NAT44 setup, the Citrix ADC appliance might crash while receiving SIP traffic because of the following reason:
- The LSN module does not find the service while decrementing the reference count or deleting the service.
[ NSHELP-29134 ]
在a large scale NAT44 setup, the Citrix ADC appliance might crash while receiving SIP traffic because of the following reason:
- Because of stale filtering entry.
[ NSHELP-28895 ]
在a Large scale NAT44 deployment, the Citrix ADC appliance might crash while receiving SIP traffic because of the following reason:
- The LSN module accessed the memory location of an already deleted service.
[ NSHELP-28815 ]
在a high availability setup, dynamic routing enabled SNIP address is not exposed to VTYSH on reboot if the following condition is met:
- A dynamic routing enabled SNIP address is bound to the shared VLAN in non-default partition.
As part of the fix, the Citrix ADC appliance now does not allow binding a dynamic routing enabled SNIP address to the shared VLAN in non-default partition
[ NSHELP-24000 ]
Platform
The high availability failover does not work in AWS and GCP clouds. The management CPU might reach its 100% capacity in AWS and GCP clouds, and Citrix ADC VPX on-premises. Both of these issues are caused when the following conditions are met:
- During the first boot of the Citrix ADC appliance, you do not save the prompted password.
- Subsequently, you reboot the Citrix ADC appliance.
[ NSPLAT-22013 ]
Some python packages are not installed, when you downgrade the Citrix ADC appliance from 13.1-4.x version and higher versions to any of the following versions:
- Any 11.1 build
- 12.1-62.21 and earlier
- 13.0-81.x and earlier
[ NSPLAT-21691 ]
On the Citrix ADC SDX 8015/8400/8600 platform, you might see increased memory consumption on Xen Server.
Workaround: Run the following command on Xen Server, and then reboot the appliance.
/opt/xensource/libexec/xen-cmdline –set-xen “dom0_mem=1024M,max:1024M”[ NSHELP-32260 ]
During the Citrix ADC VPX HA failover, the Elastic IP address movement in the AWS cloud fails if you configure an IPset without binding the IPset to any IP address.
[nshelp - 29425]
The HA failover for Citrix ADC VPX instance on the GCP and AWS cloud fails when the password of an RPC node contains a special character.
[ NSHELP-28600 ]
Policies
Connections might hang if the size of processing data is more than the configured default TCP buffer size.
Workaround: Set the TCP buffer size to maximum size of data that needs to be processed.
[ NSPOLICY-1267 ]
SSL
When a virtual server receives a TLS 1.3 record with invalid padding, it sends a fatal “decode_error” alert instead of an “unexpected_message” alert.
[ NSSSL-11890 ]
On a heterogeneous cluster of Citrix ADC SDX 22000 and Citrix ADC SDX 26000 appliances, there is a config loss of SSL entities if the SDX 26000 appliance is restarted.
Workaround:
- On the CLIP, disable SSLv3 on all the existing and new SSL entities, such as virtual server, service, service group, and internal services. For example,
设置ssl vserver <名称> -SSL3禁用
. - Save the configuration.
[ NSSSL-9572 ]
- On the CLIP, disable SSLv3 on all the existing and new SSL entities, such as virtual server, service, service group, and internal services. For example,
You cannot add an Azure Key Vault object if an authentication Azure Key Vault object is already added.
[ NSSSL-6478 ]
You can create multiple Azure Application entities with the same client ID and client secret. The Citrix ADC appliance does not return an error.
[ NSSSL-6213 ]
The following incorrect error message appears when you remove an HSM key without specifying KEYVAULT as the HSM type.
ERROR: crl refresh disabled[ NSSSL-6106 ]
Session Key Auto Refresh incorrectly appears as disabled on a cluster IP address. (This option cannot be disabled.)
[ NSSSL-4427 ]
An incorrect warning message, “Warning: No usable ciphers configured on the SSL vserver/service,” appears if you try to change the SSL protocol or cipher in the SSL profile.
[ NSSSL-4001 ]
System
在a Citrix ADC appliance, the default value of the “maxHeaderFieldLen” parameter in the HTTP profile causes the following issue.
- Traffic failure after upgrading to 13.0 build.
[ NSHELP-32079 ]
High RTT is observed for a TCP connection if the following condition is met:
- a high maximum congestion window (>4 MB) is set
- TCP NILE algorithm is enabled
For a Citrix ADC appliance to use the NILE algorithm for congestion control, the conditions must exceed the slow start threshold, which is coupled with the maximum congestion window
So, until the maximum configured congestion window is reached, the Citrix ADC continues to accept data and ends up with high RTT.
[ NSHELP-31548 ]
A Citrix ADC appliance might crash when the following condition is met:
- Both analytics profile and AppFlow policy are bound, and the profile has the “httpAllHdrs” option enabled.
[ NSHELP-30628 ]
The Citrix ADC appliance reports a false SNMP alarm on the service SYN flood counters.
[ NSHELP-28710, NSHELP-28713 ]
在creased packet retransmissions are seen in public cloud MPTCP cluster deployments if linkset is disabled.
[ NSHELP-27410 ]
Citrix ADC设备可能会发送一个无效的TCP packet along with TCP options such as SACK blocks, timestamp, and MPTCP Data ACK on MPTCP connections.
[ NSHELP-27179 ]
A mismatch in Logstream records is observed in the Citrix ADC appliance and the dataloader.
[ NSHELP-25796 ]
在certain scenarios, the nstrace packet capture misses all packets if you apply the IP address based filter.
[ NSHELP-23483 ]
When you install Citrix ADM on a Kubernetes cluster, it does not work as expected because the required processes might not come up.
Workaround : Reboot the Management pod.
[ NSBASE-15556 ]
在a cluster configuration, a node with CCO priority gets disconnected from Open vSwitch (OVS) because of network issues. After the node rejoins to the cluster configuration, it does not receive the latest SYN cookie.
[ NSBASE-14419 ]
User Interface
Create/Monitor CloudBridge Connector wizard might become unresponsive or fails to configure a cloudbridge connector.
Workaround: Configure cloudbridge connectors by adding IPSec profiles, IP tunnels, and PBR rules by using the Citrix ADC GUI or CLI.
[ NSUI-13024 ]
Modifying a static route by using the Citrix ADC GUI (system > network > routes) might incorrectly fail with the following error message:
- “Required argument missing [gateway]”
[ NSHELP-32024 ]
在an HA / Cluster setup, configuration synchronization fails if you have configured SSH keys other than RSA. For example, ECDSA or DSA keys.
[ NSHELP-31675 ]
在a Citrix ADC appliance, binding the cache policy to override global or default global using the GUI interface fails with the following error:
- Required argument missing.
This error is not seen while binding the cache policy using the CLI interface.
[ NSHELP-30826 ]
Due to an incorrect upgrade installation sequence, the following issue occurs in the Citrix ADC appliance.
- The kernel image is updated first and after a few steps, encryption keys are copied. In between these steps some failure happens and the ADC appliance comes up with a new image. The missing encryption keys in the new image lead to decryption failure and missing configuration.
[ NSHELP-30755 ]
Citrix ADC GUI might incorrectly generate a cluster technical support bundle of only one node instead of all the cluster nodes.
[ NSHELP-28606 ]
Generating a cluster technical support bundle by using Citrix ADC GUI might fail with an error.
[ NSHELP-28586 ]
After upgrading a high availability setup or a cluster setup to release 13.0 build 74.14 or later, config synchronization might fail because of the following reason:
- Both “ssh_host_rsa_key” private and public keys are an incorrect pair.
Workaround: Regenerate “ssh_host_rsa_key”. For more information, seehttps://support.citrix.com/article/CTX322863.
[ NSHELP-27834 ]
You cannot bind a service or a service group to a priority load balancing virtual server using the Citrix ADC GUI.
[ NSHELP-27252 ]
在a high availability setup, VPN user sessions get disconnected if the following condition is met:
- If two or more successive manual HA failover operations are performed when HA synchronization is in progress.
Workaround: Perform successive manual HA failover only after the HA synchronization is completed (Both the nodes are in Sync success state).
[ NSHELP-25598 ]
Sometimes it takes a long time for the Application firewall signatures to sync to non-CCO nodes. As a result, commands using these files might fail.
[ NSCONFIG-4330 ]
If you (system administrator) perform all the following steps on a Citrix ADC appliance, the system users might fail to log in to the downgraded Citrix ADC appliance.
- Upgrade the Citrix ADC appliance to one of the builds
- 13.0 52.24 build
- 12.1 57.18 build
- 11.1 65.10 build
- Add a system user, or change the password of an existing system user, and save the configuration, and
- Downgrade the Citrix ADC appliance to any older build.
To display the list of these system users by using the CLI:
At the command prompt, type:query ns config -changedpassword [-config
] Workaround: To fix this issue, use one of the following independent options:
- If the Citrix ADC appliance is not yet downgraded (step 3 in above mentioned steps), downgrade the Citrix ADC appliance using a previously backed up configuration file (ns.conf) of the same release build.
- Any system administrator whose password was not changed on the upgraded build, can log in to the downgraded build, and update the passwords for other system users.
- If none of the above options work, a system administrator can reset the system user passwords.
For more information, seehttps://docs.citrix.com/en-us/citrix-adc/13/system/ns-ag-aa-intro-wrapper-con/ns-ag-aa-reset-default-amin-pass-tsk.html.
[ NSCONFIG-3188 ]
- Upgrade the Citrix ADC appliance to one of the builds