Is DNS-01 the only way to do the challenge? If so, then the line on the above link "Validate domain ownership using automated methods (For example, DNS-01 challenge)." is kind of incorrect, isn't it? Shouldn't it say "Validate domain ownership using DNS-01 only (HTTP-01 not supported)"

Recently, I tried to download the ADM agent from the Cloud Console. After selecting the on-prem Linux KVM server and clicking Download Image, the download didn’t start.

Because of this, we downloaded the ADM agent directly from the Citrix website and installed it on OpenStack. However, when running the deployment.py script, we encountered an issue.

The script is supposed to prompt for the service URL and activation code, but these prompts never appear. We also created a support ticket, but we haven’t received any updates yet.

If anyone has experienced this issue or knows a solution, please share—your help would be greatly appreciated.

when I want to Update the Netscaler Console, i got the following Error:

Database corruption detected. Upgrade cannot proceed. Restore to the previous stable system backup for recovery.

Current Version is: 14.1-56.71
Update Version is: 14.1-60.52

When I go to bash and Run /mps/mas_recovery/mas_recovery.py script then Database Connection is fine.

Does anyone have an idea?

Is there a way to configure an alert to notify us if an ADM agent goes down? For NetScaler instances, we’re able to receive alerts, but we’d like to achieve the same for ADM agents as well.

If anyone has documentation or knows of a possible method to set this up, please share—it would be very helpful.

Thank you!

Request is simple, a dark mode for the GUI. Living in 2025 almost 2026 and still no dark mode would help not only me alot but others as well.

└── OU=Citrix

└── OU=Groups

└── CN=ag_netscaler_user

└── OU=Groups

├── CN=Network

└── CN=role_network_operator

└── CN=user_to_authenticate

I want to use ag_netscaler_user to authenticate users, where role_network_operator is a memberOf ag_netscaler_user. But console logs show only main group CN=role_network_operator during extraction.
/usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[2203]: receive_ldap_group_search_event 0-0: Nested group extraction done for user user_to_authenticate, group string:
role_network_operator
/usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[2229]: receive_ldap_group_search_event 0-0: Nested group extraction done for user brozma, group string:
role_network_operator
, now doing user bind
/usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[2265]: receive_ldap_user_bind_event 0-0: Got user bind event.

It means ag_netscaler_user is never extracted. My Nested Group Extraction config:
Enable Nested Group Extraction: Enabled
Maximum Nesting Level: 3 (just in case, but 2 should be enough)
Group Name Identifier: cn
Group Search Attribute: MemberOf
Group Search Subattribute: cn

I am facing an issue where the "Transaction Logs" page under Web Insight module is not populating on an on-premise ADM installed on Nutanix AHV. I am sharing the configuration at both Netscaler and ADM. Could anyone please help us to resolve the issue?

Netscaler HA on MPX 9110

Netscaler Version: NS14.1 47.48.nc

License Type: Premium

ADM Version: 14.1 47.46

Netscaler Appflow Collector Configuration output of command "show appflow action af_action_log_10.xx.xx.xx_web_insight"

Name: af_action_log_10.xx.xx.xx_web_insight

Collectors: af_collector_logstream_10.xx.xx.xx

Client-side Measurements: ENABLED

Page Tracking: DISABLED

WebInsight: ENABLED

Security Insight: DISABLED

Bot Insight: DISABLED

Content Inspection Insight: DISABLED

Video Insight: DISABLED

Distribution Algorithm: DISABLED

Metrics Logs: NO

Transactions Logs: ALL

Hits: 1

Action Reference Count: 1

ADM Configuration:

1. Enabled Web Insight with "Client side measurements"

2. Enabled Detailed Web Transactions under Analytics Settings. Screenshot attached.

I need advice on a somewhat unusual Load Balancer configuration.

I'm using Netscaler for DNS load balancing, based on a DNS-based Vserver. All my client workstations are configured to use the Vserver's IP address as their primary DNS server.
For certain DNS queries, I need Netscaler to intercept the query and provide a different response than the DNS server.

For example, on the DNS servers, the server1.remote.lan record has the IP address 192.168.1.10.
I would like Netscaler to respond with 10.20.30.40 when a client performs a DNS query to resolve server1.remote.lan.

Some of you may be wondering why I want to do this. It's because we have a conditional forwarder on our DNS server that forwards queries for the remote.lan domain to another company's DNS server. However, the IP address provided by it is not accessible on our local network. The returned IP address should be a NAT IP address. I don't want to create a specific DNS zone on our DNS servers.

After a little digging, I succeeded using DNS-specific rewrite policies:
- policy: dns.RES.QUESTION.TYPE.EQ(A) && DNS.RES.QUESTION.DOMAIN.EQ("server1.remote.lan")
- action: dns.new_rrset_a("10.20.30.40",300)
However, I have about fifty exceptions to handle, which would require me to create 50 rewrite policies/actions.

I tried to use the "String Maps" feature, but I can't get it to work (because dns.new_rrset_a accepts only a string, not a function)

Note that Netscaler is currently in version 13.1 57.26 (I'll be updating soon).

If anyone has any ideas, I'd love to hear them.

I thank you in advance for any help you can give me

I am also seeing 9 files changed on all of the MPX 16000 machines with names of /etc/c6xx_ns_dev0.conf through c6xx_ns_dev8.conf.

All of the files seem to be the same interiorly, and suggest they are for a device config of some sort.

Should I be concerned about these? Is there a way to mark them as Known?

(See attached images)

I upgraded the NetScaler Console version to the latest 14.1  34.43 and these two NetScalers will still not come out of Unmanaged to allow for Bandwidth and License adjustment via the NetScaler Console.  When viewing the NetScaler in the Instances view I have an option to “Unmanage” it.  I have tried selecting this and trying to manage it again but nothing is working. 

Can someone confirm this functionality actually works for them?

https://docs.netscaler.com/en-us/netscaler-console-service/manage-licenses/flexed-licenses/configure-flexed-licensing.html#step-3---edit-flexed-bandwidth-for-netscaler-instancesvia

How can I remove the dead Netscaler from the inventory and release the license on the console? 

is it a new way of working that when we enable Analytics by using NetScaler Console on NetScaler ADC that the process only create a collector and appflow profiles but is not creating actions and policies that have to be bonded on vServer?

Thanks,

Gérald

What are Citrix ADM/Console ML/AI capabilities for WAF , DOS or Bot?

I mean like providing recommendations, auto tunning the WAF relaxation rules, detecting Bots or auto DOS HTTP Layer 7 threeshold configuration.

I'm using Netscaler Console Service for many different administration purposes e.g. custom configuration jobs, notifications, audit config templates, etc.

Is there a way to export all possible custom configurations on NS Console Service A and import them on a NS Console Service B?

Many thanks in advance

I'm trying to onboard my NetScaler's and am getting the following error.

HTTP Error 500 ([object Object]) while accessing the data endpoint: "tenant"

Can you assist?

Cheers

Martin

I am trying to replicate this functionality in ADM and needs some idea on how to do this. FYI, I am totally new in this. Thanks.

save config

reboot -warm

Y

We need to allocate the new licenses to the ADM as their Virtual Servers allocated licensing is expiring soon, but there is no legacy style license available.  We applied the flex licensing but it did not increase the virtual server license count.

Does this mean on-prem ADM is dead for analytics?

What am I missing?  Possibly another tile on my Citrix Cloud dashboard?  I see ADM being mentioned occasionally.  There isn't a separate ADM tile, right?  I don't have that if so.

Thanks.

We want to integrate a Netscaler VPX with the built-in agent for another location. This Netscaler VPX is also displayed in the Netscaler Console under Infrastructure-Instance Dashboard-Netscaler (status is up, agent is empty, only “–” is displayed. According to the diagscript on the Netscaler VPX, communication with the Citrix Cloud is good and error-free. Under Netscaler Licensing-Flexed Licensing-Dashboard, it is also shown that the instance license and throughput capacity for the third Netscaler VPX have been issued “Allocated” (Again 1 Instance and 1 Gbps Capacity). But I cannot see the third Netscaler VPX under Licensed Netscalers. This means I cannot carry out the step that is required according to the instructions in the Netscaler Console to end the license status “Grace Period”.  In the Netscaler VPX Console, the license status is also displayed as pooled with the requested bandwidth. Here I can also request a further bandwidth capacity increase.  However, you will then receive a warning that the Netscaler is in grace mode and will lose its functionality after 720 hours.

NetScaler VPX in the second location can talk to the Agent with LSA role in the first location over Firewall-Rules.  I use License Server IP  (127.0.0.1) in Netscaler Instance with the built-in agent.  I also tried using the IP address of the on-premises agent that holds the LSA role as the license server IP. No change, so I changed back to 127.0.0.1 as described in the documentation.

Why is this Netscaler VPX not displayed as a Netscaler Agent and Licensed Netscaler in the Netscaler Console? 

Or if I need to configure my appliances to point to Solarwinds with SNMP.

Chad

As a CSP, we are migrating from the old licensing model (create a license file on the Citrix portal and import this into the netscaler appliances) to the new licensing model (through Netscaler Console hosted on Citrix cloud, Flexed licensing and a Netscaler console agent on premise who is acting as proxy between the ADCs and Netscaler console).

I've got some questions about a best practice setup (and avoid single point of failures).

•  in a scenario with multiple sites and 1 agent per site, there is only 1 LSA per tenant (https://docs.netscaler.com/en-us/netscaler-console-service/manage-licenses/adm-service-agent-behavior-pooled-licensing.html). If the agent goes down in one of the sites (no matter if this agent is the LSA or not), the ADC (registered to this agent) will enter a grace period for 30 days. This means, during the downtime of this agent, all ADC's connected to this agent will enter a grace period and you cannot modify the license allocation. Am I correct that everything will keep on working (except license modifications like assign 1 GB instead of 500 MB bandwidth) as long as you don't exceed those 30 days? It's not like to the ADC will start working with a express license?
•  we have, logically seen, 1 datacenter but in fact, there are 2 physical datacenters with L2 connection in between. Netscaler HA pairs have both members running in a different physical datacenter but they connect to each other in the same L2 subnet. I'm thinking now about the 'Netscaler Console agent setup'. Should I deploy 1 agent (in one of the 2 physical locations) or 2 agents (one in each physical location)?
  • deploying 1 agent in one of the 2 physical locations : this means I can register both ADC members of a HA pair to the same agent and this agent will provide licensing for both ADCs (ADC 1 is located in datacenter 1 and ADC 2 in datacenter 2). In case of a failure with the agent, I have 30 days to fix this and meanwhile, I cannot modify licenses.
  • deploying an agent in both physical locations : if agent 1 is acting as LSA (only 1 agent can act as LSA) and this one is failing, license allocation will automatically migrate to agent 2 within 24 hours? But should I register ADC 1 to agent 1 and ADC 2 to agent 2 (while ADC 1 and ADC 2 are both members of a HA group)?

Documentation is a bit confusing but as I understand, I should register both ADC members of a HA pair to the same agent.

As long as, in case of a agent failure and I don't need to modify licenses and I can get it back up & running within 30 days, one agent on one of both datacenters is sufficient.

Is this correct?

thanks for your help!

Gijs.