Tag: NetScaler Gateway 16 posts

Many NetScaler administrators are currently likely to be updating their appliances to 14.1-73.33 or later because of current security issues.

And, of course, the recommendation remains:

👉 Install security updates!

However, the release notes contain a small detail worth knowing before the maintenance window.

ICA Proxy sessions may lose their ability to reconnect

The scenario:

A user starts a Citrix session before the NetScaler upgrade.

The session continues running on the VDA.

The NetScaler is then updated to 14.1-73.33+.

When the user subsequently tries to reconnect to the existing session:

💥 Reconnect fails.

The reason is the session tickets issued before the upgrade.

They can no longer be used for reconnection after the upgrade. The user must start a new session.

The good news:

This is not a general ICA Proxy issue after the upgrade.

Sessions started after the upgrade work normally, including subsequent reconnects.

No additional configuration is required.

The affected transition is:

Pre-upgrade session → upgrade → post-upgrade reconnect

Why does this matter?

We normally perform NetScaler HA upgrades with as little user impact as possible:

Upgrade secondary → failover → upgrade primary.

It is easy to assume:

HA upgrade without downtime = users notice nothing.

That is not necessarily true here.

The infrastructure may be fully available while existing ICA sessions are still affected at the next reconnect.

🔥 Zero-downtime HA upgrade ≠ zero user impact

My recommendation

When upgrading to 14.1-73.33+:

👉 Account for existing ICA sessions
👉 Inform users about possible session loss
👉 Prepare the service desk accordingly
👉 Perform the upgrade outside productive usage hours where possible

This small detail can become particularly relevant in 24/7 environments.

Takeaway

Of course, this is no reason to postpone a security update.

But it demonstrates again:

Sometimes the most interesting findings are not in the security bulletin, but somewhere in the release notes. 😉

Over recent weeks, I have observed repeated unexplained reboots and anomalies involving the Packet Engine (nsppe) in several NetScaler environments.

Interestingly, I am apparently not alone. Administrators in the NetScaler community are reporting similar cases, sometimes involving multiple reboots within a few hours across several appliances.

In one of these cases, Citrix Support reportedly identified an unexpected termination of a Packet Engine process (nsppe) with signal 11. The supervision process then detected the Packet Engine failure and initiated an appliance restart.

Particularly noticeable: some events were observed after high volumes of malformed or suspicious SSL VPN requests, including path-traversal patterns.

Important: A causal link between these requests and the nsppe crashes is currently not confirmed. This should not be interpreted as evidence of a new exploit or vulnerability.

However, the current NetScaler 14.1 build 73.30 is interesting.

This version contains a range of fixes, including changes around the Packet Engine. At the same time, early administrator reports suggest their systems stabilized after updating to 14.1-73.30.

My recommendation
Anyone currently seeing unexplained NetScaler reboots should investigate more closely:
🔹 Check nsppe crashes and core dumps
🔹 Check /var/core
🔹 Analyze newnslog and system logs around the reboot
🔹 Correlate the timing with SSL VPN/Gateway traffic
🔹 Check the current firmware level
🔹 Assess the fixes in 14.1-73.30 against your own environment

I would therefore include 14.1-73.30 in near-term upgrade planning, following prior testing, of course.

If the Packet Engine dies and the appliance consequently reboots, it was UP again afterwards is not a sufficient investigation. 😉

I would be interested to know: Have you also seen unexplained reboots or nsppe crashes on NetScaler 14.1 in recent weeks?