https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
j
I would create new LACP with correct VLANs. Can you do HA to replicate the conf between the 2 NS?
💯 1
c
I have gave the two new 5905s new nsips and they are now on the network. I am going to perform a firmware upgrade to latest version and license them and configure hostnames and configure NTP and configure LACP then add them together in a HA pair. I am planning to export the ns.conf from the mpx 8200 and make amendments with notepad++ after copying over files such as SSL certs, and loginschemas, VPN bookmarks ect and then day of cutover shutdown the mpx 8200s and then do a batch import of the modified ns.conf minus things such as the HA config/hostname/NSIP ect and fix the vlan to interface bindings in the config
j
I am in a similar situation. I would get the network NSIP, LACP ready then you break HA on 8200 and add 5905 to it. Run your load from 5905, once good, remove 8200 and add other 5905. Easier than amending the NS.conf and less risky IMO. That's how I've done it when I replace NS hardware.
c
Interesting I did think about that method and it's clearly the easiest way to do it but I was always under the impression that because the hardware is different it's not recommended to HA pair a mpx 8200 and 5905 as an example? And not everything you need file wise is synced through HA. This is why i was going to copy over things like the vpn bookmarks , ssl certs,loginschemas,themes and then export the ns.conf and modify it and then batch import it on day of cutover once i shutdown the old MPX 8200
j
You need to be on the same firmware, that's all, hardware doesn't matter. And all files needed are sync through HA. A ctx told me that a while ago, I did already successfully and going to do again the same way very soon.
c
wouldnt it break tho if the MPX 8200 hardware lets say had 1Gbps interfaces 1/1 1/2 ect and the new mpx 5905 had 10Gbps interfaces 10/1 10/2 ect if you added them into a HA pair and the conf had the incorrect vlan to interfaces bindings ?
j
Interface, vlans are not part of the HA sync, only files. So when you have the new 5905 ready by network, create new VIP and SNIP in various VLANs to confirm connectivity then delete. At this stage you can start breaking HA and add the new 5905 to HA Pair.
Check CTX109013 and it is clearly said "The info about the interfaces are also omitted" from the HA sync. I've done it a few times with different interfaces binding, it works 100%
k
Great info. Had quite long exercises when migrating HW to new platform previously... never even considered the HA path @jvitech discussed here!
🙏 1
Although these been somewhat worthwhile as we've had the opportunity to modernize the configs on the same go (and firmware version)... moving one VIP at a time
👍 1
c
great thread to stumble on, thanks for the info @jvitech. Banking this for next hardware appliance migration👍
👍 1
c
@Steve Noel
s
timely info, tried searching keywords in here and in linen and didn't come up with this, thanks for the mention @c4rm0
so your breaking HA pair when adding the new models? any reason why they can't be added to the existing HA pair with the 'stay secondary' ha mode setting?
j
You can't have 3 nodes in HA last time I checked, only 2.
s
oh, is that the reason i've only ever seen 2!?!!? haha, for some reason thought you could add more
👍 1
maybe this confused me.
c
clustering you can have more nodes HA is always two 🙂
👍 1
just completed my change to migrate our mpx 8200's to the mpx5905. I shutdown the mpx 8200's and then batch imported my modified nsconf. When reviewing the output of the batch import and checking the config on the mpx 5905's i noticed it errored importing the SSL certs and LDAP,Radius auth servers with errors like below (basically anything with a encrypted password using KEK files). I had to recreate the Auth polices/servers for ldap and radius (my saml auth policy/server also didnt import but beleive that was because the idp cert signing cert was missing) and rebind them i also had to re add each SSL cert and re bind and re link which Is strange as i copied over the .KEK files from old to new Netscaler and had also copied over all SSL certs and keys. exec :add authentication radiusAction IFVMOKTAVIP -serverName IFVMOKTAVIP.corp.com -serverPort 1812 -authTimeout 120 -radKey 12345 -encrypted -encryptmethod ENCMTHD_3 -kek -suffix 2023_05_14_07_05_36 ERROR: Internal error [Error while decrypting the argument]
exec :add ssl certKey Citrix.corp.com-2020 -cert Citrix.corp.com-2020Nokey.cer -key Citrix.corp.com-2020 da391bae9736372a9379000000000cf03fad5acae509dbe8dfdfbf5b40 -encrypted -encryptmethod ENCMTHD_3 -kek -suffix 2023_05_14_07_05_36 ERROR: Internal error [Error while decrypting the argument]
all good apart from that which was a pain in ass
k
it was so much easier with the certs before they started encrypting the passwords 😄
an improvement definitely, but migrating stuff is a tad harder if one has lost the password
s
if you replace the guid with the plain text password and remove the -encrypted and -encryptedmethod it will work, done that a few times nwo.
j
If you copy the private key from old to new NS, it can decrypt the pwd, no change needed.
c
It didn't work I had copied all the certs and private keys and kek files from old netscalers to new prior to the batch import. It used to work on older versions when I did it but didn't this time as they are now encrypting the passwords in the private key
j
Oh ok thanks for the info!
5 Views
Open in Slack
PreviousNext
Powered by