So, decided to play around with the new VPX Express licensing in 14.1. I have a couple XenServer lab nodes, so I spun up two NetScalers from the OVA. They are up, running, but refuse to synchronize in an ha pair. NS certificate is in place. They show to have the free license. But they will not synchronize. I suspect that this may be a limit of the free license. Is this correct? No ha pairs on free licensing?

Check your ssl ciphers, they are missing…

So, you are thinking the express license will permit HA? We are trying to figure out what we are going to do for our CSP customers that use a VPX for gateway. Since they will have to be licensed through our NS Console in the future, this requires an NS Agent. Smallest one possible on AWS for example is 8 CPU 16 GB RAM which costs ~$144 US. this seems to be a costly burden for a customer who only needs to license a VPX. VPX Express could (once it works) answer this problem. A 25 user client can use up to 20 MB of throughput. I thought the problem was only with upgraded appliances. I guess I will have to wait for the fixed version. 😞

Yes, it will allow HA as it is fully featured except that you don’t get support. HA is depending on correct encrypted connections, so without ciphers it is a no go.

VPNs on AWS and Azure still incur costs. All my customers would then have a common VPN tunnel to the same place, which seems, at best, problematic and, at worst, a security hole. And I am on the hook to provide the agent. They need to offer a free method to prove that you have the license they are giving you for free. Proving license ownership is something the vendor needs, not the customer or the reseller. Therefore, the software vendor should incur the costs of proving license ownership, not the customer or the reseller.

If you run free, you don’t need the console agent. If you license it, just open up tcp/27000 to the agent and that’s it. Security impact would be minimal at that point, although I agree they still connect to a single agent. Maybe WireGuard vpn is more cost effective instead of traditional IPsec

7279 is also needed for licensing. Product document shows it is from the NetScaler to the agent. I wonder if you could permit inbound TCP 27000 and 7279 from specific internet IPs and avoid tunneling... Security problem too, but if inbound IP addresses is limited....

That one as well, my bad. But those are two only two needed.

Agreed, just hate to have to do extra effort. I still think it is on NetScaler to provide an easy way to license.

Not sure if possible on public cloud, but on-prem you could trim down on the agent system requirements.

Public cloud permits "Agent Lite" which is the 4 CPU/8 GB RAM, 30 disk. But this is ~$144 US/month on AWS. Documentation states for licensing you can reduce the agent to 4 CPU 8 GB RAM. I can run a VPX on 2 CPU 4 GB RAM. But I need twice the resources to license it. See what I am saying? There cannot be that much load on any appliance to license another appliance. What else is it doing that it needs that many resources? For licensing only, I should be able to use a t2.micro, not a m4.xlarge.

I totally agree it’s idiotic!! And what about the onboard agent in NetScaler?

Can't use the onboard agent, because local licensing requires a file, and remote licensing wants an IP address.

I think it has been in the works for a long time to make a smaller agent, but given the current licensing structure with UHMC and CPL, they want you to use analytics anyway.

We have a meeting with the PMs hopefully next week to discuss this. Wish me luck convincing them we need a smaller option.

Let me know the RFE and I’ll back you up from CTP and PTEC!

But of course.