https://worldofeuc.com logo
Join Slack
Powered by
I really shouldn't be allowed to touch NetScalers ...
# citrix-netscaler
j
I really shouldn't be allowed to touch NetScalers - just did an upgrade (from the CLI, I've learned) and it all seemed to go OK, config is solid and running the latest version - but now every time I access the gateway website, I get the following error. Nothing else has changed bar the upgrade - anyone got any pointers?
r
Does it work in incognito?
j
No, same error
r
i'd diff the config then... upgrade borked something for sure
c
You got saml configured in a nfactor flow ?
shell nsapimgr_wr.sh -ys call=ns_saml_dont_send_subject
✅ 2
c
j
That is present in the RC.netscaler file, the line John put in
c
Where is your advanced saml Auth policy bound ? In a nfactor policy label or directly on the AAA vserver ?
You only need the above command if you are using nfactor
j
I haven't a clue, where do I check that?
c
on your AAA Vserver you can find it in Security > AAA Application traffic > Virtual servers
j
Let me check that when I get back from football
c
You only need the nsapimgr command if you have your advanced saml auth policy part of a nfactor flow. In this setup its bound directly to the AAA Vserver and not part of the nfactor flow so dont need the command
j
OK, so this is weird. After the NetScaler boots if I run "shell nsapimgr_wr.sh -ys call=ns_saml_dont_send_subject" from the console, everything works fine. But this line is present in the rc.netscaler file, so why isn't it being run at bootup?
c
j
/bin/sh /etc/ntpd_ctl full_start
nsapimgr_wr.sh -ys call=ns_saml_dont_send_subject
I tried removing the first line and just using the second, still doesn't seem to work. That Citrix article looks - confusing
c
your rc.netscaler file in /nsconfig ? these are the commands i ran from my notes Run the command ‘nsapimgr_wr.sh -ys call=ns_saml_dont_send_subject’. Run the command ‘touch /nsconfig/rc.netscaler’ Run the command ‘chmod 644 /nsconfig/rc.netscaler’. Run the command echo “nsapimgr_wr.sh -ys call=ns_saml_dont_send_subject” >> /nsconfig/rc.netscaler
j
Yes it's in nsconfig folder. Let me try these commands
This is so annoying - ran those commands and the file looks fine....reboot and it breaks, run the command manually from the console, everything fine again. How odd
If I hash out the line in the crontab file like it suggests in the Citrix article, this makes no difference either - the changes to the crontab file don't persist after a reboot either
r
i don't understand why you would need to do that stuff, because, yes, that makes sense
@uncon ^---- you know everything...
c
Yeah I am a bit unsure what is going on as adding the nsapimgr command to the rc.netscaler file should be all that is required for it to persist after a reboot
j
Fuck it, I've logged a case with Citrix, let them sort it
n
same issue here after upgrading to .72 to address the cve....i rolled back the snapshot for now, no time to deal with it at the moment
j
Wow, glad to hear I'm not alone
a
Same issue for me after upgrade to 13.1-56.18, nsapimgr command not working even if present in rc.netscaler. Any response on the support case?
j
None yet. For me, the command works if run directly from SSH but not from rc.netscaler
a
yes same for me
k
just a wild guess... what are the permissions on rc.netscaler? ... I mean like: 
cd /nsconfig
ls -la | grep rc.netscaler
j
Checked that, they're all fine
c
The commands I gave James uses chmod 644
k
oh, sorry... tl;dr
😀 1
j
Citrix have confirmed this as a bug (rc.netscaler not working after upgrade to latest version) as it affects multiple customers, engineering working on a fix
👍 9
❤️ 1
🙌 1
n
I figured it was, hence was i rolled back the snap and moved on to the next crisis, hehe
@James Rankin I forgot to ask, what version did you experience this issue on?
j
13.1
n
yea, me too....no new version yet...
j
Jan for the update, or you can upgrade to 14.x if you want the fix sooner
n
looking to move to 14.1 for OTP actually....starting to investigate in between other projects...
r
@Richard Faulkner ^--- This thread here, i think might be relevant.
👀 1
c
@James Rankin did the fixed 13.1 build ever come out ?
j
Not that I've noticed. You all know as much as me now, we no longer have a back door into Citrix 😞
c
looks like it did
image.png
sweet
j
"An internal error"
r
About time.
n
anyone have 57.26 in prod yet, granted its only been 24 hours....i dont want to be the first to jump in the pool
r
We want you to be the first in the pool. 🙂
c
done my UAT Netscaler didnt see any obvious issues after firmware update and been connected all day to it without issues via HDX
👍 1
any one updated to 13.1.57.26 yet ? since the firmware update i been getting some HA propergation errors. I tried turning it off/on via set HA node -haProp DISABLED/Enabled but still seeing the errors
c
I updated my H/A pair Thursday night , running in Azure. Failed over a few times. No issues so far
c
getting loads of config saves as well (Seems like every hour ) i am guessing these are coming from netscaler console
2 Views
Open in Slack
PreviousNext
Powered by