GM, we have a HA pair with some issues related to v14.1.x and DUO. What's the best way to setup a Netscaler UAT? Clone or just new install and import configuration (vSphere)?

I usually will just parallel authentication options on the same unit. Easier to flip between modes. And removes different snip issues that can show up from using a separate instance.,

The problem is that this is 24/7/365, so currently not able to swap v13 to v14 with DUO OAuth. Not even for troubleshooting.

I would import config (via backup)

yeah, that's the plan, just got a new VPX running, just need to wait for full backup and running config.

are you connecting it to the same networks as the production?

yes, I will get another public IP for UAT testing.

the ns.conf -file inside the backup contains the production IPs, so if you just restore that in to a parallel box, you will run in to some serious IP conflict issues

yes indeed, I will need to cleanup the file before it gets imported.

or then just disconnect the traffic interfaces from the hypervisor, boot it up, update the IPs and once the System / Network / IPs -list doesn't show any conflicting IPs with prod, you can connect the interfaces