https://worldofeuc.com logo
Join Slack
Powered by
New week, same story :slightly_smiling_face: <CIT...
# citrix-netscaler
c
New week, same story 🙂 CITRIX | Support
👀 3
💩 3
🤮 2
😢 2
n
At least I only have to change a couple numbers from last week's RFC 😂
😅 1
😂 1
j
Are they going to backrev this one too? Or just get everyone to 47.46
k
this is bullshit.
13.1-59.19 is not available in NetScaler Console service
💯 1
d
Anyone on 47.46? Any serious issues?
k
@Dima, just updated one env, nothing for me, but read a couple of messages above, there seem to be issues with WatchGuard IdP and there was something with RSA key authentication (ssh based management I think), no sure if touches the latest 14.1
👍 1
l
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server I think we are affected if using Citrix Gateway because it's ICA Proxy or not ? Thanks
j
yes, gateway is affected as well
m
With 13.1-59.19 not being available in NetScaler Console service I'm currently incapable of action.
c
Jep, we're uploading the Firmware from local
👍🏻 1
j
I had other people report batching from console as well. I have been telling them all just do the winscp and putty method
s
My God. 2 weeks in a row?
l
Citrix doens't have a cyber security team which is able to test and analyse version before posting to be ensure there is no security breach ?
s
Just patched both of my VPX clusters to 59.19. No issues
👍🏻 1
👍🏼 1
👍 1
j
On the bright side, I haven't had any issues downloading FW either this week or last.
👍🏻 1
👍 2
a
I just ran on one of my test environments and seems to have broken radius. No error just loops.
j
Can you reproduce the issue with cache disabled, in incognito/inprivate or in a fresh browser @Al?
e
Was just about to upgrade when I saw your message, @Al. Would love to hear some more.
a
Yes reproduced, and mas even sends me failure for the login. But on the login screen it just continues to prompt for radius
We are using radius for second factor for mgmt access to mgmt.
Over 2 hour wait time with even talking to support.
🥃 1
e
Anyone else with Radius experiencing problems? Or not? :)
k
now the 13.1-59.19 build shows up in the library in NSC
👍🏻 1
m
It’s not radius for auth on the gateway?
s
no radius configured here
j
I have radius on one gateway, but I won't have that one updated until this afternoon.
m
Everything updated. We'll see tomorrow, if there are any issues.
🍺 2
m
Appreciate you early adopters ❤️
j
I updated our lab to 59.19 and radius on the gateway seems to be working ok for me.
l
Same here on our Lab. We use Watchguard MFA Radius on Citrix Gateway and its working.
k
Don't you love it that in the previous CVE a problem in the SAC was also posted which required to patch it. Now that they shipped 13.1-59.19, it comes with an older, vulnerable version of the SAC and you need to remember to patch it again after you've updated the firmware.
m
So maybe just something with radius being used for management
r
@Al I just now discovered that I can't even log into MAS/NetScaler Console since I updated it to 13.1-58.32 - not with LDAP credentials nor the local nsroot account. (I upgraded to 13.1-58.32 last week, but hadn't tried logging in since. I went to log in today to upgrade to 13.1-59.19 and couldn't log in.) Ugh..
e
@Robert Blissitt I experienced that exact same issue. Had to use this procedure to reset the password: How to reset the password for NetScaler ADM | NetScaler Application Delivery Management 13.1
a
I didn’t have any issue with console, but i am at 14. 1.47.46.
r
@Eric Spicer Thank you... 🙂 So far those instructions seem to be working well. (I'd forgotten that I'd recently upgraded the NetScaler Console to 14.1, so I used the slightly different instructions at https://docs.netscaler.com/en-us/netscaler-application-delivery-management-software/cu[…]t-release/manage-system-settings/how-to-reset-password.html )
m
I didn’t have issues with the console upgrade but they have some hsts bug in it that Nessus is annoying me about now lol. Should be fixed in the next release according to support
g
Upgrading our VPX from 13.1 58.32 -> 13.1 59.19. It looks like they added Content-Security-Policy header on the gateway. One of our login flows uses an external js file so that broke after the upgrade. I reverted the firmware while I figure out my plan.
b
Someone on Reddit mentioned this: Citrix Gateway > Global Settings > Change AAA settings > Default CSP header? = Disabled It did not fix the issue with our traditional Duo iframe not loading. Maybe it will work for others.
k
If you have enabled WAF for GW/AAA and run in to problems, make sure you're running the latest signature version. Just saw that as an issue.
s
This whole date shuffle on 14.1-Versions is still confusing... to patch all the vulnerabilites from last week and yesterday... which version on 14.1 should be installed on the ADCs?
k
14.1-47.46
👍🏻 1
👍 1
m
It's 10am now. We only make use of ICA Proxy with LDAP, RADIUS or SAML And Load Balancing for Storefront and Director: All 30 VPX run without issues. 4x 14.1 and 26x 13.1.
✅ 2
e
No issues here. Gateway with Radius/SAML/OAuth.
🥳 1
l
In version 13.1-59.19, we have an issue on Citrix Gateway with SAML because on firefox it's working but on Chrome/Edge when accessing the url of citrix gateway, the navigator is not redirecting to external saml. After clearing the cache, same issue but working on firefox, not on Edge/Chrome.
j
No issues here after testing with our RADIUS and SAML SP Gateways; 13.1 58.12 to 13.1 59.19
r
@lstod I am now running 13.1-59.19 and not experiencing that problem with Firefox or Edge. Brandon mentioned the "Citrix Gateway > Global Settings > Change AAA settings > Default CSP header" setting. Don't know if it will help with 13.1 or not. This may be the reddit thread he is talking about above: https://www.reddit.com/r/Citrix/comments/1ldqfuv/is_ctx693420_security_issue_for_netscaler_gateway/
g
@Brandon Faubion. Thanks this does seem to be my problem. Changing it doesn't fix it right away. In DevTools I can see that getAuthenticationRequirements.do no longer has CSP but images that are part of the theme still are sending it. I can see it on multiple computers so I think it is cached on the NetScaler.
j
If you change that you have to flush the optimization cache as well for it to take effect immediately.
g
Using 
shell nsapimgr_wr.sh -ys call=ns_ic_flush
cleared it. (not plat). Thanks!
👍 1
b
@Greg Beck @Jeff Riechers Thanks guys. After flushing the cache it's now working.
l
We disabled csp because here you see it was enable :
it's working, thanks
o
@Shane Kleinert fyi on above for our FIPS and non-FIPS, etc.
a
Just an update for me, shell works fine with workspace worked fine too. Thanks. I was more concerned with workspace, so just seems it broke with mgmt gui console.
r
This did not work for me. 13.1 59.19. Management GUI broken. Using Radius which points to NPS then Duo Auth Proxy. setting set aaa parameter -defaultCSPHeader DISABLED didn't work, or a nsapimgr_wr.sh -ys call=ns_ic_flush... aaad.debug just shows a generic error. RADIUS auth: ignore radius error below, canceling dialogue mode....
URL goes to login/loginview?errorcode=1034, instead of the normal /login/do_login to enter my passcode
Radius using a user that doesn't point to Duo, and has just a Read-Only command set works fine though....
j
Did the 13.1 59.19 put in the CORS policies like 14.1 that broke the classic duo iframe? If so you need these policies bound to your Gateway.
add rewrite action delete_cors_header_1_act delete_http_header Cross-Origin-Opener-Policy add rewrite action delete_cors_header_2_act delete_http_header Cross-Origin-Embedder-Policy add rewrite action delete_cors_header_3_act delete_http_header Cross-Origin-Resource-Policy add rewrite policy delete_cors_header_1_pol true delete_cors_header_1_act add rewrite policy delete_cors_header_2_pol true delete_cors_header_2_act add rewrite policy delete_cors_header_3_pol true delete_cors_header_3_act bind vpn vserver <VPN VServer> -policy delete_cors_header_1_pol -priority 100 -gotoPriorityExpression NEXT -type RESPONSE bind vpn vserver <VPN VServer> -policy delete_cors_header_2_pol -priority 110 -gotoPriorityExpression NEXT -type RESPONSE bind vpn vserver <VPN VServer> -policy delete_cors_header_3_pol -priority 120 -gotoPriorityExpression NEXT -type RESPONSE
r
not gateway, this is just MGMT gui
bind those globally then?
j
Gotcha, so if it is cors related, you would bind it globall.
r
Thanks, will try
j
Duo doc on the same, but yeah... previously was scoped to 14.1 https://help.duo.com/s/article/8990?language=en_US
r
i'm not great in the CLI here...
doesn't like -type RESPONSE on this global policy
Need food. Bbl...
Putting in a ticket.. I can't figure this out. Will post the solution here if/when I get it.
First ticket of the year... nearly July.. not bad....
Ok, so management access is now a known issue. Bug report already put in. They are working on a fix. Should be released "shortly"
j
How was the journey? First tier auto ack it was a known issue or did you have to fight for it?
r
she was smart. logged in, looked around for 4 minutes, then put me on hold, and came back with the bug report. acceptable.
👍🏼 1
j
I opened my first Gateway service ticket earlier in the week for what used to be quick open/closes - request for Splunk logs on RP side of OAuth login....
Copy code
[2025-06-30 10:55:53] Consumer:
What I'm requesting is analysis of the Splunk logs at that time stamp on the cloud side
[2025-06-30 10:56:14] Consumer:
Validated that her Okta attributes are configured correctly in her Okta profile.  Tried from her Mac and from her office PC, tried from CWA and tried from <https://rgrdlaw.cloud.com> (web)

[2025-06-30 10:56:43] Consumer:
Immediately after authenticating with the IdP, it forwards back to the RP, and she receives the error in the screenshot

[2025-06-30 10:57:16] Consumer:
There is a transaction error, but the transaction # is a Gateway transaction so I cant look it up in Monitor, hence the ticket.

[2025-06-30 10:57:37] Consumer:
This normally is a very easy ticket to get gateway/Splunk logs on

[2025-06-30 10:57:49] Consumer:
but I understand post the 8th June, support process has changed

[2025-06-30 10:58:38] Shubhang:
thank you for the update and yes things have become a lot more complicated
r
oh my
j
🙂
Those used to be 'call, "this is what i need", "here you go sir" "thanks!"
r
ikr? big oof there
a
@Ryan Gallier they keep telling me they are investigating, haven’t acknowledged a bug to me, but at least it isn’t just me seeing it in mgmt gui. Thank you for the update.
r
i'm off this week, so i'll follow up next week on my ticket.
They have completely ignored my ticket and all my ticket updates about "any updates here" for a month now. That's where Citrix support is at these days.
Pathetic.
a
I got told this morning, next release they will fix. However, they led me on last year about another issue we reported.
🤕 3
r
This is fixed for me in 13.1 59.22
With zero updates to my ticket since this thread
👍 1
41 Views
Open in Slack
PreviousNext
Powered by