We're having a heck of a time getting our Netscalers set up with LAS. We have a few physical MPX appliances and a single VPX that we're trying to convert from file-based licenses to UHMC with LAS. Initially we thought we could just use built-in agents on the Netscalers and point them at Citrix Netscaler Cloud Console service, but when we tried to do that, the Netscalers would show Out of Service. So, we figured we'd just stand up an on-prem Console, but when we try to add our Netscaler (14.1 56.74) instances to it, we get the error below. Any idea of what might be going on? We were able to get the on-prem Console activated to the cloud LAS, but the Netscalers themselves show Out of Service. Any help on this would be greatly appreciated. We've spent so much time on something that really should be simple process.

are internal services up on the the VPX? those 443/ssl services using a cert? https://support.citrix.com/external/article/CTX335426/adding-adc-instance-on-adm-failed-with-e.html

Yeah, I saw that KB but all the internal services appear to be online.

Interesting. It won't let you add the instance from the NetScaler console? Are they on the same network? Are the respective ports open?

image.png

I was having the exact same thing with the very latest 14.1.x release here on VPX. 'out of service' as it was failing copying to the secondary as the only error I could see so it was seeing it as a standalone but showing then 'out of service' So I removed it now and we are planning on getting approval to try and do the external agent next to move it off those instance and hopefully just fix the issue. hopefully.... @Shane Kleinert fyi on that deployment

We're going to validate the ports, but the console and VPX are on the same network with no firewall between them - it's an internal test setup. This is a standalone VPX instance we're dealing with. Currently it's running a freemium license, but we're looking to switch it over to UHMC/LAS as a test before we do our MPX appliances. It seems from research I've done people have been having trouble getting on prem Netscaler Console set up and are opting for using the Agent instead. If that would solve our problem, we would consider doing that since these Console servers are new and aren't being used for anything. We could ditch them and use Agent without much trouble.

yeah, Freemium here also right out of the gate as of course we have to onboard to console service to then enable the flex licensing/LAS integration for the entitlement with UHMC. So same thing here. But yeah, we def were not wanting the full NetScaler Console deployment on-prem - just the external agent and better yet, there is lightweight agent guidance on resources for that when just needing it for limited LAS purposes.

So, we have made some progress with support on this issue. It turns out we had this old responder policy https://support.citrix.com/external/article/CTX230709/how-to-block-connections-to-netscaler-co.html that was dropping the traffic from the Netscaler Console. We modified the expression to exclude the on-prem Console IP HTTP.REQ.HEADER("User-Agent").VALUE(0).LENGTH.EQ(0) && CLIENT.IP.SRC.EQ(x.x.x.x).NOT and this fixes the problem for on-prem Console licensing. Now we're trying to figure out if we can make it work with the cloud Console instead as we really don't want to use on-prem Console if we don't have to. Unfortunately, we tried a few different variations of the expression such as HTTP.REQ.HEADER("User-Agent").VALUE(0).LENGTH.EQ(0) && HTTP.REQ.HOSTNAME.EQ("citrix.com") with no luck. Anybody know how to modify this expression HTTP.REQ.HEADER("User-Agent").VALUE(0).LENGTH.EQ(0) to exclude traffic originating from the cloud Console?