Anyone with crashes for NSPPE few hours after update? Just got informed by friend. By the way: does creating citrix support tickets work for you? Apologize. I am currently having problems dealing with your request. I will now transfer you to one of our live agents. Which of the following describe the status of your issue? 🤷🏻‍♂️

Check if you have tls 1.3 enabled on backend profile... It does exactly that (and more) if the VPX is running on SDX

Nahhh you're kidding @Eric JULIEN??? On Monday, we plan to switch to new backend ssl profiles with TLS 1.3 (many VPX on SDX) 😄

It's MPX… with TLS 1.2 & 1.3

Not kidding... Spent many hours until late yesterday fixing a pair of sdx 15k with 14 ha pairs that went bonkers because of this...

I remember AppFlow few years ago as a source of similar issues…

One HA pair failed over unexpectedly about 12 hours after upgrading to 14.1-72.61. Logs point to route monitor failures as the trigger. No NSPPE crashes or dump files, so likely a network-side issue rather than something on the appliance itself. Odd that only this one HA pair was affected — everything else in the same environment was fine. The environment is running VPX on ESXi, and TLS 1.3 is not enabled in the backend profile. Opening a ticket just in case.

@Eirik Vesterhus / Intility AS are you using AppFlow ?

@Arthur No.

Confirmed by Citrix as a code issue in the 14.1-72.x line. It triggers only when all three conditions are met: • Adaptive Transport (EDT) enabled on the Gateway to backend path • Network Telemetry enabled on DDCs/VDAs • Appliance running the affected build Workarounds until the fixed build ships: Option 1: Disable Network Telemetry via Citrix policy on the Delivery Controllers/VDAs. EDT keeps working. Takes effect after session reconnect. Option 2: Disable DTLS on the VPN vserver: set vpn vserver <name> -dtls DISABLED Users fall back to TCP based ICA. Permanent fix is in development. If you see this pattern, check the three conditions before rolling back.

Do you know if DTLS 1.2 is also affected? As the reference in option 2 points to DTLS 1.0 setting.

Good point - it's a copy/paste command from an email from Citrix. Disable Adaptive Transport (EDT) at the NetScaler Gateway by disabling DTLS on the VPN virtual server. This is an appliance-side change and does not require any modifications to the backend infrastructure.

Haven't run into any of these issues -yet-, but getting really tired of seeing the usual suspects of EDT or telemetry being the culprits here.. at least AppFlow is innocent, this time. I hope it doesn't impact many of your instances. :/

Also interesting is, shouldn't exactly this scenario be supported within the build before (Which was 72.57)? I mean, it's a new feature "Network Telemetry for EDT is supported with NetScaler version *14.1 Build 72.57*and newer. If you are using an older version of NetScaler, sessions will be forced to use TCP if Network Telemetry is enabled."

.

the new 14.1-73.30 release notes states it fixes back-end tls 1.3 issue

Good eye, I haven't read through them yet!