Everyone is patching NetScaler again and I keep thinking we are solving it the wrong way. Chasing CVEs on-prem is a loop with no exit. The real answer is Citrix Gateway Service. Curious what the #1494 guys think.

Looking to make that move ourselves @Arthur

the real answer is that citrix should stop with on-prem vpn😂

Vulnerabilities exist everywhere, but cloud services just win on response time. That is the whole argument.

We are getting there. Moved to UHMC licensing last year. WEM Service and NS Console Service this year. DAAS migration just about done. Next will be GaaS.

Two points. First, not everyone uses NetScaler only for gateway. Second, several of these CVEs were NOT on Gateway, but Oracle or simply load balancing StoreFront or other web addresses. If you only use it for Gateway, then Service may be the answer, unless you want the traffic to go to your data center instead of always having to go to cloud from start to finish. Some people still prefer that you login to cloud, but display of Icons, etc. comes from your network, eliminating the client to cloud to datacenter to cloud to client extra steps. I am sensing a new PVS vs. MCS discussion for this To gateway Service or Not to Gateway service.

We'd still need one on prem for various LB VIPs but at least I wouldn't need on-prem exposed to the internet.

give proper insights on gateway as a service then I'll move the CVAD stack blind to it, find it very difficult to process that a support would be the lightball for suppor to see that a POP is overloading, that was my experience with it.

@Steve Elgan Citrix has advised customers who are behind a VPN and only do load balancing to upgrade their firmware immediately. This one affects all systems and needs correction right away.

We are upgraded

Updated all my NS to latest 14.1 and no issue so far

To clarify, I was specifically talking about NetScaler Gateway in front of CVAD, not general VPN replacement.