This message was deleted.

from which version do you update?

From 12.1 60.19 to 12.1 62.23

yes it will then be enabled. This is the new default since 13.0 build 64.35 and later or release 12.1 build 61.18 and later.

On a standalone netscaler it showed a message that secure rpc will be enabled and it did. On other environment we have gslb. When i run show rpcnode, On all the other nodes secure rpc is turned on. But for the local IP address it is showing as off in show rpcnode output. Will that be enabled too, after upgrade is what i want to know.

I have only updated environments without GSLB so far and there it enabled Secure HA for internal after the update. I think that will be the same for you.

Thank you. I ll have to test it out in production environment.

let me know how it went. my GSLB customers do not have the courage to update yet. 🙂

But we have to.. isnt it? Because of this vulnerability

It should be done promptly, but I would not do an emergency change overnight for this.

if you are using MEP over the INET it was always best practise to secure MEP using set rpc node 1.2.3.4 -password PA55w0rd -secure YES -srcIP 5.6.7.8 going from non secure to secure also changes the ports to 3008/3009 used for synchronization and propergation. When updated show rpc node should show all services HA/GSLB as using secure RPC

We are using MEP. And all the ips except the local ip address in show rpcnode output show secure rpc is turned on.

i just tested this on a gslb setup before the firmware update. I enabled secure RPC on the gslb site IP's as soon as i did that MEP status shows as down and the remote gslb service shows as down. I performed a packet capture and can see it now uses port 3009 and firewall looks like it is blocking it as get RST's/Retranmissions untick Secure RPC on GSLB site ips and it uses 3011 and works fine. Does anyone know if secure rpc is enforced on the new firmware builds ? i know it changes it to securerpc but can you switch it back to non secure ?

On which version did you check ? I have tested on 12.1 62.23 version. After a day or two, citrix removed it and added 62.25. In 62.23, as soon as the upgrade is finished, it showed a message. Please see the screenshot. In 62.25, didn't you get such message on the screen after upgrade and before reboot? Again, on my dev instance, I got the secure rpc message. Post reboot, I have disabled secure rpc. It was successful.

Hi, All the GSLB sites i've checked after secure RPC was made default, has been secure on all IPs. Also on newest version 13 and 12.1 But all the GSLB sites i've been involved in, has always been running secure.

if the NSIP's have SecureRPC enabled it doesnt really matter as your NSIPs for your prirmary/secondary appliances will be on the same subnet so it doesnt really matter if the port changes from 3011 to 3009 as there isnt a firewall. I had no issues with HA sync/propergation after secure rpc was enabled on my NSIPS it was only GSLB MEP that was a issue as when secure RPC is enabled on the GSLB site ips it changes from 3011 to 3009 which was blocked on our firewall