This message was deleted.

The AAA-TM/Storefront one you mentioned is important for sure. Also make sure you've changed the default RPC node passwords (it will nag you if you haven't but won't break), and make sure you're using secure RPC between HA nodes before upgrading otherwise it'll be enabled automatically.

Thanks Mike, going through notes looks like the AAA-tm/Storefront one this is fixed only in 13.0 builds. Is it still old hat thinking to not jump major builds, and to step through them; eg 12.0 -> 12.1 13.0?

Also worth mentioning that if you're doing SAML then you'll need to be on at least 12.1-62.23 to cover the CVE

Got it, missed that in the 2nd set of bullet points. Thanks.

The AAA-TM change may have only affected 13.0 code trains, let me see if I can confirm

ah ok, i'm good there. multiple gateways either LDAP+RADIUS or SAML SP. Used to have nFactor with custom cascading to user cert or other MFA option, but simplified awhile back.

The Storefront SSO issue I was thinking on looks to only be in v13, they disabled some SSO methods globally which included what is used for Storefront. In that case you'd have to add a traffic policy enabling SSO as denoted in https://docs.citrix.com/en-us/citrix-adc/current-release/aaa-tm/single-sign-on-types/enable-sso-for-auth-pol.html

I would avoid 13.0, if you don't especially need a feature from that release. The 12.1 is in maintenance phase, where as 13.0 is in feature phase.

Thanks Kari, yes, I'm trying to avoid 13.0. Just trying to validate the Storefront SSO then I think I'm good to go. Testing it on a test pair as we speak.

While I agree that 12.1 is the more mature place to be unless you need a v13 feature, the feature vs maintenance release phase definitions have been updated from 13.0 onward. All subsequent releases are on a 5 year lifecycle now, first two years are feature releases every quarter and subsequent years are maintenance releases until EOM. https://support.citrix.com/article/CTX241500

Thanks Mike

Yeah... but as you've been happy with 12.0 so far, I think you'll love 12.1 🙂

Agreed. Just making sure that we don't inadvertently think of 13.1 as a maintenance focused train since the definitions changed. This stuff is not exactly communicated well, something we're trying to address internally

Yeah, that's a good pick.

No issues other than the Storefront AAA-TM one, and yeh avoid v13.0 for now unless you really need some of the newer features.

Thanks Carl!

what is so bad about 13? I’m just using it for the gateway but haven’t run into any issues other than the ldap bugs in the gui

It had a rough start since it was the initial build for a ton of new features, basically. I believe it was also the first branch that was natively 64 bit from the start which was a big fundamental change, so there were definitely some growing pains early on. It hasn't quite reached the maintenance phase milestone yet whereas 12.1 has been there for a while, and generally maintenance phase releases are suggested for production unless you need a feature from a newer build.

12.1 also has LDAP GUI issues