This message was deleted.
# citrix-netscalers
Slackbot
04/07/2021, 2:05 PMThis message was deleted.
👍 4
s
Steven Lemonier
04/07/2021, 4:20 PMlooks like we should disable DTLS forever…
👍 1
d
dready
04/07/2021, 4:23 PMWonder if those „patched“ ADCs have HelloVerifyRequest enabled
m
Mads Petersen
04/07/2021, 4:26 PMI had to fix a customer on a patched version with CVH enabled today.
What is also different this time, was the ADCs crashed (that only happened if CVH was enabled on a unpatched before after a while because of memory)
What we saw today was crashed almost instant, and before they would have crazy outbound traffic.
k
Kari Ruissalo (WyW)
04/07/2021, 5:40 PMone of our customer environment was totally burnt by this today, even on 12.1-61.18 and helloverifyreq enabled
Kari Ruissalo (WyW)
04/07/2021, 5:41 PMone of the nodes lost its licensing and the nodes ended up in a boot loop, finally we just downgraded to 12.1-58.15 and disabled dtls
Kari Ruissalo (WyW)
04/07/2021, 5:41 PMthis was roughly 12hours ago in Finland
m
Mads Petersen
04/07/2021, 5:42 PMThat is what I’m hearing from others, fully patch with CVH gets hit (I saw it at one customer myself)
@Kari Ruissalo (WyW) did you make a support case? I know citrix is looking for logs from patched customers with CVH enabled.
k
Kari Ruissalo (WyW)
04/07/2021, 5:44 PMI did
m
Mads Petersen
04/07/2021, 5:45 PMCan you PM me the case number and I can give it to a security person at citrix.
k
Kari Ruissalo (WyW)
04/07/2021, 5:45 PMactually we had a couple of crashes prior to this, but at the beginning of this week the environment went crazy
Kari Ruissalo (WyW)
04/07/2021, 5:45 PMsure
m
Mads Petersen
04/07/2021, 5:45 PMThanks
n
nsvegman
04/07/2021, 5:47 PMAh good, I was going to link you this thread Kari, glad to see you found it.
k
Kari Ruissalo (WyW)
04/07/2021, 5:52 PM"really nice to be here in the Nordics, the shit hits the fan here first" 😄
Kari Ruissalo (WyW)
04/07/2021, 5:52 PMwe were the first ones to experience the original DTLS problem
f
Frank Vandebergh
04/08/2021, 7:10 AMExperienced similar yesterday for customer not using DTLS or Gateway but where ADC is in front of VMWare Horizon Blast UDP 443.. ADC did not crash but behaved ‘slow’ while no clear indication (cpu , bandwidth etc within normal range)
n
nsvegman
04/08/2021, 7:57 AMThat is interesting, as we had first heard of it as slowness, but that could be their view on session reliability, when it crashed, but it absolutely could be a UDP flooding.
s
Stephen
04/08/2021, 7:38 PMWe experienced it from 2am until about 5 am. Disabled DTLS and it was gone
k
Kari Ruissalo (WyW)
04/09/2021, 6:26 AMWe're now seeing in one environment (firmware 12.1-61.18) with high memory consumption... the Gateway started showing "Cannot complete your request". Got it fixed with a HA failover.
I have already disabled the DTLS a couple of days ago in that environment.
Kari Ruissalo (WyW)
04/09/2021, 6:28 AMestablished a case and sent it privately to @Mads Petersen
Kari Ruissalo (WyW)
04/13/2021, 6:01 AMI'm waiting for a verification, but it's starting to seem that the 12.1-61.18 is vulnerable to the DTLS DDoS attack, where as the 12.1-61.19 is not. This is not yet confirmed, but it starts to look like it. The environments we're running 12.1-61.19 haven't got any issues, but the ones with 12.1-61.18 broke.
👍 1
n
nsvegman
04/15/2021, 9:12 AMInteresting, I thought as much, I’ll be sure to keep that in mind if our 61.18 fleet gets another bump, thank you for the heads up!
2 Views