Citrix ADC, LDAP Test Fails

After Citrix implemented the security of ns.conf with the KEK keys I have notices that the “Test Network connectivity” through an error in the GUI:

Well, how do we the test the LDAP configuration and connection?

This can be done by the CLI, in shell mode 😊

From the shell mode you can run the following command to test the LDAP configuration:

ldapsearch -b “DC=contoso,DC=com” -D “” -h -p 389 -w “Password1”

If your username and password are not valid you will get something like this:

If there are connection to a Domain Controller and username and password are valid you will receive information of the users in the Active Directory.

So, we can use the CLI shell mode to test the LDAP connection and validate the username and password. But there is one problem. To test we need to type the password in clear text. In my blog “NetScaler CLI, Watch Out” I wrote about the “history” of the CLI commands and that password in clear text are stored until the Citrix ADC is rebooted.

We have the same problem when we test the LDAP connection when using CLI in shell mode. If I run the “history” command I get this:

It is therefore my recommendation that you create a temporary user account on the Citrix ADC. Then run the command to test the LDAP. And finally remove the temporary user account.

By doing this the password for the LDAP users can not be accessed through the “history” command.


Some customers currently experience high outgoing traffic from there Citrix ADC/NetScalers. Citrix has reported more about this in there article here:

Threat Advisory – DTLS Amplification Distributed Denial of Service Attack on Citrix ADC and Citrix Gateway

The fix is to upgrade to one of these versions:

  • Citrix ADC and Citrix Gateway 13.0-71.44 and later releases
  • NetScaler ADC and NetScaler Gateway 12.1-60.19 and later releases
  • Citrix ADC 12.1-FIPS 12.1-55.210 and later releases
  • NetScaler ADC and NetScaler Gateway 11.1-65.16 and later releases

Or you can disable DTLS.

In their article it is describe how-to disable DTLS on the Citrix Access Gateway configuration, but if you have a Content Switch in front this will not do it as the client session it terminated on the Content Switch vServer.

A quick test to show that:

My Content Switch vServer configuration:

My Access Gateway vServer configuration:

When I make a Citrix Session, I get this:

As you can see this Citrix Session is using DTLS.

If you have a Content Switch in front of your Access Gateway function you need to disable DTLS on the Content Switch configuration, or else you are still vulnerability for the DDoS attack. This is missing from the Citrix article.

Citrix ADC, Storefront SSO

With the release of Citrix ADC 13.0 build 64.35, Citrix have made some change to the “Single Sign-on to Web Application” in the Session Profiles:

This is new and can affect the SSO to Citrix Storefront. In my test environment after upgrading to 13.0 build 64.35 I got this error when logging in to the Access Gateway:

 There were no errors in the event viewer of the Storefront Server to help me.

In the release note for ADC 13.0 build 64.35 Citrix state, the flowing:

Title: Support to disable the weak Basic, Digest, and NTLM authentication globally

The SSO configuration is now made more secure by dishonoring the following weak authentication methods globally.

– Basic authentication

– Digest Access Authentication

– NTLM without setting Negotiate NTLM2 Key or Negotiate Sign

[ NSAUTH-7747 ]

I got my test environment to work with a simple traffic profile and traffic policy.

Traffic profile:

Traffic policy:

Just bind the policy to the Access Gateway, and you will not get the Storefront error, 😊

CLI commands:

add vpn trafficAction traf_prof_sf_sso http -SSO ON

add vpn trafficPolicy traf_pol_sf_sso true traf_prof_sf_sso

bind vpn vserver <NAME> -policy traf_pol_sf_sso -priority 100 -gotoPriorityExpression END -type REQUEST

Citrix ADC, Integrated caching

Do the Citrix ADC cache. O yes it does, even when the feature is not licensed. This can give some funny trouble shooting issues.

I resent have some problems about the logon page to an Access Gateway function. After a change in the logon page code, the client still gets the old look.

To check if your Citrix ADC is caching anything use this command:

As you can se the Citrix ADC is caching loginstatcobjects, but the feature is not licensed !!!!

If you run this, you will get a static of the caching function on the Citrix ADC:

The good is that you can disable this build in cache of loginstatcobjects. You can do this by running this command:

And to check that it is set:

I took me a while to find that is was the caching function that give me the strange behavior, as the function was not licensed, and I never thought that is could be enabled by default. I hope this can help others.

Citrix ADC, Partition, Radius

This blog is from a lesson learned in the field. I have done a normal upgrade from 11.1 to 12.1 on a Citrix ADC HA pair. After the upgrade users complained that they get an error when logging in to some Web sites that where protected by a Security Server on the ADC.

We found that the sites where all located in a Partition on the ADC.

LDAP test run without any error.

Radius test give this error:

Ok, the problem where with the MFA Radius authentication.

To debug I run a nstrace from the partition:

  • switch partition radius_test
  • start nstrace -size 0 -filter CONNECTION.PORT.EQ(1812)
    • Did the Radius test and got the error again
  • stop nstrace

But there where no trace files in /var/partition/radius_test/nstrace. I did this again but still no trace files.

What was going on???????

After some more debugging I did a trace on Default partition, and now I got some data in my trace:

But the request was coming from the NSIP and not from the SNIP in the partition. Do to Firewall configuration the Radius server could not be accessed this way.

It turns out that the Radius test is done from the default partition. You can’t use the test with in at partition as the request is not send from the source address you think.

I later found this in ns.log:

The learned lesson is that if you use Partitions, you can not relay on the Radius test function, as this may not give you a correct response, do to the way traffic is going out of the ADC.

We found a bug in ADC 12.1 build 55.18. Challenge-Response Radius request from a Partition got stuck at the ADC, and the users never received their token, and where not prompted for it.

As the ADC 11.1 build 63.15 had the same bug from default partition, we ended up with a total rollback, and is now waiting for Citrix to fix this.

Page 1 of 4

Powered by WordPress & Theme by Anders Norén