Questions[netscaler](server)

Our company recently upgraded from Citrix version 6 (server 2008 R2 host servers) to 7.15 (Server 2016 host servers). We have an application that we host where external users connect with a WYSE terminal and serial connections (antiquated, yes...however it has to interface with certain equipment). On our Citrix 6 platform, we were able to use regular ICA connections and these were stable. When we upgraded, we weren't able to use ICAs anymore so we did this by configuring a broker server on the WYSE (with a url like "https://apps.myorganization.com/Citrix/Ourapps/PNAgent/config.xml").

The connection initially works, and will be stable for a fair amount of time. However we have noticed that the serial traffic is interrupted at least once a day. The serial seems to stop responding altogether once this happens, and we have to stop the app and restart it so that a new Citrix session opens. We have noticed that when connecting this way, even our old farm does this with the exception of one server. So far we have been unable to determine what specific setting may be allowing this old server to remain up and neither has Citrix. They most frequently occur every night within the same timeframe, 12 AM to 6 AM, however there have been a few, sporadic occurrences at other times. If we are using the PNAgent URL as shown above, would this use our NetScaler, and would load balancing possibly be causing the issue? If not, what other settings could be causing this?

Also, forgive my Citrix ignorance in advance...I actually the person that wrote this application and offer basic support, and am not typically involved in Citrix support.

I'm trying to design a container-based network that uses Citrix ADC CPX (formerly Netscaler CPX). At this stage, I'm trying to get it to run locally on Docker Desktop. When I run:

docker run -dt -P --privileged=true --net=host -e NS_NETMODE="HOST" -e NS_CPX_LITE=1  -e CPX_CONFIG='{"YIELD":"NO"}' -e EULA=yes store/citrix/citrixadccpx:13.0-36.29

There are no Docker specific errors, but when I run docker logs on the container id, I get quite a few errors. Included directly below are the full logs.

 User has accepted EULA. Starting CPX

ignoring ['::1', 'localhost', 'ip6-localhost', 'ip6-loopback']
ignoring ['fe00::0', 'ip6-localnet']
ignoring ['ff00::0', 'ip6-mcastprefix']
ignoring ['ff02::1', 'ip6-allnodes']
ignoring ['ff02::2', 'ip6-allrouters']
Cannot remove namespace file "/var/run/netns/netscaler": No such file or directory
Cannot find device "ns1"
('Generated UUID for CPX: %s\n', '0c8ded4e-aef1-4cb7-a2f0-75dbf4b941e8')
RTNETLINK answers: File exists
nsnetsvc: cfe_state_init(): Pooled licensed
nsnetsvc: check_and_establish_connections(): nsconfigd successfully connected to all packet engines

nsconfigd: ns_init_global_partition_id(): Creating SHM for storing partition id

nsconfigd: main(): Warm Reboot - unsetting partition ids in shared mmy
nsconfigd: cfd_prime(): Cluster is not enabled
nsconfigd: check_and_establish_connections(): nsconfigd successfully connected to all packet engines

nsconfigd: cfd_init_config(): Establishing built-in entities
nsconfigd: _dispatch(): No such file
nsconfigd: _dispatch():   Failing command: "add authentication loginSchema lschema_cert_deviceid -authenticationSchema "/nsconfig/loginschema/LoginSchema/DeviceID_Cert.xml" -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): No such file
nsconfigd: _dispatch():   Failing command: "add authentication loginSchema lschema_single_factor_deviceid -authenticationSchema "/nsconfig/loginschema/LoginSchema/SingleAuthDeviceID.xml" -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): No such file
nsconfigd: _dispatch():   Failing command: "add authentication loginSchema lschema_dual_factor_deviceid -authenticationSchema "/nsconfig/loginschema/LoginSchema/DualAuthDeviceID.xml" -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): No such file
nsconfigd: _dispatch():   Failing command: "add authentication loginSchema lschema_cert_single_factor_deviceid -authenticationSchema "/nsconfig/loginschema/LoginSchema/ClientCertSingleAuthDeviceID.xml" -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): No such file
nsconfigd: _dispatch():   Failing command: "add authentication loginSchema lschema_cert_dual_factor_deviceid -authenticationSchema "/nsconfig/loginschema/LoginSchema/ClientCertDualAuthDeviceID.xml" -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): No such file
nsconfigd: _dispatch():   Failing command: "add authentication loginSchema lschema_adal -authenticationSchema "/nsconfig/loginschema/LoginSchema/OnlyOAuthToken.xml" -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): Action does not exist
nsconfigd: _dispatch():   Failing command: "add authentication loginSchemaPolicy lschema_cert_deviceid -rule "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"NAC/1.0\")" -action lschema_cert_deviceid -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): Action does not exist
nsconfigd: _dispatch():   Failing command: "add authentication loginSchemaPolicy lschema_single_factor_deviceid -rule "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"NAC/1.0\")" -action lschema_single_factor_deviceid -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): Action does not exist
nsconfigd: _dispatch():   Failing command: "add authentication loginSchemaPolicy lschema_dual_factor_deviceid -rule "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"NAC/1.0\")" -action lschema_dual_factor_deviceid -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): Action does not exist
nsconfigd: _dispatch():   Failing command: "add authentication loginSchemaPolicy lschema_cert_single_factor_deviceid -rule "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"NAC/1.0\")" -action lschema_cert_single_factor_deviceid -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): Action does not exist
nsconfigd: _dispatch():   Failing command: "add authentication loginSchemaPolicy lschema_cert_dual_factor_deviceid -rule "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"NAC/1.0\")" -action lschema_cert_dual_factor_deviceid -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): Action does not exist
nsconfigd: _dispatch():   Failing command: "add authentication loginSchemaPolicy lschema_adal -rule "HTTP.REQ.HEADER(\"User-Agent\").CONTAINS(\"OAuth/2.0\")" -action lschema_adal -builtin MODIFIABLE PARTITION_ALL"
nsconfigd: _dispatch(): Invalid password
nsconfigd: _dispatch():   Failing command: "add ssl certKey ns-sftrust-certificate -cert ns-sftrust.cert -key ns-sftrust.key"
nsnetsvc: nsnetsvc sent command NSAPI_POST_STARTUP to PEs, ErrorCode=0x0

nsconfigd: cfd_init_config(): 13 built-ins failed
nsconfigd: cfd_init_config(): 0 built-ins exempted
nsconfigd: cfd_init_config(): 0 built-ins immune
nsconfigd: cfd_init_config(): 0 built-ins not sourced due to license absent
nsconfigd: cfd_init_config(): Loading initial configuration
nsconfigd: cfd_init_config(): Loading Partition configuration
nsnetsvc: nsnetsvc sent command NSAPI_NSCONF_READ_END to PEs, ErrorCode=0x0

nsnetsvc: nsnetsvc sent command NSAPI_INIT_DYNMEMPOOLS to PEs, ErrorCode=0x0

nsconfigd: cfd_ch_config(): Skipping command (set callhome -mode CSP -hbcustomInterval 1
) for non-CSP depoyments
nsconfigd: Failed to open file:/flash/nsconfig/.callhome.conf, No such file or directory

nsconfigd: cfd_ch_config(): get_set_callhome_conf failed, error code: -1
nsconfigd: cfd_start(): starting

The container is still up, but I can't ssh into it or connect. I'm mostly following these instructions here. I'm curious if these errors are expected or if I'm missing something.

edit So I ended up abandoning the pure Docker method and went with Kubernetes instead. I followed these tutorials on GitHub (I highly suggest them!) and they really helped and had examples.

Under macOS version 10.15.3, the extensions used by Citrix Netscaler Gateway could be allowed in the Security settings under System Preferences, as suggested in this serverfault answer.

However, macOS 10.15.4 does not offer such a possibility, making the latest version of Netscaler Gateway not work.

This can be seen in the log files. Specifically, in /var/log/cagplugin_install.log I can see this:

2020-04-02 16:10:00 Install: Starting up Citrix Access Gateway client services.
/Library/Extensions/CitrixDNERegistry.kext failed to load - (libkern/kext) system policy prevents loading; check the system/kernel logs for errors or try kextutil(8).
2020-04-02 16:10:00 Install: /bin/launchctl load  /Library/LaunchDaemons/com.citrix.daemon.dneregsvr.plist
2020-04-02 16:10:00 Install: Started dneregsvr.
/Library/Extensions/CitrixDNE.kext failed to load - (libkern/kext) system policy prevents loading; check the system/kernel logs for errors or try kextutil(8).
/Library/Extensions/CitrixSSLVpn.kext failed to load - (libkern/kext) system policy prevents loading; check the system/kernel logs for errors or try kextutil(8).

Also, in /var/log/cagplugin.log I can see this:

{03-04-20:16h56m37s}:4084:{WARNING}:{AGAS/AGKEXTInterface:-[AGKEXTInterface createCtlSocket] ioctl(to com.citrix.kernel.sslvpn.control) failed with error 2.}:
{03-04-20:16h56m37s}:4084:{WARNING}:{AGAS/AGKEXTInterface:-[AGKEXTInterface createIoctlSocket] ioctl(ioctl_info.com.citrix.kernel.sslvpn) failed with error 2.}:
{03-04-20:16h56m37s}:4084:{WARNING}:{AGAS/Failed to initialize sslvpnPlugin}:
{03-04-20:16h56m37s}:4084:{INFO}:{AGAS/Packet Filter Service Ready.}:
{03-04-20:16h56m37s}:4084:{INFO}:{AGAS/AGKEXTInterface:-[AGKEXTInterface sendIoctl:withData:] No IOCTL socket yet.}:

The result is that the connection is apparently successful, but then no communication takes place (zero bytes sent and zero bytes received, as seen in the Netscaler Gateway status window).

I tested with Citrix Netscaler Gateway 4.4.4 and 4.4.8, with the same results.

Is there any way to make it work?

I need to load balance SMTP to handle some applications that don't know how to use MX records.

I set up a Netscaler using the TCP option on port 25 and now Exchange sees the source IP as that of the DMZ of the Netscaler for every connection, not the client.

Obviously this prevents RBLs, Whitelists, and all other IP-based reputation to fail. It also make it impossible to whitelist a trusted IP for anonymous relay.

Question

How should I configure the NetScaler (or Windows Load Balancing) so that I can allow load balancing yet still maintain visibility of the source IP?

I'm looking to move from F5 to Netscaler and having a hard time figuring out if Netscalers have a feature similar to iRules.