Citrix Application Delivery Management (ADM) 13

Last Modified: Mar 13, 2023 @ 10:31 am

60 Comments

Navigation

The older 12.1 version of Citrix ADM is detailed in a different post.

💡 = Recently Updated

Change Log

Planning

Why ADM?

Citrix Application Delivery Management (ADM), formerly known as NetScaler Management and Analytics System (MAS), enables every Citrix ADC (formerly known as NetScaler) administrator to achieve the following:

  • Alert notifications – Receive email alerts whenever something goes down. For example, if a Load Balancing service goes down, you can receive an email alert.
    • ADM can email you for any SNMP trap produced by any ADC appliance.
  • Automatically backup all Citrix ADC instances.
    • ADM can even transfer the backups to an external system, which is then backed up by a normal backup tool.
  • SSL Certificate Expiration – Alert you when SSL certificates are about to expire.
    • Show you all SSL certificates across all ADC appliances.
  • Configuration Record and Play – Use the Configuration Recorder to configure one ADC appliance, and then push out the same configuration changes to additional appliances. This is the easiest method of managing ADC appliances in multiple datacenters.
  • AppFlow Reporting – Receive ICA AppFlow traffic from ADC and show it in graphs.
    • Integrate ADM with Citrix Director so Help Desk can see the AppFlow data.

Everything listed above is completely free, so there’s no reason not to deploy ADM.

ADM Overview

For an overview of ADM, see Citrix’s YouTube video Citrix NetScaler MAS: Application visibility and control in the cloud.

Citrix Tech Zone Citrix Application Delivery Management (ADM) Overview Cheat Sheet

Cloud vs on-prem

ADM is available both on-premises, and as a Cloud Service. For the Cloud Service, you import a ADM Agent appliance to an on-prem hypervisor, or deploy a ADM Agent to AWS or Azure. The ADM Agent is the broker between the Cloud Service and the on-prem (or cloud hosted) Citrix ADC appliances. For more info on the ADM Cloud Service, see the following:

The rest of this article focuses on the on-premises version, but much of it also applies to the Cloud Service.

On-premises ADM Licensing:

  • Instance management is free (unlimited). This includes Configuration Jobs, Instance Backups, Network Functions/Reporting. Basically everything in the Networks node is free.
  • Analytics and Application monitoring are free for up to 30 Virtual Servers (Load Balancing, Citrix Gateway, Content Switching, etc.).

ADM version – The version/build of Citrix ADM must be the same or newer than the version/build of the Citrix ADC appliances being monitored. ADM 13 can monitor many ADC appliance versions including version 11.1, version 12.1, and version 13.0.

HDX Insight

See CTX239748 for a list of HDX Insight Quality Improvements in Citrix Gateway 12.1 and newer. These include:

  • NSAP protocol for reduced performance impact on ADC
  • EDT support

HDX Insight Requirements (aka AppFlow Analytics for Citrix ICA traffic):

  • Your ADC appliance must be running Enterprise Edition or Platinum Edition.
  • ADC must be 10.1 or newer.
  • HDX Insight works with the following Receivers:
    • Receiver for Windows must be 3.4 or newer. Or upgrade to Workspace app.
    • Receiver for Mac must be 11.8 or newer. Or upgrade to Workspace app.
    • Receiver for Linux must be 13 or newer. Or upgrade to Workspace app.
    • No mobile Receivers. See the Citrix Receiver Feature Matrix for the latest details.
  • For ICA Session Reliability with AppFlow: NetScaler 10.5 build 54 and newer.
    • For ICA Session Reliability, AppFlow, and ADC High Availability: NetScaler 11.1 build 49 and newer.
  • For EDT (UDP-based ICA), Citrix ADC must be 12.1 build 49 or newer.
  • AppFlow statistics are only generated when ICA traffic flows through a Citrix Gateway. Internally, when a user clicks an icon from StoreFront, an ICA connection is established directly from Receiver to the VDA, thus bypassing the internal ADC. Here are some methods of getting ICA traffic to flow through an internal ADC:
  • A new Receiver / Workspace app Virtual Channel named NetScaler App Experience or NSAP can dramatically reduce the CPU needed on the ADC to process AppFlow. Details at Citrix Blog Post HDX Insight 2.0. NSAP requires the following:
    • VDA 7.17 or newer, including VDA 1903. VDA 7.15 (LTSR) does not include the NSAP functionality.
    • Workspace app or Receiver 4.10 and newer.
    • ADC 12.0 build 57.24 or newer, including ADC 12.1 and ADC 13.
  • For ICA round trip time calculations, in a Citrix Policy, enable the following settings:
    • ICA > End User Monitoring > ICA Round Trip Calculation
    • ICA > End User Monitoring > ICA Round Trip Calculation Interval
    • ICA > End User Monitoring > ICA Round Trip Calculation for Idle Connections
  • Citrix CTX215130 HDX Insight Diagnostics and Troubleshooting Guide contains the following contents:
    • Introduction
    • Prerequisites for Configuring HDX Insight
    • Troubleshooting
      • Issues Related to ICA parsing
      • Error Counter details
    • Checklist before Contacting Citrix Technical Support
    • Information to collect before Contacting Citrix Technical support
    • Known Issues

Citrix CTX204274 How ICA RTT is calculated on NetScaler Insight: ICA RTT constitutes the actual application delay. ICA_RTT = 1 + 2 + 3 + 4 +5 +6:

  1. Client OS introduced delay
  2. Client to NS introduced network delay (Wan Latency)
  3. NS introduced delay in processing client to NS traffic (Client Side Device Latency)
  4. NS introduced delay in processing NS to Server (XA/XD) traffic (Server Side Device Latency)
  5. NS to Server network delay (DC Latency)
  6. Server (XA/XD) OS introduced delay (Host Delay)

Multi-Datacenter Deployment Architecture

In a main datacenter, import two Citrix ADM appliances into the same subnet and configure them as an HA pair with a Floating IP address.

In a DR datacenter, import a DR node Citrix ADM appliance, and configure it to replicate with the main datacenter.

For Citrix ADC appliances in additional datacenters, import two ADM Agent appliances into each datacenter. Remote ADC instances are discovered and managed through remote ADM agents.

  • The virtual appliance for ADM Agent is different than the normal ADM appliance.
  • Documentation at Configure multisite deployment at Citrix Docs, and will be detailed later in this post.

Import ADM Appliance

If you are upgrading an existing ADM or MAS, skip to the Upgrade section.

There are two different ADM appliances:

  • ADM appliance for the main datacenter, including High Availability, and for the DR node.
  • ADM Agent appliance for remote datacenters

To import a ADM Appliance into vSphere, do the following:

  1. Download Citrix ADM Image for ESX.

    • The download page for ADM has two different images: one called ADM Image, and one called ADM Agent Image. The first image should be the non-agent image.
  2. Extract the downloaded .zip file for the non-agent image.
  3. In vSphere Web Client, right-click a cluster, and click Deploy OVF Template.
  4. In the Select an OVF Template page, select Local file, and browse to the Citrix ADM .ovf files. If vCenter 6.5 or newer, select all three files. Click Next.

  5. In the Select name and folder page, enter a name for the virtual machine, and select an inventory folder. Then click Next.
  6. In the Select a resource page, select a cluster or resource pool, and click Next.
  7. In the Review details page, click Next.
  8. In the Select storage page, select a datastore. Due to high IOPS requirement, SSD is recommended.
  9. Change the virtual disk format to Thin Provision. Click Next.
  10. In the Select networks page, choose a valid port group, and click Finish.
  11. In the Ready to Complete page, click Finish.
  12. Before powering on the appliance, you can review its specs. Right-click the virtual machine, and click Edit Settings.
  13. Review the specs. Citrix Docs VMware ESXi Hardware Requirements has recommended specs.
  14. The OVF defaults to 8 vCPU and 32 GB of RAM.
  15. You can add a second hard disk at this time.
  16. Citrix Docs Attach an additional disk to Citrix ADM says that an additional disk must be added before initial deployment.
    • Use the ADM storage calculator to determine the recommended size of the disk. Ask your Citrix Partner for the tool.
    • The new disk must be larger than 120 GB.
    • In ADM 13, the new disk can be larger than 2 TB.
    • In ADM 13, the new disk can be grown later, and /mps/DiskPartitionTool.py can resize the partition, but only up to 2 TB. If you need more than 2 TB, the initial disk should be larger than 2 TB.
  17. Power on the Virtual Machine.

Appliance IP Address Configuration

  1. Open the console of the virtual machine.
  2. Configure IP address information.
  3. Enter 7 when done.

Second Disk

  1. SSH to the appliance and login as nsrecover/nsroot.
  2. Enter /mps/DiskPartitionTool.py

  3. Enter info to see that there are no existing partitions on the second disk.
  4. Enter create to create partitions on the second disk. A reboot is required.
  5. During the reboot, the database is moved to the second disk.
  6. After the reboot, the Disk Partition Tool info command shows the partition on the second disk.
  7. If you need to increase the size of the disk, reboot the ADM appliance so it detects the larger size. Then use the Disk Partition Tool resize command.

Deployment Modes

HA Pair in the Main Datacenter

First Node:

  1. SSH to the first node and login as nsrecover/nsroot.
  2. Enter deployment_type.py.
  3. Enter 1 for Citrix ADM Server.
  4. Enter no when prompted for Citrix ADM Standalone deployment.
  5. For the First Server Node prompt, enter yes.
  6. Enter yes to Restart the system.

Second Node:

  1. Import another ADM appliance to the same subnet, and configure an IP address.
    • Latency to the HA node must not exceed 10 ms.
    • The HA nodes must be on the same subnet.
  2. If you added a second disk to the first ADM appliance, then you must add the same size second disk to the second ADM appliance.
  3. Configure the new nodes’ IP address.
  4. SSH to the second appliance, login as nsrecover/nsroot, and run the Disk Partition tool.
  5. SSH to the second appliance, login as nsrecover/nsroot, and run deployment_type.py.
  6. Enter 1 for Citrix ADM Server.
  7. Enter no when prompted for Citrix ADM Standalone deployment.
  8. Enter no when prompted is this is First Server Node.
  9. Enter the IP address of the first ADM node.
  10. Enter the nsroot password of the first node. The default password is nsroot.
  11. Enter a new Floating IP address.
  12. Enter yes to restart the system.

Deploy HA Configuration:

  1. After both appliances are fully booted, point your browser to the first appliance’s IP address, and login as nsroot/nsroot. It will take several minutes after booting before the ADM appliance is ready.
  2. If you see Customer User Experience Improvement Program, click Enable, or click Skip.
  3. In the What is Application Delivery Management page, click the blue Get Started button.
  4. On the Instances page, click Add Instance. This wizard will keep appearing at logon until you add an instance.

    1. Enter IP Address or FQDN of one of your ADC instances.
    2. The Profile Name contains the password for your ADC nsroot account. To specify the password, you can Edit the built-in ns_nsroot_profile, or you can create a new Profile.
    3. Check the box next to Change Password and enter the ADC’s nsroot password.
    4. Scroll down and click OK to close the ADC Profile window.
    5. Click OK to close the Add Instances window and begin the discovery process.
    6. Click Close when Operation completed successfully. If there’s an error, switch to the Error tab to see more details.
    7. You can add more instances, or just click Next.
  5. In the Customer Identity page, make your choices, and then scroll down and click Next.

  6. In the System Notifications page, check the box next to Send Email and then click Add.

    1. In the Create Email Distribution List page, next to Email Servers, click Add.
    2. Enter your email server details and then click Create to close the Create Email Server window.
    3. Back in the Create Email Distribution List window, enter a From address, enter a To address, and then click Create.
    4. Back in the Getting Started wizard, click Next.
  7. On the Done page, click Finish.
  8. If you want to make any network changes (e.g. DNS servers) to either node, then you must make those changes before you deploy the HA pair. Click the menu icon on the top left. Then go to System > Administration > IP Address, Host Name and Proxy Server.

    1. Enter an Alternate DNS and then click Save.
  9. On the top left, click the menu (hamburger) icon, expand System, and then click Deployment.
  10. In the top right, click Deploy.
  11. Click Yes to reboot.
  12. It takes around 10 minutes to restart.
  13. After deployment, you can now use the Floating IP to manage the appliance.
  14. The System > Deployment page should show both nodes as UP.

Afterwards, you can manage High Availability.

  1. System > Deployment lets you see the HA nodes.
  2. You can Force Failover from here. Note: HA failover only occurs after three minutes of no heartbeats.
  3. On the top right is a HA Settings button that lets you change the Floating IP.

DR Node

Requirements for the DR node:

  • The main datacenter must have an HA pair of ADM appliances. Standalone in the main datacenter is not supported.
  • Latency from the main datacenter HA pair to the DR node must not exceed 200 ms.
  • Ports 5454 and 22 open between the ADM nodes.

To configure a DR node:

  1. Import another ADM appliance into a remote datacenter, and configure an IP address.
  2. If you added a second disk to the main datacenter ADM appliances, then you must add the same size second disk to the DR ADM  appliance.
  3. After configuring the new nodes’ IP address, SSH to the DR appliance and login as nsrecover/nsroot.
  4. Enter deployment_type.py.
  5. Enter 2 for Remote Disaster Recovery Node.
  6. Enter the Floating IP address of the HA pair in the main datacenter.
  7. Enter the nsroot password, which is nsroot by default.
  8. The DR node registers with the ADM HA Pair.
  9. You can change the password of the DR node by running the following command: 
    ./mps/change_freebsd_password.sh <username> <password>
  10. Point your browser to the Floating IP Address and login.
  11. Go to System > Administration.
  12. On the right, in the right column, click Disaster Recovery Settings.
  13. The Registered Recovery Node should already be filled in. Click Deploy DR Node.
  14. Click Yes to enable DR.
  15. A System Backup is performed and replicated to the DR appliance. Click Close when done.
  16. The status of the DR node is displayed. You can click the Refresh icon on the top right to update the display.
  17. ADM 13.0 build 71 and newer have a Sync DR Node button in case it gets out of sync.
  18. Disaster Recovery is not automatic. See the manual DR procedure at at Citrix Docs. Docs also shows how to fail back.
    • /mps/scripts/pgsql/pgsql_restore_remote_backup.sh

ADM Agents

ADM Agents help ADM discover and manage instances on the other side of a high latency WAN link.

The virtual appliance for ADM Agent is different than the normal ADM appliance.

  1. Download the ADM Agent from the main ADM download page. On the ADM download paged for a particular build, scroll down the page to find the ADM Agent images.
  2. Extract the downloaded .zip file.
  3. Import the .ovf to vSphere.

  4. Edit the settings of the virtual machine to see the allocated CPU and Memory.
  5. There’s no need to add a disk to the Agent.
  6. Power on the ADM Agent virtual machine.
  7. At the virtual machine’s console, configure an IP address.
  8. Login as nsrecover/nsroot.
  9. Run /mps/register_agent_onprem.py
  10. Enter the floating IP address of the main ADM HA Pair. Enter nsroot credentials.
  11. The Agent will be registered and services restarted.
  12. To change the nsrecover password on ADM Agents, putty (SSH) to the ADM Agent appliance, login as nsrecover and then run the script at /mps/change_agent_system_password.py
  13. Login to the ADM Floating IP.
  14. Go to Networks > Agents.
  15. On the right, select the ADM Agent, and then click Attach Site.
  16. In the Site drop-down, if you don’t see your site, then you can click the Add button to create a new site.

    1. Enter a name and other location information.
    2. Make sure you enter the coordinates. Google can find coordinates for various locations. If Longitude is West, then the value is negative.
    3. Click Create when done.
  17. Click Save to attach the Site to the Agent. Any ADC instance discovered through this Agent will be attached to the configured Site.
  18. For Agent HA, import two ADM Agents into your hypervisor and attach both Agents to the same Site.
  19. ADM 13.0 build 61 and newer let you change the nsrecover password from the ADM GUI.

ADM Appliance Maintenance

Add Instances

Citrix ADM must discover Citrix ADC instances before they can be managed. Citrix Docs How Citix ADM discovers instances.

  1. Once you’ve built all of the nodes, point your browser to the Citrix ADM Floating IP address, and login as nsroot/nsroot.

Before adding more instances, ADM needs to know the nsroot password for the new instances. You create Admin Profiles to specify the nsroot passwords.

  1. To edit, or create new Admin Profiles, on the top left, click the hamburger menu icon, and then go to Networks > Instances > Citrix ADC.
  2. On the right, open the menu named Select Action, and click Profiles.
  3. Click the Add button to create an Admin Profile.
  4. In the top half, give the Profile a name and enter the password for the instance’s nsroot account. Create a separate Admin Profile for each unique nsroot password.
  5. In the bottom, make up some SNMP settings. You can do SNMP v3.
  6. Click Continue when done.

To add more instances:

  1. Click the top left hamburger icon.
  2. Go to Networks > Instances > Citrix ADC.
  3. On the right, select a tab (e.g. MPX), and then click Add.
  4. The Add instance screen is the same as shown during the getting started wizard. To authenticate to the ADC using nsroot, select an existing Profile or create a new one. If you have Sites or Agents, you can select one.

Tags:

  1. You can assign Tags to instances. See How to create tags and assign to instances at Citrix Docs.

  2. You can then search instances based on the Tags.

Instance Authentication from ADM

By default, when you click the blue link for one of the instances, ADM will do single sign-on to the instance using nsroot credentials. This is probably a security risk, or certainly an auditing risk.

To prevent ADM from doing single sign-on to instances:

  1. In ADM, go to System > Administration.
  2. On the right, click System, Time zone, Allowed URLs and Message of the day.
  3. In the Basic Settings page, check the box next to Prompt Credentials for Instance Login and click Save.

Citrix ADC SDX

  1. At Networks > Instances > Citrix ADC, on the SDX tab, you can click Add to discover a SDX appliance plus all VPXs on that SDX appliance. You don’t have to discover the VPXs separately.
  2. In the Add Citrix ADC SDX page, click the Add button next to the Profile Name drop-down to create an SDX profile. Note: SDX profiles are different than VPX profiles.

    1. Enter the credentials for the SDX SVM Management Service.
    2. For Citrix ADC Profile, select an admin profile that has nsroot credentials for the VPX instances. After the SDX’s VPX instances are discovered, ADM uses this ADC Profile to login to each VPX. If you don’t have a VPX Admin Profile in your drop-down list, click the Add button. Note: You can only select one ADC Profile. If each VPX instance has different nsroot credentials, you can fix it after SDX discovery has been performed. The ADC Profile is different than the SDX Profile.
    3. Back in the Configure ADC SDX Profile page, enter a new Community string for the SDX SVM. This appears to be SNMP v2 only.
    4. If you need the communication to be http instead of https, then you can uncheck the box for Use global settings for SDX communication.
    5. Click OK when done.
  3. Back in the Add Citrix ADC SDX page, select a Site, and optionally an Agent.
  4. Click OK to start discovery.
  5. After discovery is complete, switch to the VPX tab. You should automatically see the VPX instances.
  6. To specify the nsroot credentials for a VPX, right-click the VPX, and click Edit.

    1. In the Modify Citrix ADC VPX page, either select an existing Profile Name, or click the Add button to create a new one. Click OK when done. It should start rediscovery automatically.
  7. After fixing the nsroot credentials, right-click the VPX instance, and click Configure SNMP. ADM will configure the VPX to send SNMP Traps to ADM.

Instance management

  • REST API proxy – Citrix ADM can function as a REST API proxy server for its managed instances. Instead of sending API requests directly to the managed instances, REST API clients can send the API requests to Citrix ADM. See Citrix CTX228449 Citrix ADM as an API Proxy Server
  • Citrix ADC VPX Check-In/Check-Out Licensing – You can allocate VPX licenses to Citrix ADC instances on demand from Citrix ADM. The Licenses are stored and managed by Citrix ADM, which has a licensing framework that provides scalable and automated license provisioning. A Citrix ADC VPX instance can check out the license from the Citrix ADM when a Citrix ADC VPX instance is provisioned, or check back in its license to Citrix ADM when an instance is removed or destroyed. See Citrix CTX228451 Citrix ADC VPX check-in and check-out licensing

Licenses

Virtual Server License Packs

Without Virtual Server licenses, you can enable analytics features on only 30 Virtual Servers. You can install additional licenses in 100 Virtual Server packs. More info at Licensing at Citrix Docs.

  1. On the left menu, go to Networks > Licenses.
  2. On the right, notice the Host ID. You will need this ID when allocating licenses at https://www.citrix.com/account.
  3. At https://www.citrix.com/account, allocate your Citrix ADM licenses to this Host ID.
  4. Then use the Browse button to upload the allocated license file.
  5. Click Finish after uploading the license file to apply it.
  6. The License Expiry Information section shows you the number of installed licenses and when they expire.
  7. You can use the Notification Settings section to email you when licenses are almost fully consumed or about to expire.
  8. Check the box next to Email and select a distribution list. If you don’t have an Email server setup yet, click the Add button to create one.
  9. Click Save when done.

Allocate licenses to Virtual Servers

ADM tries to automatically allocate all licenses to Virtual Servers in the order the Virtual Servers are discovered. If you don’t have enough licenses for every Virtual Server that ADM discovers, then you can manually unassign an automatically-allocated ADM Virtual Server license and reassign the license to a different Virtual Server.

  1. Go to System > Licensing & Analytics to see the number of currently installed (Entitled) licenses, and the number of Licensed virtual servers.
  2. By default, Auto Licensed Virtual Servers is enabled. If you disable this setting, then the Configure License button appears.
  3. Click the Configure License button.
  4. The top right shows you the number of licensed vs Entitled Virtual Servers.
  5. You can sort by Type. Or use the search box to filter the list of Virtual Servers.
  6. The Licensed column shows you the Virtual Servers that are licensed. You can select a Licensed Virtual Server and Unlicense it.
  7. Select a Virtual Server you want to license, and then click the License button.
  8. You can also Enable Analytics from here.

All licensed Virtual Servers are shown on the Applications > Dashboard page.

Enable AppFlow / Insight / Analytics

Citrix ADC 12.1 and newer have an additional port TCP 5563 from ADC SNIP to ADM for Metrics Collector.

You can only enable Analytics (i.e. AppFlow) on Virtual Servers that are licensed.

  1. Go to Networks > Instances > Citrix ADC.
  2. On the right, switch to one of the instance type tabs (e.g. VPX).
  3. Select an instance, open the Select Action menu, and click Configure Analytics.
  4. Select one or more Virtual Servers. If they are not licensed, then click the License button.
  5. After licensing, select one or more Virtual Servers and then click the button labelled Enable Analytics.
  6. Different options are available for different types of Virtual Servers.
    • For ICA Proxy Gateways, you want HDX Insight. Gateway Insight provides AAA and EPA info for the Gateway. Leave it set to ICA unless you are doing double-hop ICA.
    • For HTTP Load Balancing Virtual Servers, you want Web Insight. If you are licensed for ADC Premium Edition, then you can also enable Security Insight for Web App Firewall and Bot Protection monitoring.
  7. For appliances that have Gateway Virtual Servers, expand Advanced Options and select Citrix Gateway.
  8. Click OK to enable AppFlow on the Virtual Servers.
  9. Click Close when configuration is complete.
  10. Enable Analytics on more Virtual Servers.
  11. Login to the Citrix ADC (not ADM), and go to System > Settings.
  12. On the right, click Configure Modes.
  13. If you are using LogStream, then make sure ULFD is checked. Click OK.

    enable mode ulfd
  14. On the right, click Change Global System Settings.
  15. Scroll down to ICA port(s) and add 1494 and 2598 to the list. Click OK. (Source = Citrix Discussions)

    set ns param -icaPort 1494 2598
  16. On the right, click Change HTTP Parameters.
  17. At the top, add 80 and 443 to the Http Ports list. Click OK. (Source = Citrix Discussions)

    set ns param -httpPort 80 443
  18. By default, with AppFlow enabled, if an ADC High Availability pair fails over, then all Citrix connections will drop and users must reconnect manually. NetScaler 11.1 build 49 and newer have a feature to replicate Session Reliability state between both HA nodes.
    1. From Session Reliability on NetScaler High Availability Pair at Citrix Docs: Enabling this feature will result in increased bandwidth consumption, which is due to ICA compression being turned off by the feature, and the extra traffic between the primary and secondary nodes to keep them in sync.
    2. On a NetScaler 11.1 build 49 and newer ADC appliance, go to System > Settings.
    3. On the right, in the Settings section, click Change ICA Parameters.
    4. Check the box next to Session Reliability on HA Failover, and click OK.
  19. In a NetScaler 12 or newer instance, at System > AppFlow > Collectors, you can see if the Collector (ADM) is up or not. However, older ADC uses SNIP to verify connectivity, but AppFlow is sent using NSIP, so being DOWN doesn’t necessarily mean that AppFlow isn’t working. Citrix CTX227438 After NetScaler Upgrade to Release 12.0 State of AppFlow Collector Shows as DOWN.
  20. When AppFlow is enabled on a Gateway vServer, an AppFlow policy is bound to the twice to the Gateway: once for Request Policies (i.e. HTTP), and once for ICA Request Policies. You might want to verify that these bindings are actually configured.
  21. On the ADM appliance, AppFlow for ICA (HDX Insight) information can be viewed under the Analytics > HDX Insight node.

Citrix Blog Post – NetScaler Insight Center – Tips, Troubleshooting and Upgrade

Enable Syslog on Instance

ADM can configure ADC instances to send Syslog to ADM. Note: this will increase disk space consumption on the ADM appliances.

  1. Go to Networks > Instances > Citrix ADC. On the right, select one of the tabs containing your ADC instance.
  2. On the right, select an instance, open the Select Action drop-down, and click Configure Syslog.
  3. At the top, check the Enable box.
  4. In ADM 13, the Log Level should already be set to Custom with some boxes selected. Feel free to check other boxes while keeping in mind the disk space requirements.
  5. Click OK.

ADM nsroot Password

Changing ADM’s nsroot password also changes ADM’s nsrecover password.

  1. In ADM , go to System > User Administration.
  2. On the right, on the tab named Users, select the nsroot account, and click Edit.
  3. Check the box next to Change Password and enter a new password.
  4. You can also specify a session timeout by checking the box next to Configure Session Timeout.
  5. Click OK.

ADM Agent nsrecover Password

ADM 13.0 build 61 and newer let you change the nsrecover password from the ADM GUI.

In older ADM, putty (SSH) to the ADM Agent appliance, login as nsrecover and then run the script at /mps/change_agent_system_password.py

ADM Management Certificate

  1. The certificate to upload must already be in PEM format. If you have a .pfx, you must first convert it to PEM (Base64 certificate and key files). You can use a ADC’s Import PKCS#12 feature to convert the .pfx to PEM, and then download the converted certificate from the appliance.
    1. On any Citrix ADC, go to Traffic Management > SSL.
    2. On the right, click Import PKCS#12.
    3. Enter a name for a new file that will contain the PEM certificate and PEM key.
    4. Browse to the .pfx file and enter the password.
    5. You can optionally encrypt the PEM key by selecting an Encoding Format and entering an encryption key.
    6. Click OK.
    7. To download the PEM file, go to Manage Certificates / Keys / CSRs.
    8. Scroll to the bottom of the list, right-click the new file, and click Download.
  2. Back in ADM, go to System > Administration.
  3. On the right, in the SSL Settings section, click Install SSL Certificate.
  4. Click Choose File to browse to the PEM format certificate and key files. If the PEM certificate and PEM key are in the same file, then browse to the same file for both fields.
  5. If the keyfile is encrypted, enter the password.
  6. Click OK.
  7. Click Yes to reboot the system.

  8. To force users to use https when accessing the ADM management page, go to System > Administration. On the right, click System, Time zone, Allowed URLs and Message of the day.
  9. On the Basic Settings page, check the box next to Secure Access Only and click Save.

System Configuration

  1. Go to System > Administration.
  2. On the right, click System, Time zone, Allowed URLs and Message of the day.

    1. Check the box next to Enable Session Timeout, and specify a value.
    2. By default, at Networks > Instances > Citrix ADC , if you click a blue IP address link, ADM does single sign on to the instance using the nsroot credentials. If you want to force ADM users to login using non-nsroot credentials, then in check the bottom box for Prompt Credentials for Instance Login.

    3. Click Save.
    4. On the Time Zone page, configure Time Zone, and then click Save.
    5. On the left, click the Message of the day tab.
    6. On the right, check the box next to Enable Message.
    7. Enter a message, and then click Save.
    8. Click the back arrow when done.
    9. When you login to ADM, you’ll be shown the message.
  3. Configure SSL Settings lets you disable TLS 1 and TLS 1.1.

    1. On the right, click the Protocol Settings section in the Edit Settings section on the right side of the screen.
    2. On the left, uncheck TLSv1 and TLSv1.1. Then click OK.
    3. Click Yes when asked to confirm the restart.

Prune Settings

  1. At System > Administration, on the right, in the left column, is System and Instance Data Pruning.
  2. System Pruning defaults to deleting System Events, Audit Logs, and Task Logs after 15 days. System events are generated by the ADM appliance, which is different than Instance events (SNMP traps) that are generated by ADC appliances.
    1. If you change anything on these pages, click the Save button before switching to a different tab/node/page.
    2. ADM can initiate a purge automatically as the database starts to get full.
    3. To see the current database disk usage, go to System > Performance and wait a few seconds.
  3. Instance Events page controls when instance SNMP traps are pruned, which defaults to 40 days.
  4. If you are sending Syslog from instances to ADM, then Instance Syslog page controls when the log entries are purged.

Backup Settings

  1. In System > Administration, in the middle column, under Backup, click Configure System and Instance backup.
  2. System Backup Settings defines how many ADM backups you want to keep. These are ADM backups, not ADC backups.
    1. There’s an option for External Transfer.
    2. System backups (not Instance Backups) are at System > Backup Files.
  3. The Instance page lets you configure how often the instances are backed up.
    1. You probably want to increase the number of instance backups, or decrease the backup interval. The backups are quite small (e.g. 700 KB).
    2. There is an option to perform a backup whenever the ADC configuration is saved.
    3. The Enable External Transfer checkbox lets you transfer the backups to an external system so it can be backed up by your backup tool.
    4. Instance backups can be found at Networks > Instances > Citrix ADC. Right-click an instance, and click Backup/Restore.
    5. You can Restore a backup, Download the backup, or Transfer it to an external system.

Analytics Settings

  1. There are more settings at Analytics > Settings.
  2. ICA Session Timeout can be configured by clicking the link.

    • If ADM doesn’t receive AppFlow records for a session, it will consider that session has got terminated in ADC and stops monitoring that session further. The time for which ADM needs to wait before considering a session terminated is ICA session timeout. This is configurable in ADM, by default it is set to 15 minutes. (source = Citrix Discussions)
  3. You can configure how the App Score (Application Dashboard) is calculated.

  4. Analytics > Settings > Data Persistence lets you configure how long Analytics data is retained. Adjusting these values could dramatically increase disk space consumption. See CTX224238 How Do I Increase Granularity of Data Points Stored on NetScaler MAS Analytics?.

    • To see the current database disk usage, go to System > Performance and wait a few seconds.

NTP Servers

  1. On the left, click System > Administration.
  2. On the right, click NTP Servers.
  3. Click Add.
  4. Enter an NTP server, and click Create.

  5. After adding NTP servers, click the NTP Synchronization button.
  6. Check the box next to Enable NTP Synchronization, and click OK.
  7. Click Yes to restart.

Syslog

This is for syslog entries generated by ADM server, and not for syslog entries generated by the instances.

  1. Go to System > Audit Log Messages > Syslog Servers.
  2. On the right, click Add.
  3. Enter the syslog server IP address, and select Log Levels. Click Create.
  4. You can click Syslog Parameters to change the timezone and date format.

Email Notification Server

  1. Go to System > Notifications.
  2. On the right, on the Email tab, click the button named Email Servers.

    1. Click Add.
    2. Enter the SMTP Email server address, and click Create.
  3. In the breadcrumb, click Notifications.
  4. On the right, on the Email tab, and click Add.

    1. Enter an information for a destination distribution list, and click Create.
  5. You can highlight a Distribution List and click the Test button.


  6. On the left, click System > Administration.
  7. On the right, click Change Event Notification and Digest.

    1. Move notification categories (e.g. UserLogin) to the right.
    2. Check the box next to Send Email. Select a notification distribution list. Then click Save.

Authentication

  1. Go to System > Authentication.
  2. On the right, switch to the tab named LDAP.
  3. Click Add.
  4. This is configured identically to ADC.
    1. Enter a Load Balancing VIP for LDAP.
    2. Change the Security Type to SSL, and Port to 636. Scroll down.
    3. Enter the Base DN in LDAP format.
    4. Enter the bind account credentials.
    5. Check the box for Enable Change Password.
    6. Click Retrieve Attributes, and scroll down.
    7. For Server Logon Attribute, select sAMAccountName.
    8. For Group Attribute, select memberOf.
    9. For Sub Attribute Name, select cn.
    10. To prevent unauthorized users from logging in, configure a Search Filter. Scroll down.
    11. If desired, configure Nested Group Extraction.
  5. Click Create.
  6. On the left, go to System > User Administration.
  7. On the right, click the tab named Groups.
  8. On the right, click Add.

    1. Enter the case sensitive name of your Citrix ADC Admins AD group.
    2. Move the admin Role to the right.
    3. The Configure User Session Timeout checkbox lets you configure a session timeout.
    4. Click Next.
    5. On the Authorization Settings page, if you are delegating limited permissions, you can uncheck these boxes and delegate specific entities.
      • All DNS Domain Names (GSLB) is an option for Stylebooks in ADM 12.1 build 49 and newer.
    6. Click Create Group.
    7. In the Assign Users page, click Finish. Group membership comes from LDAP, so there’s no need to add local users.
  9. On the top right, click the button named Settings.

    1. If desired, check the box next to Enable User Lockout, and configure the maximum logon attempts. Click OK.
  10. On the left, go to System > Authentication.
  11. On the top right, click the button named Settings.
  12. Change the Server Type to EXTERNAL, and click Insert.
  13. Select the LDAP server you created, and click OK.
  14. Make sure Enable fallback local authentication is checked, and click OK.

Analytics Thresholds

  1. Go to Analytics > Settings > Thresholds.
  2. On the right, click Add.
  3. Enter a name.
  4. Use the Traffic Type drop-down to select HDX, WEB, SECURITY, or APPANALYTICS.
  5. Use the Entity drop-down to select a category of alerts. What you choose here determines what’s available as Metrics when you click Add Rule.

    1. With HDX as the Traffic Type, to add multiple rules for multiple Entity types, simply change the Entity drop-down before adding a new rule.
    2. If the Traffic Type is HDX, and the Entity drop-down is set to Users, on the bottom in the Configure Geo Details section, you can restrict the rule so it only fires for users for a specific geographical location.
  6. In the Notification Settings section, check the box to Enable Threshold.
  7. Check the box to Notify through Email, and select an existing Email Distribution List.
  8. Click Create.

Private IP Blocks

You can define Geo locations for internal subnets.

  1. Go to Analytics > Settings > IP Blocks.
  2. On the right, click Add.
  3. In the Create IP Blocks page:
    1. Enter a name for the subnet.
    2. Enter the starting and ending IP address.
    3. Select a Geo Location (Country, Region, City). As you change the fields, the coordinates are automatically filled in.
  4. Click Create.

SSL Certificate Expiration Notification

SSL Dashboard can notify you when certificates will expire soon.

  1. In the ADM menu, expand Networks, and click SSL Dashboard.
  2. On the top right, click the button named Settings.
  3. In the Certificate is expiring in (days) field, enter the number of days before expiration that you want to receive a notification. The default is 30 days.
  4. Check one of the boxes (e.g. Email) below How would you like to be notified.
  5. Select a notification profile (e.g. Mail Profile) or Add one.
  6. Click Save and Exit, or click Next to see more SSL Dashboard settings.

Instance Email Alerts (SNMP Traps)

You can receive email alerts whenever a ADC appliance sends a critical SNMP trap.

  1. On the left, go to Networks > Events > Rules.
  2. On the right, click Add.
  3. Give the rule a name.
  4. Move Severity filters (e.g. Major, Critical) to the right by clicking the plus icon next to each Severity.
  5. While scrolling down, you can configure additional alert filters. Leaving them blank will alert you for all categories, objects, and instances.
  6. On the bottom of the page, in the Event Rule Actions section, click Add Action.
  7. In the Add Event Action page:
    1. Select an Action Type (e.g. Send e-mail Action).
    2. Select the recipients (or click the Add button to add recipients).
    3. Optionally, enter a Subject and/or Message.
    4. If you enter a Subject, you can check Prefix severity, category, and failure object information to the custom email subject.
    5. Emails can be repeated by selecting Repeat Email Notification until the event is cleared.
  8. Click OK.
  9. Then click Create.
  10. See the Event Management section at All how to articles at Citrix Docs.

Events Digest

ADM can email you a daily digest (PDF format) of system and instance events

To enable the daily digest:

  1. Go to System > Administration.
  2. On the right, click Configure Event Notification and Digest.
  3. Switch to the Event Digest page.
  4. Uncheck the box next to Disable Event Digest.
  5. Configure the other settings as desired, and click OK.

Director Integration

Integrating Citrix ADM with Director adds Network tabs to Director’s Trends and Session Details views. Citrix Blog Post Configure Director with Netscaler Management & Analytics System (MAS)

Requirements:

  • Citrix Virtual Apps and Desktops (CVAD) must be licensed for Premium Edition (formerly known as Platinum Edition). This is only required for the Director integration. Without Premium, you can still access the HDX Insight data by going visiting the Citrix ADM web site instead of from Director.
  • Director must be 7.11 or newer for Citrix ADM support.

To link Citrix Director with Citrix ADM:

  1. On the Director server, run C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /confignetscaler.
  2. Enter credentials for a user that only has HDX Insight permissions. 
    User Role for ADM Director Integration
  3. If HTTPS Connection (recommended), the Citrix ADM certificate must be valid and trusted by both the Director Server and the Director user’s browser.
  4. Enter 1 for Citrix ADM (aka MAS).
  5. Do this on both Director servers.

Use Citrix ADM

Networks

Everything under the Networks node is free.

Infrastructure Analytics – ADM 13 and newer has an Infrastructure Analytics node under the Networks node. For details, see Infrastructure Analytics at Citrix Docs.

  • On the right, if you click the gear icon above the table, then the right panel changes to the Settings Panel instead of the Summary Panel. In the right panel, you can then switch to the tab named Score Thresholds to adjust how Infrastructure Analytics scores instance CPU, Memory, Disk, etc.
  • You can click the Circle Pack button to change to the Circle Pack view.

At Networks > Instances, select an instance and view its Dashboard.

  • The Instance Dashboard has tabs.

Backups are available by selecting an instance, and clicking Backup/Restore.

Networks > Network Reporting lets you create Dashboards where you can view Instance performance data.

Networks > Network Reporting > Thresholds lets you create thresholds when counters cross a threshold. For example, you might want a notification when Throughput gets close to the licensed limit.

Configuration Record and Play

Use ADM to record a configuration change on one instance, and push to other instances.

  1. Go to Networks > Configuration Jobs.
  2. On the right, click Create Job.
  3. Give the job a name.
  4. Change the Configuration Source drop-down to Record and Play.
  5. Change the Source Instance drop-down to the instance you want to record.
  6. Click Record.
  7. ADM opens the instance GUI. Make changes as desired.
  8. When done, go back to ADC, and click Stop.
  9. ADC retrieves the changed config.
  10. On the left, you’ll see the changed commands. Drag them to the right.
  11. On the right, you can change instance-specific values to variables by simply highlighting the values. This allows you to change the values for each instance you push this config to.
  12. Proceed through the rest of the Configuration Job wizard like normal. You’ll select instances, specify variable values for each instance, and schedule the job.

Dave Brett Automating Your Netscaler 11.1 Vserver Config Using Netscaler Management and Analytics System uses a Configuration Job to deploy StoreFront load balancing configuration to an instance.

Analytics and Applications

This functionality requires Virtual Server licenses, which can come from your built-in 30 free licenses.

The AppFlow Analysis tools (e.g. HDX Insight) are located under the Analytics node. See Viewing HDX Insight Reports and Metrics at Citrix Docs.

Applications > Dashboard automatically includes all licensed Virtual Servers.

  • On the top middle, click Define Custom App to group Virtual Servers together into an application. The grouped Virtual Servers are removed from the Others list.

  • You can then click any Application’s box to view stats. For Custom Applications, it combines stats about all of the vServers in that Custom Application. On the top right-click the name of the Application to view more details.
  • ADM 13 adds a Transaction Log tab.

Applications > Configurations > StyleBooks lets you use StyleBooks to create new ADC configurations.

There are built-in StyleBooks for Exchange, SharePoint, Oracle, ADFS, etc. Or you can create your own StyleBook and use it to create ADC configurations. For details, see StyleBooks at Citrix Docs.

The Applications Node has quite a bit of functionality. See Application Analytics and Management at Citrix Docs for details.

Link:

HDX Insight

HDX Insight Dashboard displays ICA session details including the following:

  • WAN Latency
  • DC Latency
  • RTT (round trip time)
  • Retransmits
  • Application Launch Duration
  • Client Type/Version
  • Bandwidth
  • Licenses in use

Citrix CTX215130 HDX Insight Diagnostics and Troubleshooting Guide contains the following contents:

  • Introduction
  • Prerequisites for Configuring HDX Insight
  • Troubleshooting
    • Issues Related to ICA parsing
    • Error Counter details
  • Checklist before Contacting Citrix Technical Support
  • Information to collect before Contacting Citrix Technical support
  • Known Issues

Gateway Insight

In the Analytics node is Gateway Insight.

This feature displays the following details:

  • Gateway connection failures due to failed EPA scans, failed authentication, failed SSON, or failed application launches.
  • Bandwidth and Bytes Consumed for ICA and other applications accessed through Gateway.
  • # of users
  • Session Modes (clientless, VPN, ICA)
  • Client Operating Systems
  • Client Browsers

More details at Gateway Insight at Citrix Docs.

Security Insight

The Security Insight dashboard uses data from Application Firewall to display Threat Index (criticality of attack), Safety Index (how securely ADC is configured), and Actionable Information. More info at Security Insight at Citrix Docs.

Troubleshooting

Citrix CTX215130 HDX Insight Diagnostics and Troubleshooting Guide: Syslog messages; Error counters; Troubleshooting checklist, Logs

Citrix CTX224502 Frequently Asked Questions During NetScaler MAS Troubleshooting

Upgrade Citrix ADM

  1. If you are upgrading from MAS 12.0 build 56 and older, you must upgrade to MAS 12.0 build 57.24 before you can upgrade to ADM 12.1. Then upgrade from ADM 12.1 to ADM 13. (Source = Before you upgrade at Citrix Docs)
  2. Citrix recommends upgrading to ADM 13.0 build 61.48 before you upgrade to later builds.
  3. Download the latest Citrix Application Delivery Management (ADM) Upgrade Package. You want the ADM Upgrade Package, not a ADM image. It’s around halfway down the page.
  4. Login to Citrix ADM Floating IP or Active Node. Upgrading the Active Node automatically upgrades the Passive Node.
  5. Go to System > Deployment and make sure both nodes are online and replicating.
  6. Go to System > Administration.
  7. On the right, in the far right column, click Upgrade Citrix ADM.
  8. Browse to the build-mas-13.0…tgz Upgrade Package, and click OK. The file name starts with build-mas-13.0 (not masagent).

  9. Click Upgrade. Note: the upgrade screens changed in ADM 13.0 build 61 and newer. Upgrading to 67 and newer takes a while due to the database upgrade.

  10. Click Yes to reboot the appliance.





  11. After it says that upgrading is complete, login.
  12. In 13.0 build 67 and newer, you can click the link to see the database migration status.
  13. If you upgraded to ADM 13.0 build 58 or newer, you might see the CUXIP banner at the top of the screen.
  14. If you upgraded from a version older than 12.1 build 50 to ADM 13 or newer, you might be prompted to Configure Customer Identity. Make your choice.

    • You can return to the Configure Customer Identity screen by going to System > Administration.
  15. After upgrading to 13.0 build 41 or newer, you might see a banner asking you to configure System Notifications.

    1. Notice that all categories are configured.
    2. Check the box next to Send Email, select a Distribution List, and click Save.
  16. The new firmware version can be seen by clicking your username in the top right corner.

Upgrade Disaster Recovery Node

After you upgrade the HA pair in the primary datacenter, you can upgrade the DR node.

  1. Use WinSCP or similar to connect to the DR node using the nsrecover credentials.
  2. On the ADM DR node, navigate to /var/mps/mps_images.
  3. Create a new Directory with the same name as the 13.0 build number. Then double-click the new directory to open it.

  4. Upload the file named build-mas-13.0-##.##.tgz to the version-specific directory. This is the regular ADM upgrade file with a name starting with build-mas-13.0. It’s not the Agent upgrade file.
  5. SSH (Putty) to the DR node and login as nsrecover.
  6. Enter the following. Replace the # with the version number. 
    cd /var/mps/mps_images/13.0-##.##
tar xvzf build-mas-13.0-##.##.tgz

  7. Then enter the following. The appliance will reboot automatically. 
    ./installmas

  8. After the reboot, the file /var/mps/log/install_state…
  9. …shows you the installed version.

Upgrade ADM Agents

After you upgrade the ADM HA pair in the primary datacenter, and after you upgrade the DR node, you can then upgrade the ADM Agents.

  1. From the ADM 13.0 download page, at the bottom of the page, download the ADM Agent Upgrade Package. This Agent Upgrade file is different than the regular ADM upgrade file. And it is different than the files to deploy a new Agent. Find it at the bottom of the downloads page.
  2. Use WinSCP or similar to connect to the ADM Agent using the nsrecover credentials.
  3. On the ADM Agent, navigate to /var/mps/mps_images.
  4. Create a new Directory with the same name as the 13.0 build number. Then double-click the new directory to open it.

  5. Upload the file named build-masagent-13.0-##.##.tgz to the version-specific directory. This is the ADM Agent upgrade file, and not the regular ADM upgrade file.
  6. SSH (Putty) to the ADM Agent and login as nsrecover.
  7. Enter the following. Replace the # with the version number. 
    cd /var/mps/mps_images/13.0-##.##
tar xvzf build-masagent-13.0-##.##.tgz

  8. Then enter the following. The appliance will reboot automatically. 
    ./installmasagent

  9. After the reboot, the file /var/mps/log/install_state…
  10. …shows you the installed version.
  11. Repeat for any additional ADM Agents.
  12. If you login to ADM and go to Networks > Agents, you should see the new Version. It will take several minutes for the version number to update.

60 thoughts on “Citrix Application Delivery Management (ADM) 13”

  1. Can we create an account to use other than nsroot, for adding instances? If so, what settings need to be set for the account?

    Reply

      1. appadmin will do. not that there are many roles

        if you want your own policy just drill down where the device is ie in 13.0 that was all > networks>instances>citrix adc and enable edit. that should work

        Reply

  2. Hi Carl,

    I’m sure some others have the same issue I have been having when updating HA pairs over the last couple of years. ie for the first few it worked perfectly but post a DB upgrade every time I update the firmware the secondary dies. it may still be running old firmware, have a nonexistent DB, or such but citrix always go ‘deploy a new replacement’ which honestly gets very tiring hearing the same solution and no real fix as it just breaks again on next update, or the update after…

    while you probably dont have an answer to this, it might be worth including how to detect/replace a ‘dead’ node in troubleshooting.

    Reply

      1. indeed they do. But then when I’ve had real issues its never fixed them, well not by pressing it alone.

        ie https://support.citrix.com/article/CTX327923/how-to-debug-and-resolve-admha-db-streaming-broken-issues see “/var/mps/db_pgsql/data/pg_hba.conf file corruption.”

        I’ve had a few support tickets open regarding update failures, and stream failures that have resulted from issues with the updates that have only occurred on ‘next’ reboot none of which have been fixed by any of their support documentation. Their most recent solution was to completely rebuild the environment.

        Reply

  3. When creating a job, is it possible to view the output for show commands? For example, I need to review the SNMP configuration for multiple instances so I created a job to run these commands:

    sh ns save | grep “snmp mib”
    sh ns save | grep “snmp community”
    sh ns save | grep “snmp manager”
    sh ns save | grep “snmp trap”

    But the job does not provide the output of executing the commands, it simply tells me the commands were executed successfully.

    Reply

  4. Will an unlicensed ADM work to backup and restore various VPX instances?
    I know the latest ADM will only support 2 vServers, but what about backup and restore of VPX images?

    Reply

    1. Yes, unlimited for instance backups and other instance infrastructure features (e.g., SNMP alerting, upgrade jobs)

      Reply

      1. yea the licenses for ADM are about its analytics features. so was 10 now 2 vservers have this for free so you can work out how many you want long term and change to suit. The non-analytics side just works fine regardless of if it’s just the 2 free or not.

        I can personally confirm ADM happily backs up over 19 netscaler HA pairs with no issues and with no extra out of pocket.

        Reply

  5. Hi carl,
    I have a problem regarding the connection from a VPX with multiple TD, I can’t connect to ADM. Data does not appear to ADM. do you have experienced the same thing?

    Reply

  6. Hi Carl,
    First thank god for your website, he’s way more usefull then Citrix website 😉

    I have a question regarding ADM, How do you manage your software Images for your VPX Instances? I would like to manage my VPX images, add new, remove others… I find this action very easy using my SDX (Management Service -> Software Images) but I cannot find something like this into my ADM.

    Currently, when I want to upgrade a VPX, I create a maintenance job then in the last tab, Software Image, I upload using Local or I see my stored images into Appliance. But I cannot manage them 🙁

    Is there a better way to manage my VPX Images?

    Thank you for your help and your experiances

    Best regards

    Mathieu

    Reply

      1. On-Prem ADM, when selecting the file, there’s an option on get it from appliance and it shows you all firmware files you previously uploaded.

        Reply

      2. the upgrade images can be found here /var/mps/ns_images on your local appliances, so you can poke this location with winscp to maintain them, or script out management of the contents.

        we also updated our firmware via the SDX. I preferred this way as the SDX’s were HA unaware. The upgrade jobs on ADM are HA aware so do a fully automated update of both nodes. Given firmware bugs in the past have done things like remove vlans, pbr, etc we never do fully automated updates as we test for potential issues prior to a failover as we are very, very, risk adverse. Those with very simple VPX setups won’t run into these issues or can wear the downtime, but sadly if there is an issue at least one of our HA pairs will typically hit it on an update cycle and we can’t have that level of downtime

        Reply

  7. Dear Carl,
    there is not any data in My ADM :
    1. ApplicationsUsers>Endpoints>Dashboard.
    2. Analytics>Security?Security Violations

    do i forget to enable some settings?

    Reply

      1. i can see the data in Web Insight, but No data in Applications>Users & Endpoints>Dashboard, Transactions, Outbound Traffic Dashboard.
        Thanks again your blog.

        Reply

        1. should i enable WAF in netscaler and bind WAF policy to virtual server?
          Because it is empty in App Security and Users & Endpoints. THank you.

          Reply

          1. That’s a good point regarding the Security data. Yes, Security in ADM requires WAF configuration.

  8. Hi Carl,I have implement Citrix ADM as a pooled licensing server
    basically no monitoring, and the resources as per citrix recommendation for ADM is a little bit high , 32GB RAM and 8 vCPUs, so since I’m using it for pooled lic do you think decreasing the resources will be ok?

    Reply

    1. you can get by with less resources if your demands on the ADM are very low. I think I deployed it with 2vCPUs and 8GB RAM in my lab and no issues.

      Reply

  9. Hi Carl , i have deployed the ova and i can ping and ssh the adm appliance
    but can’t reach it through gui ,? any suggestions ? it is brand new installation

    Reply

  10. Dear Carl, how can I login to the postgresql and see the databases and tables. I am getting psql command not found.

    Reply

  11. Hi Carl, thank you for the excellent writeup. Question, is there a way to view what client IPs connect to what backend servers via ADM?

    Thanks in advance,

    Rondy

    Reply

    1. Not that I can think of. ADC Auditing (syslog) has a TCP Connections logging option but I’m not sure if that includes back-end connections.

      Reply

  12. Hi Carl,
    My question is once we enable syslog on ADM for netscaler vpx instances, how do we get email alert for any critical alerts?Also where do we see syslog messages on ADM?

    Reply

  13. Hello Carl,
    I have newly installed citrix ADM as per above procedure, but I am not able to access ADM through GUI. Command line looks good but GUI is not accessible.
    How to allow http acess in ADM. I am able to ssh the ADM appliance but not through http. Please advise

    Reply

    2. Hi It is usually observed Citrix ADM install takes good amount of time the movement we import the VM and perform Network configurations. the system deployment once started it would take 30 or more minutes to get to GUI portal login. however while the install process is progress still we could access SSH and view the system is doing backend process

      Reply

  14. Hi Carl,
    I have installed and configured Citrix ADM 13.0.52.24
    I have a strange issu, in HDX –> User it show only 1 hour analitycs, if i change to 1 day\1 week etc it show no data to Display.
    Any suggestion?
    It is up and running from at least 2 weeks.

    Reply

  15. Can ADC MAS / ADM provide SSL VPN users Login / Logoff details, Historical reports like monthly, weekly and daily how many VPN users connected and each user, what he used during the connected (session ) time etc?

    Reply

    1. I’m not aware any ADM report that can do that. But you can configure ADC to send Syslog to a syslog server (e.g. Splunk) and generate your own reports. ADC generates Syslog entries when users log into Gateway.

      Reply

  16. Hello Carl,

    I have an installation with Citrix Gateway 13 and Citrix ADM 13. I have enabled AppFlow policy action on the ADC side and when trying to bind the AppFlow policy on the VPN VSERVER object, the Appflow policy gets bound as request type but it does not get bound as ICA_Request type. Citrix Gateway throws an error “feature(s) not licensed”. I am using a Citrix Gateway CSP License, which includes the AppFlow feature but not the “Appflow for ICA” feature. Can this feature be individually enabled in the license?

    Reply

  17. HDX Insight Requirements “Your ADC appliance must be running Enterprise Edition or Platinum Edition”. Thats a pity.

    Reply

  18. Hi Carl,

    I am trying to setup RADIUS Auth against Cisco ISE. For the ADC, it is working fine. For ADM, I get the error “User not authorized for any operation”. I am trying to setup LDAP for group extraction, but I don’t know where to get the SSH key for LDAP. I spoke to my AD SysAdmin and he has no idea what I talking about. Can you point me in the right direction?

    Thanks!

    Reply

  19. Hi Carl,

    I have an issue where in the AppFlow has been enabled through ADM but the data is not being collected. Is there a way to check if the data is getting routed from the ADC to ADM? the ADC version is 12.1.55.18 and ADM version is 12.1.55.13

    Reply

    1. Usually I start with tcpdump to make sure the traffic is arriving to ADM. tcmpdump port 5557 (Logstream) on ADM. You can do nstcpdump.sh on the ADC.

      Reply

      1. Thanks for the quick response, i did a nstcpdump from ADC to ADM and can see quite a few seq and ack packets from ADC’s SNIP to the ADM on port 5557. When i do tcpdump from ADM to ADC on port 5557 i see 0 packets captured.

        Having said this, tried to telnet to ADM through ADC on port 5557 and gets connected

        Reply

  20. Hi:

    With regards to “For example, if a Load Balancing service goes down, you can receive an email alert,” I don’t get the method for that, and can’t find any examples. If I add a rule, choose instance and name the LB as failure object, nothing happens. This was relatively easy to set up in Command Center.

    Reply

    1. Make sure you select all events or select the ENTITYDOWN event. Make sure your rule has an Email Action.

      Reply

      1. Hi Carl ,
        we tested this is entitydown in our EVENT RULE configuration, entitydown work if FARM url is DOWN but not the specific individual host URL.

        here is my example
        I have VirtualServer Farm URL :
        “dnstesting.lb.com”

        under this farm , i have 3 service urls like below , since my app is clustered.
        dnstest.stghost1:8443 UP
        dnstest.stghost2:8443 UP
        dnstest.stghost3:8443 OUT OF SERVICE / DOWN

        the eventrule for entitydown will tigger an alert-email only when ALL the 3 serviceURLs were DOWN /OUTOFSERVICE.

        But we have a critical need /requirement to have email notification alert via ADM when atleast 1 serviceURL were down.
        please help let me know how we can achieve this via ADM event RULE itself.

        we were not able to use below options in eventrule category
        vsvrCurServicesDown (1.3.6.1.4.1.5951.4.1.3.1.1.37)
        The current number of services which are bound to this vserver and are in the state ‘down’.

        vsvrCurServicesOutOfSvc (1.3.6.1.4.1.5951.4.1.3.1.1.39)
        The current number of services which are bound to this vserver and are in the state ‘outOfService’.

        vsvrCurServicesUp (1.3.6.1.4.1.5951.4.1.3.1.1.41)
        The current number of services which are bound to this vserver and are in the state ‘up’.

        Reply

  21. Hi Carl,

    You write that for an agent HA implementation, you can just run two agent appliances and add them to the same site. In the Citrix documentation FAQ, they state that there is no possibility to run agents in HA mode. So they just run independently? What happens when both agents discover the same ADC appliance?

    I haven’t tested it yet myself, but it’s an important consideration we face in a current project.

    Reply

      1. Hello, i have this error on Director, in section “Network” :
        “Error fetching the licensing information”.

        Reply

  23. Hi Carl, do you know if you can get security insight logs for a Citrix Gateway? Option only appears available for Load Balancing and my security team are mainly interested in Citrix Gateway. Thanks Darren

    Reply

      1. Thanks, appears you can’t bind an AppFW policy on a virtual server running SSL_BRIDGE either. Can you think of any other ways to get these working?

        Reply

  24. I am missing the option to enable AppFlow for a CR. On your screen shot is shows LB, CR,CS and Citrix Gateway.

    My Application list only displays “Lists the LB, CS and Citrix Gateway applications running on the Citrix ADC appliance”. Is there a feature I need to enable. Running ADC 13.36.27 and ADM 13.36.27.

    Reply

    1. I’m guessing that’s one of the few screenshots I didn’t update. My ADM 13 also does not have CR as an option.

      Reply

  25. The first version of MAS/ADM we installed (11.x) had a very useful feature. In what is now seen under the Analytics / Applications / menu, you could see the SSL Protocol used for that application (TLS 1.2 vs 1.1 vs 1.0) displayed in a ring graph on the right hand side. This functionality at the application was removed in later builds, but retained in the Clients menu where it’s not really useful. I contacted both Citrix support and our local Citrix office over a year ago, and both understood the value of the missing information and said they would pass my request on to Development. Having the TLS version(s) used per application would be very useful in removing TLS 1.0/1.1 on an application-by-application basis. Does anyone know a straightforward way to obtain the TLS versions used on a given application through ADM 12.x/13.x or the NetScalers themselves?

    Reply

      1. Yes, I believe it is SSL Insight. I’ve tried everything I can think of, including making sure I’m using Logstream and not IPFIX to transport the data from the NetScaler to MAS. (I believe that’s a requirement for SSL Insight.) I was really hoping they would have put it back in for version 13, but perhaps it was omitted because it was so useful.

        I’ll review the article you linked since that may be our only option to get this reporting. Thank you, Carl.

        Reply

Leave a Reply

Your email address will not be published. Required fields are marked *