Advisory · Projects · Speaking LinkedIn GitHub Credly IT EN

Access · Citrix

Citrix ADC build-13.0-64.35_nc_64

A few days ago I upgraded my lab Citrix ADC instances to the latest available 13.0 firmware version (build-13.0-64.35_nc_64).

After the firmware upgrade, I ran into some very unusual problems with the ADC instances. The only way to get my ADC cluster working properly again was to downgrade to the version I had before.

In particular, I ran into problems with the ADC GUI: while browsing the various configurations, it showed me incorrect settings. For example, on some Load Balancers with SSL Offload, I found the server certificate “bound” in the section reserved for the CA certificate as well. When I tried to remove the certificate, the GUI threw an error, because the certificate wasn’t actually “bound” as a CA, even though it was shown as such.

Another oddity showed up in the configuration of a Citrix Unified Gateway: in this case I found LDAP policies visually “bound” in sections of the GUI reserved for Content Switching policies. Or LDAP policies “bound” where, in my case, there should have been only a RADIUS policy.

Besides the GUI problems, some LBs also gave me strange issues…some Load Balancers stopped working properly and showed unusual behavior; for example, StoreFront servers were no longer load balanced with persistence, which obviously caused problems for user sessions.

So I recommend skipping this version and waiting a few releases before upgrading. Clearly this version wasn’t tested enough.