Customer finds following message in /var/log/ns.log, which indicates some gateway users failed to login:
Aug 14 09:17:01 x.x.x.x 08/14/2023:01:17:01 GMT xxxxxxx 0-PPE-5 : default SSLVPN Message 503230 0 : "Failed to process setclient for id , user due to "<license limit reached>"

This software application is provided to you as is with no representations, warranties or conditions of any kind. You may use and distribute it at your own risk. CITRIX DISCLAIMS ALL WARRANTIES WHATSOEVER, EXPRESS, IMPLIED, WRITTEN, ORAL OR STATUTORY, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT. Without limiting the generality of the foregoing, you acknowledge and agree that: (a) the software application may exhibit errors, design flaws or other problems, possibly resulting in loss of data or damage to property; (b) it may not be possible to make the software application fully functional; and (c) Citrix may, without notice or liability to you, cease to make available the current version and/or any future versions of the software application. In no event should the software application be used to support ultra-hazardous activities, including but not limited to life support or blasting activities. NEITHER CITRIX NOR ITS AFFILIATES OR AGENTS WILL BE LIABLE, UNDER BREACH OF CONTRACT OR ANY OTHER THEORY OF LIABILITY, FOR ANY DAMAGES WHATSOEVER ARISING FROM USE OF THE SOFTWARE APPLICATION, INCLUDING WITHOUT LIMITATION DIRECT, SPECIAL, INCIDENTAL, PUNITIVE, CONSEQUENTIAL OR OTHER DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. You agree to indemnify and defend Citrix against any and all claims arising from your use, modification or distribution of the software application.

To disable the advanced features of the Gateway (SSL VPN SMARTACESS, etc.), set ICA Only to true.

1. Navigate to Citrix Gateway>Citrix Gateway Virtual Servers
2. Select the Gateway and Click Edit
3. Search Basic Settings and Click Edit
4. Click More
5. Check ICA Only

More NetScaler Gateway Universal License, check Citrix Gateway Licensing eDoc.
Important: Before enabling advanced features of NetScaler Gateway, please evaluate your production concurrent user number and place the proper NetScaler Gateway Universal License

---

Problem Cause

"Maximum Citrix Gateway Users Allowed" user limitation reached.

There are two kind of User type in NetScaler Gateway, ICA Users and Citrix Gateway Users.
ICA Users number is unlimited in NetScaler and only consumed in Gateway ICA Only mode.
Citrix Gateway Users number is limited to NetScaler Platform License type(Standard, Advanced, Premium) and purchased Gateway Universal License. More license info, Citrix Gateway Licensing eDoc.

ICA Only set false in NetScaler Gateway basic setting. NetScaler gateway Universal License number will be consumed. Maximum Citrix Gateway Users Allowed is 1000 in customer's NetScaler license (Enterprise License) . At the corresponding point in time, NetScaler counter (aaa_cur_sessions) reaches 1000.

The following command can be running in NetScaler Shell check Universal License Usage (ICA Only setup false)
>shell
#cd /var/nslog
#nsconmsg -K newnslog -d current -g aaa_cur_sessions -s disptime=1 | more