Typical symptoms include:

License Server: <Console_Agent_IP>    Status: Disconnected

Internal error [LAS token expired]

NetScaler Console Agent logs may show:

HTTP: Connection refused

HTTPS: tlsv1 alert protocol version

Exception: DEVICE_NOT_REACHABLE

ICMP connectivity may still succeed.

Run the following command to confirm the NSIP management configuration:

show ns ip <NSIP>

If the NSIP is configured as SECUREONLY, HTTP management is disabled.

Option 1 — Temporarily Enable HTTP and Push the License

Connect to the unlicensed NetScaler through SSH and run:

set ns ip <NSIP> -gui ENABLED

Do not reboot the appliance. The command may not be saved while the appliance is unlicensed.

Open the following URL in a browser:

http://<NSIP>

If the login page opens:

1. Configure the NetScaler Console admin profile to use HTTP.
2. Rediscover the appliance.
3. Navigate to:

NetScaler Licensing > License Management > License with LAS

4. Select the affected appliance and apply the license.

Verify the licensing state:

show ns license
show ns licenseserver

After the appliance is licensed, immediately restore HTTPS-only management:

set ns ip <NSIP> -gui SECUREONLY
save ns config

Do not leave HTTP management enabled.

Option 2 — Have the NetScaler Pull the License

Use this option when temporary inbound HTTP management access is not permitted or Option 1 does not work.

Connect to the NetScaler through SSH and enter the shell:

shell

Initialize the LAS registration:

curl -k -X POST "http://<Console_Agent_IP>/nitro/v1/config/las_lic_init" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'object={"las_lic_init":{"nsip":"<NSIP>","hostname":"<hostname>","nstype":"ns-mpx"}}'

Request the license token:

curl -k -X POST "http://<Console_Agent_IP>/nitro/v1/config/las_lic_activate" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'object={"las_lic_activate":{"nsip":"<NSIP>","action":"initial","plt_capacity":"<bandwidth_mbps>"}}'

Replace:

• <Console_Agent_IP> with the NetScaler Console Agent or LSA IP address.
• <NSIP> with the affected NetScaler NSIP.
• <hostname> with the appliance hostname.
• <bandwidth_mbps> with the allocated bandwidth value.

Verify the result:

show ns license
show ns licenseserver

Option 2 should be performed only under guidance from Citrix Support or Engineering.

Problem Cause

The appliance is unlicensed and its LAS token is expired.

While unlicensed, normal SSL management communication is unavailable or restricted. HTTPS connections from NetScaler Console fail during TLS negotiation.

At the same time, HTTP management is disabled because the NSIP is configured with:

-gui SECUREONLY

NetScaler Console therefore cannot establish the NITRO session required to apply the license and reports:

DEVICE_NOT_REACHABLE

Temporarily enabling HTTP or initiating the LAS request from the NetScaler breaks this licensing deadlock.

A NetScaler MPX using License Activation Service (LAS) may drop all connections and be unable to re-establish connectivity with NetScaler Console or its LAS Agent, appearing as Out of Service in NetScaler Console.

The appliance remains reachable through ICMP, but NetScaler Console cannot apply the license because:

• HTTPS management fails while the appliance is unlicensed.
• HTTP management is refused when the NSIP is configured with -gui SECUREONLY.
• NetScaler Console reports DEVICE_NOT_REACHABLE.

This creates a licensing deadlock. The issue can be resolved by temporarily enabling HTTP so NetScaler Console can push the license, or by having the NetScaler initiate the licensing request.