There was a change introduced where ADC term-based licenses were being revoked by forcing auto-reboot at the end of the license expiry. Applicable to VPX on hypervisors. It does not affect VPX on SDX. This change has since been reverted.
Affected Builds for VPX on hypervisors
12.1 GA builds before 12.1-63.22
13.0 GA builds before 13.0-82.41)
Change Reverted in Following Builds
The later GA ADC builds, as detailed below, have the change reverted, hence for these builds onwards there will be no auto-reboot on the license expiry for term-based licenses. This behavior has also been deprecated on all recommended releases for CVE-2021-22955 and CVE-2021-22927 and after.
Note: If the VPX is automatically rebooted with an expired license it will revert to VPX Express license which is the default behavior for all Citrix ADC VPX licenses.
Licenses that are impacted
Only Term based licenses directly applied on ADC which would be VPX Subscription Licenses. VPX Subscription licenses can be used on-prem or in a private cloud or public cloud (i.e. AWS, Azure, GCP) with Customer Licensed option (BYOL)
Licenses that are not impacted
Documentation
Upon license expiration, the Citrix ADC appliance automatically restarts to revoke the license. If the Citrix ADC appliance uses Citrix service provider (CSP) licenses, the appliance does not restart automatically to revoke the license. However, if the user restarts the appliance, it restarts as unlicensed.
https://docs.citrix.com/en-us/citrix-adc/12-1/licensing/citrix-adc-licensing-overview.html
Workaround for customers on the affected builds
If it is standalone ADC (no HA or Cluster), the admin needs to procure a license before expiry and find a maintenance window to do a warm reboot to apply for the new license. In the case of HA/Cluster, the license can be applied one by one on the nodes to avoid downtime.
The command “show ns license” shows the Day to Expiration. If the “Days to expiration” falls below 30, it is recommended to schedule a maintenance window to apply for the new license.
Eg #show license output via CLI …
…
Model Number ID: 8000
License Type: Platinum License
Licensing mode: Local
Days to expiration: 12
Eg show license output via Nitro API response
Nitroresponse : { "errorcode": 0, "message": "Done", "severity": "NONE", "nslicense": { "wl": true, "sp": true, "lb": true, "cs": true, "cr": true, "sc": true, "cmp": true, "delta": false, "pq": true, "ssl": true, "gslb": true, "gslbp": true, "hdosp": true, "routing": true, "cf": true, "contentaccelerator": true, "ic": true, "sslvpn": true, "f_sslvpn_users": "4294967295", "f_ica_users": "0", "aaa": true, "ospf": true, "rip": true, "bgp": true, "rewrite": true, "ipv6pt": true, "appfw": true, "responder": true, "agee": false, "nsxn": true, "htmlinjection": true, "modelid": "8000", "push": true, "wionns": true, "appflow": true, "cloudbridge": true, "cloudbridgeappliance": false, "cloudextenderappliance": false, "isis": true, "cluster": true, "ch": true, "appqoe": true, "appflowica": true, "isstandardlic": false, "isenterpriselic": false, "isplatinumlic": true, "issgwylic": false, "isswglic": false, "feo": true, "lsn": true, "licensingmode": "Local", "daystoexpiration": "12", "rdpproxy": true, "rep": true, "urlfiltering": false, "videooptimization": true, "forwardproxy": false, "sslinterception": false, "remotecontentinspection": true, "adaptivetcp": true, "cqa": true } }
Long Term Solution
Once the ADCs (VPX on hypervisors) are upgraded to the following builds there will be no auto-reboot on license expiry for term-based licenses.
12.1-63.22 and above
13.0-82.41 and above
13.1(all builds)