Auto Reboot on License Expiry for term based licenses for VPX (on hypervisors) for a certain range of older builds

Auto Reboot on License Expiry for term based licenses for VPX (on hypervisors) for a certain range of older builds

book

Article ID: CTX338617

calendar_today

Updated On:

Description

There was a change introduced where ADC term-based licenses were being revoked by forcing auto-reboot at the end of the license expiry. Applicable to VPX on hypervisors. It does not affect VPX on SDX. This change has since been reverted. 

Affected Builds for VPX on hypervisors
12.1 GA builds before 12.1-63.22
13.0 GA builds before 13.0-82.41)
 
Change Reverted in Following  Builds
The later GA ADC builds, as detailed below, have the change reverted,  hence for these builds onwards there will be no auto-reboot on the license expiry for term-based licenses. This behavior has also been deprecated on all recommended releases for CVE-2021-22955 and  CVE-2021-22927 and after.

  • 12.1-63.22 and above
  • 13.0-82.41 and above
  •  13.1(all builds)


Note: If the VPX is automatically rebooted with an expired license it will revert to VPX Express license which is the default behavior for all Citrix ADC VPX licenses.

Licenses that are impacted

Only Term based licenses directly applied on ADC which would be VPX Subscription Licenses. VPX Subscription licenses can be used on-prem or in a private cloud or public cloud (i.e. AWS, Azure, GCP) with Customer Licensed option (BYOL)

 Licenses that are not impacted
  • Pooled Licenses including Zero Capacity licenses
  • VCPU  licenses via ADM
  • CSP license
  • Marketplace Subscription licenses
  • MPX Perpetual License, there are no term-based licenses for MPX.
  • VPX on SDX is not impacted.

 
Documentation
Upon license expiration, the Citrix ADC appliance automatically restarts to revoke the license. If the Citrix ADC appliance uses Citrix service provider (CSP) licenses, the appliance does not restart automatically to revoke the license. However, if the user restarts the appliance, it restarts as unlicensed.
https://docs.citrix.com/en-us/citrix-adc/12-1/licensing/citrix-adc-licensing-overview.html

 

 

Resolution

Workaround for customers on the affected builds
If it is standalone ADC (no HA or Cluster), the admin needs to procure a license before expiry and find a maintenance window to do a warm reboot to apply for the new license. In the case of HA/Cluster, the license can be applied one by one on the nodes to avoid downtime.

The command “show ns license” shows the Day to Expiration. If the “Days to expiration” falls below 30, it is recommended to schedule a maintenance window to apply for the new license.

Eg #show license output via CLI                             …
                             …
                       Model Number ID: 8000
                          License Type: Platinum License
                        Licensing mode: Local
                    Days to expiration: 12


Eg show license output via Nitro API response 
Nitroresponse :     { "errorcode": 0, "message": "Done", "severity": "NONE", "nslicense": { "wl": true, "sp": true, "lb": true, "cs": true, "cr": true, "sc": true, "cmp": true, "delta": false, "pq": true, "ssl": true, "gslb": true, "gslbp": true, "hdosp": true, "routing": true, "cf": true, "contentaccelerator": true, "ic": true, "sslvpn": true, "f_sslvpn_users": "4294967295", "f_ica_users": "0", "aaa": true, "ospf": true, "rip": true, "bgp": true, "rewrite": true, "ipv6pt": true, "appfw": true, "responder": true, "agee": false, "nsxn": true, "htmlinjection": true, "modelid": "8000", "push": true, "wionns": true, "appflow": true, "cloudbridge": true, "cloudbridgeappliance": false, "cloudextenderappliance": false, "isis": true, "cluster": true, "ch": true, "appqoe": true, "appflowica": true, "isstandardlic": false, "isenterpriselic": false, "isplatinumlic": true, "issgwylic": false, "isswglic": false, "feo": true, "lsn": true, "licensingmode": "Local", "daystoexpiration": "12", "rdpproxy": true, "rep": true, "urlfiltering": false, "videooptimization": true, "forwardproxy": false, "sslinterception": false, "remotecontentinspection": true, "adaptivetcp": true, "cqa": true } }
 
 
Long Term Solution
Once the ADCs  (VPX on hypervisors) are upgraded to the following builds there will be no auto-reboot on license expiry for term-based licenses.
12.1-63.22 and above
13.0-82.41 and above
 13.1(all builds)

 


Problem Cause

There is an auto-reboot initiated on license expiry for ONLY term-based licenses for VPX (on hypervisors) for a certain range of older builds. The change has since been reverted.