Product Documentation

Connection Management

Apr 26, 2017
What is an admin connection?
An admin connection establishes a connection to the NetScaler IP (NSIP) address and allows administrators to configure and monitor the NetScaler appliance.
What are the types of admin connections?
There are two types of admin connections:
  • SSH connection – Admin users use an SSH client to logon through the NetScaler IP (NSIP) address.
  • NITRO API connection – Admin users use NITRO API’s to automate the logon process to NetScaler appliance.
Note: Admin users can also log on through the NetScaler GUI to log on, by using a browser to connect to the NSIP address. The GUI internally opens a NITRO API connection. Therefore, a GUI session is equivalent to a NITRO API connection, and FAQs related to NITRO API apply to GUI.
How many concurrent admin connections are allowed on a NetScaler appliance?
The appliance allows up to 20 concurrent admin connections.
Which login credentials are required for an admin logon?
Admin logon requires a user name and a password.
Note: An authentication key can be used instead of a password.
Which external authentication methods does a NetScaler appliance support?
The appliance supports the following external authentication methods:
  • RADIUS
  • LDAP
  • TACACS

For more details, see External Authentication

What is a client?
A client is a device (laptop or desktop), used by admin user to open an admin connection.
What is a session token?
A session token is a unique identifier that the NetScaler appliance issues to a client that sends a NITRO API logon request.
  • API clients can reuse the session token, if it has not expired, for subsequent API requests on new TCP connections
  • GUI clients internally open NITRO API connections and keep the session token active for the duration of the GUI session.
What is an active session on a NetScaler appliance?

A CLI session is considered active if the session has not expired and has an open SSH connection with a NetScaler appliance.

A NITRO API session is considered active if the session token timeout has not expired on the NetScaler appliance.

How does NetScaler enforce the concurrent connection limit?
Every time the NetScaler appliance receives an admin connection request (SSH or NITRO API), it checks the number of admin connections it has open. If the number is lower than 20, a new connection is opened.
Which counter reflects the number of admin connections on a NetScaler appliance?
The connection counter (nsconfigd_cur_clients) reflects the number of active connections. This counter is incremented when a client opens new connection to the appliance, and is decremented when a connection is closed.
Which counter reflects the number of active tokens on the NetScaler appliance?
The configd_cur_tokens counter reflects the number of active tokens on NetScaler appliance.
How does NetScaler appliance handle errors on a connection?
The NetScaler appliance immediately closes the client (CLI, API, and GUI) connection if it encounters errors on a connection.
Does a CLI or GUI session on a connection to the management address count against the admin connection limit?
Yes, all CLI and GUI connections are TCP based connections, and every TCP connection to the management address counts against the admin connection limit.
Does a NITRO session count against the admin connection limit?
A NITRO session counts against the admin connection limit if there is an open TCP connection using the session token issued by the NetScaler appliance.
What is the default timeout period for API, GUI, and CLI sessions on NetScaler appliance?
The following table lists the default timeout period for API, GUI and CLI sessions on the NetScaler appliance:
NetScaler Releases CLI default timeout period (min) API default timeout period (min) GUI default timeout period (min)

NetScaler 9.3

None

30 Minutes

30 Minutes

NetScaler 10.1

None

30 Minutes

30 Minutes

NetScaler 10.5 Onwards

15 Minutes

30 Minutes

15 Minutes

How can you set the CLI sessions time out on a NetScaler appliance?

The CLI session timeout can be configured by executing the following command at the CLI prompt:

set cli mode -timeout <xx seconds>

How do you override the default timeout period when using the NITRO API?
You can override the default timeout period for a NITRO API by setting the timeout duration in the “timeout” field of the login object. If the session timeout is set to zero, the session token has an infinite timeout.
Note: An infinite timeout is not advisable, because sessions that do not time out continue to count against the admin connection count.
What happens if a user account is deleted from the NetScaler appliance after an admin session is created?

For internal system users, NetScaler appliance closes the existing CLI or NITRO API session.

For external system users, session remains active until it expires.

Can NITRO API clients use a single session token to open multiple admin connections on the NetScaler appliance?
Yes. Each such connection counts against the admin connection limit.
If management access is enabled for a MIP or SNIP address, do admin connections to that address count against the limit for the number of admin connections?
Yes, admin connections to management address (MIP or SNIP) count against the admin connection limit on NetScaler ADC.
Can a NetScaler admin log on to the NetScaler appliance after the maximum connections limit is reached?
Yes. One additional admin connection is allowed after the maximum connection limit is reached.
Can NITRO API endpoints open multiple admin connections on NetScaler the appliance?
Yes, NITRO API endpoints can open multiple admin connections and exhaust the concurrent admin connection limit on a NetScaler appliance. In such situations, an additional SSH/CLI connection is allowed and the admin can force closure of old API sessions, or reduce the session timeout duration for the existing API sessions.
Can same client open multiple API sessions on a NetScaler appliance?
Yes, a client can open multiple API session by repeatedly logging on. For example, the client might log back on after a reboot.
Note: Repeated client logons count against the admin connection limit on NetScaler appliance.
Can API clients use the entire API session token limit?

Yes, API clients can use the entire API session token limit, provided by repeatedly logging on without using a previously issued token.

Note: If a client’s session timeout is zero, the token is valid forever. Repeated logons using new session tokens can count against the limit for API session tokens.

Do CLI sessions count against the API session token limit?
No, CLI sessions are not counted against the API session token limit.
Can admin users use telnet to open a CLI session?
No. Only an SSH client can open a CLI session.
What is connection limit and API session limit applicable for various NetScaler releases?
The following table lists the maximum concurrent admin connection and active API session limits applicable for various NetScaler releases:
NetScaler Releases 9.3

10.1

(Before 130.x)

10.1

(Before 130.10)

10.1

(From 130.10)

Maximum number of concurrent admin connections

20

20

20

20

Maximum number of active API sessions*

1000

20

1000

1000

Note*:
  • API sessions are considered active if they have not timed out. For example, if 500 API sessions were created but 100 have expired, 400 API sessions are active.
  • An API session need not open a TCP connection to the NetScaler appliance.