Jump to content


Photo

After VPX upgrade to 11.1 48.10 all Virtual servers showing as down

Started by Justin Shay , 21 September 2016 - 04:40 PM
11 replies to this topic

Justin Shay Members

Justin Shay
  • 35 posts

Posted 21 September 2016 - 04:40 PM

I upgraded from 11.0 62.10 to 11.1 48.10 and now all virtual servers are showing as down in load balancing.  I reverted to a backup and tried the upgrade again and the problem happened again. Looking at it it looks like it could be a monitor problem but I am not sure why it would have blown up during the upgrade.

 

Anyone else running into this?

 

 



Carl Stalhood CTP Member

Carl Stalhood
  • 11,940 posts

Posted 21 September 2016 - 04:54 PM

What is the back end? What monitor?



Thomas Preischl Members

Thomas Preischl
  • 21 posts

Posted 21 September 2016 - 06:20 PM

Are there all ssl certs remaining? And are they bound to the vs and so on?

Ketil Gjerde Members

Ketil Gjerde
  • 32 posts

Posted 21 September 2016 - 10:27 PM

If this is IIS backend, I guess this could still be an issue on 11.1?
http://support.citrix.com/article/CTX205578



Robert Fjerdingstad Members

Robert Fjerdingstad
  • 8 posts

Posted 22 September 2016 - 12:27 PM

I had the same problem after upgrading to Netscaler 11.1 from 11.0.

It looks like it enables tls 1.1 and 1.2 again.

 

What I had to do was go to Traffic Management > SSL > Change advanced SSL setting and enable "Use Default Profile".

This will change all your VIPs and services to use the default SSL Profiles. (should be done during a maintenance window)

 

Then make sure that "ns_default_ssl_profile_backend" under System > Profiles > SSL Profiles, has TLSv11 and TLSv12 disabled.



Justin Shay Members

Justin Shay
  • 35 posts

Posted 22 September 2016 - 05:19 PM

I had the same problem after upgrading to Netscaler 11.1 from 11.0.

It looks like it enables tls 1.1 and 1.2 again.

 

What I had to do was go to Traffic Management > SSL > Change advanced SSL setting and enable "Use Default Profile".

This will change all your VIPs and services to use the default SSL Profiles. (should be done during a maintenance window)

 

Then make sure that "ns_default_ssl_profile_backend" under System > Profiles > SSL Profiles, has TLSv11 and TLSv12 disabled.

I think you may be on to something I did need to set both of those settings and I think that fixed my netscaler gateway virtual server but all of my virtual servers under load balancing are still showing as down. 



Justin Shay Members

Justin Shay
  • 35 posts

Posted 22 September 2016 - 05:21 PM

What is the back end? What monitor?

It is VPX running on VMWare.  It seems to be all monitors as I have several Virtual servers under load balancing and they are all showing as down.



Pankaj Kumar Citrix Employees

Pankaj Kumar
  • 8 posts

Posted 24 September 2016 - 05:52 AM

Justin, can you please share support bundle (ns.conf, failure trace) to help us debug the issue? You can mail it to pankaj.kumar@citrix.com.

Also, is a support case opened for this issue? Please share the id. Thanks.



Paul Blitz Members

Paul Blitz
  • 3,915 posts

Posted 25 September 2016 - 09:29 PM

Sounds like it's the same (Microsoft?) Issue that storefront has when the backend uses tls1.2, it's a (lack of) compatibility issue

Justin Shay Members
  • #10

Justin Shay
  • 35 posts

Posted 27 September 2016 - 03:23 PM

Justin, can you please share support bundle (ns.conf, failure trace) to help us debug the issue? You can mail it to pankaj.kumar@citrix.com.

Also, is a support case opened for this issue? Please share the id. Thanks.

Citrix Engineers are working on this issue for me.  I will post the answer when we have it resolved.



Justin Shay Members
  • #11

Justin Shay
  • 35 posts

Posted 20 October 2016 - 01:51 PM

Citrix has stopped responding on this issue so i am am back to the drawing board.  I have restored to a backup and then re upgraded to several different versions including just going to 11.0.68 and it is doing the same thing.  I have restored again and then tried to upgrade the other node of of the HA cluster with the same issues. It appears that all Service groups are showing as down.  If I turn off Health monitoring then they show as okay again.  I have modified the SSL profiles to turn off TLS1.1 and 1.2 but still have the same look.  I can't be the only one who has sen this.



Avinash Piare Members
  • #12

Avinash Piare
  • 4 posts

Posted 13 April 2017 - 05:46 PM

I just upgraded two SDX 8015 appliances using the single-bundle upgrade, and after that two H/A VPX pairs (running on the SDX appliances). 

 

After upgrading the Secondary of the first H/A pair I ran into the same issue. Virtual servers were down, because the monitors were down. 

 

I read this thread http://discussions.citrix.com/topic/385210-after-securing-ha-netscalers-should-lb-on-secondary-be-down/ and saw the comment Jens Ostkamp posted:

 

 

This should be expected behaviour and your secondary NetScaler will get his services (and so the LBVSRVs) up, as soon as he needs to take over primary role

 

 

I forced a failover and voila all services and virtual servers were UP again. 

After I upgraded the former-Primary (the Secondary at that moment) all services and virtual servers were UP whilst in Secondary status.

Probably has to do with the difference in version between two NSsen in a H/A pair.