Updating Login Portal on NetScaler with ADM

 

 Customizing the login portal on a Netscaler login page can be a bit tricky, especially since Citrix doesn’t officially support it. The challenge lies in updating multiple Netscaler devices across the environment. Unlike pushing CLI commands, which can be automated, portal changes are typically done manually through the GUI. These modifications often result in changes to specific files rather than the main ns.conf configuration file. For instance, when configuring background images or logos, the process involves adjusting these files directly. 🛠️🔒

Below is the path where the significant changes in custom portals will happen 

Logos

/var/netscaler/logon/themes/<custom theme name>/custom_media/

Configs Related to button/background header color/footer color/text file etc will happen for the below files in the path 

File: custom.css  and theme.css

path: var/netscaler/logon/themes/<custom theme name>/css/custom.css

           var/netscaler/logon/themes/<custom theme name>/css/theme.css

Also along with this please replace the custom_theme.json file which  is available under the custom theme folder

path: var/netscaler/logon/themes/<custom theme name>/custom_theme.json

The easiest way to handle this is to take one Netscaler and update the portal as needed and then the configs on that Netscaler should be on the 3 files along with logos. If we  do a config job on ADM to push the files to all Netscaler this will replace the files and changes will be effective immediately  ( no reboot needed)

The config job on Netscaler should look as below

Please note the custom_portal in the path is not a default. It is the name of folder if you create a custom theme.

Things to Note for the config job on ADM

1) Ensure we select "scp" for the dropdown before each command

2) Ensure we select the variable type as File. You should be able to see when you click on the variable or if you select the Preview Variable option on the right side top. 

3) Ensure we give the complete name of the file when specifying the path. Below is an example

Hope this helps 

cheeers!!!!

BIGIP Configuration for Prober reference on Generic host

    Today I worked on a GTM issue that happened because of configuration that was done not knowing the consequence. 

For Generic host we will have an option saying prober preference ---> outside datacentre. This will make any LTM or GTM outside the Datacentre configured in the GTM cluster. This  means there is a possibility that LTM that is behind the firewall can also poll and we might end up seeing member being marked down if there is no firewall rule to allow this traffic.

Netscaler password hashing With KEK for instance specific password

 

Before 13.1 version on Netscaler if we replace the ns.conf file from one Netscaler to another everything would normally work including the passwords. This means if I copy the command with the password in the hash, it would work fine.  However, after 13.1 they started to include additional hashing where the commands used to have an additional part that said KEK .  Here the password gets hashed again with keys local to the device. This means if you copy the command from one Netscaler and try pasting on another one it will fail.

It would throw an error saying the decryption failed. There is a way to get rid of this. If we go to /nsconfig folder there will be a folder with name keys. Try copying the files to the device where you wanted to import the password and this will work like magic.