Secure Management FAQs

Last published : Sep 24, 2026
This section answers common questions about the Secure Management feature, which enforces strict separation of the Management and Data planes in NetScaler. For a complete description of the feature, see Secure management: Implement strict separation of Management and Data planes.

How can I maintain access to NetScaler after enabling Secure Management?

Ensure that the Management plane has a valid route back to your management network before rebooting. When Secure Management is enabled, the NSIP is moved to the Management plane, which uses the management traffic domain (TD 4094 by default). The existing default gateway is moved to the management traffic domain only if it belongs to the NSIP subnet. As a result, after a reboot you can lose access to NetScaler. This can occur if the Management plane does not have either a default route or a specific route back to your management network.
Before you reboot, validate the Management plane routing path:
  • Confirm that a return route exists for NSIP management traffic.
  • Add a Management plane default route, if one is required:
    add route 0.0.0.0 0.0.0.0 <mgmt-gateway> -mgmt
  • Alternatively, add a specific Management plane route to the administrator network:
    add route <admin-network> <mask> <mgmt-gateway> -mgmt
If you lose access:
If the required routes were not configured, you might no longer be able to reach NetScaler. To recover access, connect through the console or from a host that is in the same subnet as the NSIP. Then add the missing Management plane route.

What is the role of NSVLAN, and how do heartbeats and redundancy work in high availability after enabling Secure Management?

After Secure Management is enabled, HA functions use the interfaces mapped to the NSVLAN for monitoring and configuration synchronization. They also use the interfaces mapped to the Management plane for the same purpose.
For the sync VLAN:
  • It must be placed in the management traffic domain.
  • It must not carry any IP addresses.
For example, assuming the Management plane is TD 4094 and the sync VLAN is 100:
add vlan 100
bind ns trafficdomain 4094 -vlan 100
set HA node -syncvlan 100

What happens to my existing PBRs after enabling Secure Management?

The action you take depends on the IP addresses referenced by each policy-based route (PBR):
  • PBRs that reference Data-plane IP addresses: No change is required. These PBRs continue to work after the feature is enabled.
  • PBRs that reference Management-subnet IP addresses: Update them after enabling the feature, based on where the traffic must go:
    • If the traffic stays within the Management plane: Convert the PBRs to static routes in the management routing table.
      add route <network> <mask> <gateway> -mgmt
    • If the traffic requires a plane override and must exit through the Data plane: Add a PBR to the management traffic domain that keeps the rule in the Management plane while directing matched traffic to it.
      add ns pbr <name> ALLOW ... -td <mgmt-TD> -targetTD <mgmt-TD>
      Here, -td keeps the PBR in the Management plane, and -targetTD sends the matched traffic to the specified traffic domain. The -targetTD parameter cannot be combined with -nextHop.

How do I configure a SNIP on the Management plane?

In HA deployments, some administrators use a SNIP to manage their NetScaler so that they always remain connected to the primary node. To add a SNIP on the Management plane, assign it to the management traffic domain and enable management access:
add ns ip <SNIP> <subnet-mask> -td 4094 -mgmtAccess ENABLED
Note:
With Secure Management enabled, SNIPs with management access are permitted only on the Management plane.