NetScaler agent behavior

Last published : Sep 26, 2026
Important:
File-based licensing system (also referred to as manually managed entitlements), traditionally used for activating various on-premises components, will be End of Life (EOL) on April 15, 2026. License Activation Service (LAS) is the next generation technology for product activations across the suite of Citrix products. LAS will be the only way to activate and license NetScaler instances after April 15, 2026, supporting NetScaler Flexed licenses (Citrix Platform License/Universal Hybrid Multi-Cloud), legacy NetScaler Pooled licenses, and NetScaler Fixed term Bandwidth licenses. To remain supported, your NetScaler and NetScaler Console deployments must be on a LAS compatible version.
The minimum required NetScaler versions that are LAS compatible are:
  • NetScaler ADCs: 14.1-51.x, 13.1-60.x, 13.1-37.246 (FIPS), 14.1-66.68 (FIPS)
  • NetScaler SVM: 14.1-51.x, 13.1-60.x
  • NetScaler Console Service: Supported from early September 2025.
  • NetScaler Console on-prem: 14.1-51.x
    Note: LAS support for Console on-prem is from release 14.1-51.x onwards. However, file-based licensing is deprecated as of April 15 2026 from Console on-prem releases 14.1-51.x onwards and 13.1-60.x onwards. If you upgrade to Console on-prem release 14.1-51.x or release 13.1-60.x or later, you can continue using file-based licensing until 15th April 2026. However you must upgrade to Console on-prem release 14.1-51.x or later, and switch to LAS before 15th April 2026 because Console on-prem 13.1 does not support LAS.
All the other forms of legacy NetScaler licenses such as NetScaler virtual CPU licensing (Pooled vCPU), NetScaler VPX Check-In and Check-Out (CICO), perpetual will not be supported with LAS. NetScaler instances leveraging perpetual licenses without an active maintenance will become unlicensed upon upgrade to the above mentioned software versions.
LAS-based licenses may not be available to customers where prohibited by law or regulations.
If you have questions or concerns, contact Customer Care. Citrix may limit or suspend your Citrix Maintenance for non-compliance with these requirements without liability in addition to any other remedies Citrix may have at law or equity. These requirements don’t apply where prohibited by law or regulation.
The NetScaler agent works as an intermediary between NetScaler Console and the discovered instances across different data centers and public clouds. NetScaler Console service requires a minimum of one agent per tenant for Flexed or Pooled licensing to work. Multiple NetScaler agents can be deployed per site or multi-site, but only one agent can have the License Server Agent (LSA) role for the entire tenant deployment.
Related information

LAS-based licensing

When using LAS-based licensing, a built-in agent within NetScaler handles license communication. An external agent is an optional component that you can deploy within your architecture to serve as a proxy for licensing communication.
To configure the NetScaler built-in agent for LAS, see Configure the built-in agent to manage instances.
To enable agent failover, see netscaler-console-service/getting-started/initiate-built-in-agent.
Note:
If you are using a built-in agent, you can only transition to LAS-based licensing through the NetScaler Console GUI.

Manually managed entitlement (file-based licensing)

An LSA is an agent that works as a license server in NetScaler Console service based pooled licensing deployment. If the LSA goes down, the service waits for 24 hours to elect a new LSA.
Until then, the NetScaler instances using pooled or flexed license go in grace period. As an administrator, you can also manually elect an LSA.
The following example shows two agents deployed and one of them has the LSA role:
Agent designated as LSA
The following sections are applicable for manually managed entitlement (file-based licensing).

Manually select a NetScaler Console agent as LSA

Admins can manually select a NetScaler Console agent as the LSA for NetScaler Pooled licensing or NetScaler Flexed licensing. When the LSA is down, the NetScaler Console service waits for 24 hours before auto-electing the next LSA. The admin can manually elect the new LSA in the interim by using this feature. However, the admin must ensure that the status of the new LSA being elected is UP and its diagnostic status is OK.
When the admin manually selects a new LSA, it might take up to 5 minutes for the licensing functionality to work correctly. During this time, the NetScaler instances are in grace and any fresh checkout for a license fails.
To select an LSA:
  1. Navigate to Infrastructure > Instances Dashboard > Agents and select an agent.
  2. In the Select Action list, select Set as LSA.
  3. Click Yes to confirm. The selected agent assumes the LSA role.

Multiple NetScaler agents behavior

In a deployment with a combination of multiple agents and multiple sites, the NetScaler agents follow the client/server architecture.
The first or oldest agent registered in an UP state is assigned the LSA role. Any other agents added later act as a proxy and communicate with the agent hosting the main LSA role for license allocation. Each agent hosting the proxy role communicates to the agent with the current LSA role through the NetScaler Console service.
Note:
There is no direct communication between the agent holding the LSA role and the other (non-LSA) agents. All the connections go through the NetScaler Console service only.

NetScaler agent failover behavior

The agent failover works in a multi-agent deployment in the following way.
Assume that there are two agents, AG1 and AG2, in the same data center.
  • AG1 is configured to use ADC11, ADC12, ADC13 as the remote license host or LSA.
  • AG2 is configured to use ADC21, ADC22, ADC23 as the remote license host or LSA.
  • AG2 is acting as the license server.
    • If AG1 fails, ADC11, ADC12, and ADC13 automatically connect through AG2 for license reconciliation.
      • ADC11, ADC12, and ADC13 might still notice a small period of grace if a few heartbeats are missed, while this reconnection happens.
    • If AG2 fails, all ADCs continue to stay in grace until:
      • Either AG2 comes back up/is brought back up, or AG1 is selected as the new LSA either automatically after 24 hours by NetScaler Console service or manually by admin.
      • Or AG2 is deleted from the NetScaler Console service. Once deregistered, the NetScaler Console service designates AG1 as the agent with the LSA role.
      • After the election has completed, AG1 starts allocating and reconciling resources to the configured instances.
For questions related to LSA, see FAQs on License Server Agent.

Configure license server through NetScaler built-in agent

If you have a License Server Agent (LSA) configured in one site and want to use the same LSA from other sites, you can use a NetScaler built-in agent. While using the built-in agent, you must configure the license server using the following command on the NetScaler instance.
add licenseserver 127.0.0.1 -port 27000
In this configuration, NetScaler can reach the License Server Agent (LSA) through Console service.
Note:
NetScaler built-in agent cannot be assigned the LSA role.