NetScaler ADC form factors licensing describes how the licence mechanics change when the same ADC software runs as a VPX virtual appliance, an MPX or SDX hardware appliance, a CPX container or a BLX bare-metal instance. The licensing overview says NetScaler offers “a wide range of product editions and licensing models for MPX and VPX appliances” and that each appliance needs an edition licence; the offering is then chosen by term (perpetual or subscription, yearly or hourly), by metric (vCPU or bandwidth) and by deployment (on premises or cloud).[1] The product terms list the form factors as appliance (MPX, SDX), VM (VPX), bare metal (BLX) and container-based instance (CPX), with Pooled Capacity and Self-Managed variants.[10]
Summary of form factors
| Form factor | What it is | Typical licence families | Free tier |
|---|---|---|---|
| VPX | Virtual appliance on hypervisors and clouds | Flexed or Pooled instance plus bandwidth; fixed bandwidth subscription; marketplace subscription | VPX Express, 20 Mbps[1] |
| MPX | Hardware appliance | Fixed-term software, or zero-capacity MPX-Z with pool check-out | None stated |
| SDX | Hardware appliance hosting multiple VPX instances | Fixed-term software, or zero-capacity SDX-Z with pool check-out | None stated |
| CPX | Container-based instance | Flexed or Pooled through Console agent; legacy vCPU and CP1000 | CPX Express, 100 Mbps[2] |
| BLX | NetScaler software on bare-metal Linux | Fixed bandwidth subscription; pooled capacity | BLX Express[3] |
VPX
NetScaler VPX runs on VMware ESXi, Citrix Hypervisor, Linux KVM, Microsoft Hyper-V, AWS, Microsoft Azure and Google Cloud. Under Flexed and Pooled licensing a VPX needs no zero-capacity licence: to process traffic it must check out bandwidth and an instance licence from the pool, and for AWS and Azure an IPsec tunnel is required for communication with NetScaler Console.[14] The maximum bandwidth depends on the platform, from 100 Gbps on VMware ESXi and Linux KVM to 3 Gbps on Hyper-V, with a 10 Mbps minimum and check-out unit.[11]
VPX Express needs no licence file and provides 20 Mbps, a maximum of 250 SSL sessions and 20 Mbps SSL throughput; from NetScaler 14.1 build 29.65 it includes all advanced features available with the Premium licence.[1] Express is therefore a deployment that does not appear in licence-file inventories and must be found by discovery.
In public clouds there are two models. A customer-licensed (BYOL) VPX from the AWS marketplace needs a licence generated in the Citrix licensing portal and uploaded to the instance; a paid marketplace instance does not need a licence because the correct feature set and performance activate automatically. The documentation provides a procedure for migrating between the subscription and BYOL models.[9] Marketplace licences are not supported by the License Activation Service, so pay-as-you-go VPX must move to BYOL before LAS-based licensing applies to it.[12] On large cloud instance types, the VPX network throughput may differ from the licence: on AWS, an instance type above VPX 5000 may not reach the throughput stated by the licence, although other features such as SSL throughput may improve.[9]
MPX
MPX is the single-tenant hardware appliance. Hardware is bought separately from software subscriptions, and hardware maintenance has to be purchased for MPX and zero-capacity hardware even where software maintenance is included in a fixed-term, pooled or self-managed subscription.[10] Under Flexed or Pooled licensing the MPX is “zero-capacity hardware” (MPX-Z) and needs a platform (Z-cap) licence before it can check capacity out of the pool.[14] The MPX table gives each model its own minimum and maximum bandwidth with a 1 Gbps unit, for example MPX 5900Z from 1 to 10 Gbps and MPX 26000Z from 100 to 200 Gbps.[11]
For fixed-term deployments the SKU names include the model, for example “NetScaler MPX Fixed Term Software Premium 9120”. LAS supports these through NetScaler ADC directly; end-of-life MPX models such as the 14000 and 22000 families are not supported by LAS.[12] Where an appliance is used in a high availability pair, “Buy separate licenses for each appliance” and install the same types on both, so a Premium licence on one appliance means another Premium licence on the second.[8]
SDX
SDX is a multi-tenant appliance that hosts VPX instances managed from a Management Service. The Management Service of an SDX-Z does not consume an instance licence under Pooled capacity, but each VPX on the SDX does.[14] The SDX table adds a minimum and maximum number of instances by model and release; for example, for release 13.1 build 51.x and later, an SDX 14000Z has 10 to 100 Gbps and 1 to 25 instances.[11]
Licences can be allocated in the Management Service by hardware serial number, licence access code or file upload, and can be partially allocated: a file of ten licences can be allocated six now and four later, but never more than the file contains.[4] Within the SDX the licensed bandwidth is shared among VPX instances either in dedicated mode, where each VPX has a fixed rate with equal minimum and maximum, or burstable mode, where a VPX has a minimum assured bandwidth and may burst to a preset limit according to a priority from P0 to P4; if total demand exceeds the licensed capacity the lower-priority VPX gives up its burst while the minimum guarantee is always honoured.[5] Bandwidth metering is a distribution scheme inside the licensed amount, not an extra licence.
When an SDX licence expires, the Management Service immediately limits the throughput of its VPX instances to 20 Mbps in release 14.1-43.x and later, for pooled and fixed licences; earlier behaviour was a 1 Mbps limit applied after a restart.[4]
CPX
NetScaler CPX is a container-based ADC for Kubernetes and Docker. CPX Express is free for on-premises and cloud deployments, is applied by default to a CPX downloaded from the Quay repository, has all CPX features and offers 100 Mbps from CPX 14.1 build 17.x (previously 20 Mbps); only community support is included.[2] Commercial CPX is licensed only through NetScaler Console, using pooled or Flexed licences; per the product terms, “NetScaler CPX requires NetScaler Console software to authenticate usage” and Console must be purchased separately where it is not bundled.[2][10]
CPX has a special counting rule. A CPX consuming up to 1 Gbps checks out only from the instance pool; at 1,200 Mbps the first 1,000 Mbps come from the instance pool and the remaining 200 Mbps from the bandwidth pool.[2] For LAS-based licensing, one container-based Console agent per Kubernetes cluster licenses all CPX instances in that cluster, and the Helm chart sets licensingMode: las, the agent address and the bandwidth in Mbps.[2] The legacy vCPU licensing for CPX checked out one licence per core, with 1 to 16 cores supported, and a CP1000 private pool; vCPU licences are no longer sold.[13]
BLX
BLX comes with an Express licence by default and requires no licence file. It also supports fixed bandwidth subscriptions, which enforce a maximum throughput, and pooled capacity. The Host ID is needed for fixed throughput and pooled licences and is obtained with show hardware.[3] A BLX needs no Z-cap licence and, under Flexed or Pooled licensing, checks out bandwidth and an instance licence from the pool, up to 100 Gbps with a 10 Mbps unit.[11]
Fixed bandwidth subscriptions and perpetual licences
Fixed bandwidth perpetual licences are end of sale, and a fixed bandwidth subscription fixes the throughput of a deployment in any form factor (MPX, SDX, VPX or BLX). Only Advanced and Premium editions are supported, edition and bandwidth upgrades are not supported, and migration to pooled capacity is not supported. After expiry the instance stops its normal operations, with configuration loss and shutdown of traffic processing.[1] Existing perpetual licences are subject to the SA date and Burn-In Date check described in NetScaler License Activation Service.
File-based licence mechanics
The legacy mechanism, which applies to appliances still on file-based licensing, allocates licences with the hardware serial number or licence access code from the licensing portal, with partial allocation, upload or CLI copy to /nsconfig/license, then a restart. An optional feature needs a feature-specific licence, so an Advanced customer must buy and install the AppCache licence to enable Integrated Caching. NetScaler can alert before expiry (a GUI alert at 30 days or fewer by default, SNMP traps if configured) and on expiry the appliance restarts automatically to revoke the licence, except appliances on service provider licences, which restart as unlicensed only when next restarted.[8] Licences can be tested without a reboot using the test licence function before applying them.[8]
NetScaler Gateway
NetScaler Gateway requires a Platform licence, which allows unlimited connections to Citrix Virtual Apps, Citrix Virtual Desktops or StoreFront by ICA Proxy; the Platform licence is delivered electronically with every new Gateway order and NetScaler Gateway VPX comes with it. VPN connections from the Citrix Secure Access client, a SmartAccess logon point or Secure Hub need an additional Universal licence.[6] The Universal licence limits concurrent user sessions to the number of licences purchased, and a user who logs on from more than one computer occupies a licence for each session; when all are occupied no new connection can open until a session ends or an administrator terminates one.[6] Universal licence files add up: a 100-user file plus a 400-user file give 500 licences.[7]
Unlike ADC pooled licences, “The appliance does not obtain licenses from NetScaler license Server”, so Gateway licence files are installed on each appliance and generated against the host name configured on it (the host name is case-sensitive in the portal).[6] For Citrix Virtual Apps and Desktops use cases such as endpoint analysis (EPA), SmartAccess and SmartControl, the product terms require additional Universal licences, and Universal licences received as part of another product are limited to Gateway appliances supporting that product environment.[10] Gateway is listed with Advanced and Premium editions in the product terms.[10] The Gateway documentation adds that a Standard edition licence allows 500 concurrent sessions.[6]
Out of scope
This article does not list every NetScaler hardware model or data-sheet throughput, nor the CLI and API calls for each licence mode, which the vendor documents in its product guides.