The NetScaler License Activation Service (LAS) is the cloud-based licensing solution through which NetScaler activates and renews its instances. NetScaler describes LAS as “a licensing mechanism, not a license type”: it is an alternative to the older file-based method of licensing, in which manually managed entitlements (licence files) were uploaded to NetScaler or NetScaler Console.[2] The vendor states that file-based licensing reached end of life on 15 April 2026 and that “LAS will be the only way to activate and license NetScaler instances” from that date, for which NetScaler and NetScaler Console deployments must run a LAS-compatible version.[1] For an asset manager the change turns a static inventory of licence files into a live relationship with a Citrix Cloud account that must be monitored.
Version requirements
The minimum LAS-compatible versions listed in the NetScaler Console documentation are NetScaler ADC 14.1-51.x, 13.1-60.x, 13.1-37.246 (FIPS) and 14.1-66.68 (FIPS), NetScaler SVM 14.1-51.x and 13.1-60.x, NetScaler Console service from early September 2025, and NetScaler Console on-prem 14.1-51.x.[2] Console on-prem 13.1 does not support LAS, so customers had to upgrade to Console on-prem 14.1-51.x or later and switch to LAS before 15 April 2026.[1] For SDX appliances the SVM must be upgraded to a LAS-supported build; the specific VPX build on the SDX does not affect compatibility.[2] The NetScaler documentation also says LAS-based licences may not be available to customers where prohibited by law or regulation, and that Citrix may limit or suspend maintenance for non-compliance with the requirements.[1]
What LAS can license
LAS supports a closed list of licence types, and the documentation states that it “does not support any license type other than” those in its table.[1]
| LAS-supported licence | How it appears in the licensing portal | Deployment path |
|---|---|---|
| Citrix Platform License (CPL) | Product name contains “Flexed”, for example NetScaler Flexed VPX SW instance | LAS with Console service or Console on-prem Cloud Connect |
| Universal Hybrid Multi-Cloud (UHMC) | Same “Flexed” naming | LAS with Console service or Console on-prem Cloud Connect |
| Legacy Pooled capacity or bandwidth licence | Contains “Starter Pool”, for example a 20/20 pack, Premium edition with 20G and 20 instances | LAS with Console |
| Fixed capacity or bandwidth subscription | For example VPX/BLX Software Subs (Fixed Model) Advanced 1 Gbps; MPX Fixed Term Software Premium 9120; SDX Fixed Term Software Premium 16030 | LAS with NetScaler ADC (VPX, MPX) or NetScaler SVM (SDX) |
Source: LAS for NetScaler.[1] Catalog rows: ADC VPX/BLX/CPX Starter Pool, ADC VPX/BLX Software Subs (Fixed Model), NetScaler MPX Fixed Term Software and NetScaler SDX Fixed Term Software.
What LAS cannot license
The Console documentation states that Pooled vCPU and CICO licences “are not supported with LAS”.[2] The LAS FAQ lists further exclusions and a “path forward” for each (the list is described as not exhaustive):
- Expired contracts. Expired termed licences, and perpetual licences with an expired maintenance date or expired contract expiry date, are not supported; a new supported licence has to be purchased.[1]
- End-of-life hardware. “EOL NetScaler hardware units are not supported in LAS.” The FAQ lists MPX/SDX 14000-40G, 14000-40S, 25000-40G, 25000A and MPX 25000TA and 25000T (end of life 1 April 2025), MPX/SDX 14000 (1 October 2024), MPX/SDX 22000 (1 July 2024) and a group of older MPX and SDX models including 5550, 5650, 8005, 8010, 8015, 8200, 8400, 8600 and 8800 (1 January 2024).[1]
- Perpetual VPX, MPX and SDX licences and Gateway licences with active maintenance beyond 15 April 2026. NetScaler states a replacement LAS-compatible licence for the remainder of the contract term is provided, as it is for Pooled vCPU licences whose contract runs beyond that date.[1]
- Marketplace pay-as-you-go VPX. LAS “works only with Citrix-provided licenses”; customers must migrate from PAYG to BYOL to avoid service impact.[1]
- FIPS appliances. MPX 14000 FIPS is supported on firmware 14.1-66.x and 13.1-62.x, and perpetual-licence customers receive a fixed-capacity replacement for the MPX 14080 FIPS; SDX 14000 FIPS is supported only on SVM 13.1 from build 13.1-60.x, not on SVM 14.1.[1]
Prerequisites
Using LAS requires a valid Citrix Cloud account whose Organization ID holds valid purchased entitlements, LAS-compatible NetScaler and NetScaler Console versions, and the NetScaler instance added as a managed instance in NetScaler Console.[2] On hypervisors, the dynamic MAC settings must be switched off.[1] To use LAS-based licensing, the edition of the NetScaler instance must match the edition of the Pooled or Flexed licence, so edition changes happen before migration.[2] Zero-capacity (Z-cap) licence files on MPX and SDX are not needed with LAS.[8] LAS uses port 443 for all licensing communication.[6]
Activation blobs and the cloud connection
With Console on-prem the typical deployment is “Activate LAS with Cloud Connect”: the on-prem Console connects to the Console service, which retrieves the licence entitlement (a blob) from LAS. The Console on-prem blob is valid for 30 days and a cloud-connected Console refreshes it every day. Initial Pooled or Flexed entitlements are fetched within an hour once cloud connection is established and later new or renewed entitlements within 24 hours.[2][6] The Console then issues blobs to licensed instances, also valid for 30 days or until the Console’s own blob expires, whichever is first; the Console issues them only while its own blob is valid.[2]
The information sent to LAS on each request includes the Console’s identifiers (a GUID and a SHA-256 identifier), its public key, the Citrix Cloud ID used to onboard it, its build, hostname and the list of NetScalers with LAS licences. NetScaler IP addresses are not shared; only the unique LPEID is provided. From Console on-prem 14.1-60.57 the cloud-connected workflow uses a system identifier rather than the IP address and host name.[2]
Grace and expiry behaviour
Blobs refresh every 8 hours by default. If three consecutive refresh attempts fail over 24 hours, the NetScaler enters a grace period.[2] The expiry scenarios document says the grace period lasts 30 days, during which licensing functionality continues to work; on the thirty-first day VPX, CPX, BLX and MPX instances undergo a forced reboot and become unlicensed, and the throughput of every VPX on an SDX is reduced to 1 Mbps.[3] The SDX page says that since 14.1-38.x (pooled) and 14.1-43.x (pooled and fixed) an expired licence immediately limits VPX throughput to 20 Mbps, without a Management Service restart, whereas earlier the limit was 1 Mbps and applied only after a restart.[9]
There are two distinct failure paths. In Scenario A the NetScaler loses contact with Console on-prem, and after three failed 8-hour attempts it enters Grace status. In Scenario B the Console on-prem loses contact with the Console service and cannot refresh its own blob, so it issues instance blobs of decreasing validity (29, 28, 27 days and so on); before release 14.1-72.x this led to an abrupt outage with no grace status, and from 14.1-72.x the instances are moved into Grace status automatically so administrators are alerted.[2]
If a licence is renewed before its term expires, a NetScaler that is running switches seamlessly to the new licence with no restart. After expiry without renewal, the instance stops normal operations, loses its configuration and shuts down traffic processing.[3]
Monitoring
NetScaler recommends monitoring the last LAS renewal date in the Console GUI, system events for the CloudConnectStatus category, and the Licenses and License Pool event categories. A banner appears on the Console GUI when the activation blob cannot be refreshed, and instances in grace are visible in the Flexed dashboard or with the sh licenseserver command. NetScaler generates the SNMP traps pooledLicenseGraceStarted, pooledLicenseGraceNormal and pooledLicenseGracePeriodOver.[4] Expiry notifications for the entitlement itself are emailed at 30, 20 and 10 days before the contract end date.[6]
Migration notes
The Console GUI divides instances into those to be licensed with LAS (unlicensed or on another licence type), those ready to migrate (Flexed or Pooled file-based licences on compatible builds) and those that require an upgrade first. Selected instances restart for the licence to take effect, except SDX, and local file-based licences on the SVM should be deleted from /mpsconfig/license once migration is complete.[2] The transition guide notes that Pooled vCPU, fixed subscription or perpetual, fixed vCPU and CICO licences move to Flexed licensing through the “Transition to LAS” workflow rather than the migration workflow.[7] To move instances from one Console on-prem to another as licence server, the second Console must hold the entitlements and manage the instances before the first Console is stripped of them.[1]
Perpetual licence checks
Separately from LAS, NetScaler introduced a Subscription Advantage (SA) date check for perpetual licences. The SA date is in the perpetual licence file in YYYY.MMDD format, and every NetScaler build now has a Burn-In Date. If the Burn-In Date of the build being installed is later than the SA date, the instance becomes unlicensed after the upgrade; the check occurs during boot. It applies to VPX, MPX and SDX from 14.1-51.x, 13.1-60.x and 13.1-37.x (FIPS). Customers who renewed maintenance must replace the old perpetual licence file with the latest one; otherwise the old SA date applies.[5] Burn-In Dates in the table include 14.1 build 51.72 (2 September 2025), 56.74 (9 November 2025) and 60.52 (3 December 2025), and 13.1 build 60.32 (31 October 2025) and 61.25 (27 November 2025).[5]
Out of scope
This article does not describe the Citrix Cloud account model beyond what LAS requires, the CLI commands for each licence mode, or licence exception file extensions for air-gapped deployments, which the vendor documents separately and in which known issues have been recorded for 13.1 builds of SDX SVM and Console on-prem.[1]