Background Context
Starting with NetScaler firmwares 13.1 b63.18+ and 14.1 b72.16+, ICA sessions disconnect and do not reconnect on HA failover when undergoing an upgrade between HA pair nodes.
Root Cause
Starting with the aforementioned build versions, Citrix has implemented a security measure that forces ICA sessions to disconnect when there is a firmware version mismatch between the nodes of a NetScaler HA pair. This decision was likely made in response to some historical vulnerabilities affecting AAA/NetScaler Gateway vServers, where clearing existing sessions was required to fully mitigate the risk per remediation guidance, a step that many customers historically did not perform post-upgrade.
As a result, even when HA failovers are initiated and all other settings required for seamless session reconnection are properly configured, active Citrix sessions may freeze or disconnect if the firmware versions of the two appliances differ. Users will then be required to reauthenticate and relaunch their sessions to regain access.
This behaviour is intentional, not a bug. It is enforced by design and cannot be disabled or modified.
Release notes confirm this behaviour.
If both appliances are running the same firmware version during an HA failover, sessions should transition and reconnect normally. This behaviour should only affect HA pairs with mismatched firmware versions, such as during a firmware upgrade.
Resolution
As this is an intentional security measure introduced in the firmware, there is no workaround or configuration change available to prevent this behaviour. The recommended action is therefore awareness and expectation management, particularly around end-user communications, change planning, and impact statements. Administrators should now plan for active sessions to be disconnected when failing over between HA nodes running different firmware versions during an upgrade.
