- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Citrix NetScaler
Your apps sit behind a load balancer here, a WAF there and DNS failover by hand. One delivery tier can do all three — Citrix NetScaler balances, steers and inspects application traffic on one code base — MPX and SDX hardware, VPX, CPX containers or BLX bare metal, with a WAF, bot and API protection inline.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Citrix platform family
This page covers Citrix NetScaler — the application delivery controller, including NetScaler Console. The rest:
Quick facts
30-second orientation- Product
- Application delivery controller with WAF, bot mitigation, API protection and NetScaler Console
- Maker
- Citrix, a business unit of Cloud Software Group (privately held); co-president Hector Lima
- Patch status
- CVE-2026-88771 and -88772 (27 Sep 2026) are fixed only in 14.1-73.37 and 13.1-64.23 or later
- Price
- No list price; NetScaler Fixed Capacity or a Citrix subscription, quoted through Citrix or a partner
- Licence
- Fixed Capacity buys throughput and instances one by one; hardware is bought separately
- Forms
- MPX and SDX hardware, VPX virtual, CPX container and BLX bare metal, all one code base
- Scale
- Citrix claims clustering of up to 8 Tbps of L7 throughput on up to 32 nodes
- Lifecycle
- 13.1 left maintenance on 15 Sep 2026 (end of life 15 Sep 2027); 14.1 is maintained to 2029
- India
- Self-hosted, so traffic stays in your site; Citrix’s India office is in Bengaluru; no INR list
- In India via
- TechBag — build audit, Fixed Capacity or subscription quote in INR with GST, upgrade plan
Understand application delivery controllers before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is an application delivery controller?
An ADC sits in front of your servers, spreads the load, ends TLS and steers users to a healthy site.
A load balancer per app and a separate WAF vs Citrix NetScaler — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A load balancer per app, a separate WAF | Citrix NetScaler |
|---|---|---|
| Spreading load | A load balancer bought per application | Shared vservers on one NetScaler pair |
| Site failover | DNS records changed by hand | GSLB steering users to a healthy site |
| Web attacks | A separate WAF chained in front | WAF in the same traffic path |
| Kubernetes traffic | Another ingress product to learn | Kubernetes ingress and Gateway API |
| Fleet oversight | Logging in to each box | NetScaler Console across all instances |
| What it is NOT | — | Patch-free, list-priced or SaaS-hosted |
The cheapest first step is a build audit: list every instance, its version and its exposure, and see what needs 14.1-73.37 today.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Forms
One NetScaler code base ships as MPX hardware, multi-tenant SDX hardware, the VPX virtual machine, the CPX container and BLX on bare metal, so policy carries across them.
Vservers
Each published service is a virtual server: load-balancing vservers spread requests over back ends, while GSLB answers decide which site or cloud a user reaches first.
Security
The web application firewall, bot mitigation and API protection sit in the same traffic path as the load balancer, so a request is checked before it reaches any server.
Console
NetScaler Console, renamed from Citrix ADM, manages instances, certificates and configuration across the fleet; the on-premises 13.1 Console reached end of life in April 2026.
One code base on five form factors — load balancing, GSLB and a WAF in the same path, run by NetScaler Console.
Nine capabilities. Deliver, protect, operate.
Citrix NetScaler puts load balancing, GSLB and a WAF in one traffic path, on hardware or software you run.
Spread requests over servers
Load-balancing virtual servers share traffic across back-end pools and pull an unhealthy server out of rotation.
Pick the right site or cloud
Global server load balancing sends each user to a working data centre or cloud region and away from one that is down.
Decrypt once, with hybrid PQC
SSL/TLS work moves off the servers; Citrix says it was first to ship NIST-aligned hybrid post-quantum cryptography.
Web attacks stopped inline
The web application firewall inspects requests on the same appliance that balances them, with no separate box to chain.
Automated traffic filtered
Bot mitigation separates scripted traffic from people before scrapers or credential stuffers reach a login page.
API calls held to policy
API protection applies security policy to API endpoints published through NetScaler, next to the web apps it fronts.
One view of every instance
NetScaler Console, formerly ADM, manages instances, certificates and configuration for hardware and software alike.
Ingress and Gateway API
NetScaler serves as a Kubernetes ingress and implements the Gateway API, including for OpenShift workloads.
Scale out across nodes
Citrix claims a cluster reaches up to 8 Tbps of Layer 7 throughput on as many as 32 nodes working as one system.
Watch Citrix NetScaler in action
WAF tuning advice, NetScaler as an AI gateway, configuration as code, and the Kubernetes Gateway API on OpenShift. All 2026, from Citrix’s official channel.
NetScaler TechTalks: WAF recommendations
Citrix engineers on setting up and tuning the NetScaler web application firewall.
NetScaler AI Gateway in action: 3 enterprise use cases
Three enterprise scenarios for NetScaler as a gateway in front of AI traffic.
NetScaler as code: From runtime to desired state
Managing NetScaler configuration as declared, version-controlled state rather than by hand.
From Ingress to Intelligence: NetScaler Kubernetes Gateway API for Modern OpenShift Workloads
NetScaler’s Kubernetes Gateway API support, shown on Red Hat OpenShift.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Every new app gets its own load balancer and its own WAF. NetScaler puts delivery and security in one path.
Here’s what genuinely sets it apart — and exactly where it stops.
One code base from appliance to container
The same NetScaler software runs on MPX and SDX hardware, as a VPX virtual machine, as the CPX container and as BLX on bare metal. A team can keep a hardware pair in the data centre, run VPX in a cloud account and put CPX inside Kubernetes without learning a second product.
Delivery and security in one hop
Load balancing, GSLB and TLS offload share a traffic path with the WAF, bot mitigation and API protection, so there is one device to size and one policy to audit. Citrix lists FIPS 140-3 Level 2 validated hardware, a DoDIN APL entry and GA hybrid post-quantum TLS, which it calls a first.
Capacity already inside a Citrix subscription
Universal Hybrid Multi-Cloud entitles 999 instances of each NetScaler form factor and 1,000 Gbps of throughput; the Citrix Platform licence lifts throughput to unlimited. Estates already paying for Citrix DaaS may own more NetScaler than they deploy. Without one, Fixed Capacity sells throughput and instances on their own.
Where it stops
You own the patching, and it is relentless: exploited critical bugs in 2023, 2025 and September 2026, the last fixed only in 14.1-73.37 and 13.1-64.23. Version 13.1 left maintenance on 15 Sep 2026. There is no list price, no INR rate card and no current analyst placement to lean on.
The numbers behind the platform
What your Citrix NetScaler rollout looks like
Find every build you run
List each MPX, SDX, VPX, CPX and BLX instance with its exact build, and flag anything below 14.1-73.37 or 13.1-64.23.
Get off 13.1 and old Console
Plan the move to 14.1, since 13.1 left maintenance in September 2026, and retire any on-premises 13.1 Console.
Check what you already own
Read your Citrix subscription for NetScaler entitlements before buying Fixed Capacity; UHMC and Platform both include it.
Switch on WAF and bot rules
Start the WAF in log-only mode on one app, then add bot and API policies once false positives settle.
Move config into code
Hold vserver and policy definitions as declared state, wire Console alerts to your SOC, and schedule quarterly upgrades.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our GSLB pair moved net-banking users to the DR site in under a minute during a link cut. Nobody noticed but us.”
“We run MPX in the data centre and VPX in our cloud account. Same config syntax both sides saved a lot of retraining.”
“September’s bulletin meant an emergency change window on a Saturday. Budget for patch weekends, not just licences.”
“Turning on the WAF where we already balanced traffic beat buying another appliance, but tuning took two sprints.”
“We found our Citrix subscription already covered NetScaler instances we had been quoting separately for months.”
“NetScaler as our OpenShift gateway works, but the docs assume you already think in vservers. Newcomers struggle.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the application delivery market — tap any vendor to see why it sits where it does.
TechBag Application Delivery Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; often already entitled in a Citrix subscription.
Where It Runs × Delivery Depth
The grid nobody publishes — how many places the product can run, from box to container to edge, vs how much traffic delivery it does beyond the WAF.
Five form factors; L4–7, GSLB and Kubernetes Gateway API.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Citrix NetScaler vs the application delivery and WAAP field
Against F5 BIG-IP, A10 Networks Thunder ADC, Akamai App & API Protector, Cloudflare Application Security and Barracuda Application Protection — on traffic covered, forms, price, scale, security, patching and India.
| Dimension | Citrix NetScaler | F5 BIG-IP | A10 Networks Thunder ADC | Akamai App & API Protector | Cloudflare Application Security | Barracuda Application Protection |
|---|---|---|---|---|---|---|
| What it is | ADC with WAAP built in | Modular ADC platform | ADC with firewalls | Edge WAAP, not an ADC | Edge WAAP, not an ADC | WAF that also balances |
| Deployment | Five forms, one code | Boxes, chassis, VEs | Five forms, portable | Edge, or Hybrid sidecar | Its network only | Box, VM, cloud, SaaS |
| Traffic covered | L4–7, GSLB, K8s | L4–7; DNS is a module | L4–7, GSLB, TCP tuning | Web and API only | Web, API, L3/4 DDoS | HTTP only |
| Pricing model | Capacity or subscription | Four licence routes | Pooled subscription | Quote; unit unpublished | Plans, then Enterprise | Configurator and quote |
| Published entry price | Not published | Not published | Pool sizes, no price | Not published | About $20 a site | Not on the WAF page |
| Included vs add-on | Security in the licence | Module by module | Support in the pool | Core in; modules extra | Depth on Enterprise | DDoS included |
| Scale limits | 8 Tbps on 32 nodes | Chassis scale-out | 150 Gbps per box | Edge, 100% SLA | 330+ cities, ~500 Tbps | Model sets the ceiling |
| Security depth | WAF, bot, API, PQC | Behavioural WAF | Web and DNS firewalls | Self-tuning WAAP | Full WAAP stack | API rules from specs |
| Automation and management | Console, as code, K8s | Marketplace images | Terraform, Ansible, TKC | Terraform, SIEM kits | API and Terraform | Per form console |
| Who patches it | You, often and urgently | You, after a breach | You, on your boxes | Akamai, on its edge | Cloudflare, centrally | Depends on the form |
| India data path | Your Indian site | Your DC; Hyderabad R&D | Your own racks | Hybrid keeps it local | Indian DCs, DLS region | Box in India; Bengaluru |
| Support | Lifetime hardware RMA | Quoted with licence | Gold support included | 24/7, managed options | Rises with the plan | Terms not on the page |
| Lock-in and exit | Portable across forms | F5 formats | Pool moves, config stays | Tied to Akamai’s edge | Tied to its proxy | Barracuda formats |
| Best fit | Citrix estates, big DCs | BIG-IP and telco shops | Many apps, one pool | Edge-first web estates | Self-serve to Enterprise | Mid-market web apps |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Citrix NetScaler if…
- ✓You balance many applications across data centres and clouds and want GSLB, TLS offload and a WAF on one device
- ✓You already hold a Citrix subscription whose NetScaler entitlement you are not yet using
- ✓You need the same software on hardware, VMs, containers and bare metal, including a Kubernetes Gateway API
Compare alternatives if…
- ✓You want a price before the first call — Cloudflare publishes plan rates, and A10 at least publishes its pool sizes
- ✓You would rather a provider patch the engine — Akamai and Cloudflare run their WAAP on their own edge
- ✓You need chassis-class hardware sold module by module — F5 BIG-IP on VELOS is built that way
Do not expect…
- ✓A quiet patch calendar: plan for out-of-cycle upgrades whenever Citrix issues an emergency bulletin
- ✓A rate card in rupees, or a Citrix-run Indian cloud for the cloud-delivered services
- ✓A current analyst ranking to justify the choice for you
TechBag has no application delivery guide yet, so Citrix NetScaler sits outside the category guides. Browse all products to compare it with the rest of the catalogue. →
What does running app delivery box by box cost you?
Drag the sliders (applications behind the ADC; engineer-hour cost). Estimates model engineering time spent on per-app load-balancer changes, certificate renewals and separate WAF rule upkeep at an assumed 1.5 hours per application a year, with 70% of it removed by one managed delivery tier. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Not published: Citrix prints no NetScaler price and no INR list. NetScaler Fixed Capacity buys throughput and instances individually; Universal Hybrid Multi-Cloud entitles 999 instances of each form factor and 1,000 Gbps, and the Citrix Platform licence makes throughput unlimited. Hardware is bought separately and includes lifetime RMA. TechBag checks your existing entitlement first, then quotes in INR with GST.
NetScaler Fixed Capacity
Best for estates without a Citrix subscription
- Throughput and instances bought one by one
- Hardware bought separately, lifetime RMA
- Quoted; no published list price
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Inside a Citrix subscription
Best for estates already licensing Citrix DaaS
- UHMC: 999 instances per form, 1,000 Gbps
- Citrix Platform licence: unlimited Gbps
- Per user, quoted with the subscription
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Is every instance on 14.1-73.37 or 13.1-64.23 or later? Builds that only fixed CitrixBleed 2 are still exposed.
When does each 13.1 box move to 14.1? 13.1 is out of maintenance and reaches end of life on 15 Sep 2027.
Have you activated through the License Activation Service? File-based licences stopped working on 15 April 2026.
Does a UHMC or Citrix Platform subscription already cover the instances and throughput you are about to buy?
Which apps need MPX or SDX hardware, and which can run on VPX, CPX or BLX inside your own cloud account?
Which vservers face the internet, and could any of them sit behind a WAF policy or an allow list instead?
Will NetScaler Console run as a service or on-premises, and does a 14.1 Console replace any 13.1 one?
Does the quote split hardware, software and support, state the term, and come in INR with GST?
Questions buyers ask
Ready to evaluate Citrix NetScaler?
Audit your builds against the September 2026 bulletin first, or let a TechBag advisor check what your Citrix subscription already entitles before you buy capacity.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.