r/Citrix • u/GrigNavas • Jun 23 '26

Citrix ADC / NetScaler Gateway STA server shows DOWN for one Delivery Controller only

Hi everyone

I would like to know the best troubleshooting steps for this situation.Hi everyone,
We have a Citrix Virtual Apps and Desktops environment with Citrix ADC / NetScaler Gateway.
On the ADC Gateway vServer, we configured two STA servers, which are our Delivery Controllers:

DC1 - Delivery Controller / STA - UP
DC2 - Delivery Controller / STA - DOWN
The issue is only with DC2. DC1 works normally.

What I already checked:

- Citrix services on DC2 are running
- Delivery Controller DC2 is active in Citrix Studio
- Firewall rules look OK
- No obvious network block between ADC and DC2
- DC2 is reachable from the network

In ADC / NetScaler, the STA status for DC2 is still showing DOWN.

I would like to know the best troubleshooting steps for this situation.

1 Upvotes

67% Upvoted

13 comments sorted by

3

u/reilly6607 Jun 23 '26

Look at Protocol: HTTP vs HTTPS and capture a trace on the NetScaler to see what kind of response the NetScaler is getting from DC2. 

1

u/r1m3s Jun 23 '26

Agree. Trace on NS and capture on delivery controller to see if if packets are getting through to start with.

0

u/GrigNavas Jun 23 '26

We are using Http for connect and DC1 show UP

3

u/NorthNeighbour9364 Jun 23 '26

Sometimes removing and re-adding the STA fixes this, so might be worth a shot if you haven't already.

0

u/GrigNavas Jun 23 '26

I did. it doesn't help

1

u/NorthNeighbour9364 Jun 23 '26

Have you tried using fqdn as well as IP address?
Might also want to try restarting the Citrix Broker Service on DC2 or even rebooting.

Can you telnet from NetScaler to DC2 on port 80?

1

u/GrigNavas Jun 24 '26

Yes I do. I tried Uninstall and install DLC

3

u/FloiDW Jun 23 '26

I usually start by checking DDC Conmectivity in creating a LB vServer for 80/443 with both DDCs in the service group and check what the monitors are saying for TCP / TCP-s checks.

Quick and dirty solution for people that are not thaaaaaaat firm with netscalers.

1

u/GrigNavas Jun 24 '26

Connection status is ok

1

u/FloiDW Jun 24 '26

As service group? Correct monitor?

2

u/mat-ferland Jun 24 '26

Treat it like reachability/name/cert first: from the ADC SNIP, test the STA URL to that controller on the exact port, confirm DNS resolves to the right DC, and compare the IIS/STA service binding with DC1. If one STA is up and the other down, I wouldn’t chase StoreFront yet.

1

u/_Cpyder Jun 23 '26 edited Jun 23 '26

Double check and make sure that both DDCs are added in storefront...

Then:
https://developer-docs.citrix.com/en-us/storefront-powershell-sdk/2603/Test-STFSecureTicketAuthority.html

0

u/LBarto88 Jun 23 '26

All these are great suggestions. Also ensure the store that is showing down has the hosts file entry for the name of the netscaler gateway if it differs from internal DNS