Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Build status


PowerShell module for interacting with Citrix NetScaler via the Nitro API.

This module contains functions that abstract away the nitty-gritty aspects of the Nitro API. It provides a set of idiomatic PowerShell functions with parameter validation and inline documentation. The module can be used for both a better command line experience and writing scripts that automate NetScaler setup.

Getting started

Login into NetScaler

This script establishes a session with the NetScaler instance and sets its host name:

$Nsip, $Username, $Password = "", "nsroot", "nsroot"

$SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential ($Username, $SecurePassword)

$Session =  Connect-Netscaler -Hostname $Nsip -Credential $Credential -PassThru

Set-NSHostname -Hostname ns01 -Force -Session $Session

Initial setup

Once logged into a freshly installed NetScaler, the following script sets up the time zone, installs a license, saves the configuration and reboots:

Set-NSTimeZone -TimeZone 'GMT+01:00-CET-Europe/Zurich' -Session $Session -Force

Install-NSLicense -Path licenses/license.lic -Session $Session
Restart-NetScaler -WarmReboot -Wait -SaveConfig -Session $Session -Force

After reboot, a reconnection is required:

$Session =  Connect-Netscaler -Hostname $Nsip -Credential $Credential -PassThru

Basic tasks

Once initial setup is done, regular configuration can start. The following commands will set up a VIP and SNIP:

Add-NSIPResource -Type SNIP -IPAddress -SubNetMask '' -VServer -Session $Session

Add-NSIPResource -Type VIP  -IPAddress -SubNetMask '' -VServer -Session $Session

This will add a DNS server:

Add-NSDnsNameServer -IPAddress

The line below will enable the following features:

  • Authentication, Authorization and Auditing,
  • Load balancing,
  • Rewrite,
  • SSL offloading.
Enable-NSFeature -Session $Session -Force -Name "aaa", "lb", "rewrite", "ssl"

Setting up a reverse proxy

The above example deal with setting up the stage. However, to configure NetScaler for some real work, more complex set of commands is needed. Usually, this kind of work can be abstracted in a PowerShell function. For instance, the following function will create a very simple reverse proxy:

New-ReverseProxy -IPAddress -ExternalFQDN www.extlab.local -InternalFQDN www.lab.local

The actual implementation could be:

function New-ReverseProxy {
        [String]$CertificateName = $ExternalFQDN
    $VServerName = "vsrv-$ExternalFQDN"
    $ServerName = "srv-$InternalFQDN"

    New-NSLBServer -Name $ServerName -Domain $InternalFQDN
    Enable-NSLBServer -Name $ServerName -Force
    New-NSLBServiceGroup -Name svg-$ExternalFQDN -Protocol HTTP
    New-NSLBServiceGroupMember -Name svg-$ExternalFQDN -ServerName $ServerName

    New-NSLBVirtualServer -Name $VServerName -IPAddress $IPAddress -ServiceType SSL -Port 443
    Add-NSLBVirtualServerBinding -VirtualServerName $VServerName -ServiceGroupName svg-$ExternalFQDN
    Enable-NSLBVirtualServer -Name $VServerName -Force

    Add-NSLBSSLVirtualServerCertificateBinding -Certificate $CertificateName -VirtualServerName $VServerName

    New-NSRewriteAction -Name "act-proxy-host-$InternalFQDN" -Type Replace -Target 'HTTP.REQ.HOSTNAME' -Expression "`"$InternalFQDN`""
    New-NSRewritePolicy -Name "pol-proxy-host-$InternalFQDN" -ActionName "act-proxy-host-$InternalFQDN" -Rule "true"
    Add-NSLBVirtualServerRewritePolicyBinding -VirtualServerName $VServerName -PolicyName "pol-proxy-host-$InternalFQDN" `
        -BindPoint Request -Priority 100

Beyond the module

Although, the module is still a work in progress, there are already more than 140 functions implemented. Those functions cover most needs. However, you might occasionally need a Nitro resource that is not implemented. In that case you can rely on a simple call to Invoke-Nitro. For instance, the following call will set the nsroot user's session expiration time to 1 day (not recommended in production but very helpful in a development environment!):

Invoke-Nitro -Type systemuser -Method PUT -Payload @{
        username     = "nsroot"
        timeout      = "86400"
        logging      = "ENABLED"
        externalauth = "ENABLED"
    } -Action Add -Force

## Examples

For a more complete example you can take a look ad NSConfig.ps1

Similar work