Model catalogue
48 models and 35 licence SKUs across the three vendors. Tick up to six models from any vendor to compare them side by side.
Citrix NetScaler · NetScaler Web App Firewall (AppFirewall) - Premium edition
NetScaler sizes on system throughput, HTTP requests per second, SSL bulk throughput and SSL transactions per second at RSA-2048 or ECDSA P-256. AppFirewall runs in the packet-processing path, so the figure that matters is throughput and request rate with the firewall profile applied - typically a third of the system rating once signatures, learning and bot protection are on.
Citrix NetScaler licensing
What each line does, and whether it is mandatory on every deployment of this platform.
| Licence / subscription | Type | Mandatory | What it covers |
|---|---|---|---|
| NetScaler Premium edition | Module | Yes | The Web App Firewall (AppFirewall) itself, plus bot management, content security policy, GSLB, caching, rewrite and the full analytics set. Mandatory: Standard and Advanced editions cannot run the WAF at any platform size. |
| Platform licence (MPX / SDX / VPX / BLX / CPX) | Module | Yes | The appliance or software instance entitlement at the rated throughput. On VPX the throughput tier is enforced in software, so the tier is a sizing decision and not just a price. |
| NetScaler Pooled Capacity | Subscription | Optional | A shared pool of bandwidth and instance licences that appliances check out at boot and return when decommissioned. The usual choice for more than a few instances, or when capacity has to move between data centre and cloud. |
| NetScaler Console Advanced | Management | Optional | Central configuration, StyleBooks, WAF violation analytics, certificate expiry tracking and pooled-licence management. The basic tier is free; Advanced adds the analytics most WAF operators actually want. |
| Bot Management | Module | Optional | Signature, fingerprint, rate-limit and CAPTCHA-based bot control. Included in Premium, so no separate SKU - but it consumes platform capacity and must be allowed for in the sizing. |
| WAF signature and security updates | Subscription | Yes | Signature refreshes and the SNORT-derived rule imports that keep the negative security model current. Delivered under the support contract. |
| API Gateway (Premium feature) | Module | Optional | OpenAPI schema import and validation, per-endpoint rate limiting, JWT verification and API-specific policy. Part of Premium. |
| GSLB (Premium feature) | Module | Optional | DNS-based global server load balancing across sites, for active/active data centres behind the same protected hostname. Part of Premium. |
| NetScaler Console service / Security Advisory | Subscription | Optional | Cloud-delivered security posture scoring and CVE advisories against the running firmware and WAF profile. |
| NetScaler support (Select / Premier) | Support | Yes | Firmware and signature updates, TAC access and hardware replacement. Premier adds 24x7 severity-1 response and an assigned engineer. |
Figures are indicative values held for relative sizing between models, last reviewed 2026-09. Confirm the final model against the current vendor datasheet before quoting.