--- title: Ivanti Connect Secure Gateway Management slug: ps/help/en_us/nsa/22x/nsa-ics/ag/1006 docTags: createdAt: 2026-07-22T09:12:32.921Z --- - [Introduction](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Viewing ICS Gateway/Cluster Details](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Creating an ICS Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Restarting Services](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Rebooting ICS Gateway/Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Rolling Back a Gateway/Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Upgrading a Gateway and Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Upgrading Multiple Gateways and Clusters](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Patch lifecycle management](docId\:OCsHa-ksFP2a79Rmz0Vhg) - [Removing Ivanti Connect Secure Gateway](docId\:OCsHa-ksFP2a79Rmz0Vhg) ## Introduction An admin can manage the ICS Gateway/Cluster with the following operations: - **Restart Services**: Kills all processes and restarts the Gateway/Cluster. The Gateway/Cluster is available again after a few minutes. See [Restarting Services](docId\:OCsHa-ksFP2a79Rmz0Vhg). - **Reboot Gateway**: Reboots the Gateway. The Gateway is available again after a few minutes. See [Rebooting ICS Gateway/Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg). - **Reboot Cluster**: Reboots all nodes in the Cluster. See [Rebooting ICS Gateway/Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg). - **Rollback to \**: Reverts the registered Gateway virtual machine instance to the specified version. See [Rolling Back a Gateway/Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg). - **Rollback Cluster**: Reverts the cluster instance to the previous version. See [Rolling Back a Gateway/Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg). - **Upgrade to \**: Upgrades the registered Gateway virtual machine instance to the specified version. See [Upgrading a Gateway and Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg) - **Upgrade to \ Cluster**: Upgrades all the nodes in the Cluster to the specified version. See [Upgrading a Gateway and Cluster](docId\:OCsHa-ksFP2a79Rmz0Vhg). - **Delete Gateway**: Removes the Gateway record. See [Removing Ivanti Connect Secure Gateway](docId\:OCsHa-ksFP2a79Rmz0Vhg). - **Configure Integrity Scanner**: Scans the system periodically to check for any integrity anomalies. - **Upgrade multiple Gateways/Clusters to new version**: Upgrades multiple Gateways/Clusters to the specified version. See [Upgrading Multiple Gateways and Clusters](docId\:OCsHa-ksFP2a79Rmz0Vhg). - **Patch lifecycle management**: Provides controlled patch lifecycle for gateways enabling seamless patch upgrades, rollback and removal while maintaining operational continuity. See [Patch Lifecycle Managagement](docId\:OCsHa-ksFP2a79Rmz0Vhg). :::hint{type="info"} The available menu options vary depending on whether the selected Gateway is registered and connected to the NSA. ::: ## Viewing ICS Gateway/Cluster Details To view the list of ICS Gateways and Clusters: 1. Log in to the Ivanti Neurons for Secure Access portal as a Tenant Admin. See [Logging in to Ivanti Neurons for Secure Access](docId\:I-CcADUmY061RdLfDCdaE). 2. Use the Gateway Switcher and select **Ivanti Connect Secure**. 3. From the Ivanti Connect Secure menu, click the **Gateways** icon, then select **Gateways > Gateways List**. The Gateways List page is displayed showing a list of standalone ICS Gateways and Cluster nodes. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/fimVq0D6CdzvTViYtBz8X_gw-list-option631x245.png" alt="img/gw-list-option.png" position="flex-start" size="63" width="631" height="245" initialPath="img/gw-list-option_631x245.png" githubPath="img/gw-list-option_631x245.png" darkWidth="631" darkHeight="245" showCaption="false"} - Use the page controls at the bottom to select the number of log records/rows per page, or select a specific page. - Use the Search bar to filter the results list. For example, to show only those Gateways that match a search string. - Use the **Group by** option and select the field type (Gateway Type, Connection status, Version or Region) to view the table information in groups. - Use the Refresh icon (:inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/bDzQIkT67dkIVtsijzGCv_iconcirculararrow22x22.png" alt caption size="10" width="22" height="22"}) to manually refresh the data. - Use the Expand all / Collapse all icon (:inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/QtOTgVUV1Bcpd-L7ufv-P_iconexpand18x20.png" alt caption size="10" width="18" height="20"}) provided in the Gateways List page to expand / collapse the Clusters and Gateways lists. :::hint{type="info"} The Gateway management functions can be performed only if the status of the Gateway is green. ::: To view the details of a specific Gateway: 1. In the All Gateways page, double-click the required Gateway from the Standalone Gateways list. The Gateway Overview page is displayed showing the Gateway Status, Version, Registration State, and last Updated time. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/MHhQ7SC_TaFbth4bdnjBx_pcsgwmgmtgwdetails747x205.png" alt="img/pcs_gw_mgmt_gwdetails.png" position="flex-start" size="75" width="747" height="205" initialPath="img/pcs_gw_mgmt_gwdetails_747x205.png" githubPath="img/pcs_gw_mgmt_gwdetails_747x205.png" darkWidth="747" darkHeight="205" showCaption="false"} 2. Click the context menu icon present at the top-right of the page to access the options applicable to the selected Gateway. To view the details of an Active-Active Cluster: 1. In the Gateways List page, double-click the Active-Active Cluster from the list. The Gateway Overview page is displayed showing the Model, Cluster Name and Configuration of the Cluster. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/PfzMlKahlqcqCjOGKde6t_pcsgwmgmtaadetails845x411.png" alt="img/pcs_gw_mgmt_aadetails.png" position="flex-start" size="80" width="845" height="411" initialPath="img/pcs_gw_mgmt_aadetails_845x411.png" githubPath="img/pcs_gw_mgmt_aadetails_845x411.png" darkWidth="845" darkHeight="411" showCaption="false"} 2. Click the context menu icon present at the top-right of the page to access the options applicable to the selected Cluster. To view the details of an Active-Passive Cluster: 1. In the Gateways List page, double-click **Active-Passive Cluster** from the list. The Gateway Overview page is displayed showing the Model, Cluster Name, Configuration, External and Internal VIP Owner, External and Internal VIP IPV4/IPV6 of the Cluster. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/MBzd02DPucWm1-9gVWXUg_pcsgwmgmtapdetails745x304.png" alt="img/pcs_gw_mgmt_apdetails.png" position="flex-start" size="75" width="745" height="304" initialPath="img/pcs_gw_mgmt_apdetails_745x304.png" githubPath="img/pcs_gw_mgmt_apdetails_745x304.png" darkWidth="745" darkHeight="304" showCaption="false"} 2. Click the context menu icon present at the top-right of the page to access the options applicable to the selected Cluster. ## Creating an ICS Cluster Clusters define a collection of Gateways that operate as if they were a single machine. A cluster pair is used to refer to a cluster of two units and a multiunit cluster refers to a cluster of more than two units. Once two or more units are joined in a cluster, they act as one unit. To create an ICS Cluster: 1. In the Gateways List page, click the **Create** drop-down list. 2. From the Gateway types list, select **ICS Cluster**. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/n4wwhPVHgiKfAgk3J-dSI_createcluster567x241.png" position="flex-start" size="57" width="567" height="241" initialPath="img/create_cluster_567x241.png" githubPath="img/create_cluster_567x241.png" darkWidth="567" darkHeight="241" showCaption="false"} 3. Select the ISA **Model.** 4. Select the Gateway **Version**. 5. Enter a unique **Cluster Name**. Maximum 19 characters, only alphanumeric and hyphens are allowed between characters. 6. Select a member node and click **Add **to add the nodes. 7. Enable **Configuration Only Cluster** to limit data transfer between cluster nodes. User and session specific limits are only enforced on the node and not across the cluster. 8. Click **Create Cluster**. :::hint{type="info"} After creating a cluster from NSA, add subsequent nodes to the cluster from NSA only. ::: ## Restarting Services To restart services: 1. In the Gateway Overview page, click the context menu icon at the top-right to access the options applicable to the selected Gateway or Cluster. 2. Select the **Restart Services** option. The Gateway/Cluster is available again after a few minutes. ## Rebooting ICS Gateway/Cluster To reboot ICS Gateway: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable to the selected Gateway. 2. Select the **Reboot Gateway** option. The Gateway is available again after a few minutes. To reboot ICS Cluster: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable to the selected A/A or A/P Cluster. 2. Select the **Reboot Cluster** option. The Cluster is available again after a few minutes. ## Rolling Back a Gateway/Cluster Your ICS Gateway/Cluster can be rolled back to a previously-installed version through the Tenant Admin Portal. You might want to return to an earlier version if, for example, you encounter an unforeseen issue with a newly-upgrading Gateway instance, or for testing purposes. You can roll back to a version only where that Gateway instance has been previously upgraded through the Tenant Admin Portal, and only to the previously-installed version. To roll back a Gateway to an earlier version: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If a rollback function is available for this Gateway, a corresponding link is displayed in the drop-down menu: 2. Select the **Rollback to \** link. As the rollback process starts, your Gateway remains operating on the current version and continues to serve traffic. After the earlier version is reinstated, the Gateway reboots and becomes unavailable for a short time. If the procedure is successful, the new software version is displayed in the Gateway Overview page. To roll back a Cluster to the previous version: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Cluster. If a rollback function is available for this Cluster, a corresponding link is displayed in the drop-down menu: 2. Select the **Rollback Cluster** link. As the rollback process starts, your Cluster remains operating on the current version and continues to serve traffic. After the earlier version is reinstated, the Cluster reboots and becomes unavailable for a short time. If the procedure is successful, the new software version is displayed in the Gateway Overview page. ## Upgrading a Gateway and Cluster Ivanti periodically creates and releases new software versions to address updates and issues, and to improve performance. As new version packages become available, you can trigger an upgrade for your Gateway/Cluster through the NSA to take advantage of the updates available in the new version. :::hint{type="info"} Upgrading to ICS Gateway version 25.1.0.0 is supported only from ICS Gateway version 22.8R2 for standalone ISA hardware appliances and ISA-V ESX virtual appliances. Upgrades from earlier ICS Gateway versions (ICS 22.7R2.x and below) to ICS 25.1.0.0 are not supported. ::: To upgrade a Gateway to a higher version: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If the upgrade function is available for this Gateway, a corresponding link is displayed in the drop-down menu: 2. Select the **Upgrade to \** link. :::hint{type="info"} In some cases, there might be more than one version available. Select the version you want, or contact your support representative for details. ::: As the upgrade process starts, your Gateway remains operating on the current version and continues to serve traffic. After the upgrade to new version, the Gateway reboots and becomes unavailable for a short time. If the procedure is successful, the upgrade task is marked with a status of “Success” and the new software version is displayed in the Gateway Overview page. :::hint{type="info"} Cluster upgrades to ICS Gateway version 25.1.0.0 are not supported. ::: To upgrade a Cluster to a higher version: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Cluster. If the upgrade function is available for this Cluster, a corresponding link is displayed in the drop-down menu: 2. Select the **Upgrade to \ Cluster** link. :::hint{type="info"} In some cases, there might be more than one version available. Select the version you want, or contact your support representative for details. ::: As the upgrade process starts, your Cluster remains operating on the current version and continues to serve traffic. After the upgrade to new version, the Cluster reboots and becomes unavailable for a short time. If the procedure is successful, the upgrade task is marked with a status of “Success” and the new software version is displayed in the Gateway Overview page. ## Upgrading Multiple Gateways and Clusters This feature allows you to upgrade one or more gateways and clusters in a tenant with a selected version. :::hint{type="info"} \- Upgrading to ICS Gateway version 25.1.0.0 is supported only from ICS Gateway version 22.8R2 for standalone ISA hardware appliances and ISA-V ESX virtual appliances. \- Note that cluster upgrades are not supported. Additionally, upgrades from earlier ICS Gateway versions (ICS 22.7R2.x and below) to ICS 25.1.0.0 are not supported. ::: ### Upgrading Gateways and Clusters with Ivanti Secure Access Client To upgrade one or more Gateways and Clusters with an Ivanti Secure Access Client package newer version: 1. Log in to the Ivanti Neurons for Secure Access portal as a Tenant Admin. See [Logging in to Ivanti Neurons for Secure Access](docId\:I-CcADUmY061RdLfDCdaE). 2. Use the Gateway Switcher and select **Ivanti Connect Secure**. 3. Select **Administration > Upgrade > Installation Packages**. 4. In the Installation Packages page, select the **Ivanti Secure Access Client** tab. Lists of available Ivanti Secure Access Client packages appears per OS, namely, **Cross-Platform**, **Windows**, **MacOS **and **Linux**. The list contains ISAC packages common to ICS and ZTA , and ISAC packages specific to ICS. ![](https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/URfTeAMUtVIwsf6ZZ8hzv_image.png) 5. Select any of the OS tabs to see the Ivanti Secure Access Client packages. This is the version of the Ivanti Secure Access Client software that you want users to have on their device. As each user next logs into Ivanti Secure Access Client on their device, if their software is at a different version, Ivanti Secure Access Client provides a prompt to the user to change to the version you selected in NSA. :::hint{type="info"} After the Client package download starts from NSA to ICS Gateway, any other operations in NSA, for example a Role or Realm creation and any configuration change, do not work unless the download is complete. After the successful download, config creations or modifications appear. ::: ### Upgrading Gateways and Clusters with ESAP ### Downloading an ESAP Package Download the Endpoint Security Assessment Plug-in from the Software Download Portal to your computer. You need to have the login credentials to access the portal. 1. Open the [Software Download Portal](https://forums.ivanti.com/s/product-downloads) page. 2. Click the **Software **tab. 3. Navigate to the ESAP release you want, and click the link to download the package file to accessible local storage. ### Uploading the ESAP Package To upload the ESAP package that you downloaded from Software Download Portal: 1. Select **Administration > Upgrade > Installation Packages**. 2. In the Installation Packages page, select the **ESAP** tab. 3. Click the **Upload ESAP file** box. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/fIJVsbOkh8Oc7NBbLkQX6_esapupload611x349.png" alt="img/esap_upload.png" position="flex-start" size="61" width="611" height="349" initialPath="img/esap_upload_611x349.png" githubPath="img/esap_upload_611x349.png" darkWidth="611" darkHeight="349" showCaption="false"} 4. Browse and select the latest ESAP package that you want to upload and then click **Import**. After successful upload to NSA, the ESAP package gets listed in the ESAP packages page. :::hint{type="info"} You can upload only one ESAP package. ::: ### Upgrading with ESAP To upgrade one or more Gateways and Clusters to a newer ESAP package version: 1. Select **Administration > Upgrade > Installation Packages**. 2. In the Installation Packages page, select the **ESAP** tab. 3. Select the required build version from the list and click **Select Gateways/Clusters to Upgrade**. 4. In the Select Gateways / Clusters for Upgrade dialog, from the **Select Gateways** drop-down list, select one or more Gateways. :::hint{type="info"} The UI shows the applicable Gateways/Clusters running on version 21.12 and above. ::: 5. From the **Select Clusters** drop-down list, select one or more Clusters. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/BCkLaK97draBaAtgfGwgn_selectgwsclustersesap449x288.png" alt="img/select_gws_clusters_esap.png" position="flex-start" size="45" width="449" height="288" initialPath="img/select_gws_clusters_esap_449x288.png" githubPath="img/select_gws_clusters_esap_449x288.png" darkWidth="449" darkHeight="288" showCaption="false"} :::hint{type="info"} The Select Gateways and Select Clusters list shows only those Gateways and Clusters that have lower versions than the selected version. ::: 6. Click **Upgrade**. The upgrade task is scheduled, and a notification is displayed in the logs. :::hint{type="info"} NSA deletes all the existing ESAP packages from the ICS Gateway after the upgrade and retains only the upgraded ESAP version. ::: ### Upgrading Gateways and Clusters with a New Gateway/Patch Version The Gateway Upgrade system manages firmware upgrades and patches for Ivanti ICS gateways. It supports: - **Full upgrades:** Major/minor version changes (e.g., 22.8R2 → 25.1.0, or 25.1.2 → 25.1.4) - **Scheduled upgrades:** Planned upgrades at a specific date/time - **Auto-upgrades:** Automatic upgrades during configured maintenance windows To upgrade one or more Gateways and Clusters: 1. Select **Gateways > Multinode Configuration > Gateway Upgrade**. The Gateways Upgrade page shows the list of Gateways. You can sort the list based on gateway name or connection status. To change the fields displayed, use the :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/lGMC5Vk_a4HO4PgQzzfkL_iconfieldselector23x23.png" alt caption size="10" width="23" height="23"} icon. To trigger the advanced filter selection, use the :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/d1VrJUdsJbt3jVWXo9U44_iconadvfilter24x25.png" alt caption size="10" width="24" height="25"} icon. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/nwHPssWRn9LEkwxDRW-rP_instpkgsgateways624x241.png" position="flex-start" size="62" width="624" height="241" initialPath="img/inst_pkgs_gateways_624x241.png" githubPath="img/inst_pkgs_gateways_624x241.png" darkWidth="624" darkHeight="241" showCaption="false"} Upgrade Status column shows the following statuses: - Up to date - Upgrade scheduled - Download scheduled - Ready to upgrade (check box beside the Gateway name is enabled) - Install (option that appears once the package is downloaded. Click Install to upgrade the Gateway.) 2. Select one or more Gateways with same version from the list and click **Upgrade**. The Upgrade dialog is displayed. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/EbzdRu27EwFGv87LhbVgr_upgradeoptions527x229.png" position="flex-start" size="53" width="527" height="229" initialPath="img/upgrade_options_527x229.png" githubPath="img/upgrade_options_527x229.png" darkWidth="527" darkHeight="229" showCaption="false"} :::Paragraph{listStyleType="disc" indent="2"} From the **Eligible Version** list, choose the ICS version that you want to upgrade to. ::: :::Paragraph{listStyleType="disc" indent="2"} From the **Upgrade Action** list, choose appropriate option from the following: **Upgrade now**, **Download now**, **Schedule download**, or **Schedule upgrade**, and follow the instructions. ::: 1. Click **Apply**. The Overview page shows the actions related to Upgrade now or Download now options. 2. To view the scheduled actions, select the **Scheduled** tab. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/vGCXSIZsLj0msXR4kpmBD_upgradescheduled656x170.png" position="flex-start" size="66" width="656" height="170" initialPath="img/upgrade_scheduled_656x170.png" githubPath="img/upgrade_scheduled_656x170.png" darkWidth="656" darkHeight="170" showCaption="false"} 3. In the Tenant Admin Logs page, see the logs generated for the Stage/Upgrade activities: Sample Tenant Admin Logs page ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/RovdLHQVC8KvUYDwYJeEU_gwupgradeschedulelog583x351.png" position="flex-start" size="58" width="583" height="351" initialPath="img/gw_upgrade_schedule_log_583x351.png" githubPath="img/gw_upgrade_schedule_log_583x351.png" darkWidth="583" darkHeight="351" showCaption="false" indent="1"} ## Patch Lifecycle Management Patch versions are cumulative and its lifecycle management like upgrade, rollback and removal workflows are supported. It enables faster upgrades and supports both standalone gateways and multi-node clusters. To upgrade a Gateway to a higher patch version: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If the upgrade function is available for this Gateway, a corresponding link is displayed in the drop-down menu: 2. Select the **Upgrade to \ (Patch)** link. :::hint{type="info"} To roll back a Gateway to an earlier patch version: ::: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If a rollback function is available for this Gateway, a corresponding link is displayed in the drop-down menu: 2. Select the **Rollback to \ (Patch)** link. As the rollback process starts, your Gateway remains operating on the current version and continues to serve traffic. After the earlier version is reinstated, the Gateway reboots and becomes unavailable for a short time. If the rollback procedure is successful, the previous software version is displayed in the Gateway Overview page. To remove a patch package: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If a remove patch function is available for this Gateway, a corresponding link is displayed in the drop-down menu: 2. Select the **Remove Patch** link. As the removal process starts, your Gateway remains operating on the current version and continues to serve traffic. If the removal procedure is successful, the base version is displayed in the Gateway Overview page. ## Removing Ivanti Connect Secure Gateway To remove Ivanti Connect Secure Gateway: 1. In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable to the selected Gateway. 2. Select **Delete Gateway**. The selected Gateway is removed from the list of Gateways.