--- title: What's New slug: ps/help/en_us/nsa/22x/nsa-ics/rn/whats-new docTags: createdAt: 2026-07-27T14:58:40.910Z --- ::::ExpandableHeading{isOpen="true"} ## 25.1.0.0 :::ExpandableHeading ### SKU based licensing Features part of SKU based licensing: - Custom WAF blocking rules - Features access management - Patch lifecycle management - AI Chat interface - Threat Neutralizer - Scanning with Indicator of Comromise - Platform-specific Client OS packages **Note**: These features are in Beta and will be enabled for few customers. Customers who want to test these features must reachout via their Ivanti Sales Reps. ::: :::ExpandableHeading ### Features access management NSA provides centralized control of features on the ICS Gateways/Gateway Groups directly from NSA User Interface. Multiple features can be selected across multiple gateways and enabled/disabled in one action. For details, see [Features Access Management](docId\:cEXAJmp23j44EdOgsGO4K). ::: :::ExpandableHeading ### Scanning with Indicator of Compromise The Indicator of Compromise (IoC) feature is a licensed NSA capability that scans ICS gateways for runtime anomalies and threats. It reports gateway health status to the ICT service and triggers admin alerts. For details, see [Scanning with Indicator of Compromise](docId\:rAVGucM2HSZKJtF72ivqw). ::: :::ExpandableHeading ### Feature parity with ICS Gateway release - RSA Authentication Manager (formerly known as ACE/Server) is supported that allows user authentication based on credentials from the RSA SecurID® product from RSA Security Inc. For details, see [Using a RSA Server (REST API)](docId\:xspmMKlIYdJkGpv_mrnQI). - Microsoft's Windows Hello for Business (WHfB) is supported which is passwordless authentication solution for Windows devices. For details, see[Windows Hello for Business SSO Server](docId\:xspmMKlIYdJkGpv_mrnQI). - Post-Quantum Cryptography (PQC) is supported to protect against future quantum computer attacks. For details, see [Inbound SSL Options](docId\:Ie3a96GcGf22zYaDVjwnE) and [Outbound SSL Options](docId\:Ie3a96GcGf22zYaDVjwnE). ::: :::ExpandableHeading ### Patch lifecycle management Patch packages provides a controlled patch lifecycle for gateways, enabling seamless patch upgrades, rollback, and removal without disrupting gateways operations. This feature is controlled by the feature entitlement. For details, see [Patch Lifecycle Management](docId\:OCsHa-ksFP2a79Rmz0Vhg). ::: :::ExpandableHeading ### Custom WAF blocking rules Tenant admins can create WAF rules to block specific traffic such as bad IPs, malicious payloads, etc. This feature is controlled by the feature entitlement. For details, see [Creating Custom WAF Rules](docId\:Ie3a96GcGf22zYaDVjwnE). ::: :::ExpandableHeading ### Platform-specific Client OS packages The ISAC Client Components now offers different client versions list per OS. The platform-specific option lets tenant admins to independently activate packages and enforce Minimum Support Version per OS. This feature is controlled by the feature entitlement. For details, see [Manage Ivanti Secure Access Client Versions](docId\:q2SWzExiSq6OxuG47Wuyb), and [Upgrading Gateways and Clusters with Ivanti Secure Access Client](docId\:OCsHa-ksFP2a79Rmz0Vhg). - Combined ISAC package supporting all Desktop Client OSes continues to be supported as is. - On uploading a new Client package, only the affected clients receive the upgrade prompt. - Applying client hotfix for specific OS saves time for tenant admins managing multiple ICS deployments. ::: :::ExpandableHeading ### Automated license expiry detection Automated monitoring of license expiry ensures efficient license management, timely awareness, and improved operational efficiency. This feature introduces daily tenant lifecycle checks, milestone-based notifications through email and alerts, and a configurable 30-day grace period. For details, see [NSA Licensing/Subscription](docId\:giMBWDXdcRTaW6IzFdYQJ). ::: :::ExpandableHeading ### Archiving config sync rule Archiving config sync rule allows to deactivate the rule temporarily instead of deleting the rule. The archived rule can be unarchived without losing its configuration for later use. For details, see [Archiving Config Sync Rule](docId\:cEXAJmp23j44EdOgsGO4K). ::: :::ExpandableHeading ### Config cleanup when Tenant / Gateway deletion Deleting a gateway or self-deregistration automatically performs end-to-end cleanup and stops communication with NSA. Disabling a tenant automatically cleans up associated gateways and blocks NSA access. VTM synchronizes blacklist data and blocks traffic from deleted gateways and disabled tenants. ::: :::: :::ExpandableHeading ## 22.8R1.12 Important Updates and Improvements - **ICS Upgrade Enhancements and Duration Improvements**: The upgrade workflow has been enhanced to improve efficiency and provide better visibility into gateway upgrade operations. These enhancements help streamline upgrade activities and reduce the overall duration required to complete gateway upgrades across managed deployments. For details, see [Upgrading Gateways and Clusters with a New Gateway Version](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_mgmt.htm#Upgradin4). - **ICS Config Backup, Restore and Scheduled Backup (supported for ICS 22.7, ICS 22.8 and ICS 25.1.3.0 Gateways)**: NSA now provides enhanced configuration backup and restore capabilities for managed ICS gateways. Administrators can back up gateway configurations and restore them when required, simplifying operational recovery and configuration management. For more details, see [Config Backup, Restore and Schedule Backup](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_config.htm#Config3). - **NSA Alerts Enhancements**: This release introduces enhancements to the NSA alerting framework, providing improved visibility into events and operational conditions. These improvements help administrators more effectively monitor and respond to important system activities. For details, see [Managing Alerts and Notifications](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Managing4). - **Licensing for Cloud Storage Phase 1**: Phase 1 of Cloud Storage Licensing introduces foundational licensing capabilities required for cloud-based storage services and future cloud storage enhancements. - **Advanced HTML5 Feature Licensing support**: NSA now supports licensing and feature entitlement management for Advanced HTML5 functionality on 22.8R2 and 25.x gateway platforms, simplifying feature activation and deployment management. ICS Gateway side enhancements for feature licensing have been progressively integrated into the platform to support upcoming NSA capabilities. For details, see [Feature Licenses](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/licensing.htm#Feature). ## Zero Day Support for External ICT and for 25.1.3.0 Gateways: This release adds Zero-Day support capabilities for External ICT deployments and extends support to ICS 25.1.3.0 gateways, enabling administrators to manage and monitor newer gateway deployments through NSA. Support for 25.1.3.0 includes the latest ICS platform features and enhancements. For details, see [Scanning with External Integrity Checker Tool](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_admin.htm#Scanning).22.8R1.12 Important Updates and Improvements - **ICS Upgrade Enhancements and Duration Improvements**: The upgrade workflow has been enhanced to improve efficiency and provide better visibility into gateway upgrade operations. These enhancements help streamline upgrade activities and reduce the overall duration required to complete gateway upgrades across managed deployments. For details, see [Upgrading Gateways and Clusters with a New Gateway Version](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_mgmt.htm#Upgradin4). - **ICS Config Backup, Restore and Scheduled Backup (supported for ICS 22.7, ICS 22.8 and ICS 25.1.3.0 Gateways)**: NSA now provides enhanced configuration backup and restore capabilities for managed ICS gateways. Administrators can back up gateway configurations and restore them when required, simplifying operational recovery and configuration management. For more details, see [Config Backup, Restore and Schedule Backup](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_config.htm#Config3). - **NSA Alerts Enhancements**: This release introduces enhancements to the NSA alerting framework, providing improved visibility into events and operational conditions. These improvements help administrators more effectively monitor and respond to important system activities. For details, see [Managing Alerts and Notifications](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Managing4). - **Licensing for Cloud Storage Phase 1**: Phase 1 of Cloud Storage Licensing introduces foundational licensing capabilities required for cloud-based storage services and future cloud storage enhancements. - **Advanced HTML5 Feature Licensing support**: NSA now supports licensing and feature entitlement management for Advanced HTML5 functionality on 22.8R2 and 25.x gateway platforms, simplifying feature activation and deployment management. ICS Gateway side enhancements for feature licensing have been progressively integrated into the platform to support upcoming NSA capabilities. For details, see [Feature Licenses](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/licensing.htm#Feature). - **Zero Day Support for External ICT and for 25.1.3.0 Gateways**: This release adds Zero-Day support capabilities for External ICT deployments and extends support to ICS 25.1.3.0 gateways, enabling administrators to manage and monitor newer gateway deployments through NSA. Support for 25.1.3.0 includes the latest ICS platform features and enhancements. For details, see [Scanning with External Integrity Checker Tool](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_admin.htm#Scanning). ::: :::ExpandableHeading ## 22.8R1.11 Important Updates and Improvements - Support for ICS Gateway versions 22.7R2.13, 22.8R2.4, 25.1.1.1 and 25.1.2.1in nSA Controller - Critical Service Updates - Brief service disruption expected during maintenance window for nSA administrators. - No disruption for VPN end users running 22.7R2.5 or above. - Brief disruption to first time VPN users logging in onto ICS Gateway version 25.1.0.0 during the maintenance window. ::: ::::ExpandableHeading ## 22.8R1.10 Important Updates and Improvements - **ICS Config Backup and Restore**: This feature enhancement allows tenant admin to download config backup package of any of the supported gateways. This downloaded config package can be used to restore the user configuration via ICS Gateway UI. For more details, see [Config Backup and Restore](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_config.htm#Config3). - **Alert Enhancements**: The goal of alert enhancements is to ensure that only genuine, actionable alerts are displayed to users, while minimizing false positives. This improves operational efficiency, reduces unnecessary distractions, and ensures that attention is focused on real issues. This feature enhancement allows tenant admin to configure frequency for email notifications. Event logs is added in Tenant Admin Logs for Config Authoring and Config Sync activities instead of raising alerts. :::Paragraph{indent="1"} Key Enhancements are: ::: :::Paragraph{listStyleType="disc" indent="2"} **Suppression of Transient Alerts** ::: :::Paragraph{listStyleType="disc" indent="3"} **Gateway Down/Up Events**: If a gateway goes down, it triggers the gateway disconnect alert. This gateway disconnect alert will be suppressed / removed once the gateway connects back. ::: :::Paragraph{listStyleType="disc" indent="3"} **Short-lived Failures**: Alerts triggered by temporary or self-resolving issues will not be shown to users. Currently this functionality applies only to gateway disconnect and reconnect cases. ::: :::Paragraph{listStyleType="disc" indent="2"} **Historical Data in Event Logging** ::: :::Paragraph{listStyleType="disc" indent="3"} **Event Logging Repository**: Config Authoring and Config Sync related alerts are recorded in event logs. ::: :::Paragraph{listStyleType="disc" indent="3"} **Separation of Alerts and Logs**: Alerts are reserved for real-time actionable issues, while logs provide a complete historical record. ::: :::Paragraph{listStyleType="disc" indent="3"} **Audit and Analysi**s: Event logs can be used for trend analysis, troubleshooting, and compliance purposes. ::: :::Paragraph{indent="2"} For more details, see [Managing Alerts and Notifications](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Managing4) and [Checking Tenant Admin Logs.](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_admin.htm#Checking) ::: - **Support for ICS Gateway version 25.1.2.0 in NSA Controller**: This release supports registering the ICS Gateway (ISA6500 Hardware) with nSA controller. - **Troubleshooting Enhancements**: This feature enhancement simplifies Gateway troubleshooting, which includes enhanced Debug Log, Node Monitoring, TCP Dump, System Snapshot, and Network Command functionalities. For more details, see [Using the Troubleshooting Tools](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/trblshoot.htm#top). - **ISAC package management** : ISAC Client packages are separately provided for ICS and ZTA so that these can be managed independently. This provides flexibility to plan for ZTA ISAC releases. For more details, see [Upgrading Multiple Gateways and Clusters](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_mgmt.htm#Upgradin2). :::: ::::ExpandableHeading ## 22.8R1.9 - Support for ICS Gateway version 25.1.1.0 in NSA Controller - Critical Service Updates - Feature parity with ICS Gateway :::Paragraph{indent="1"} The following features are supported with ICS 22.7R2.12, 22.8R2.3, 25.1.1.0: ::: :::Paragraph{listStyleType="disc" indent="2"} Proxy Servers for PSAM Connections: ICS Gateway supports Proxy Server for connections to PSAM destination (TCP only) via Proxy Servers. Administrators can modify existing policies to route traffic through proxy servers, enhancing both security and scalability. For details, see [Proxy Servers for PSAM Connection](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Proxy). ::: :::Paragraph{listStyleType="disc" indent="2"} Samsung Knox Manage: This feature enhances security by ensuring that only authorized android devices are permitted access based on validated device identifiers. For details, see [Configuring MDM Authentication Server](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_authn_ds.htm#Configur9). ::: :::Paragraph{listStyleType="disc" indent="2"} Source IP and Geo-Location access restriction: Allows administrators to configure and enable both Geo-Location and manual IP lists simultaneously. This enhancement improves ICS security by allowing customers to better restrict access from bad actors while permitting legitimate traffic. For details, see [Configuring Administrator Access](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_nw_host_admin.htm#Configur). ::: :::Paragraph{listStyleType="disc" indent="2"} DSIDID Enforcement for Secure VPN Authentication: DSIDID enforcement ensures secure VPN authentication by verifying both DSID and DSIDID cookies. This provides an additional layer of device and session validation, enhancing overall security. For details, see [Miscellaneous Setup](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_sys_config.htm#Miscella). ::: :::: :::ExpandableHeading ## 22.8R1.8.1 Important Updates and Improvements - Critical Service Updates ::: ::::ExpandableHeading ## 22.8R1.8 - **Enhancement: Syslog Server Configuration **: To optimize syslog server connectivity and performance, the Syslog Server configuration interface now includes a new dropdown enabling users to explicitly select the Server CA (Certificate Authority) when setting up secure connections. This enhancement complements the existing client certificate option and addresses latency issues during SSL handshakes. - **Key Improvements**: - **Targeted Server CA Selection**: Administrators can now specify which Server CA to use when configuring syslog servers. Previously, if no Server CA was selected, the system sequentially tested all trusted CAs in the tenant during connection establishment, which increased connection times. This results in a better performance and a better user experience. - **Reduced Latency and Streamlined Handshakes**:Enhanced the syslog forwarding mechanism to enable real-time log delivery by directly consuming gateway log events. - **Improved Security and Accuracy**:By ensuring the correct Server CA is always used, this enhancement minimizes the risk of mismatched certificates and strengthens secure logging communications. - **Enhanced User Experience**: The refined UI makes syslog server setup more intuitive and efficient, speeding up configuration and accelerating message delivery. :::Paragraph{indent="2"} Administrators are encouraged to specify the relevant Server CA when adding or editing syslog server configurations to gain the benefits of this enhancement. ::: :::Paragraph{indent="2"} For details, see [Syslog Forwarding](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/tadmin_entint.htm#Adding2). ::: - **ICS Config Backup**: This feature allows tenant admin to take config backup of any of the supported gateways. For more details, see [Config Backup](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_config.htm#Config3). - **Gateway Upgrade Improvements**: - Current version column is added in the Gateways list table. - Confirmation dialog is added for manual upgrades. For more details, see [Upgrading Gateways and Clusters with a New Gateway Version](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_mgmt.htm#Upgradin4). - **Feature parity with ICS Gateway releases** - :::Paragraph{indent="1"} The following features are Deprecated/ Changed (Applicable from 22.7R2.11, 22.8R2.2, 25.1.1.0 onwards): ::: :::Paragraph{listStyleType="disc" indent="3"} Enterprise Onboarding is disabled in Users main menu. ::: :::Paragraph{listStyleType="disc" indent="3"} Fallback to NTLMv1 authentication option is not supported. ::: :::Paragraph{listStyleType="disc" indent="3"} Hosted Java applets, OWA (2010/13/16+), Lotus iNotes 7/8/8.5, and MSRDWeb in Rewriter applications are not supported. ::: :::Paragraph{listStyleType="disc" indent="3"} IP plus Location based restrictions at realm level. ::: :::Paragraph{listStyleType="disc" indent="3"} Java Support options in Citrix/VDI/Terminal Services resource profiles are not supported. ::: :::Paragraph{listStyleType="disc" indent="3"} NTLMv1 protocol in Active Directory authentication is not supported. ::: :::Paragraph{listStyleType="disc" indent="3"} SAML 1.1 is not supported. ::: :::Paragraph{listStyleType="disc" indent="3"} SAML Artifact options in IDP and SP configurations are not supported. ::: :::Paragraph{listStyleType="disc" indent="3"} TOTP as a fallback server is supported. ::: :::Paragraph{listStyleType="disc" indent="3"} Virtual Desktop menu is hidden. ::: - **(Preview) AI-based migration of ICS Configuration to ZTA Gateways**: This preview feature allows tenant admin to fetch the config details of one or more ICS gateways to migrate to one or more ZTA gateways. For more details, see [AI-based Migration of ICS Configrations to ZTA Gateways](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/migrate_to_zta.htm). :::: :::ExpandableHeading ## 22.8R1.6 - **External Integrity Checker Tool enhancements**: This release includes scheduling, history and snapshot downloading options along with RBAC support. For more details, see [Scanning with External Integrity Checker Tool](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_admin.htm#Scanning). - **UAL enhancements**: First Login time and Last Login time details are provided in the Subscriptions > Users page. For more details, see [Device to User Normalization](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/licensing.htm#Device). - **Feature parity with ICS Gateway release 22.7R2.10**: - **Troubleshooting with Portprobe command**: Use Portprobe command to display the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP) port status. For more details, see [Troubleshooting TCP and UDP Port Status](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/trblshoot.htm#Trouble). - **Proof Key of Code Exchange (PKCE) Support**: Enabling Proof Key for Code Exchange (PKCE) helps to protect against interception of the authorization code returned from the authorization endpoint. For more details, see [Configuring OAuth Server](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_authn_ds.htm#Configur12) - SFTP method of archiving servers. For more details, see [Archiving Servers](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_config_file_admin.htm#Archivin). - Selection of IE as embedded browser in Client Connections is removed. For more details, see [Ivanti Secure Access Client Connections](https://help.ivanti.com/ps/help/en_US/ISAC/vNow/cg_ics_client/connection-set-options.htm). - **Admin experience enhancement**: Enhanced page controls to select the number of log records per page and to select a specific page. For more details, see [Viewing Log Records](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Viewing8). ::: ::::ExpandableHeading{isOpen="true"} ## 22.8R1.5 - **Log Forwarding to NSA from ICS**: A configurable option on the ICS gateway is added to stop forwarding logs to the NSA. By default, log forwarding is enabled during registration, but it can be toggled off. When disabled, the NSA controller will not display any log or analytics data. For more details, see [Completing Registration of an ICS Appliance](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/regn.htm#Completi). ### Deprecated/Unsupported Features in ICS 25.x Gateways :::hint{type="success"} Upgrading to ICS GW version 25.1.0.0 is supported only from version 22.8R2 for standalone ISA hardware appliances and ISA-V ESX virtual appliances. ::: :::hint{type="success"} Note that cluster upgrades are not supported. Additionally, upgrades from earlier versions (22.7R2.x and below) to 25.1.0.0 are not supported. ::: :::Paragraph{indent="1"} For 25.x gateway, a popup/tooltip message will be shown in the NSA for the following pages: ::: :::Paragraph{listStyleType="disc" indent="2"} SAML ECP Use Cases ​– need “ECP definition” ::: :::Paragraph{listStyleType="disc" indent="2"} Named Users model on the gateways​. Applies only for Classic Named user model. ::: :::Paragraph{listStyleType="disc" indent="2"} Enterprise Onboarding, see [Enterprise Onboarding](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Enterpri).​ ::: :::Paragraph{listStyleType="disc" indent="2"} DMI​ & NetConf ::: :::Paragraph{listStyleType="disc" indent="2"} OWA 2010, OWA 2013​ and All OWA versions, see [Microsoft OWA Versions](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Microsof2). ::: :::Paragraph{listStyleType="disc" indent="2"} Lotus iNotes 7 and 8, see [Lotus iNotes Versions](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Lotus). ::: :::Paragraph{listStyleType="disc" indent="2"} Hosted Java Applet, see [Hosted Java Applet](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Hosted). ::: :::Paragraph{listStyleType="disc" indent="2"} Java support options under Citrix and VDI profiles, see [Terminal Services](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Terminal), [Virtual Desktop](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Virtual). ::: :::Paragraph{listStyleType="disc" indent="2"} Resource profiles > HTML5 > Performance flags ::: :::Paragraph{listStyleType="disc" indent="2"} Resource profiles > WEB > MS Rdweb, see [Microsoft RDWeb](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Microsof). ::: :::Paragraph{listStyleType="disc" indent="2"} Protocol Binding to use for SAML Response ::: :::Paragraph{listStyleType="disc" indent="2"} SAML > Artifact, see [SAML Identity Provider](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_sign_in_policy.htm#SAML). ::: :::Paragraph{listStyleType="disc" indent="2"} AD > NTLM V1 ::: :::Paragraph{listStyleType="disc" indent="2"} VMWare View and Citrix Client Delivery ::: :::Paragraph{listStyleType="disc" indent="2"} VDI: System > Configuration > Virtual Desktops, see Virtual Desktops Configuration. ::: :::Paragraph{listStyleType="disc" indent="2"} Citrix: System > Configuration > Virtual Desktops > Disable Citrix tab ::: :::Paragraph{listStyleType="disc" indent="2"} Cloud Secure ::: :::Paragraph{listStyleType="disc" indent="2"} Multicast ::: :::Paragraph{listStyleType="disc" indent="2"} Telnet client in HTML5 Resource Profile ::: - **UAL enhancements** - Sort option for Updated time is provided in the Subscriptions > Users page. - Auto-delete function is now extended to machine logins. :::Paragraph{indent="1"} For more details, see [Device to User Normalization](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/licensing.htm#Device). ::: :::: :::ExpandableHeading{isOpen="true"} ## 22.8R1.4 - **Manage Advanced HTML5**: Tenant admin can now apply feature licenses (Advanced HTML5) for gateways. For more details, see [Feature Licenses](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/licensing.htm#Feature). - **Alerts and Notifications enhancement**: Tenant admin can configure alerts with users Email IDs to whom the Email notification should be sent. For more details, see [Managing Alerts and Notifications](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Managing4). - **External Integrity Checker Tool**: External Integrity Check scanning tool is provided to scan the system to check for any integrity anomalies. For more details, see [Scanning with External Integrity Checker Tool](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_admin.htm#Scanning). - **Feature parity with ICS Gateway release**: - Web Application Firewall (WAF) configuration for ICS Gateways protects web applications by filtering and monitoring HTTP traffic, preventing attacks such as SQL injection, cross-site scripting (XSS), and other web exploits. This feature is supported from ICS Gateway 22.8R2 release. For more details, see [Configuring Web Application Firewall](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_sys_config.htm#Configur). - Debug logs now provides Web server logs with debug severity codes for web-related events. This feature is supported from ICS Gateway 22.8R2 release. For more details, see [Using the Debug Log](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/trblshoot.htm#Using). - Ivanti recommends MFA for all realms. This feature is supported from ICS Gateway 22.7R2.7 release. If not configured with MFA, realms will be listed in red color. For more details, see [Configuring User Realm](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Configur). - Suspend tunnel on smart card removal. This feature is supported from ICS Gateway 22.7R2.8 release. For details, see [Ivanti Secure Access Client Connection is Established Options](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_users_config.htm#Ivanti3). - Specifying passwords for configuration files is mandatory. This feature is supported from ICS Gateway 22.8R2 release. For details, see [Configuration File Administration](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_config_file_admin.htm#top), and [Exporting/Importing TOTP Users](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_authn_ds.htm#Exporti). - Limiting simultaneous connections from a single IP address to the server. This feature is supported from ICS Gateway 22.8R2 release. For details, see [Miscellaneous Setup](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_sys_config.htm#Miscella). - **Admin experience enhancement**: - When the Auto Delete process deletes a user, a corresponding "Auto Delete" message (with message ID, such as ADM65432) is created in the admin logs, thus providing visibility into how many and which licenses were deleted over a specified period. For more details, see [NSA Licensing/Subscription](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/licensing.htm#top). - Disable/Enable functionality is provided for Admin policies. For details, see [Viewing Admin Authentication Policies](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_admin.htm#Viewing2). ::: :::ExpandableHeading{isOpen="true"} ## 22.8R1.3.2 - Upgrade to ICS Gateway 22.8R2 from NSA will be supported starting with NSA 22.8R1.4. However, gateways upgraded to 22.8R2 using the Gateway Admin UI will remain interoperable with the current NSA version 22.8R1.3.2. - This release includes [bug fixes](docId:5aiOpLej-QwfkAkX-ElT1). There are no new features. ::: ::::ExpandableHeading{isOpen="true"} ## 22.8R1.3.1 - **Gateway-side Enhancements for Upcoming NSA Features**: Gateway-side enhancements supporting upcoming NSA features, Feature Licensing and External ICT Management are now included in ICS Gateway 22.7R2.9. :::hint{type="info"} These features will be fully functional following the upcoming release of NSA 22.8R1.4. ::: - This release includes [bug fixes](docId:5aiOpLej-QwfkAkX-ElT1). There are no new features. :::: :::ExpandableHeading{isOpen="true"} ## 22.8R1.3 - This release includes [bug fixes](docId:5aiOpLej-QwfkAkX-ElT1). There are no new features. ::: ::::ExpandableHeading{isOpen="true"} ## 22.8R1.2 - **Gateway Upgrade Improvements**: NSA now provides option to stage the package on individual Gateway/Cluster or multiple Gateways/Clusters, and upgrade the Gateways manually or on a specified date and time. The Gateway stage and upgrade from NSA is supported for ICS Gateway with base version 22.7R2.8. For more details, see [Upgrading Gateways and Clusters with a New Gateway Version](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_mgmt.htm#Upgradin4). - **NSA Syslog Server Integration**: NSA enables you to configure external syslog server to forward ICS Gateway logs and NSA Tenant Admin logs. This enables centralized and secure log management and enhanced visibility into the health and efficiency of the services running in your ICS Gateways, or to facilitate debugging in the event of unexpected service behavior. For details, see [Using Enterprise Integration to Export Your Logs for External Analysis](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/tadmin_entint.htm). - **Config Sync Enhancements**: Config Sync enhancement supports configuring the entire configuration synchronization across multiple targets (up to 15 targets for entire configuration and 50 targets for selective configuration). This enhancement enhances flexibility and scalability for managing multiple gateways or clusters. This is particularly useful for enterprises with extensive networks, as it simplifies configuration management across various systems. This feature is supported from ICS Gateway 22.7R2.8 release. For details, see [Config Synchronization](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_config.htm#Config). - **Segregation of app visibility logs**: In order to avoid performance issue, app visibility logs is segregated from user access logs. App visibility logs is available in debug log/snapshot for troubleshooting. This feature is supported from ICS Gateway 22.7R2.8 release. For details, see [Using the Debug Log](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/trblshoot.htm#Using). The maximum debug log file size for Gateways with disk space > 80 GB is increased to 1024 MB. - **Reporting Enhancements**: - The number of schedule/on-demand exports is increased to 10. - Summary charts of gateways, user roles, application access, anomalies, non-compliance, and user risk now displays top 100 with up to 1 lakh users aggregation. - User analytics now shows maximum top 30 users. - **Admin experience enhancements**: - Search and Sort options are added for selective tables: - Gateway > Users > Resource Policies - Gateway > System > Configuration, Network, IF-MAP Federation, Log/Monitoring - Gateway > Authentication > Signing In, Authentication Servers :::hint{type="info"} Move Up and Down arrow option is disabled when Search function is applied to a table. ::: - **Feature Parity with ICS Gateway**: - For Gateways with disk space > 80 GB, maximum debug log file size is increased to 1024 MB. For details, see [Using the Debug Log](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/trblshoot.htm#Using). This change is applicable from ICS 22.7R2.6. - VPN Tunneling Resource Policy configuration allows you to enable / disable IPv4 and IPv6 address assignments and specify IPv4 and IPv6 address ranges. For details, see [VPN Tunneling Resource Policy Configuration Use Case](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_users_config.htm#VPN). This change is applicable from ICS 22.7R2.6. :::: :::ExpandableHeading ## 22.8R1.1 This release includes [bug fixes](docId:5aiOpLej-QwfkAkX-ElT1). There are no new features. ::: :::ExpandableHeading ## 22.8R1 - **Enhancements to Tenant Admin Audit Logs for end-to-end admin activities**: Tenant Admin logs now captures all the admin activities from login to logout. For more details, see [Checking Tenant Admin Logs](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#Checking). - **Config Sync enhancements**: Admin can now schedule config sync rule jobs to run only on a specified time or to run daily, weekly or monthly frequencies. For more details, see [Scheduling Config Sync Rule Job](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_config.htm#Scheduli). - **Admin experience enhancements**: Search and Sort options are added for tables in Gateway > Users > Roles, Realms, and Resource Profiles, and Authentication > Endpoint Security. - NSA Config Authoring can handle multiple certificates with the same serial number. ::: :::ExpandableHeading ## 22.7R1.6 - **(Preview) Enhancements Tenant Admin Audit Logs for Gateway operations**:Tenant Admin Logs page now additionally shows the audit logs generated for config change operations (create/update/delete) performed by all admins. For more details, see [Checking Tenant Admin Logs](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#Checking). - **Config Sync enhancements**: "Duplicate Config" option is newly added in the Config Synchronization Status page to clone the config sync rule. For more details, see [Cloning a Config Sync Rule](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_config.htm#Cloning). - **Admin experience enhancements**: "Group by" option is added in the Gateway List page to filter the list based on Gateway Type, Connection status, Version or Region. ::: :::ExpandableHeading ## 22.7R1.5 - **(Preview) Tenant Admin Audit Logs for Gateway operations**: Tenant Admin Logs page is newly added to show NSA admin audit logs generated for Gateway operations such as create, delete, upgrade, reboot and rollback. For more details, see [Checking Tenant Admin Logs](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#Checking). - **Password policy for XML configuration export and import, and TOTP users export and import**: - Strengthening the XML configuration file import/export process with password authentication checks. For more details, see: [Exporting an XML Configuration File](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_config_file_admin.htm#configuration_file_administration_293578963_1016333). - Strengthening the TOTP server by adding password authentication checks for importing and exporting the users data file. For more details, see: [Exporting/Importing TOTP Users](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_authn_ds.htm#Exporti). - **Config Sync enhancements**: "Refresh Gateway Status" option is newly added in Config Synchronization Status page for target gateways with status "Pending", "Importing" or "Timed out". For more details, see [Config Synchronization](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_config.htm#Config). - **Admin experience enhancements**: - Alphabetical sorting (ascending / descending) is now possible in the Gateways List and the Config Synchronization pages. Use the arrow icon provided in the column header to show alphabetically sorted list. - "Expand all / Collapse all" functionality is added in the Gateways List page. Use the Expand all / Collapse all icon provided in the Gateways List page to expand / collapse the Clusters and Gateways lists. ::: :::ExpandableHeading ## 22.7R1.4 - **Admin UI user experience enhancements**: Column reordering is newly added in the Users L3 and L4 pages. To move a column, a user can click the header and drag to its new position. For more details, see [Ivanti Connect Secure Gateway Analytics](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/analytics.htm). ::: :::ExpandableHeading{isOpen="true"} ## 22.7R1.3 - **Consolidated landing page**: Drill down support for the Sankey chart is newly added on the consolidated landing page. With each chart, the View all link provides a page with detailed log records for that category. For more details, see Consolidated Landing Page, see [Consolidated Landing Page](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Consolid). - **Multinode configuration status enhancement**: configuration status now includes start and end timestamps and additional status information. For more details, see [Config Synchronization](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_config.htm#Config). - **All Gateways Counter**: All Gateways counter is newly added on ZTA and NSA specific analytics landing page. For more details, see [Reviewing Your Network Activity](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Reviewin). For more details, see [Registering Ivanti Connect Secure Gateway](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/regn.htm#top) and [Creating an ICS Cluster](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_mgmt.htm#Creating). - **Gateway name / Cluster name length**: The maximum length of ICS Gateway name / Cluster name is increased to 19 characters. Admin can now register the existing ICS Gateway Cluster with cluster name length up to 19 characters to NSA. - **Feature parity with ICS Gateway 22.7R2.1 version**: - Max log Size for Event logs: The range is 1- 200 MB and the maximum size is 200 MB for Virtual Appliances. The range is 1- 1024 MB and the maximum is 1GB/1024MB for ISA Hardware. For details, see [Events to Log](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_sys_config.htm#Events). - Play integrity check for rooting detection on Android devices: checks if interactions and server requests are coming from the genuine app binary running on a genuine Android device. For details, [see Mobile Configuration](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_sys_config.htm#Mobile). ::: :::ExpandableHeading{isOpen="true"} ## 22.7R1.2 - **(Preview) Consolidated landing page**: A new unified landing page allows tenant admin to examine the shared analytical tables and charts for nZTA and ICS Gateways. For more details, see [Consolidated Landing Page](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/analytics.htm#Consolid). - **Admin UI user experience enhancements**: Improvements to the admin experience (Modernize the table view for session management and log view). Advanced filter on the page for managed users. For more details, see: - [Checking the Logs](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/analytics.htm#Checking) - [Managing the Sessions](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/analytics.htm#Managing) - [Viewing Admin Authentication Methods](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#Viewing) - [Viewing Admin Authentication Policies](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#Viewing2) - [Creating Admin Groups](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#Creating3) - **Sync Now**: A new Sync Now page allows the tenant admin to implement changes made to Admin Management and correct any configuration problems based on the alerts. For more details, see [Synchronizing the Configuration](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/analytics.htm#Synchron). ::: :::ExpandableHeading{isOpen="true"} ## 22.7R1 - **Admin Experience Enhancements**: To enhance the administrative experience, there have been improvements in the form of table modernization for both Admin Management and Session Management. For details, see [NSA Administration](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#top). - **Password Strengthening for Local Authentication Server**: The local authentication server has stronger password restrictions. For details, see [Workflow: Creating a Local Authentication Policy](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#Workflow). ::: ::::ExpandableHeading{isOpen="true"} ## 22.6R1 - **IPv6 L3 VPN Application Visibility** (Supported only for 22.x ICS Gateway): Support for IPV6 L3 VPN visibility in NSA. You can view both IPv4 and IPv6 applications for L3 user sessions from the Applications overview page. For details, see [Using the Applications Filter Bar](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/analytics.htm#Using7). - **NSA Named User License Normalization** (Supported only for 22.6R2 ICS Gateway with 22.6R1 ISAC Client and later versions): Normalization of license seat reservation across devices and users. Single license is consumed instead of two through associating devices with users for Machine Cert Authentication and subsequent User Authentication. For details, see [NSA Licensing/Subscription](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/licensing.htm#top). - **Licensing Enhancements for named user licenses (UAL)**: Support added to perform out of band license checks. The subscription page in NSA tenant admin portal will be updated with few minutes of delay from the new user login. - **NSA Feature parity with 22.6R2 ICS gateway** - Resource policies > VPN Tunnelling > Connection Profile > DHCP Subnet - 22.x - HTML5 Bookmark - Enable Auto Resolution Option - 22.x and 9.x - User Roles Options - Enable Auto Resolution Option - 22.x and 9.x - System > Configuration > SAML > New SAML > Hide PDP Option - 22.x - Hide Authentication > Auth Servers > LDAP server > Health check - 9.x - Authentication > Auth Servers > LDAP server > Health check - 22.x - System > Configuration > Security > Miscellaneous > Relay state option - 22.x - **Support SAML Authentication server as a secondary authentication server when configuring Certificate Authentication server** (Supported only for 22.x ICS Gateway): NSA now supports configuration of Certification Authentication server with SAML Authentication server as a secondary authentication server. For details, see [Configuring Certificate Authentication Server](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_authn_ds.htm#Configur5). - Admin experience enhancements to L4, Gateway Logs, and Logs Tables in terms of selection and resizing, pagination, and text copy/paste :::Paragraph{indent="1"} The following list shows the enhancements to L4, Gateway Logs, and Logs Tables. ::: :::Paragraph{listStyleType="disc" indent="2"} Column resizing across ICS pages ::: :::Paragraph{listStyleType="disc" indent="2"} Cell content copy text from Table ::: :::Paragraph{listStyleType="disc" indent="2"} Pagination across ICS pages ::: :::Paragraph{listStyleType="disc" indent="2"} Minimum number of columns in all the tables in L4 dashboards ::: :::Paragraph{listStyleType="disc" indent="2"} Enhancement to Advanced Filter ::: For details, see [Using the Top Active Breakdown Charts](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Using5) and [Filtering the Logs](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/analytics.htm#Filterin). :::: ::::ExpandableHeading{isOpen="true"} ## 22.5R1 - **Auto Selecting Dependent Configurations as part of Config Sync**: While creating config sync rule, if there is any dependency mismatch, admin can review dependent configurations and select them before creating/editing rule. For details, see [Config Synchronization](http://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_config.htm#Config). :::Paragraph{indent="2"} For example, If realm configuration is mapped to Authentication server and if config sync rule is created with only realm. The dependent configuration is highlighted (Auth server). Realm configuration is highlighted with i icon and when dependencies are reviewed, Authentication server is mentioned in the dependency tree. ::: - Preview of changes done in source gateway before config sync. This feature is available only with Manual sync. :::hint{type="info"} Preview before sync will work only when one manual config sync rule is triggered. ::: - 22.5R2 ICS configuration parity in NSA. - **Admin Access Control based on location, Host Checker, and Network**: Checks the Admin's device geographic location/network/host checker compliance for admin sign-in policy before providing access to admin login. For details, see [Creating Admin Policies](http://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_admin.htm#Creating4). - **NSA Licensing Enhancements**: When NSA licensing is enabled on Gateway, and if there is connectivity issue between gateway and controller, grace period of 24 hours is applied for new user logins up to platform limit. :::: :::ExpandableHeading{isOpen="true"} ## 22.4R3 - **Role Based Access Control for Admin Users**: With Role-based access control (RBAC), organizations can easily add admins and assign them specific roles, with differing levels of access to the NSA Admin Portal. In addition to an existing set of default roles, Administrators can now create custom granular roles for specific functions within the NSA admin portal. For details, see [Role-based Access Control for Admin Users](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-ics/ag/gw_admin.htm#Role-based) ::: :::ExpandableHeading{isOpen="true"} ## 22.4R1 - **Analytics: Historical View**: Analytics supports data visualization in Active View. Admin can see the historic data on different time windows. Admin's can find all connections details for different time frames past 30 days. For details, see [Using the Filter Bar](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/analytics.htm#Using) - **Config Sync Rule Status**: This feature allows a user to view the config sync rule status of all target gateways. For details, see [Config Synchronization](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/gw_config.htm#Config). - **NSA named user licensing normalization**: This feature allows a user to use different login formats - Domain\username, Common Name (CN), and User Principal Name (UPN) - from different devices, but consumes only one seat for the user. For details, see [NSA Licensing/Subscription](https://help.ivanti.com/ps/help/en_US/NSA/22.x/nsa-ics/ag/licensing.htm#top). ::: ::::ExpandableHeading{isOpen="true"} ## 22.3R4 - **Configuring ZTA Policy to an ICS Application**: Administrators can now configure ICS application with ZTA secure access policy from the NSA-ICS Applications page. - **NSA Named User Licensing - Freeing named user licenses automatically**: Users who have not logged in to the ICS Gateway for the last 30 days can be deleted automatically from the Users list. - **Addition of a new alert "Config Sync Target Cluster Deleted**": This alert is generated when the Target Cluster, which is in any of the Config Sync rule gets deleted. :::hint{type="info"} Configuration template functionality is consolidated into Configuration sync feature. ::: :::: :::ExpandableHeading{isOpen="true"} ## 22.3R3 Actionable Insights: Step up Authentication, Subsequent login and Chart Visibility. ::: :::ExpandableHeading{isOpen="true"} ## 22.3R1 - Enhanced Admin experience - Config Sync enhancements - Alerts and Notification enhancements - NSA UI parity with 9.1R16 and R17 - L3 VPN App Visibility - Config Replace/reorder :::