Configure admin partitions

Important

• Only superusers are authorized to create and configure admin partitions.
• Unless specified otherwise, configurations to set up an admin partition must be done from the default partition.

By partitioning a Citrix ADC appliance, you are in-effect creating multiple instances of a single Citrix ADC appliance. Each instance has its own configurations and the traffic of each of these partitions is isolated from the other by assigning each partition a dedicated VLAN or a shared VLAN.

A partitioned Citrix ADC has one default partition and the admin partitions that are created. To set up an admin partition, you must first create a partition with the relevant resources (memory, maximum bandwidth, and connections). Then, specify the users that can access the partition and the level of authorization for each of the users on the partition.

Accessing a partitioned Citrix ADC is the same as accessing a non-partitioned Citrix ADC: through the NSIP address or any other management IP address. As a user, after you provide your valid logon credentials, you are taken to the partition to which you are bound. Any configurations that you create are saved to that partition. If you are associated with more than one partition, you are taken to the first partition with which you were associated. If you want to configure entities on one of your other partitions, you must explicitly switch to that partition.

After accessing the appropriate partition, configurations that you perform are saved to that partition and are specific to that partition.

Note

• Citrix ADC superusers and other non-partition users are taken to the default partition.
• Users of all the 512 partitions can log in simultaneously.

Tip

To access a partitioned Citrix ADC appliance over HTTPS by using the SNIP (with management access enabled), make sure that each partition has the certificate of its partition administrator. Within the partition, the partition admin must do the following:

1. Add the certificate to the Citrix ADC.

   add ssl certKey ns-server-certificate -cert ns-server.cert -key ns-server.key

2. Bind it to a service named nskrpcs-<SNIP>-3009, where <SNIP> must be replaced with the SNIP address, in this case 100.10.10.1.

   • bind ssl service nskrpcs-100.10.10.1-3009
   • certkeyName** ns-server-certificate

Partition resource limiting

In a partitioned Citrix ADC appliance, a network administrator can create a partition with partition resources such as memory, bandwidth, and connection limit configured as unlimited. This is done by specifying Zero as the partition resource value, where Zero indicates the resource is unlimited on the partition and it can be consumed up to system limits. Partition resource configuration is useful when you migrate a traffic domain deployment to an administrative partition or if you do not know about resource allocation limit for a partition in a given deployment.

Resource limit for an administrative partition is as follows:

1. Partition memory. This is the maximum allocated memory for a partition. You must make sure to specify the values when creating a partition.

   Note

   From NetScaler 12.0 onwards, when you create a partition, you must the set the memory limit as Zero or if a partition is already created with a specific memory limit, you can reduce the limit to any value or set the limit as Zero.

   Parameter: maxMemLimit

   Maximum memory is allocated in megabytes in a partition. A zero value indicates the memory is unlimited on the partition and it can consume up to the system limits.

   Default value: 10

2. Partition bandwidth. Maximum allocated bandwidth for a partition. If you specify a limit, make sure it is within the appliance’s licensed throughput. Otherwise, you are not limiting the bandwidth that can be used by the partition. The specified limit is accountable for the bandwidth that the application requires. If the application bandwidth exceeds the specified limit, packets are dropped.

   Note

   From NetScaler 12.0 onwards, when you can create a partition, you can set the partition bandwidth limit to Zero or if a partition is already created with a specific bandwidth, you can reduce bandwidth or set the limit as Zero.

   Parameter: maxBandwidth

   Maximum bandwidth is allocated in Kbps in a partition. A zero value indicates the bandwidth is unrestricted. That is, the partition can consume up to the system limits.

   Default value: 10240

   Maximum Value: 4294967295

3. Partition connection. Maximum number of concurrent connections that can be open in a partition. The value must accommodate the maximum simultaneous flow expected within the partition. The partition connections are accounted from the partition quota memory. Previously, the connections were accounted from the default partition quota memory. It is configured only on the client-side, not on the back-end server-side TCP connections. New connections cannot be established beyond this configured value.

   Note

   From NetScaler 12.0 onwards, you can create a partition with number of open connections set to Zero or if you have already created a partition with a specific number of open connections, you can reduce the connection limit or set the limit as Zero.

   Parameter: maxConnections

   Maximum number of concurrent connections that can be open in the partition. A zero value indicates no limit on number of open connections.

   Default value: 1024

   Minimum value: 0

   Maximum Value: 4294967295

Configure an admin partition

To configure an admin partition, complete the following tasks.

Access an admin partition

To access in an admin partition by using the command line interface

1. Log on to the Citrix ADC appliance.
2. Check if you are in the correct partition. The command prompt displays the name of the currently selected partition.
3. If yes, skip to the next step.

4. If no, get a list of the partitions with which you are associated and switch over to the appropriate partition.

   • show system user <username>
   • switch ns partition <partitionName>
5. Now, you can perform the required configurations just as a non-partitioned Citrix ADC.

To access an admin partition by using the configuration utility

1. Log on to the Citrix ADC appliance.

2. Check if you are in the correct partition. The top bar of the graphical user interface displays the name of the currently selected partition.

   • If yes, skip to the next step.

   • If no, navigate to Configuration > System > Administrative Partitions > Partitions, right-click the partition to which you want to switch, and select Switch.

3. Now, you can perform the required configurations just as a non-partitioned Citrix ADC.

Add an admin partition

The root administrator adds an administrative partition from the default partition and binds the partition with VLAN 2.

To create an administrative partition by using the command line interface**

At the command prompt, type:

add partition <partitionname>

Switch user access from default partition to an admin partition

Now switch user access from default partition to partition Par1.

To switch a user account from default partition to an admin partition by using the command line interface:

At the command prompt, type:

Switch ns partition <pname>

Adding SNIP address to a partition user account with management access enabled

In the partition, create SNIP address with management access enabled.

To add SNIP address to the partition user account with management access enabled by using the command line interface:

At the command prompt, type:

> add ns ip <ip address> <subnet mask> -mgmtAccess enabled

Create and Bind a partition user with partition command policy

In partition, create a partition system user and bind the user with partition-admin command policies.

To create and bind a partition system user with partition command policy by using the command line interface:

At the command prompt, type:

> add system user <username> <password> Done

Creating and binding partition user group with partition command policy

In Partition Par1, create a partition system user group and bind the group with partition command policy such as partition admin, partition read-only, partition-operator, or partition-network.

To create and bind a partition user group with partition command policy by using the command line interface:

> add system group <groupName>
> bind system group <groupname> (-userName | -policyName <cmdpolicy> <priority> | -partitionName)

Configuring external server authentication for external users

In partition Par1 you can configure an external server authentication to authenticate external TACACS users accessing the partition through SNIP address.

To configure external server authentication for external users by using the command line interface:

At the command prompt, type:

    add authentication tacacsaction <name> -serverip <IP> -tacacsSecret <secret key> -authorization ON -accounting ON
    add authentication policy <policname> -rule true -action <name>
    bind system global <policyname> -priority <value>1

Configure a Partition System User Accounts in a Partition by using the GUI

To configure a partition user account in an administrative partition, you must create a partition user or a partition user group and bind it partition command policies. Also, you can configure the external server authentication for an external user.

To create a partition user account in a partition by using the GUI

Navigate to System > User Administration, click Users to add a partition system user and bind the user to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).

To create a partition user group account in a partition by using the GUI

Navigate to System > User Administration, click Groups to add a partition system user group and bind the user group to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).

To configure External server authentication for external users by using the GUI

Navigate to System > Authentication > Basic Actions and click TACACS to configure TACACS server for authenticating external users accessing the partition.

Sample Configuration

The following configuration shows how to create a partition user or a partition user group and bind it partition command policies. Also, how to configure the external server authentication for authenticating an external user.

    > add partition Par1
    > switch ns partition Par1
    > add ns ip 10.102.29.203 255.255.255.0 -mgmtAccessenabled
    > add system user John Password
    > bind system user Jane partition-read-only -priority 1
    > add system group Retail
    > bind system group Retail -policyname partition-network 1 (where 1 is the priority number)
    > bind system group Retail –username Jane
    > add authentication tacacssaction tacuser –serverip 10.102.29.200 –tacacsSecret Password –authorization ON –accounting ON
    > add authentication policy polname –rule true –action tacacsAction
    > bind system global polname –priority 1

Command Policies for a Partition Users and Partition User Groups in Administrative Partition

Configure an LACP ethernet channel on the default admin partition

With Link Aggregation Control Protocol (LACP), you can combine multiple ports into a single, high-speed link (also called a channel). An LACP-enabled appliance exchanges LACP Data Units (LACPDU) over the channel.

There are three LACP configuration modes that you can enable in the default partition of a Citrix ADC appliance:

1. Active. A port in active mode sends LACPDUs. Link aggregation is formed if the other end of the Ethernet link is in the LACP active or passive mode.
2. Passive. A port in passive mode sends LACPDUs only when it receives LACPDUs. The link aggregation is formed if the other end of the Ethernet link is in the LACP active mode.
3. Disable. Link aggregation is not formed.

Note

By default, the link aggregation is disabled in the default partition of the appliance.

LACP exchanges LACPDU between devices connected by an Ethernet link. These devices are typically referred as an actor or partner.

A LACPDU data unit contains the following parameters:

• LACP Mode. Active, passive or disable.
• LACP timeout. The waiting period before timing out the partner or actor. Possible values: Long and Short. Default: Long.
• Port Key. To distinguish between the different channel. When key is 1, LA/1 is created. When key is 2, LA/2 is created. Possible values: Integer from 1 through 8. 4 through 8 is for cluster CLAG.
• Port Priority. Minimum value: 1. Maximum value: 65535. Default: 32768.
• System Priority. Uses this priority along with system MAC to form the system ID to uniquely identify the system during LACP negotiation with the partner. Sets system priority from 1 and 65535. The default value is set to 32768.
• Interface. Supports 8 interfaces per channel on NetScaler 10.1 appliance and supports 16 interfaces per channel on NetScaler 10.5 and 11.0 appliances.

After exchanging LACPDUs, the actor and partner negotiate the settings and decide whether to add the ports to the aggregation.

Configure and verify LACP

To configure and verify LACP on a Citrix ADC appliance by using the command line

1. Enable LACP on each interface.

   At the command prompt, type:

   set interface <Interface_ID> -lacpMode PASSIVE -lacpKey 1

   When you enable LACP on an interface, the channels are dynamically created. Additionally, when you enable LACP on an interface and set lacpKey to 1, the interface is automatically bound to channel LA/1.

   Note

   When you bind an interface to a channel, the channel parameters take precedence over the interface parameters, so the interface parameters are ignored. If a channel was created dynamically by LACP, you cannot perform add, bind, unbind, or remove operations on the channel. A channel dynamically created by LACP is automatically deleted when you disable LACP on all interfaces of the channel.

2. Set the system priority.

   At the command prompt, type:

   set lacp -sysPriority <Positive_Integer>

3. Verify that LACP is working as expected.

   show interface <Interface_ID>

   show channel

   show LACP

   Note

   In some versions of Cisco IOS, running the switchport trunk native vlan command causes the Cisco switch to tag LACP PDUs. This causes the LACP channel between the Cisco switch and the Citrix ADC appliance to fail. However, this issue does not affect the static link aggregation channels configured in the above procedure.