- Citrix ADC Release Notes
-
Getting Started with Citrix ADC
- Where Does a Citrix ADC Appliance Fit in the Network?
- How a Citrix ADC Communicates with Clients and Servers
- Introduction to the Citrix ADC Product Line
- Install the hardware
- Access a Citrix ADC
- Configure the ADC for the first time
- Configure high availability
- Configuring a FIPS Appliance for the First Time
- Understanding Common Network Topologies
- System management settings
- Load balance traffic on a Citrix ADC appliance
- Accelerate load balanced traffic by using compression
- Secure load balanced traffic by using SSL
- Features at a Glance
- FAQ
-
Solutions for Telecom Service Providers
-
Large Scale NAT
- Points to Consider before Configuring LSN
- Configuration Steps for LSN
- Sample LSN Configurations
- Configuring Static LSN Maps
- Configuring Application Layer Gateways
- Logging and Monitoring LSN
- STUN Timeout
- TCP SYN Idle Timeout
- Overriding LSN configuration with Load Balancing Configuration
- Clearing LSN Sessions
- Load Balancing SYSLOG Servers
- Port Control Protocol
- LSN44 in a cluster setup
- Dual-Stack Lite
-
Large Scale NAT64
- Points to Consider for Configuring Large Scale NAT64
- Configuring DNS64
- Configuring Large Scaler NAT64
- Configuring Application Layer Gateways for Large Scale NAT64
- Configuring Static Large Scale NAT64 Maps
- Logging and Monitoring Large Scale NAT64
- Port Control Protocol for Large Scale NAT64
- LSN64 in a cluster setup
- Mapping Address and Port using Translation
- Telco subscriber management
- Load Balance Control-Plane Traffic that is based on Diameter, SIP, and SMPP Protocols
- Provide DNS Infrastructure/Traffic Services, such as, Load Balancing, Caching, and Logging for Telecom Service Providers
- Provide Subscriber Load Distribution Using GSLB Across Core-Networks of a Telecom Service Provider
- Bandwidth Utilization Using Cache Redirection Functionality
- Citrix ADC TCP Optimization
- Citrix ADC Video Optimization
- Citrix ADC URL Filtering
-
Large Scale NAT
- Citrix ADC Solutions
-
Deploy a Citrix ADC VPX instance
- Support matrix and usage guidelines
- Install a Citrix ADC VPX instance on XenServer
-
Install a Citrix ADC VPX instance on VMware ESX
- Configuring Citrix ADC Virtual Appliances to use VMXNET3 Network Interface
- Configuring Citrix ADC Virtual Appliances to use Single Root I/O Virtualization (SR-IOV) Network Interface
- Migrating the Citrix ADC VPX from E1000 to SR-IOV or VMXNET3 Network Interfaces
- Configuring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
- Install a Citrix ADC VPX instance on Microsoft Hyper-V servers
-
Install a Citrix ADC VPX instance on Linux-KVM platform
- Prerequisites for Installing Citrix ADC VPX Virtual Appliances on Linux-KVM Platform
- Provisioning the Citrix ADC Virtual Appliance by using OpenStack
- Provisioning the Citrix ADC Virtual Appliance by using the Virtual Machine Manager
- Configuring Citrix ADC Virtual Appliances to Use SR-IOV Network Interface
- Configuring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
- Provisioning the Citrix ADC Virtual Appliance by using the virsh Program
- Managing the Citrix ADC Guest VMs
- Provisioning the Citrix ADC Virtual Appliance with SR-IOV, on OpenStack
- Configuring a Citrix ADC VPX Instance on KVM to Use OVS DPDK-Based Host Interfaces
-
Deploy a Citrix ADC VPX instance on AWS
- Limitations and usage guidelines
- Prerequisites
- Deploy a Citrix ADC VPX standalone instance on AWS
- Scenario: standalone instance
- Download a Citrix ADC VPX license
- Load balancing servers in different availability zones
- Deploy a high availability pair on AWS
- High availability across AWS availability zones
- Add back-end AWS auto scaling service
- Configure a Citrix ADC VPX instance to use SR-IOV network interface
- Upgrade a Citrix ADC VPX instance on AWS
- Troubleshoot a VPX instance on AWS
-
Deploy a Citrix ADC VPX instance on Microsoft Azure
- Configure a Citrix ADC standalone instance
- Configure multiple IP addresses for a Citrix ADC VPX standalone instance
- Configure a high-availability setup with multiple IP addresses and NICs
- Configure a high-availability setup with multiple IP addresses and NICs by using PowerShell commands
- Configure a high-availability setup with a single IP address and a single NIC
- Add Azure autoscale settings
- Configure GSLB on Citrix ADC VPX instances
- Configure GSLB on an ctive-standby high availability setup
- Configure address pools (IIP) for a Citrix Gateway appliance
- Configure multiple IP addresses for a Citrix ADC VPX instance in standalone mode by using PowerShell commands
- Configure multiple Azure VIPs for a standalone or high availability Citrix ADC instance
- Additional PowerShell scripts for Azure deployment
- Azure terminology
- Deploy a Citrix ADC VPX instance on Google Cloud Platform
- Jumbo frames on Citrix ADC VPX instances
- Licensing
- Upgrade and downgrade a Citrix ADC appliance
-
Authentication, authorization, and auditing application traffic
- How Authentication, authorization, and auditing works
- Enabling AAA
- Setting up an authentication virtual server
- Creating an authentication profile
- Configuring users and groups
- Configuring authentication, authorization, and auditing policies
- Self-service password reset
- Authorizing user access to application resources
- Auditing authenticated sessions
- Session settings
- Traffic settings
- Authenticating with client certificates
- Configuring Authentication, authorization, and auditing with commonly used protocols
- Citrix ADC Kerberos single sign-on
- SAML authentication
- OAuth authentication
- Multi-Factor (nFactor) authentication
- Configuring the OpenID Connect Protocol
- Admin Partitioning
-
AppExpert
- Action Analytics
-
AppExpert Applications and Templates
- How AppExpert application works
- Get started with AppExpert
- Customize AppExpert Configuration
- Configure user authentication
- Monitor Citrix ADC statistics
- Delete an AppExpert application
- Configure application authentication, authorization, and auditing
- Set up a custom Citrix ADC application
- Creating and Managing Template Files
- Citrix Gateway Applications
- AppQoE
- Entity Templates
-
HTTP Callouts
- How an HTTP Callout Works
- Notes on the Format of HTTP Requests and Responses
- Configuring an HTTP Callout
- Verifying the Configuration
- Invoking an HTTP Callout
- Avoiding HTTP Callout Recursion
- Caching HTTP Callout Responses
- Use Case: Filtering Clients by Using an IP Blacklist
- Use Case: ESI Support for Fetching and Updating Content Dynamically
- Use Case: Access Control and Authentication
- Use Case: OWA-Based Spam Filtering
- Use Case: Dynamic Content Switching
- Pattern Sets and Data Sets
- Variables
-
Policies and Expressions
- Introduction to Policies and Expressions
- Configuring Advanced Policy Infrastructure
- Configuring Advanced Policy Expression: Getting Started
- Advanced Policy Expressions: Evaluating Text
- Advanced Policy Expressions: Working with Dates, Times, and Numbers
- Advanced Policy Expressions: Parsing HTTP, TCP, and UDP Data
- Advanced Policy Expressions: Parsing SSL Certificates
- Advanced Policy Expressions: IP and MAC Addresses, Throughput, VLAN IDs
- Advanced Policy Expressions: Stream Analytics Functions
- Advanced Policy Expressions: DataStream
- Typecasting Data
- Regular Expressions
- Configuring Classic Policies and Expressions
- Expressions Reference-Advanced Policy Expressions
- Expressions Reference-Classic Expressions
- Summary Examples of Default Syntax Expressions and Policies
- Tutorial Examples of Default Syntax Policies for Rewrite
- Tutorial Examples of Classic Policies
- Migration of Apache mod_rewrite Rules to the Default Syntax
-
Rate Limiting
- Configuring a Stream Selector
- Configuring a Traffic Rate Limit Identifier
- Configuring and Binding a Traffic Rate Policy
- Viewing the Traffic Rate
- Testing a Rate-Based Policy
- Examples of Rate-Based Policies
- Sample Use Cases for Rate-Based Policies
- Rate Limiting for Traffic Domains
- Configure rate limit at packet level
-
Responder
- Enabling the Responder Feature
- Configuring a Responder Action
- Configuring a Responder Policy
- Binding a Responder Policy
- Setting the Default Action for a Responder Policy
- Responder Action and Policy Examples
- Diameter Support for Responder
- RADIUS Support for Responder
- DNS Support for the Responder Feature
- How to Redirect HTTP Requests
- Troubleshooting
-
Rewrite
- How Rewrite Works
- Enabling the Rewrite Feature
- Configuring a Rewrite Action
- Configuring a Rewrite Policy
- Binding a Rewrite Policy
- Configuring Rewrite Policy Labels
- Configuring the Default Rewrite Action
- Bypassing the Safety Check
- Rewrite Action and Policy Examples
- URL Transformation
- RADIUS Support for the Rewrite Feature
- Diameter Support for Rewrite
- DNS Support for the Rewrite Feature
- String Maps
- URL Sets
- AppFlow
-
Application Firewall
- FAQs and Deployment Guide
- Introduction
- Configuring the Application Firewall
-
Signatures
- Manually Configuring the Signatures Feature
- Adding or Removing a Signatures Object
- Configuring or Modifying a Signatures Object
- Protecting JSON Applications using Signatures
- Updating a Signatures Object
- Exporting a Signatures Object to a File
- The Signatures Editor
- Signature Updates in High-Availability Deployment and Build Upgrades
- Overview of Security checks
- Top-Level Protections
- Data Leak Prevention Checks
- Advanced Form Protection Checks
- URL Protection Checks
- XML Protection Checks
- Managing Content Types
- Profiles
- Policy Labels
- Policies
- Imports
- Global Configuration
- Statistics and Reports
- Application Firewall Logs
- Appendices
- Debugging and Troubleshooting
- Signatures Alert Articles
- Cache Redirection
-
Clustering
- Citrix ADC configuration support in a cluster
- Prerequisites for cluster nodes
- Cluster overview
- Setting up a Citrix ADC cluster
- Distributing traffic across cluster nodes
-
Managing the Citrix ADC cluster
- Configuring linksets
- Nodegroups for spotted and partially-striped configurations
- Configuring redundancy for nodegroups
- Disabling steering on the cluster backplane
- Synchronizing cluster configurations
- Synchronizing time across cluster nodes
- Synchronizing cluster files
- Viewing the statistics of a cluster
- Discovering Citrix ADC appliances
- Disabling a cluster node
- Removing a cluster node
- Removing a node from a cluster deployed using cluster link aggregation
- Detecting jumbo probe on a cluster
- Route monitoring for dynamic routes in cluster
- Monitoring cluster setup using SNMP MIB with SNMP link
- Monitoring command propagation failures in a cluster deployment
- Graceful shutdown of nodes
- Graceful shutdown of services
- IPv6 ready logo support for clusters
- Managing cluster heartbeat messages
- Configuring owner node response status
- Monitor Static Route (MSR) support for inactive nodes in a spotted cluster configuration
- VRRP interface binding in a single node active cluster
-
Cluster setup and usage scenarios
- Creating a two-node cluster
- Migrating an HA setup to a cluster setup
- Transitioning between a L2 and L3 cluster
- Setting up GSLB in a cluster
- Using cache redirection in a cluster
- Using L2 mode in a cluster setup
- Using cluster LA channel with linksets
- Backplane on LA channel
- Common interfaces for client and server and dedicated interfaces for backplane
- Common switch for client, server, and backplane
- Common switch for client and server and dedicated switch for backplane
- Different switch for every node
- Sample cluster configurations
- Using VRRP in a cluster setup
- Backup and restore of cluster setup
- Upgrading or downgrading the Citrix ADC cluster
- Operations supported on individual cluster nodes
- Support for heterogeneous cluster
- FAQs
- Troubleshooting the Citrix ADC cluster
- Content Switching
-
DataStream
- Configuring Database Users
- Configuring a Database Profile
- Configuring Load Balancing for DataStream
- Configuring Content Switching for DataStream
- Configuring Monitors for DataStream
- Use Case 1: Configuring DataStream for a Master/Slave Database Architecture
- Use Case 2: Configuring the Token Method of Load Balancing for DataStream
- Use Case 3: Logging MSSQL Transactions in Transparent Mode
- Use Case 4: Database Specific Load Balancing
- DataStream Reference
-
Domain Name System
-
Configure DNS resource records
- Create SRV records for a service
- Create AAAA Records for a domain name
- Create address records for a domain name
- Create MX records for a mail exchange server
- Create NS records for an authoritative server
- Create CNAME records for a subdomain
- Create NAPTR records for telecommunications domain
- Create PTR records for IPv4 and IPv6 addresses
- Create SOA records for authoritative information
- Create TXT records for holding descriptive text
- View DNS statistics
- Configure a DNS zone
- Configure the Citrix ADC as an ADNS server
- Configure the Citrix ADC as a DNS proxy server
- Configure the Citrix ADC as an end resolver
- Configure the Citrix ADC as a forwarder
- Configure Citrix ADC as a non-validating security aware stub-resolver
- Jumbo frames support for DNS to handle responses of large sizes
- Configure DNS logging
- Configure DNS suffixes
- DNS ANY query
- Configure negative caching of DNS records
- Caching of EDNS0 client subnet data when the Citrix ADC appliance is in proxy mode
- Domain name system security extensions
- Support wildcard DNS domains
- Mitigate DNS DDoS attacks
-
Configure DNS resource records
- Firewall Load Balancing
-
Global Server Load Balancing
- GSLB deployment types
- GSLB configuration entities
- GSLB methods
- Configure static proximity
- Configure site-to-site communication
- Configure metrics exchange protocol
- Configure GSLB by using a wizard
- Configure GSLB entities individually
- Synchronize the configuration in a GSLB setup
- GSLB dashboard
- Monitor GSLB services
- Use case: Deployment of domain name based autoscale service group
- Use case: Deployment of IP address based autoscale service group
-
How-to articles
- Customize your GSLB configuration
- Configure persistent connections
- Manage client connections
- Configure GSLB for proximity
- Protect the GSLB setup against failure
- Configure GSLB for disaster recovery
- Override static proximity behavior by configuring preferred locations
- Configure GSLB service selection using content switching
- Configure GSLB for DNS queries with NAPTR records
- Use the EDNS0 client subnet option for GSLB
- Example of a complete parent-child configuration using the metrics exchange protocol
- Link Load Balancing
-
Load Balancing
- How load balancing works
- Set up basic load balancing
- Load balance virtual server and service states
- Support for load balancing profile
- Load balancing algorithms
-
Persistence and persistent connections
- About Persistence
- Source IP address persistence
- HTTP cookie persistence
- SSL session ID persistence
- Diameter AVP number persistence
- Custom server ID persistence
- IP address persistence
- SIP Call ID persistence
- RTSP session ID persistence
- Configure URL passive persistence
- Configure persistence based on user-defined rules
- Configure persistence types that do not require a rule
- Configure backup persistence
- Configure persistence groups
- Share persistent sessions between virtual servers
- Configure RADIUS load balancing with persistence
- View persistence sessions
- Clear persistence sessions
- Override persistence settings for overloaded services
- Troubleshooting
- Customize a load balancing configuration
- Configure diameter load balancing
- Configure FIX load balancing
- Protect a load balancing configuration against failure
- Manage a load balancing setup
-
Manage client traffic
- Configure sessionless load balancing virtual servers
- Redirect HTTP requests to a cache
- Direct requests according to priority
- Direct requests to a custom web page
- Enable cleanup of virtual server connections
- Rewrite ports and protocols for HTTP redirection
- Insert IP address and port of a virtual server in the request header
- Use a specified source IP for backend communication
- Set a time-out value for idle client connections
- Manage RTSP connections
- Manage client traffic on the basis of traffic rate
- Identify a connection with layer 2 parameters
- Configure the prefer direct route option
- Use a source port from a specified port range for backend communication
- Configure source IP persistency for backend communication
- Use IPv6 link local addresses on server side of a load balancing setup
-
Advanced load balancing settings
- Gradually stepping up the load on a new service with virtual server–level slow start
- The no-monitor option for services
- Protect applications on protected servers against traffic surges
- Enable cleanup of virtual server and service connections
- Graceful shutdown of services
- Enable or disable persistence session on TROFS services
- Direct requests to a custom web page
- Enable access to services when down
- Enable TCP buffering of responses
- Enable compression
- Maintain client connection for multiple client requests
- Insert the IP address of the client in the request header
- Retrieve location details from user IP address using geolocation database
- Use source IP address of the client when connecting to the server
- Use client source IP address for backend communication in a v4-v6 load balancing configuration
- Configure the source port for server-side connections
- Set a limit on the number of client connections
- Set a limit on number of requests per connection to the server
- Set a threshold value for the monitors bound to a service
- Set a timeout value for idle client connections
- Set a timeout value for idle server connections
- Set a limit on the bandwidth usage by clients
- Redirect client requests to a cache
- Retain the VLAN identifier for VLAN transparency
- Configure automatic state transition based on percentage health of bound services
-
Built-in monitors
- TCP-based application monitoring
- SSL service monitoring
- FTP service monitoring
- Secure monitoring of servers by using SFTP
- Set SSL parameters on a secure monitor
- SIP service monitoring
- RADIUS service monitoring
- Monitor accounting information delivery from a RADIUS server
- DNS and DNS-TCP service monitoring
- LDAP service monitoring
- MySQL service monitoring
- SNMP service monitoring
- NNTP service monitoring
- POP3 service monitoring
- SMTP service monitoring
- RTSP service monitoring
- XML broker service monitoring
- ARP request monitoring
- XenDesktop Delivery Controller service monitoring
- Web interface service monitoring
- Citrix StoreFront stores monitoring
- Custom monitors
- Configure monitors in a load balancing setup
- Manage a large scale deployment
- Configure load balancing for commonly used protocols
- Use case 1: SMPP load balancing
- Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
- Use case 3: Configure load balancing in direct server return mode
- Use case 4: Configure LINUX servers in DSR mode
- Use case 5: Configure DSR mode when using TOS
- Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
- Use case 7: Configure load balancing in DSR mode by using IP Over IP
- Use case 8: Configure load balancing in one-arm mode
- Use case 9: Configure load balancing in the inline mode
- Use case 10: Load balancing of intrusion detection system servers
- Use case 11: Isolating network traffic using listen policies
- Use case 12: Configure XenDesktop for load balancing
- Use case 13: Configure XenApp for load balancing
- Use case 14: ShareFile wizard for load balancing Citrix ShareFile
- Troubleshooting
- Load balancing FAQs
-
Networking
- IP Addressing
-
Interfaces
- Configuring MAC-Based Forwarding
- Configuring Network Interfaces
- Configuring Forwarding Session Rules
- Understanding VLANs
- Configuring a VLAN
- Configuring NSVLAN
- Configuring Allowed VLAN List
- Configuring Bridge Groups
- Configuring VMACs
- Configuring Link Aggregation
- Redundant Interface Set
- Binding an SNIP address to an Interface
- Monitoring the Bridge Table and Changing the Aging time
- Citrix ADC Appliances in Active-Active Mode Using VRRP
- Using the Network Visualizer
- Configuring Link Layer Discovery Protocol
- Jumbo Frames
- Citrix ADC Support for Microsoft Direct Access Deployment
- Access Control Lists
- IP Routing
- Internet Protocol version 6 (IPv6)
- Traffic Domains
- VXLAN
- Priority Load Balancing
-
Citrix ADC Extensions
- Citrix ADC extensions - language overview
- Citrix ADC extensions - library reference
- Citrix ADC extensions API reference
-
Protocol extensions
- Protocol extensions - architecture
- Protocol extensions - traffic pipeline for user defined TCP client and server behaviors
- Protocol extensions - use cases
- Tutorial – Add MQTT protocol to the Citrix ADC appliance by using protocol extensions
- Tutorial - Load balancing syslog messages by using protocol extensions
- Protocol extensions command reference
- Troubleshoot protocol extensions
- Policy extensions
-
Optimization
- Client Keep-Alive
- HTTP Compression
-
Integrated Caching
- Configure selectors and basic content groups
- Configure policies for caching and invalidation
- Cache support for database protocols
- Configure expressions for caching policies and selectors
- Display cached objects and cache statistics
- Improve cache performance
- Configure cookies, headers, and polling
- Configure integrated cache as a forward proxy
- Default Settings for the Integrated Cache
- Troubleshooting
- Front End Optimization
- Content Accelerator
- Media Classification
- Reputation
-
SSL offload and acceleration
- SSL offloading configuration
- TLSv1.3 protocol support as defined in RFC 8446
- How-to articles
- SSL certificates
- SSL profiles
- Certificate revocation lists
- Monitor certificate status with OCSP
- OCSP stapling
- Ciphers available on the Citrix ADC appliances
- Server certificate support matrix on the ADC appliance
- Client authentication
- Server authentication
- SSL actions and policies
- Selective SSL logging
- Support for DTLS protocol
- Support for Intel Coleto SSL chip based platforms
- MPX 9700/10500/12500/15500 FIPS appliances
- MPX 14000 FIPS appliances
-
SDX 14000 FIPS appliances
- Limitations
- Terminology
- Initialize the HSM
- Create partitions
- Provision a new instance or modify an existing instance and assign a partition
- Configure the HSM for an instance on an SDX 14030/14060/14080 FIPS appliance
- Create a FIPS key for an instance on an SDX 14030/14060/14080 FIPS appliance
- Upgrade the FIPS firmware on a VPX instance
- Support for Thales nShield® HSM
- Support for Gemalto SafeNet Network hardware security module
- Troubleshooting
- SSL FAQs
- Global site certificates
- Security
-
System
- Basic operations
- Authentication and authorization
- TCP Configurations
- HTTP Configurations
- SNMP
- Audit Logging
- Web Server Logging
- Call Home
- Reporting Tool
-
CloudBridge Connector
- Monitoring CloudBridge Connector Tunnels
- Configuring a CloudBridge Connector Tunnel between two Datacenters
- Configuring CloudBridge Connector between Datacenter and AWS Cloud
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Virtual Private Gateway on AWS
- Configuring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
- Configuring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Cisco IOS Device
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Fortinet FortiGate Appliance
- CloudBridge Connector Tunnel Diagnostics and Troubleshooting
- CloudBridge Connector Interoperability – StrongSwan
- CloudBridge Connector Interoperability – F5 BIG-IP
- CloudBridge Connector Interoperability – Cisco ASA
-
High Availability
- Points to Consider for a High Availability Setup
- Configuring High Availability
- Configuring the Communication Intervals
- Configuring Synchronization
- Synchronizing Configuration Files in a High Availability Setup
- Configuring Command Propagation
- Restricting High-Availability Synchronization Traffic to a VLAN
- Configuring Fail-Safe Mode
- Configuring Virtual MAC Addresses
- Configuring High Availability Nodes in Different Subnets
- Configuring Route Monitors
- Limiting Failovers Caused by Route Monitors in non-INC mode
- Configuring Failover Interface Set
- Understanding the Causes of Failover
- Forcing a Node to Fail Over
- Forcing the Secondary Node to Stay Secondary
- Forcing the Primary Node to Stay Primary
- Understanding the High Availability Health Check Computation
- High Availability FAQs
- Troubleshooting High Availability Issues
- Managing High Availability Heartbeat Messages on a Citrix ADC Appliance
- Remove and Replace a Citrix ADC in a High Availability Setup
- TCP Optimization
- Troubleshooting Citrix ADC
- Reference Material
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
This content has been machine translated dynamically.
This content has been machine translated dynamically.
This content has been machine translated dynamically.
Translation failed!
Configure admin partitions
Important
- Only superusers are authorized to create and configure admin partitions.
- Unless specified otherwise, configurations to set up an admin partition must be done from the default partition.
By partitioning a Citrix ADC appliance, you are in-effect creating multiple instances of a single Citrix ADC appliance. Each instance has its own configurations and the traffic of each of these partitions is isolated from the other by assigning each partition a dedicated VLAN or a shared VLAN.
A partitioned Citrix ADC has one default partition and the admin partitions that are created. To set up an admin partition, you must first create a partition with the relevant resources (memory, maximum bandwidth, and connections). Then, specify the users that can access the partition and the level of authorization for each of the users on the partition.
Accessing a partitioned Citrix ADC is the same as accessing a non-partitioned Citrix ADC: through the NSIP address or any other management IP address. As a user, after you provide your valid logon credentials, you are taken to the partition to which you are bound. Any configurations that you create are saved to that partition. If you are associated with more than one partition, you are taken to the first partition with which you were associated. If you want to configure entities on one of your other partitions, you must explicitly switch to that partition.
After accessing the appropriate partition, configurations that you perform are saved to that partition and are specific to that partition.
Note
- Citrix ADC superusers and other non-partition users are taken to the default partition.
- Users of all the 512 partitions can log in simultaneously.
Tip
To access a partitioned Citrix ADC appliance over HTTPS by using the SNIP (with management access enabled), make sure that each partition has the certificate of its partition administrator. Within the partition, the partition admin must do the following:
-
Add the certificate to the Citrix ADC.
add ssl certKey ns-server-certificate -cert ns-server.cert -key ns-server.key
-
Bind it to a service named
nskrpcs-<SNIP>-3009
, where<SNIP>
must be replaced with the SNIP address, in this case 100.10.10.1.bind ssl service nskrpcs-100.10.10.1-3009
certkeyName** ns-server-certificate
Partition resource limiting
In a partitioned Citrix ADC appliance, a network administrator can create a partition with partition resources such as memory, bandwidth, and connection limit configured as unlimited. This is done by specifying Zero as the partition resource value, where Zero indicates the resource is unlimited on the partition and it can be consumed up to system limits. Partition resource configuration is useful when you migrate a traffic domain deployment to an administrative partition or if you do not know about resource allocation limit for a partition in a given deployment.
Resource limit for an administrative partition is as follows:
-
Partition memory. This is the maximum allocated memory for a partition. You must make sure to specify the values when creating a partition.
Note
From NetScaler 12.0 onwards, when you create a partition, you must the set the memory limit as Zero or if a partition is already created with a specific memory limit, you can reduce the limit to any value or set the limit as Zero.
Parameter: maxMemLimit
Maximum memory is allocated in megabytes in a partition. A zero value indicates the memory is unlimited on the partition and it can consume up to the system limits.
Default value: 10
-
Partition bandwidth. Maximum allocated bandwidth for a partition. If you specify a limit, make sure it is within the appliance’s licensed throughput. Otherwise, you are not limiting the bandwidth that can be used by the partition. The specified limit is accountable for the bandwidth that the application requires. If the application bandwidth exceeds the specified limit, packets are dropped.
Note
From NetScaler 12.0 onwards, when you can create a partition, you can set the partition bandwidth limit to Zero or if a partition is already created with a specific bandwidth, you can reduce bandwidth or set the limit as Zero.
Parameter: maxBandwidth
Maximum bandwidth is allocated in Kbps in a partition. A zero value indicates the bandwidth is unrestricted. That is, the partition can consume up to the system limits.
Default value: 10240
Maximum Value: 4294967295
-
Partition connection. Maximum number of concurrent connections that can be open in a partition. The value must accommodate the maximum simultaneous flow expected within the partition. The partition connections are accounted from the partition quota memory. Previously, the connections were accounted from the default partition quota memory. It is configured only on the client-side, not on the back-end server-side TCP connections. New connections cannot be established beyond this configured value.
Note
From NetScaler 12.0 onwards, you can create a partition with number of open connections set to Zero or if you have already created a partition with a specific number of open connections, you can reduce the connection limit or set the limit as Zero.
Parameter: maxConnections
Maximum number of concurrent connections that can be open in the partition. A zero value indicates no limit on number of open connections.
Default value: 1024
Minimum value: 0
Maximum Value: 4294967295
Configure an admin partition
To configure an admin partition, complete the following tasks.
Access an admin partition
To access in an admin partition by using the command line interface
- Log on to the Citrix ADC appliance.
- Check if you are in the correct partition. The command prompt displays the name of the currently selected partition.
- If yes, skip to the next step.
-
If no, get a list of the partitions with which you are associated and switch over to the appropriate partition.
show system user <username>
switch ns partition <partitionName>
- Now, you can perform the required configurations just as a non-partitioned Citrix ADC.
To access an admin partition by using the configuration utility
-
Log on to the Citrix ADC appliance.
-
Check if you are in the correct partition. The top bar of the graphical user interface displays the name of the currently selected partition.
-
If yes, skip to the next step.
-
If no, navigate to Configuration > System > Administrative Partitions > Partitions, right-click the partition to which you want to switch, and select Switch.
-
-
Now, you can perform the required configurations just as a non-partitioned Citrix ADC.
Add an admin partition
The root administrator adds an administrative partition from the default partition and binds the partition with VLAN 2.
To create an administrative partition by using the command line interface**
At the command prompt, type:
add partition <partitionname>
Switch user access from default partition to an admin partition
Now switch user access from default partition to partition Par1.
To switch a user account from default partition to an admin partition by using the command line interface:
At the command prompt, type:
Switch ns partition <pname>
Adding SNIP address to a partition user account with management access enabled
In the partition, create SNIP address with management access enabled.
To add SNIP address to the partition user account with management access enabled by using the command line interface:
At the command prompt, type:
> add ns ip <ip address> <subnet mask> -mgmtAccess enabled
Create and Bind a partition user with partition command policy
In partition, create a partition system user and bind the user with partition-admin command policies.
To create and bind a partition system user with partition command policy by using the command line interface:
At the command prompt, type:
> add system user <username> <password>
Done
Creating and binding partition user group with partition command policy
In Partition Par1, create a partition system user group and bind the group with partition command policy such as partition admin, partition read-only, partition-operator, or partition-network.
To create and bind a partition user group with partition command policy by using the command line interface:
> add system group <groupName>
> bind system group <groupname> (-userName | -policyName <cmdpolicy> <priority> | -partitionName)
Configuring external server authentication for external users
In partition Par1 you can configure an external server authentication to authenticate external TACACS users accessing the partition through SNIP address.
To configure external server authentication for external users by using the command line interface:
At the command prompt, type:
add authentication tacacsaction <name> -serverip <IP> -tacacsSecret <secret key> -authorization ON -accounting ON
add authentication policy <policname> -rule true -action <name>
bind system global <policyname> -priority <value>1
Configure a Partition System User Accounts in a Partition by using the GUI
To configure a partition user account in an administrative partition, you must create a partition user or a partition user group and bind it partition command policies. Also, you can configure the external server authentication for an external user.
To create a partition user account in a partition by using the GUI
Navigate to System > User Administration, click Users to add a partition system user and bind the user to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).
To create a partition user group account in a partition by using the GUI
Navigate to System > User Administration, click Groups to add a partition system user group and bind the user group to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).
To configure External server authentication for external users by using the GUI
Navigate to System > Authentication > Basic Actions and click TACACS to configure TACACS server for authenticating external users accessing the partition.
Sample Configuration
The following configuration shows how to create a partition user or a partition user group and bind it partition command policies. Also, how to configure the external server authentication for authenticating an external user.
> add partition Par1
> switch ns partition Par1
> add ns ip 10.102.29.203 255.255.255.0 -mgmtAccessenabled
> add system user John Password
> bind system user Jane partition-read-only -priority 1
> add system group Retail
> bind system group Retail -policyname partition-network 1 (where 1 is the priority number)
> bind system group Retail –username Jane
> add authentication tacacssaction tacuser –serverip 10.102.29.200 –tacacsSecret Password –authorization ON –accounting ON
> add authentication policy polname –rule true –action tacacsAction
> bind system global polname –priority 1
Command Policies for a Partition Users and Partition User Groups in Administrative Partition
Commands to authorize an user account inside administrative partition | Command policies available inside an administrative partition (built-in policies) | User account access type |
---|---|---|
add system user | Partition-admin | SNIP (with management access enabled) |
add system group | Partition-network | SNIP (with management access enabled) |
add authentication <action, policy> , bind system global <policy name>
|
Partition-read-only | SNIP (with management access enabled) |
remove system user | Partition-admin | SNIP(with management access enabled) |
remove system group | Partition-admin | SNIP (with management access enabled) |
bind system cmdpolicy to system user; bind system cmdpolicy to system group | Partition-admin | SNIP (with management access enabled) |
Configure an LACP ethernet channel on the default admin partition
With Link Aggregation Control Protocol (LACP), you can combine multiple ports into a single, high-speed link (also called a channel). An LACP-enabled appliance exchanges LACP Data Units (LACPDU) over the channel.
There are three LACP configuration modes that you can enable in the default partition of a Citrix ADC appliance:
- Active. A port in active mode sends LACPDUs. Link aggregation is formed if the other end of the Ethernet link is in the LACP active or passive mode.
- Passive. A port in passive mode sends LACPDUs only when it receives LACPDUs. The link aggregation is formed if the other end of the Ethernet link is in the LACP active mode.
- Disable. Link aggregation is not formed.
Note
By default, the link aggregation is disabled in the default partition of the appliance.
LACP exchanges LACPDU between devices connected by an Ethernet link. These devices are typically referred as an actor or partner.
A LACPDU data unit contains the following parameters:
- LACP Mode. Active, passive or disable.
- LACP timeout. The waiting period before timing out the partner or actor. Possible values: Long and Short. Default: Long.
- Port Key. To distinguish between the different channel. When key is 1, LA/1 is created. When key is 2, LA/2 is created. Possible values: Integer from 1 through 8. 4 through 8 is for cluster CLAG.
- Port Priority. Minimum value: 1. Maximum value: 65535. Default: 32768.
- System Priority. Uses this priority along with system MAC to form the system ID to uniquely identify the system during LACP negotiation with the partner. Sets system priority from 1 and 65535. The default value is set to 32768.
- Interface. Supports 8 interfaces per channel on NetScaler 10.1 appliance and supports 16 interfaces per channel on NetScaler 10.5 and 11.0 appliances.
After exchanging LACPDUs, the actor and partner negotiate the settings and decide whether to add the ports to the aggregation.
Configure and verify LACP
To configure and verify LACP on a Citrix ADC appliance by using the command line
-
Enable LACP on each interface.
At the command prompt, type:
set interface <Interface_ID> -lacpMode PASSIVE -lacpKey 1
When you enable LACP on an interface, the channels are dynamically created. Additionally, when you enable LACP on an interface and set lacpKey to 1, the interface is automatically bound to channel LA/1.
Note
When you bind an interface to a channel, the channel parameters take precedence over the interface parameters, so the interface parameters are ignored. If a channel was created dynamically by LACP, you cannot perform add, bind, unbind, or remove operations on the channel. A channel dynamically created by LACP is automatically deleted when you disable LACP on all interfaces of the channel.
-
Set the system priority.
At the command prompt, type:
set lacp -sysPriority <Positive_Integer>
-
Verify that LACP is working as expected.
show interface <Interface_ID>
show channel
show LACP
Note
In some versions of Cisco IOS, running the switchport trunk native vlan
command causes the Cisco switch to tag LACP PDUs. This causes the LACP channel between the Cisco switch and the Citrix ADC appliance to fail. However, this issue does not affect the static link aggregation channels configured in the above procedure.