- Citrix ADC Release Notes
-
Getting Started with Citrix ADC
- Where Does a Citrix ADC Appliance Fit in the Network?
- How a Citrix ADC Communicates with Clients and Servers
- Introduction to the Citrix ADC Product Line
- Install the hardware
- Access a Citrix ADC
- Configure the ADC for the first time
- Configure high availability
- Configuring a FIPS Appliance for the First Time
- Understanding Common Network Topologies
- System management settings
- Load balance traffic on a Citrix ADC appliance
- Accelerate load balanced traffic by using compression
- Secure load balanced traffic by using SSL
- Features at a Glance
- FAQ
-
Solutions for Telecom Service Providers
-
Large Scale NAT
- Points to Consider before Configuring LSN
- Configuration Steps for LSN
- Sample LSN Configurations
- Configuring Static LSN Maps
- Configuring Application Layer Gateways
- Logging and Monitoring LSN
- STUN Timeout
- TCP SYN Idle Timeout
- Overriding LSN configuration with Load Balancing Configuration
- Clearing LSN Sessions
- Load Balancing SYSLOG Servers
- Port Control Protocol
- LSN44 in a cluster setup
- Dual-Stack Lite
-
Large Scale NAT64
- Points to Consider for Configuring Large Scale NAT64
- Configuring DNS64
- Configuring Large Scaler NAT64
- Configuring Application Layer Gateways for Large Scale NAT64
- Configuring Static Large Scale NAT64 Maps
- Logging and Monitoring Large Scale NAT64
- Port Control Protocol for Large Scale NAT64
- LSN64 in a cluster setup
- Mapping Address and Port using Translation
- Telco subscriber management
- Load Balance Control-Plane Traffic that is based on Diameter, SIP, and SMPP Protocols
- Provide DNS Infrastructure/Traffic Services, such as, Load Balancing, Caching, and Logging for Telecom Service Providers
- Provide Subscriber Load Distribution Using GSLB Across Core-Networks of a Telecom Service Provider
- Bandwidth Utilization Using Cache Redirection Functionality
- Citrix ADC TCP Optimization
- Citrix ADC Video Optimization
- Citrix ADC URL Filtering
-
Large Scale NAT
- Citrix ADC Solutions
-
Deploy a Citrix ADC VPX instance
- Support matrix and usage guidelines
- Install a Citrix ADC VPX instance on XenServer
-
Install a Citrix ADC VPX instance on VMware ESX
- Configuring Citrix ADC Virtual Appliances to use VMXNET3 Network Interface
- Configuring Citrix ADC Virtual Appliances to use Single Root I/O Virtualization (SR-IOV) Network Interface
- Migrating the Citrix ADC VPX from E1000 to SR-IOV or VMXNET3 Network Interfaces
- Configuring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
- Install a Citrix ADC VPX instance on Microsoft Hyper-V servers
-
Install a Citrix ADC VPX instance on Linux-KVM platform
- Prerequisites for Installing Citrix ADC VPX Virtual Appliances on Linux-KVM Platform
- Provisioning the Citrix ADC Virtual Appliance by using OpenStack
- Provisioning the Citrix ADC Virtual Appliance by using the Virtual Machine Manager
- Configuring Citrix ADC Virtual Appliances to Use SR-IOV Network Interface
- Configuring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
- Provisioning the Citrix ADC Virtual Appliance by using the virsh Program
- Managing the Citrix ADC Guest VMs
- Provisioning the Citrix ADC Virtual Appliance with SR-IOV, on OpenStack
- Configuring a Citrix ADC VPX Instance on KVM to Use OVS DPDK-Based Host Interfaces
-
Deploy a Citrix ADC VPX instance on AWS
- Limitations and usage guidelines
- Prerequisites
- Deploy a Citrix ADC VPX standalone instance on AWS
- Scenario: standalone instance
- Download a Citrix ADC VPX license
- Load balancing servers in different availability zones
- Deploy a high availability pair on AWS
- High availability across AWS availability zones
- Add back-end AWS auto scaling service
- Configure a Citrix ADC VPX instance to use SR-IOV network interface
- Upgrade a Citrix ADC VPX instance on AWS
- Troubleshoot a VPX instance on AWS
-
Deploy a Citrix ADC VPX instance on Microsoft Azure
- Configure a Citrix ADC standalone instance
- Configure multiple IP addresses for a Citrix ADC VPX standalone instance
- Configure a high-availability setup with multiple IP addresses and NICs
- Configure a high-availability setup with multiple IP addresses and NICs by using PowerShell commands
- Configure a high-availability setup with a single IP address and a single NIC
- Add Azure autoscale settings
- Configure GSLB on Citrix ADC VPX instances
- Configure GSLB on an ctive-standby high availability setup
- Configure address pools (IIP) for a Citrix Gateway appliance
- Configure multiple IP addresses for a Citrix ADC VPX instance in standalone mode by using PowerShell commands
- Configure multiple Azure VIPs for a standalone or high availability Citrix ADC instance
- Additional PowerShell scripts for Azure deployment
- Azure terminology
- Deploy a Citrix ADC VPX instance on Google Cloud Platform
- Jumbo frames on Citrix ADC VPX instances
- Licensing
- Upgrade and downgrade a Citrix ADC appliance
-
Authentication, authorization, and auditing application traffic
- How Authentication, authorization, and auditing works
- Enabling AAA
- Setting up an authentication virtual server
- Creating an authentication profile
- Configuring users and groups
- Configuring authentication, authorization, and auditing policies
- Self-service password reset
- Authorizing user access to application resources
- Auditing authenticated sessions
- Session settings
- Traffic settings
- Authenticating with client certificates
- Configuring Authentication, authorization, and auditing with commonly used protocols
- Citrix ADC Kerberos single sign-on
- SAML authentication
- OAuth authentication
- Multi-Factor (nFactor) authentication
- Configuring the OpenID Connect Protocol
- Admin Partitioning
-
AppExpert
- Action Analytics
-
AppExpert Applications and Templates
- How AppExpert application works
- Get started with AppExpert
- Customize AppExpert Configuration
- Configure user authentication
- Monitor Citrix ADC statistics
- Delete an AppExpert application
- Configure application authentication, authorization, and auditing
- Set up a custom Citrix ADC application
- Creating and Managing Template Files
- Citrix Gateway Applications
- AppQoE
- Entity Templates
-
HTTP Callouts
- How an HTTP Callout Works
- Notes on the Format of HTTP Requests and Responses
- Configuring an HTTP Callout
- Verifying the Configuration
- Invoking an HTTP Callout
- Avoiding HTTP Callout Recursion
- Caching HTTP Callout Responses
- Use Case: Filtering Clients by Using an IP Blacklist
- Use Case: ESI Support for Fetching and Updating Content Dynamically
- Use Case: Access Control and Authentication
- Use Case: OWA-Based Spam Filtering
- Use Case: Dynamic Content Switching
- Pattern Sets and Data Sets
- Variables
-
Policies and Expressions
- Introduction to Policies and Expressions
- Configuring Advanced Policy Infrastructure
- Configuring Advanced Policy Expression: Getting Started
- Advanced Policy Expressions: Evaluating Text
- Advanced Policy Expressions: Working with Dates, Times, and Numbers
- Advanced Policy Expressions: Parsing HTTP, TCP, and UDP Data
- Advanced Policy Expressions: Parsing SSL Certificates
- Advanced Policy Expressions: IP and MAC Addresses, Throughput, VLAN IDs
- Advanced Policy Expressions: Stream Analytics Functions
- Advanced Policy Expressions: DataStream
- Typecasting Data
- Regular Expressions
- Configuring Classic Policies and Expressions
- Expressions Reference-Advanced Policy Expressions
- Expressions Reference-Classic Expressions
- Summary Examples of Default Syntax Expressions and Policies
- Tutorial Examples of Default Syntax Policies for Rewrite
- Tutorial Examples of Classic Policies
- Migration of Apache mod_rewrite Rules to the Default Syntax
-
Rate Limiting
- Configuring a Stream Selector
- Configuring a Traffic Rate Limit Identifier
- Configuring and Binding a Traffic Rate Policy
- Viewing the Traffic Rate
- Testing a Rate-Based Policy
- Examples of Rate-Based Policies
- Sample Use Cases for Rate-Based Policies
- Rate Limiting for Traffic Domains
- Configure rate limit at packet level
-
Responder
- Enabling the Responder Feature
- Configuring a Responder Action
- Configuring a Responder Policy
- Binding a Responder Policy
- Setting the Default Action for a Responder Policy
- Responder Action and Policy Examples
- Diameter Support for Responder
- RADIUS Support for Responder
- DNS Support for the Responder Feature
- How to Redirect HTTP Requests
- Troubleshooting
-
Rewrite
- How Rewrite Works
- Enabling the Rewrite Feature
- Configuring a Rewrite Action
- Configuring a Rewrite Policy
- Binding a Rewrite Policy
- Configuring Rewrite Policy Labels
- Configuring the Default Rewrite Action
- Bypassing the Safety Check
- Rewrite Action and Policy Examples
- URL Transformation
- RADIUS Support for the Rewrite Feature
- Diameter Support for Rewrite
- DNS Support for the Rewrite Feature
- String Maps
- URL Sets
- AppFlow
-
Application Firewall
- FAQs and Deployment Guide
- Introduction
- Configuring the Application Firewall
-
Signatures
- Manually Configuring the Signatures Feature
- Adding or Removing a Signatures Object
- Configuring or Modifying a Signatures Object
- Protecting JSON Applications using Signatures
- Updating a Signatures Object
- Exporting a Signatures Object to a File
- The Signatures Editor
- Signature Updates in High-Availability Deployment and Build Upgrades
- Overview of Security checks
- Top-Level Protections
- Data Leak Prevention Checks
- Advanced Form Protection Checks
- URL Protection Checks
- XML Protection Checks
- Managing Content Types
- Profiles
- Policy Labels
- Policies
- Imports
- Global Configuration
- Statistics and Reports
- Application Firewall Logs
- Appendices
- Debugging and Troubleshooting
- Signatures Alert Articles
- Cache Redirection
-
Clustering
- Citrix ADC configuration support in a cluster
- Prerequisites for cluster nodes
- Cluster overview
- Setting up a Citrix ADC cluster
- Distributing traffic across cluster nodes
-
Managing the Citrix ADC cluster
- Configuring linksets
- Nodegroups for spotted and partially-striped configurations
- Configuring redundancy for nodegroups
- Disabling steering on the cluster backplane
- Synchronizing cluster configurations
- Synchronizing time across cluster nodes
- Synchronizing cluster files
- Viewing the statistics of a cluster
- Discovering Citrix ADC appliances
- Disabling a cluster node
- Removing a cluster node
- Removing a node from a cluster deployed using cluster link aggregation
- Detecting jumbo probe on a cluster
- Route monitoring for dynamic routes in cluster
- Monitoring cluster setup using SNMP MIB with SNMP link
- Monitoring command propagation failures in a cluster deployment
- Graceful shutdown of nodes
- Graceful shutdown of services
- IPv6 ready logo support for clusters
- Managing cluster heartbeat messages
- Configuring owner node response status
- Monitor Static Route (MSR) support for inactive nodes in a spotted cluster configuration
- VRRP interface binding in a single node active cluster
-
Cluster setup and usage scenarios
- Creating a two-node cluster
- Migrating an HA setup to a cluster setup
- Transitioning between a L2 and L3 cluster
- Setting up GSLB in a cluster
- Using cache redirection in a cluster
- Using L2 mode in a cluster setup
- Using cluster LA channel with linksets
- Backplane on LA channel
- Common interfaces for client and server and dedicated interfaces for backplane
- Common switch for client, server, and backplane
- Common switch for client and server and dedicated switch for backplane
- Different switch for every node
- Sample cluster configurations
- Using VRRP in a cluster setup
- Backup and restore of cluster setup
- Upgrading or downgrading the Citrix ADC cluster
- Operations supported on individual cluster nodes
- Support for heterogeneous cluster
- FAQs
- Troubleshooting the Citrix ADC cluster
- Content Switching
-
DataStream
- Configuring Database Users
- Configuring a Database Profile
- Configuring Load Balancing for DataStream
- Configuring Content Switching for DataStream
- Configuring Monitors for DataStream
- Use Case 1: Configuring DataStream for a Master/Slave Database Architecture
- Use Case 2: Configuring the Token Method of Load Balancing for DataStream
- Use Case 3: Logging MSSQL Transactions in Transparent Mode
- Use Case 4: Database Specific Load Balancing
- DataStream Reference
-
Domain Name System
-
Configure DNS resource records
- Create SRV records for a service
- Create AAAA Records for a domain name
- Create address records for a domain name
- Create MX records for a mail exchange server
- Create NS records for an authoritative server
- Create CNAME records for a subdomain
- Create NAPTR records for telecommunications domain
- Create PTR records for IPv4 and IPv6 addresses
- Create SOA records for authoritative information
- Create TXT records for holding descriptive text
- View DNS statistics
- Configure a DNS zone
- Configure the Citrix ADC as an ADNS server
- Configure the Citrix ADC as a DNS proxy server
- Configure the Citrix ADC as an end resolver
- Configure the Citrix ADC as a forwarder
- Configure Citrix ADC as a non-validating security aware stub-resolver
- Jumbo frames support for DNS to handle responses of large sizes
- Configure DNS logging
- Configure DNS suffixes
- DNS ANY query
- Configure negative caching of DNS records
- Caching of EDNS0 client subnet data when the Citrix ADC appliance is in proxy mode
- Domain name system security extensions
- Support wildcard DNS domains
- Mitigate DNS DDoS attacks
-
Configure DNS resource records
- Firewall Load Balancing
-
Global Server Load Balancing
- GSLB deployment types
- GSLB configuration entities
- GSLB methods
- Configure static proximity
- Configure site-to-site communication
- Configure metrics exchange protocol
- Configure GSLB by using a wizard
- Configure GSLB entities individually
- Synchronize the configuration in a GSLB setup
- GSLB dashboard
- Monitor GSLB services
- Use case: Deployment of domain name based autoscale service group
- Use case: Deployment of IP address based autoscale service group
-
How-to articles
- Customize your GSLB configuration
- Configure persistent connections
- Manage client connections
- Configure GSLB for proximity
- Protect the GSLB setup against failure
- Configure GSLB for disaster recovery
- Override static proximity behavior by configuring preferred locations
- Configure GSLB service selection using content switching
- Configure GSLB for DNS queries with NAPTR records
- Use the EDNS0 client subnet option for GSLB
- Example of a complete parent-child configuration using the metrics exchange protocol
- Link Load Balancing
-
Load Balancing
- How load balancing works
- Set up basic load balancing
- Load balance virtual server and service states
- Support for load balancing profile
- Load balancing algorithms
-
Persistence and persistent connections
- About Persistence
- Source IP address persistence
- HTTP cookie persistence
- SSL session ID persistence
- Diameter AVP number persistence
- Custom server ID persistence
- IP address persistence
- SIP Call ID persistence
- RTSP session ID persistence
- Configure URL passive persistence
- Configure persistence based on user-defined rules
- Configure persistence types that do not require a rule
- Configure backup persistence
- Configure persistence groups
- Share persistent sessions between virtual servers
- Configure RADIUS load balancing with persistence
- View persistence sessions
- Clear persistence sessions
- Override persistence settings for overloaded services
- Troubleshooting
- Customize a load balancing configuration
- Configure diameter load balancing
- Configure FIX load balancing
- Protect a load balancing configuration against failure
- Manage a load balancing setup
-
Manage client traffic
- Configure sessionless load balancing virtual servers
- Redirect HTTP requests to a cache
- Direct requests according to priority
- Direct requests to a custom web page
- Enable cleanup of virtual server connections
- Rewrite ports and protocols for HTTP redirection
- Insert IP address and port of a virtual server in the request header
- Use a specified source IP for backend communication
- Set a time-out value for idle client connections
- Manage RTSP connections
- Manage client traffic on the basis of traffic rate
- Identify a connection with layer 2 parameters
- Configure the prefer direct route option
- Use a source port from a specified port range for backend communication
- Configure source IP persistency for backend communication
- Use IPv6 link local addresses on server side of a load balancing setup
-
Advanced load balancing settings
- Gradually stepping up the load on a new service with virtual server–level slow start
- The no-monitor option for services
- Protect applications on protected servers against traffic surges
- Enable cleanup of virtual server and service connections
- Graceful shutdown of services
- Enable or disable persistence session on TROFS services
- Direct requests to a custom web page
- Enable access to services when down
- Enable TCP buffering of responses
- Enable compression
- Maintain client connection for multiple client requests
- Insert the IP address of the client in the request header
- Retrieve location details from user IP address using geolocation database
- Use source IP address of the client when connecting to the server
- Use client source IP address for backend communication in a v4-v6 load balancing configuration
- Configure the source port for server-side connections
- Set a limit on the number of client connections
- Set a limit on number of requests per connection to the server
- Set a threshold value for the monitors bound to a service
- Set a timeout value for idle client connections
- Set a timeout value for idle server connections
- Set a limit on the bandwidth usage by clients
- Redirect client requests to a cache
- Retain the VLAN identifier for VLAN transparency
- Configure automatic state transition based on percentage health of bound services
-
Built-in monitors
- TCP-based application monitoring
- SSL service monitoring
- FTP service monitoring
- Secure monitoring of servers by using SFTP
- Set SSL parameters on a secure monitor
- SIP service monitoring
- RADIUS service monitoring
- Monitor accounting information delivery from a RADIUS server
- DNS and DNS-TCP service monitoring
- LDAP service monitoring
- MySQL service monitoring
- SNMP service monitoring
- NNTP service monitoring
- POP3 service monitoring
- SMTP service monitoring
- RTSP service monitoring
- XML broker service monitoring
- ARP request monitoring
- XenDesktop Delivery Controller service monitoring
- Web interface service monitoring
- Citrix StoreFront stores monitoring
- Custom monitors
- Configure monitors in a load balancing setup
- Manage a large scale deployment
- Configure load balancing for commonly used protocols
- Use case 1: SMPP load balancing
- Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
- Use case 3: Configure load balancing in direct server return mode
- Use case 4: Configure LINUX servers in DSR mode
- Use case 5: Configure DSR mode when using TOS
- Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
- Use case 7: Configure load balancing in DSR mode by using IP Over IP
- Use case 8: Configure load balancing in one-arm mode
- Use case 9: Configure load balancing in the inline mode
- Use case 10: Load balancing of intrusion detection system servers
- Use case 11: Isolating network traffic using listen policies
- Use case 12: Configure XenDesktop for load balancing
- Use case 13: Configure XenApp for load balancing
- Use case 14: ShareFile wizard for load balancing Citrix ShareFile
- Troubleshooting
- Load balancing FAQs
-
Networking
- IP Addressing
-
Interfaces
- Configuring MAC-Based Forwarding
- Configuring Network Interfaces
- Configuring Forwarding Session Rules
- Understanding VLANs
- Configuring a VLAN
- Configuring NSVLAN
- Configuring Allowed VLAN List
- Configuring Bridge Groups
- Configuring VMACs
- Configuring Link Aggregation
- Redundant Interface Set
- Binding an SNIP address to an Interface
- Monitoring the Bridge Table and Changing the Aging time
- Citrix ADC Appliances in Active-Active Mode Using VRRP
- Using the Network Visualizer
- Configuring Link Layer Discovery Protocol
- Jumbo Frames
- Citrix ADC Support for Microsoft Direct Access Deployment
- Access Control Lists
- IP Routing
- Internet Protocol version 6 (IPv6)
- Traffic Domains
- VXLAN
- Priority Load Balancing
-
Citrix ADC Extensions
- Citrix ADC extensions - language overview
- Citrix ADC extensions - library reference
- Citrix ADC extensions API reference
-
Protocol extensions
- Protocol extensions - architecture
- Protocol extensions - traffic pipeline for user defined TCP client and server behaviors
- Protocol extensions - use cases
- Tutorial – Add MQTT protocol to the Citrix ADC appliance by using protocol extensions
- Tutorial - Load balancing syslog messages by using protocol extensions
- Protocol extensions command reference
- Troubleshoot protocol extensions
- Policy extensions
-
Optimization
- Client Keep-Alive
- HTTP Compression
-
Integrated Caching
- Configure selectors and basic content groups
- Configure policies for caching and invalidation
- Cache support for database protocols
- Configure expressions for caching policies and selectors
- Display cached objects and cache statistics
- Improve cache performance
- Configure cookies, headers, and polling
- Configure integrated cache as a forward proxy
- Default Settings for the Integrated Cache
- Troubleshooting
- Front End Optimization
- Content Accelerator
- Media Classification
- Reputation
-
SSL offload and acceleration
- SSL offloading configuration
- TLSv1.3 protocol support as defined in RFC 8446
- How-to articles
- SSL certificates
- SSL profiles
- Certificate revocation lists
- Monitor certificate status with OCSP
- OCSP stapling
- Ciphers available on the Citrix ADC appliances
- Server certificate support matrix on the ADC appliance
- Client authentication
- Server authentication
- SSL actions and policies
- Selective SSL logging
- Support for DTLS protocol
- Support for Intel Coleto SSL chip based platforms
- MPX 9700/10500/12500/15500 FIPS appliances
- MPX 14000 FIPS appliances
-
SDX 14000 FIPS appliances
- Limitations
- Terminology
- Initialize the HSM
- Create partitions
- Provision a new instance or modify an existing instance and assign a partition
- Configure the HSM for an instance on an SDX 14030/14060/14080 FIPS appliance
- Create a FIPS key for an instance on an SDX 14030/14060/14080 FIPS appliance
- Upgrade the FIPS firmware on a VPX instance
- Support for Thales nShield® HSM
- Support for Gemalto SafeNet Network hardware security module
- Troubleshooting
- SSL FAQs
- Global site certificates
- Security
-
System
- Basic operations
- Authentication and authorization
- TCP Configurations
- HTTP Configurations
- SNMP
- Audit Logging
- Web Server Logging
- Call Home
- Reporting Tool
-
CloudBridge Connector
- Monitoring CloudBridge Connector Tunnels
- Configuring a CloudBridge Connector Tunnel between two Datacenters
- Configuring CloudBridge Connector between Datacenter and AWS Cloud
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Virtual Private Gateway on AWS
- Configuring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
- Configuring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Cisco IOS Device
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Fortinet FortiGate Appliance
- CloudBridge Connector Tunnel Diagnostics and Troubleshooting
- CloudBridge Connector Interoperability – StrongSwan
- CloudBridge Connector Interoperability – F5 BIG-IP
- CloudBridge Connector Interoperability – Cisco ASA
-
High Availability
- Points to Consider for a High Availability Setup
- Configuring High Availability
- Configuring the Communication Intervals
- Configuring Synchronization
- Synchronizing Configuration Files in a High Availability Setup
- Configuring Command Propagation
- Restricting High-Availability Synchronization Traffic to a VLAN
- Configuring Fail-Safe Mode
- Configuring Virtual MAC Addresses
- Configuring High Availability Nodes in Different Subnets
- Configuring Route Monitors
- Limiting Failovers Caused by Route Monitors in non-INC mode
- Configuring Failover Interface Set
- Understanding the Causes of Failover
- Forcing a Node to Fail Over
- Forcing the Secondary Node to Stay Secondary
- Forcing the Primary Node to Stay Primary
- Understanding the High Availability Health Check Computation
- High Availability FAQs
- Troubleshooting High Availability Issues
- Managing High Availability Heartbeat Messages on a Citrix ADC Appliance
- Remove and Replace a Citrix ADC in a High Availability Setup
- TCP Optimization
- Troubleshooting Citrix ADC
- Reference Material
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
This content has been machine translated dynamically.
This content has been machine translated dynamically.
This content has been machine translated dynamically.
Translation failed!
Configure cookies, headers, and polling
This topic describes the procedures to configure how the cache manages cookies, HTTP headers, and origin server polling, including modifying default behavior that causes the cache to diverge from documented standards, overriding HTTP headers that might cause cacheable content to not be stored in the cache, and configuring the cache to always poll the origin for updated content under specialized circumstances.
Divergence of cache behavior from the standards
By default, the integrated cache conforms to the following standards:
- RFC 2616, “Hypertext Transfer Protocol HTTP/1.1”
- The caching behaviors described in RFC 2617, “HTTP Authentication: Basic and Digest Access Authentication”
- The caching behavior described in RFC 2965, “HTTP State Management Mechanism”
The built-in policies and the Default content group attributes ensure conformance with most of these standards.
The default integrated cache behavior diverges from the specifications as follows:
- There is limited support for the Vary header. By default, any response containing a Vary header is considered to be non-cacheable unless it is compressed. A compressed response contains Content-Encoding: gzip, Content-Encoding: deflate, or Content-Encoding: pack200-gzip and is cacheable even if it contains the Vary: Accept-Encoding header.
- The integrated cache ignores the values of the headers Cache-Control: no-cache and Cache-Control: private. For example, a response that contains Cache-Control: no-cache=”Set-Cookie” is treated as if the response contained Cache-Control: no-cache. By default, the response is not cached.
- An image (Content-Type = image/*) is always considered cacheable even if an image response contains Set-Cookie or Set-Cookie2 headers, or if an image request contains a Cookie header. The integrated cache removes Set-Cookie and Set-Cookie2 headers from a response before caching it. This diverges from RFC 2965. You can configure RFC-compliant behavior as follows:
add cache policy rfc_compliant_images_policy -rule "http.res.header.set-cookie2.exists || http.res.header.set-cookie.exists" -action NOCACHE
bind cache global rfc_compliant_images_policy -priority 100 -type REQ\_OVERRIDE
- The following Cache-Control headers in a request force an RFC-compliant cache to reload a cached response from the origin server:
Cache-control: max-age=0
Cache-control: no-cache
To guard against Denial of Service attacks, this behavior is not the default. For more information, see “Inserting a Cache-Control Header” section.
- By default, the caching module considers a response to be cacheable unless a response header states otherwise. To make this behavior RFC 2616 compliant, set -weakPosRelExpiry and -weakNegResExpiry to 0 for all content groups.
Remove cookies from a response
Cookies are often personalized for a user, and typically should not be cached. The Remove Response Cookies parameter removes Set-Cookie and Set-Cookie2 headers before caching a response. By default, the Remove Response Cookies option for a content group prevents caching of responses with Set-Cookie or Set-Cookie2 headers.
Note: When images are cached, the built-in behavior is to remove the Set-Cookie and Set-Cookie2 headers before caching, no matter how the content group is configured. Note: Citrix recommends that you accept the default Remove Response Cookies for every content group that stores embedded responses, for example, images.
To configure Remove Response Cookies for a content group by using the command line interface:
At the command prompt, type:
set cache contentgroup <name> -removeCookies YES
To configure Remove Response Cookies for a content group by using the configuration utility
- Navigate to Optimization > Integrated Caching > Content Groups, and select the content group.
- On Others tab, in the Settings group, select Remove response cookies option.
Inserting HTTP headers at response time
The integrated cache can insert HTTP headers in responses that result from cache hits. The Citrix® Citrix ADC® appliance does not alter headers in responses that result from cache misses.
The following table describes headers that you can insert in a response. |Header|Specification| |— |— | |Age|Provides the age of the response in seconds, calculated from the time the response was generated at the origin server. By default, the cache inserts an Age header for every response that is served from the cache.| |via|Lists protocols and recipients between the start and end points for a request or a response. The Citrix ADC appliance inserts a Via header in every response that it serves from the cache. The default value of the inserted header is “NS-CACHE-9.2:last octet of the Citrix ADC IP address.” For more information, see “Configuring Global Attributes for Caching.”| |ETag|The cache supports response validation using Last-Modified and ETag headers to determine if a response is stale. The cache inserts an ETag in a response only if it caches the response and the origin server has not inserted its own ETag header. The ETag value is an arbitrary unique number. The ETag value for a response changes if it is refreshed from the origin server, but it stays the same if the server sends a 304 (object not updated) response.Origin servers typically do not generate validators for dynamic content because dynamic content is considered non-cacheable. You can override this behavior. With ETag header insertion, the cache is permitted to not serve full responses. Instead, the user agent is required to cache the dynamic response sent by the integrated cache the first time. To force a user agent to cache a response, you configure the integrated cache to insert an ETag header and replace the origin-provided Cache-Control header.| |Cache-Control|The Citrix ADC appliance typically does not modify cacheability headers in responses that is serves from the origin server. If the origin server sends a response that is labeled as non-cacheable, the client treats the response as non-cacheable even if the Citrix ADC appliance caches the response. To cache dynamic responses in a user agent, you can replace Cache-Control headers from the origin server. This applies only to user agents and other intervening caches. They do not affect the integrated cache. For more information, see “Inserting a Cache-Control Header” section.|
Insert an age, via, or ETag header
The following procedures describe how to insert Age, Via, and ETag headers.
To insert an Age, Via, or Etag header by using the command line interface:
At the command prompt, type:
set cache contentgroup <name> -insertVia YES -insertAge YES -insertETag YES
To insert an Age, Via, or Etag header by using the GUI
- Navigate to Optimization > Integrated Caching > Content Groups, and select the content group.
- On Others tab, in the HTTP Header Insertions group, select the Via, Age, or ETag options, as appropriate.
- The values for the other header types are calculated automatically. Note that you configure the Via value in the main settings for the cache.
Insert a cache-control header
When the integrated cache replaces a Cache-Control header that the origin server inserted, it also replaces the Expires header. The new Expires header contains an expiration time in the past. This ensures that HTTP/1.0 clients and caches (that do not understand the Cache-Control header) do not cache the content.
To insert a cache-control header by using the command line interface
At the command prompt, type:
set cache contentgroup <name> -cacheControl <value>
To insert a cache-control header by using the configuration utility
- Navigate to Optimization > Integrated Caching > Content Groups, and
- Click Expiry Method tab, clear the heuristic and default expiry settings and set the relevant value in Expire content after text box.
- Click Others tab and type the header you want to insert in the Cache-Control text box. Alternatively, click Configure to set the Cache-Control directives in cached responses.
Ignoring cache-control and pragma headers in requests
By default, the caching module processes Cache-Control and Pragma headers. The following tokens in Cache-Control headers are processed as described in RFC 2616.
- max-age
- max-stale
- only-if-cached
- no-cache
A Pragma: no-cache header in a request is treated in the same way as a Cache-Control: no-cache header.
If you configure the caching module to ignore Cache-Control and Pragma headers, a request that contains a Cache-Control: No-Cache header causes the Citrix ADC appliance to retrieve the response from the origin server, but the cached response is not updated. If the caching module processes Cache-Control and Pragma headers, the cached response is refreshed.
The following table summarizes the implications of various settings for these headers and the Ignore Browser’s Reload Request setting.
Setting for Ignore Cache-Control and Pragma Headers | Setting for Ignore Browser’s Reload Request | Outcome |
---|---|---|
Yes | Yes or No | Ignore the Cache-Control and Pragma headers from the client, including the Cache-Control: no-cache directive. |
No | Yes | The Cache-Control: no-cache header produces a cache miss, but a response that is already in the cache is not refreshed. |
No | No | A request that contains a Cache-Control: no-cache header causes a cache miss and the stored response is refreshed. |
To ignore Cache-Control and Pragma headers in a request by using the command line interface
At the command prompt, type:
set cache contentgroup <name> -ignoreReqCachingHdrs YES
To ignore browser reload requests by using the command line interface
At the command prompt, type:
set cache contentgroup <name> -ignoreReloadReq NO
Note: By default, the -ignoreReloadReq parameter is set to YES.
To ignore Cache-Control and Pragma headers in a request by using the GUI
- Navigate to Optimization > Integrated Caching > Content Groups, and select the content group.
- On Others tab, in the Settings group, select Ignore Cache-control and Pragma Headers in Requests option.
Example of a policy to ignore Cache-Control headers
In the following example, you configure a request-time override policy to cache responses that contain Content-type: image/* regardless of the Cache-Control header in the response.
To configure a request-time override policy to cache all responses with image/*
Flush the cache using the Invalidate All option.
For more information, see “Flushing Responses in a Content Group.”
Configure a new cache policy, and direct the policy to a particular content group. For more information, see “Configuring a Policy in the Integrated Cache.”
Ensure the content group that the policy uses is configured to ignore Cache-Control headers, as described in “Ignoring Cache-Control and Pragma Headers in Requests.”
Bind the policy to the request-time override policy bank.
For more information, see Globally Binding an Integrated Caching Policy topic.
Polling the origin server every time a request is received
You can configure the Citrix ADC appliance to always consult the origin server before serving a stored response. This is known as Poll Every Time (PET). When the Citrix ADC appliance consults the origin server and the PET response has not expired, a full response from the origin server does not overwrite cached content. This property is useful when serving client-specific content.
After a PET response expires, the Citrix ADC appliance refreshes it when the first full response arrives from the origin server.
The Poll Every Time (PET) function works as follows:
For a cached response that has validators in the form of an ETag or a Last-Modified header, if the response expires it is automatically marked PET and cached.
You can configure PET for a content group.
If you configure a content group as PET, every response in the content group is marked PET. The PET content group can store responses that do not have validators. Responses that are automatically marked PET are always expired. Responses that belong to a PET content group can expire after a delay, based on how you configure the content group.
Two types of requests are affected by polling:
- Conditional Requests: A client issues a conditional request to ensure that the response that it has is the most recent copy. A user-agent request for a cached PET response is always converted to a conditional request and sent to the origin server. A conditional request has validators in If-Modified-Since or If-None-Match headers. The If-Modified-Since header contains the time from the Last-Modified header. An If-None-Match header contains the response’s ETag header value. If the client’s copy of the response is fresh, the origin server replies with 304 Not Modified. If the copy is stale, a conditional response generates a 200 OK that contains the entire response.
- Non-Coditional Requests: A non-conditional request can only generate a 200 OK that contains the entire response.
Origin Server Response | Action |
---|---|
Send the full response | The origin server sends the response as-is to the client. If the cached response has expired, it is refreshed. |
304 Not Modified | The following header values in the 304 response are merged with the cached response and the cached response is served to the client: Date, Expires, Age, Cache-Control header Max-Age, and S-Maxage tokens |
401 Unauthorized; 400 Bad Request; 405 Method Not Allowed; 406 Not Acceptable; 407 Proxy Authentication Required | The origin’s response is served as-is to the client. The cached response is not changed. |
Any other error response, for example, 404 Not Found | The origin’s response is served as-is to the client. The cached response is removed. |
Note The Poll Every Time parameter treats the affected responses as non-storable.
To configure poll every time by using the command line interface
At the command prompt, type:
add cache contentgroup <contentGroupName> -pollEveryTime YES
To configure poll every time by using the GUI
- Navigate to Optimization > Integrated Caching > Content Groups, and select the content group.
- On Others tab, in the Settings group, select Poll every time (validate cached content with origin for every request) option.
PET and client-specific content
The PET function can ensure that content is customized for a client. For example, a Web site that serves content in multiple languages examines the Accept-Language request header to select the language for the content that it is serving. For a multi-language Web site where English is the predominant language, all English language content can be cached in a PET content group. This ensures that every request goes to the origin server to determine the language for the response. If the response is English, and the content has not changed, the origin server can serve a 304 Not Modified to the cache.
The following example shows commands to cache English responses in a PET content group, configure a named expression that identifies English responses in the cache, and configure a policy that uses this content group and named expression. Bold is used for emphasis:
add cache contentgroup EnglishLanguageGroup -pollEveryTime YES
add expression containsENExpression –rule "http.res.header(\\"Content-Language\\").contains(\\"en\\")"
add cache policy englishPolicy -rule containsENExpression -action CACHE -storeInGroup englishLanguageGroup
bind cache policy englishPolicy -priority 100 -precedeDefRules NO
PET and authentication, authorization, and auditing
Outlook Web Access (OWA) is a good example of dynamically generated content that benefits from PET. All mail responses (*.EML objects) have an ETag validator that enables them to be stored as PET responses.
Every request for a mail response travels to the origin server, even if the response is cached. The origin server determines whether the requestor is authenticated and authorized. It also verifies that the response exists in the origin server. If all results are positive, the origin server sends a 304 Not Modified response.
Configure cookies, headers, and polling
In this article
- Divergence of cache behavior from the standards
- Remove cookies from a response
- Inserting HTTP headers at response time
- Insert an age, via, or ETag header
- Insert a cache-control header
- Ignoring cache-control and pragma headers in requests
- Polling the origin server every time a request is received
- PET and client-specific content
- PET and authentication, authorization, and auditing