In Citrix ADC 13.0
In Citrix ADC
In All products
Product documentation
In Citrix ADC 13.0
In Citrix ADC
In All products
Citrix ADC 13.0
13.0 12.1 12.0 11.1 10.5
View PDF

Deploy a VPX high-availability pair with private IP address on Google Cloud Platform

October 26, 2020
Contributed by: 
C S

You can deploy a VPX high-availability pair on GCP using private IP address. The client IP (VIP) and Server IP (SNIP) must be configured as alias IP addresses on the primary node. Upon failover, both Client IP address and Server IP address are moved to the secondary node, for the traffic to resume.

Note:

Disable the Independent Network Configuration (INC) mode to configure a high-availability pair using private IP addresses.

For more information on HA, see High Availability.

Before you start

  • Read the Limitation, Hardware requirements, Points to note mentioned in Deploy a Citrix ADC VPX instance on Google Cloud Platform. This information applies to HA deployments also.
  • Enable Cloud Resource Manager API for your GCP project.

  • Allow full access to all Cloud APIs while creating the instances. Full access cloud API

  • Ensure your GCP service account has the following IAM permissions:

     REQUIRED_INSTANCE_IAM_PERMS = [
 “compute.forwardingRules.list”,
 “compute.forwardingRules.setTarget”,
 “compute.instances.setMetadata”,
 "compute.instances.get",
 "compute.instances.list",
 "compute.instances.updateNetworkInterface",
 “compute.targetInstances.list”,
 “compute.targetInstances.use”,
 "compute.zones.list",
 ]

  • If you have configured external IP addresses on an interface other than the management interface, ensure your GCP service account has the following additional IAM permissions:

     REQUIRED_INSTANCE_IAM_PERMS = [
 "compute.addresses.use"
 "compute.instances.addAccessConfig",
 "compute.instances.deleteAccessConfig",
 "compute.instances.updateNetworkInterface"
 "compute.networks.useExternalIp",
 "compute.subnetworks.useExternalIp",
 ]

  • If your VMs do not have internet access, you must enable Private Google Access on the management subnet. Private google access

  • If you have configured GCP forwarding rules on the primary node, read the limitations and requirements mentioned in Forwarding rules support for VPX high-availability pair on GCP to update them to new primary on failover.

How to deploy a VPX HA pair on Google Cloud Platform

Here’s a summary of the HA deployment steps:

  1. Create VPC networks in the same region. For example, Asia-east.
  2. Create two VPX instances (primary and secondary nodes) on the same region. They can be in the same zone or different zones. For example Asia east-1a and Asia east-Ib.
  3. Configure HA settings on both instances by using the Citrix ADC GUI or ADC CLI commands.

Step 1. Create VPC networks

Create VPC networks based on your requirements. Citrix recommends you to create three VPC networks for associating with management NIC, client NIC, and server NIC.

To create a VPC network, perform these steps:

  1. Log on the Google console > Networking > VPC network > Create VPC Network.
  2. Complete the required fields, and click Create.

For more information, see the Create VPC Networks section in Deploy a Citrix ADC VPX instance on Google Cloud Platform.

Step 2. Create two VPX instances

Create two VPX instances by following the steps given in Scenario: deploy a multi-NIC, multi-IP standalone VPX instance.

Important:

Assign a client alias IP address and server alias IP address to the primary node. Do not use the internal IP address of the VPX instance to configure the VIP or SNIP.

To create a client alias IP address, perform these steps:

  1. Navigate to the VM instance and click Edit.

  2. In the Network Interface window, edit the client interface.

  3. In the Alias IP range field, enter the client alias IP address.

Client alias IP address

To create a server alias IP address, perform these steps:

  1. Navigate to the VM instance and click Edit.

  2. In the Network Interface window, edit the server interface.

  3. In the Alias IP range field, enter the server alias IP address.

Server alias IP address

After the failover, when the old primary becomes the new secondary, the alias IP addresses move from the old primary and are attached to the new primary.

After you have configured the VPX instances, you can configure the Virtual (VIP) and Subnet IP (SNIP) addresses. For more information, see Configuring Citrix ADC-owned IP addresses.

Step 3. Configure high availability

After you’ve created the instances on Google Cloud Platform, you can configure HA by using the Citrix ADC GUI or CLI.

Configure high availability by using the GUI

Step 1. Set up high availability in INC Disabled mode on both the instances.

On the primary node, perform the following steps:

  1. Log on to the instance with user name nsroot and instance ID of the node from GCP console as the password.
  2. Navigate to Configuration > System > High Availability > Nodes, and click Add.
  3. In the Remote Node IP address field, enter the private IP address of the management NIC of the secondary node.
  4. Clear the Turn on INC (Independent Network Configuration) mode on self node check box.
  5. Click Create.

On the secondary node, perform the following steps:

  1. Log on to the instance with user name nsroot and instance ID of the node from GCP console as the password.
  2. Navigate to Configuration > System > High Availability > Nodes, and click Add.
  3. In the Remote Node IP address field, enter the private IP address of the management NIC of the primary node.
  4. Select the Turn on INC (Independent Network Configuration) mode on self node check box.
  5. Click Create.

Before you proceed further, ensure that the Synchronization state of the secondary node is shown as SUCCESS in the Nodes page.

Secondary-node synchronization state

Note

Now, the secondary node has the same log-on credentials as the primary node.

Step 2. Add client alias IP address and server alias IP address on the primary node.

  1. Navigate to System > Network > IPs > IPv4s, and click Add.
  2. To create a client alias IP (VIP) address:
    1. Enter the Alias IP address and netmask configured for the client subnet in the VM instance.
    2. In the IP Type field, select Virtual IP from the drop-down menu.
    3. Click Create.
  3. To create a server alias IP (SNIP) address:
    1. Enter the Alias IP address and netmask configured for the server subnet in the primary instance.
    2. In the IP Type field, select Subnet IP from the drop-down menu.
    3. Click Create.

    Create client and server alias IP address

Step 3. Add a load balancing virtual server on the primary node.

  1. Navigate to Configuration > Traffic Management > Load Balancing > Virtual Servers > Add.

  2. Add the required values for Name, Protocol, IP Address Type (IP Address), IP Address (primary client alias IP address) and Port, and click OK.

    LB virtual server client alias

Step 4. Add a service or service group on the primary node.

  1. Navigate to Configuration > Traffic Management > Load Balancing > Services > Add.
  2. Add the required values for Service Name, IP Address, Protocol and Port, and click OK.

Step 5. Bind the service or service group to the load balancing virtual server on the primary node.

  1. Navigate to Configuration > Traffic Management > Load Balancing > Virtual Servers.
  2. Select the load balancing virtual server configured in Step 3, and click Edit.
  3. In the Service and Service Groups tab, click No Load Balancing Virtual Server Service Binding.
  4. Select the service configured in the Step 4, and click Bind.

Step 5. Save the configuration.

After a forced failover, the secondary becomes the new primary. The client alias IP (VIP) and the server alias IP (SNIP) from the old primary moves to the new primary.

Configure high availability by using the CLI

Step 1. Set up high availability in INC Disabled mode in both the instances by using the Citrix ADC CLI.

On the primary node, type the following command.

add ha node 1 <sec_ip> -inc DISABLED

On the secondary node, type the following command.


add ha node 1 <prim_ip> -inc DISABLED

The sec_ip refers to the internal IP address of the management NIC of the secondary node.

The prim_ip refers to the internal IP address of the management NIC of the primary node.

Step 2. Add VIP and SNIP on the primary node.

Type the following commands on the primary node:

add ns ip <primary_client_alias_ip> <subnet> -type VIP

Note:

Enter the Alias IP address and netmask configured for the client subnet in the VM instance.

add ns ip <primary_server_alias_ip> <subnet> -type SNIP

Note:

Enter the Alias IP address and netmask configured for the server subnet in the VM instance.

Step 3. Add a virtual server on the primary node.

Type the following command:

add <server_type> vserver <vserver_name> <protocol> <primary_client_alias_ip> <port>

Step 4. Add a SNIP on the secondary node.

Type the following command on the secondary node:

add ns ip <primary_server_alias_ip> <subnet> -type SNIP

Step 5. Add a service or service group on the primary node.

Type the following command:

add service <service_name> <service_ip_address> <protocol> <port>

Step 6. Bind the service or service group to the load balancing virtual server on the primary node.

Type the following command:

bind <server_type> vserver <vserver_name> <service_name>

Note:

To save your configuration, type the command save config. Otherwise, the configurations are lost after you restart the instances.

Deploy a VPX high-availability pair with private IP address on Google Cloud Platform

October 26, 2020
Contributed by: 
C S
October 26, 2020
Contributed by: 
C S

In this article