Product Documentation

English
日本語
简体中文
한국어

Citrix ADC
NetScaler 11.1

NetScaler Release Notes
Getting Started with Citrix NetScaler
- Where Does a NetScaler Appliance Fit in the Network?
- How a NetScaler Communicates with Clients and Servers
- Introduction to the Citrix NetScaler Product Line
- Install the hardware
- Access a Citrix ADC
- Configure the ADC for the first time
- Configure high availability
- Configuring a FIPS Appliance for the First Time
- Understanding Common Network Topologies
- System management settings
- Load balance traffic on a NetScaler appliance
- Accelerate load balanced traffic by using compression
- Secure load balanced traffic by using SSL
- Features at a Glance
FAQs
- AppFlow
- AutoScale
- Call Home
- Clustering
- Connection Management
- NetScaler GUI
- Content Switching
- Debugging
- High Availability
- Hardware
- Integrated Caching
- Load Balancing
- SDX
- SSL
- Installing, Upgrading, and Downgrading
Solutions for Telecom Service Providers
- Large Scale NAT
- Dual-Stack Lite
- Large Scale NAT64
- Telco subscriber management
- Load Balance Control-Plane Traffic that is based on Diameter, SIP, and SMPP Protocols
- Provide DNS Infrastructure/Traffic Services, such as, Load Balancing, Caching, and Logging for Telecom Service Providers
- Provide Subscriber Load Distribution Using GSLB Across Core-Networks of a Telecom Service Provider
- Bandwidth Utilization Using Cache Redirection Functionality
- NetScaler TCP Optimization
NetScaler Solutions
- Setting Up NetScaler for XenApp/XenDesktop
- Global Server Load Balancing (GSLB) Powered Zone Preference
- NetScaler in a Private Cloud Managed by Microsoft Windows Azure Pack and Cisco ACI
Deploy a Citrix NetScaler VPX instance
- Support matrix and usage guidelines
- Install a NetScaler VPX instance on XenServer
  - Configuring NetScaler Virtual Appliances to use Single Root I/O Virtualization (SR-IOV) Network Interfaces
- Install a NetScaler VPX instance on VMware ESX
- Install a Citrix NetScaler VPX instance on Microsoft Hyper-V servers
- Install a NetScaler VPX instance on Linux-KVM platform
- Deploying NetScaler VPX Instances on AWS
- Deploy a NetScaler VPX instance on Microsoft Azure
- Deploying NetScaler VPX Instances on Oracle Public Cloud
- Deploying a NetScaler VPX Instance on Cisco CSP 2100
- Configuring the Basic System Settings
- Jumbo frames on NetScaler VPX instances
Hardware Installation
Licensing
- NetScaler licensing overview
- NetScaler Gateway Universal License
- NetScaler Pooled Capacity
Upgrade and downgrade a NetScaler appliance
AAA application traffic
- How AAA works
- Enabling AAA
- Setting up an authentication virtual server
- Creating an authentication profile
- Configuring users and groups
- Configuring AAA policies
  - Authentication policies
- Authorizing user access to application resources
- Auditing authenticated sessions
- Session settings
- Traffic settings
- Authenticating with client certificates
  - Client certificate pass-through
- Configuring AAA with commonly used protocols
  - Handling authentication, authorization and auditing with Kerberos/NTLM
- NetScaler Kerberos single sign-on
- SAML authentication
- OAuth authentication
- Multi-Factor (nFactor) authentication
Admin Partitioning
- Supported NetScaler configurations
- Configure admin partitions
- SNMP support for admin partitions
AppExpert
- Action Analytics
- AppExpert Applications and Templates
- AppQoE
- Entity Templates
- HTTP Callouts
- Pattern Sets and Data Sets
- Variables
- Policies and Expressions
- Rate Limiting
- Responder
- Rewrite
- String Maps
- URL Sets
AppFlow
- Configuring the AppFlow Feature
- Exporting Performance Data of Web Pages to AppFlow Collector
- Session Reliability on NetScaler High Availability Pair
Application Firewall
- FAQs and Deployment Guide
- Introduction
  - Web Application Security
  - How The Application Firewall Works
  - The Application Firewall Configuration Interfaces
- Configuring the Application Firewall
  - Enabling the Application Firewall
  - The Application Firewall Wizard
  - Manual Configuration
  - Manual Configuration By Using the Configuration Utility
  - Manual Configuration By Using the Command Line Interface
- Signatures
  - Manually Configuring the Signatures Feature
  - Adding or Removing a Signatures Object
  - Configuring or Modifying a Signatures Object
  - Protecting JSON Applications using Signatures
  - Updating a Signatures Object
  - Exporting a Signatures Object to a File
  - The Signatures Editor
  - Signature Updates in High-Availability Deployment and Build Upgrades
- Overview of Security checks
- Top-Level Protections
  - HTML Cross-Site Scripting Check
  - HTML SQL Injection Checks
  - Buffer Overflow Check
  - Cookie Consistency Check
  - Application Firewall Support for Google Web Toolkit
- Data Leak Prevention Checks
  - Credit Card Check
  - Safe Object Check
- Advanced Form Protection Checks
  - Field Formats Check
  - Form Field Consistency Check
  - CSRF Form Tagging Check
  - Managing CSRF Form Tagging Check Relaxations
- URL Protection Checks
  - Start URL Check
  - Deny URL Check
- XML Protection Checks
  - XML Format Check
  - XML Denial-of-Service Check
  - XML Cross-Site Scripting Check
  - XML SQL Injection Check
  - XML Attachment Check
  - Web Services Interoperability Check
  - XML Message Validation Check
  - XML SOAP Fault Filtering Check
- Managing Content Types
- Profiles
  - Creating Application Firewall Profiles
  - Configuring Application Firewall Profiles
  - Changing an Application Firewall Profile Type
  - Exporting and Importing an Application Firewall Profile
  - Configuring and Using the Learning Feature
  - Supplemental Information about Profiles
- Policy Labels
- Policies
  - Firewall Policies
  - Auditing Policies
- Imports
  - Importing and Exporting Files
- Global Configuration
  - Engine Settings
  - Confidential Fields
  - Field Types
  - XML Content Types
  - JSON Content Types
- Statistics and Reports
- Application Firewall Logs
- Appendices
  - PCRE Character Encoding Format
  - Whitehat WASC Signature Types for WAF Use
  - Streaming Support for Request Processing
  - Trace HTML Requests with Security Logs
  - Application Firewall Support for Cluster Configurations
- Debugging and Troubleshooting
  - High CPU
  - Memory
  - Large File Upload Failure
  - Learning
  - Signatures
  - Trace Log
  - Miscellaneous
  - References
Cache Redirection
- Cache redirection policies
  - Built-in cache redirection policies
  - Configure a cache redirection policy
- Cache redirection configurations
- Selective cache redirection
- Administer a cache redirection virtual server
- N-tier cache redirection
  - Configure the upper-tier NetScaler appliances
  - Configure the lower-tier NetScaler appliances
Clustering
- NetScaler configuration support in a cluster
- Prerequisites for cluster nodes
- Cluster overview
- Setting up a NetScaler cluster
- Distributing traffic across cluster nodes
  - Using Equal Cost Multiple Path (ECMP)
  - Using cluster link aggregation
- Managing the NetScaler cluster
- Cluster setup and usage scenarios
- Upgrading or downgrading the NetScaler cluster
- Operations supported on individual cluster nodes
- FAQs
- Troubleshooting the NetScaler cluster
  - Tracing the packets of a NetScaler cluster
  - Troubleshooting common issues
Content Switching
- Configuring Basic Content Switching
- Customizing the Basic Content Switching Configuration
- Content Switching for Diameter Protocol
- Protecting the Content Switching Setup against Failure
- Managing a Content Switching Setup
- Managing Client Connections
- Troubleshooting
DataStream
- Configuring Database Users
- Configuring a Database Profile
- Configuring Load Balancing for DataStream
- Configuring Content Switching for DataStream
- Configuring Monitors for DataStream
- Use Case 1: Configuring DataStream for a Master/Slave Database Architecture
- Use Case 2: Configuring the Token Method of Load Balancing for DataStream
- Use Case 3: Logging MSSQL Transactions in Transparent Mode
- Use Case 4: Database Specific Load Balancing
- DataStream Reference
Domain Name System
- Configure DNS resource records
- Configure a DNS zone
- Configure the NetScaler as an ADNS server
- Configure the NetScaler as a DNS proxy server
- Configure the NetScaler as an end resolver
- Configure the NetScaler as a forwarder
- Configure DNS logging
- Configure DNS suffixes
- DNS ANY query
- Configure negative caching of DNS records
- Domain name system security extensions
Firewall Load Balancing
- Sandwich Environment
- Enterprise Environment
- Multiple-Firewall Environment
Global Server Load Balancing
- How GSLB Works
- GSLB Deployment Types
  - Active-Active Site Deployment
  - Active-Passive Site Deployment
  - Parent-Child Topology Deployment using the MEP Protocol
- GSLB Configuration Entities
- Configuring Global Server Load Balancing (GSLB)
  - Configuring an Authoritative DNS Service
  - Configuring a Basic GSLB Site
  - Configuring a GSLB Service
  - Configuring a GSLB Virtual Server
  - Binding GSLB Services to a GSLB Virtual Server
  - Binding a Domain to a GSLB Virtual Server
  - Synchronizing a Configuration in a GSLB Setup
- Testing the GSLB setup
- Configuring the Metrics Exchange Protocol (MEP)
- Configuring Site-to-Site Communication
- Customizing Your GSLB Configuration
- Changing the GSLB Method
- Configuring Static Proximity
  - Adding a Location File to Create a Static Proximity Database
  - Adding Custom Entries to a Static Proximity Database
  - Setting the Location Qualifiers
  - Specifying the Proximity Method
  - Synchronizing GSLB Static Proximity Database
- Configuring the Dynamic Method (RTT)
- Configuring Persistent Connections
- Overriding Static Proximity Behavior by Configuring Preferred Locations
- Monitoring GSLB Services
- Monitoring GSLB Sites
- Protecting the GSLB Setup Against Failure
- Managing Client Connections
- Configuring GSLB for Disaster Recovery
- Configuring GSLB for Proximity
- Example of a Complete Parent-Child Configuration Using the Metrics Exchange Protocol
- Configuring GSLB Service Selection Using Content Switching
- Configuring Global Server Load Balancing for DNS Queries with NAPTR records
- Using the EDNS0 Client Subnet Option for Global Server Load Balancing
Link Load Balancing
- Configuring a Basic LLB Setup
- Configuring RNAT with LLB
- Configuring a Backup Route
- Resilient LLB Deployment Scenario
- Monitoring an LLB Setup
Load Balancing
- How load balancing works
- Set up basic load balancing
- Load balance virtual server and service states
- Support for load balancing profile
- Load balancing algorithms
  - Least connection method
  - Round robin method
  - Least response time method
  - LRTM method
  - Hashing methods
  - Least bandwidth method
  - Least packets method
  - Custom load method
  - Static proximity method
  - Token method
  - Configure a load balancing method that does not include a policy
- Persistence and persistent connections
  - About Persistence
  - Source IP address persistence
  - HTTP cookie persistence
  - SSL session ID persistence
  - Diameter AVP number persistence
  - Custom server ID persistence
  - IP address persistence
  - SIP Call ID persistence
  - RTSP session ID persistence
  - Configure URL passive persistence
  - Configure persistence based on user-defined rules
  - Configure persistence types that do not require a rule
  - Configure backup persistence
  - Configure persistence groups
  - Configure RADIUS load balancing with persistence
  - View persistence sessions
  - Clear persistence sessions
  - Override persistence settings for overloaded services
  - Troubleshooting
- Customize a load balancing configuration
  - Customize the hash algorithm for persistence across virtual servers
  - Configure the redirection mode
  - Configure per-VLAN wildcarded virtual servers
  - Assign weights to services
  - Configure the MySQL and Microsoft SQL server version setting
- Configure diameter load balancing
- Configure FIX load balancing
- Protect a load balancing configuration against failure
  - Redirect client requests to an alternate URL
  - Configure a backup load balancing virtual server
  - Configure spillover
  - Connection failover
  - Flush the surge queue
- Manage a load balancing setup
  - Manage server objects
  - Manage services
  - Manage a load balancing virtual server
  - Load balancing visualizer
- Manage client traffic
  - Configure sessionless load balancing virtual servers
  - Redirect HTTP requests to a cache
  - Direct requests according to priority
  - Direct requests to a custom web page
  - Enable cleanup of virtual server connections
  - Rewrite ports and protocols for HTTP redirection
  - Insert IP address and port of a virtual server in the request header
  - Use a specified source IP for backend communication
  - Set a time-out value for idle client connections
  - Manage RTSP connections
  - Manage client traffic on the basis of traffic rate
  - Identify a connection with layer 2 parameters
  - Configure the prefer direct route option
  - Use a source port from a specified port range for backend communication
  - Configure source IP persistency for backend communication
- Advanced load balancing settings
  - Gradually stepping up the load on a new service with virtual server–level slow start
  - The no-monitor option for services
  - Protect applications on protected servers against traffic surges
  - Enable cleanup of virtual server and service connections
  - Graceful shutdown of services
  - Direct requests to a custom web page
  - Enable access to services when down
  - Enable TCP buffering of responses
  - Enable compression
  - Maintain client connection for multiple client requests
  - Insert the IP address of the client in the request header
  - Use source IP address of the client when connecting to the server
  - Configure the source port for server-side connections
  - Set a limit on the number of client connections
  - Set a limit on number of requests per connection to the server
  - Set a threshold value for the monitors bound to a service
  - Set a timeout value for idle client connections
  - Set a timeout value for idle server connections
  - Set a limit on the bandwidth usage by clients
  - Redirect client requests to a cache
  - Retain the VLAN identifier for VLAN transparency
  - Configure automatic state transition based on percentage health of bound services
- Built-in monitors
  - TCP-based application monitoring
  - SSL service monitoring
  - FTP service monitoring
  - Secure monitoring of servers by using SFTP
  - Set SSL parameters on a secure monitor
  - SIP service monitoring
  - RADIUS service monitoring
  - Monitor accounting information delivery from a RADIUS server
  - DNS and DNS-TCP service monitoring
  - LDAP service monitoring
  - MySQL service monitoring
  - SNMP service monitoring
  - NNTP service monitoring
  - POP3 service monitoring
  - SMTP service monitoring
  - RTSP service monitoring
  - XML broker service monitoring
  - ARP request monitoring
  - XenDesktop Delivery Controller service monitoring
  - Web interface service monitoring
  - Citrix StoreFront stores monitoring
- Custom monitors
  - Configure HTTP-inline monitors
  - Understand user monitors
  - How to use a user monitor to check web sites
  - Understand the internal dispatcher
  - Configure a custom user monitor
  - Understand load monitors
  - Configure load monitors
  - Unbind metrics from a metrics table
  - Configure reverse monitoring for a service
- Configure monitors in a load balancing setup
  - Create monitors
  - Bind monitors to services
  - Modify monitors
  - Enable and disable monitors
  - Unbind monitors
  - Remove monitors
  - View monitors
  - Close monitor connections
  - Ignore the upper limit on client connections for monitor probes
- Manage a large scale deployment
  - Ranges of virtual servers and services
  - Configure service groups
  - Manage service groups
  - Configure automatic domain based service group scaling
  - Translate the IP address of a domain-based server
  - Mask a virtual server IP address
- Configure load balancing for commonly used protocols
  - Load balance a group of FTP servers
  - Load balance DNS servers
  - Load balance domain-name based services
  - Load balance a group of SIP servers
  - Load balance RTSP servers
  - Load balance remote desktop protocol (RDP) servers
- Use case 1: SMPP load balancing
- Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
- Use case 3: Configure load balancing in direct server return mode
- Use case 4: Configure LINUX servers in DSR mode
- Use case 5: Configure DSR mode when using TOS
- Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
- Use case 7: Configure load balancing in DSR mode by using IP Over IP
- Use case 8: Configure load balancing in one-arm mode
- Use case 9: Configure load balancing in the inline mode
- Use case 10: Load balancing of intrusion detection system servers
- Use case 11: Isolating network traffic using listen policies
- Use case 12: Configure XenDesktop for load balancing
- Use case 13: Configure XenApp for load balancing
- Use case 14: ShareFile wizard for load balancing Citrix ShareFile
- Troubleshooting
- Load balancing FAQs
Networking
- IP Addressing
- Interfaces
- Access Control Lists
- IP Routing
- Internet Protocol version 6 (IPv6)
- Traffic Domains
  - Inter Traffic Domain Entity Bindings
  - VMAC Based Traffic Domains
- VXLAN
Optimization
- Client Keep-Alive
- HTTP Compression
- Integrated Caching
- Front End Optimization
- Content Accelerator
- Media Classification
Reputation
- IP Reputation
SSL offload and acceleration
- SSL offloading configuration
- How-to articles
- SSL certificates
  - Create a certificate
  - Install, link, and update certificates
  - Generate a server test certificate
  - Import and convert SSL files
- SSL profiles
  - SSL profile infrastructure
  - Appendix A: Sample migration of the SSL configuration after upgrade
  - Appendix B: Default front-end and back-end SSL profile settings
  - Legacy SSL profile
- Certificate revocation lists
- Monitor certificate status with OCSP
- OCSP stapling
- Ciphers available on the Citrix ADC appliances
  - ECDHE ciphers
  - Diffie-Hellman (DH) key generation and achieving PFS with DHE
  - Cipher redirection
  - Leverage hardware and software to improve ECDHE and ECDSA cipher performance
  - ECDSA cipher suites support
  - Configure user-defined cipher groups on the ADC appliance
- Server certificate support matrix on the ADC appliance
- Client authentication
- Server authentication
- SSL actions and policies
  - SSL policies
  - SSL built-in actions and user-defined actions
  - SSL policy binding
  - SSL policy labels
- Support for DTLS protocol
- Support for Intel Coleto SSL chip based platforms
- MPX 9700/10500/12500/15500 FIPS appliances
  - Configure FIPS appliances in a high availability setup
  - Update the firmware to version 2.2 on a FIPS card
  - Reset a locked HSM
- MPX 14000 FIPS appliances
- SDX 14000 FIPS appliances
  - Limitations
  - Terminology
  - Initialize the HSM
  - Create partitions
  - Provision a new instance or modify an existing instance and assign a partition
  - Configure the HSM for an instance on an SDX 14030/14060/14080 FIPS appliance
  - Create a FIPS key for an instance on an SDX 14030/14060/14080 FIPS appliance
  - Upgrade the FIPS firmware on a VPX instance
- Support for Thales nShield® HSM
  - Architecture overview
  - Prerequisites
  - Configure the ADC-Thales integration
  - Limitations
  - Appendix
- Support for Gemalto SafeNet Network hardware security module
  - Prerequisites
  - Configure a SafeNet client on the ADC
  - Configure Safenet HSMs in a high availability setup on the ADC
  - Additional ADC configuration
  - Citrix ADC appliances in a high availability setup
  - Limitations
  - Appendix
  - FAQ
- Troubleshooting
- SSL FAQs
- Global site certificates
Security
- Content filtering
- HTTP denial-of-service protection
- Priority queuing
- SureConnect
- Surge protection
- DNS security options
System
- Basic operations
- Authentication and authorization
- TCP Configurations
- HTTP Configurations
  - Configuring HTTP/2 on the NetScaler Appliance
- SNMP
- Audit Logging
- Web Server Logging
- Call Home
- Reporting Tool
- CloudBridge Connector
- High Availability
- TCP Optimization
Reference Material

This content has been machine translated dynamically.

Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)

Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)

Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)

This content has been machine translated dynamically.

Switch to english Auf Englisch anzeigen Lire en anglais Leer en inglés Switch to english Switch to english Switch to english

Translation failed!

Use case 4: Configure LINUX servers in DSR mode

The LINUX operating system requires that you set up a loopback interface with the NetScaler appliance virtual IP address (VIP) on each load balanced server in the DSR cluster.

To configure LINUX server in DSR mode

To create a loop back interface with the NetScaler appliance’s VIP on each load balanced server, at the Linux OS prompt type the following commands:

ifconfig dummy0 up

ifconfig dummy0:0 inet <netscaler vip> netmask 255.255.255.255 up

echo 1 > /proc/sys/net/ipv4/conf/dummy0/arp_ignore

echo 2 > /proc/sys/net/ipv4/conf/dummy0/arp_announce

Then, run the software that re-maps the TOS id to VIP.

Note: Add the correct mappings to the software before running it. In the preceding commands, the LINUX server uses dummy0 to connect to the network. When you use this command, type the name of the interface that your LINUX server uses to connect to the network.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

THIS SERVICE MAY CONTAIN TRANSLATIONS POWERED BY GOOGLE. GOOGLE DISCLAIMS ALL WARRANTIES RELATED TO THE TRANSLATIONS, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTIES OF ACCURACY, RELIABILITY, AND ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Send us your feedback about this article

Support: https://www.citrix.com/support

Feedback and forums: https://discussions.citrix.com