In NetScaler 11.1
In Citrix ADC
In All products
Product documentation
In NetScaler 11.1
In Citrix ADC
In All products
NetScaler
13.0 12.1 12.0 11.1 10.5
View PDF

Use case 7: Configure load balancing in DSR mode by using IP Over IP

September 21, 2020
Contributed by: 
S C

You can configure your NetScaler appliance to use direct server return (DSR) mode across Layer 3 networks by using IP tunneling, also called IP over IP configuration. As with standard load balancing configurations for DSR mode, this allows servers to respond to clients directly instead of using a return path through the NetScaler appliance, improving response times and throughput. As with standard DSR mode, the NetScaler appliance monitors the servers and performs health checks on the application ports.

With IP over IP configuration, the NetScaler appliance and the servers do not need to be on the same Layer 2 subnet. Instead, the NetScaler appliance encapsulates the packets before sending them to the destination server. After the destination server receives the packets, it decapsulates the packets, and then sends its responses directly to the client.

To configure IP over IP DSR mode on your NetScaler appliance, you must do the following:

Configure a load balancing virtual server

Configure a virtual server to handle requests to your applications. Assign a service type of ANY and set the forwarding method to IPTUNNEL. Optionally, configure the virtual server to operate in sessionless mode. You can configure any load balancing method that you want to use.

To create and configure a load balancing virtual server for IP over IP DSR by using the command line interface

At the command prompt type the following command to configure a load balancing virtual server for IP over IP DSR and verify the configuration:

add lb vserver <name> serviceType <serviceType> IPAddress <ip> Port <port> -lbMethod <method> -m <ipTunnelTag> -sessionless <sessionless>

show lb vserver <name>

Example:

In the following example, we have selected the load balancing method as sourceIPhash and configured sessionless load balancing.

add lb vserver Vserver-LB-1 ANY 10.102.29.60 * -lbMethod SourceIPHash -m IPTUNNEL -sessionless enabled

To create and configure a load balancing virtual server for IP over IP DSR by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. Create a virtual server, and specify Redirection Mode as IP Tunnel Based.

Configure services for IP over IP DSR

After creating your load-balanced server, You must configure one service for each of your applications. The service handles traffic from the NetScaler appliance to those applications, and allows the NetScaler appliance to monitor the health of each application.

You assign a service type of ANY and configure it for USIP mode. Optionally, you can also bind a monitor of type IPTUNNEL to the service for tunnel-based monitoring.

To create and configure a service for IP over IP DSR by using the command line interface

At the command prompt, type the following commands to create a service and optionally, create a monitor and bind it to the service:

add service <serviceName> <serverName> <serviceType> <port> -usip <usip>

add monitor <monitorName> <monitorType> -destip <ip> -iptunnel <iptunnel>

bind service <serviceName> -monitorName <monitorName>

Example:

In the following example, we are creating a monitor of type IPTUNNEL:

add monitor mon-1 PING -destip 10.102.29.60 -iptunnel yes
add service Service-DSR-1 10.102.30.5 ANY * -usip yes
bind service Service-DSR-1 -monitorName mon-1

To configure a monitor by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Monitors.
  2. Create a monitor, and select IP Tunnel.

To create and configure a service for IP over IP DSR by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Services.
  2. Create a service and, in Settings, select Use Source IP Address.

To bind a service to a load balancing virtual server by using the command line interface

At the command prompt type the following command:

bind lb vserver <name> <serviceName>

Example:

bind lb vserver Vserver-LB-1 Service-DSR-1

To bind a service to a load balancing virtual server by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. Open a virtual server, and click in the Services section to bind a service to the virtual server.

Decapsulator configuration

  • When a NetScaler appliance is used as a decapsulator, an IP tunnel must be created in the NetScaler appliance. For details, see Configuring IP Tunnels.

     Example configuration:

add lb vserver v1 any 1.1.1.1 * -m IPTUNNEL

add service s1 2.2.2.2 ANY *

bind lb vserver v1 s1

add iptunnel tun1 <snip_in_encap> netmask *

add ns ip 1.1.1.1 255.255.255.255 –type vip –arp disabled

add lb vserver v1 any 1.1.1.1 *

add service s1 <actualserverip> ANY *

bind lb vserver v1 s1
  • When a backend server is used as a decapsulator, the backend configuration varies depending on the server type. The steps involved in configuring a backend server as a decapsulator are;
  1. Configure a loop back interface.
  2. Add a route through tunnel interface.

Note: Make sure that the tunnel modules are installed in the system.

    Example configuration:

In this example, 1.1.1.1 is the NetScaler virtual IP (VIP) address and 2.2.2.2 is the backend server IP address.

The VIP address is configured in the loopback interface and a route is added through the tunnel interface. The modprobe ipip command is used for enabling the tunnel interface.

add lb vserver v1 ANY 1.1.1.1 80 -m IPTUNNEL

add service svc1 2.2.2.2 ANY 80 -usip YES -useproxyport NO

bind lb vserver v1 svc1

ifconfig lo inet 1.1.1.1 netmask 255.255.255.255

modprobe ipip

echo 1 > /proc/sys/net/ipv4/conf/tunl0/arp_ignore

echo 2 > /proc/sys/net/ipv4/conf/tunl0/arp_announce

ifconfig tunl0 1.1.1.1 netmask 255.255.255.255 up

route add -host 1.1.1.1 dev tunl0

Use case 7: Configure load balancing in DSR mode by using IP Over IP

September 21, 2020
Contributed by: 
S C
September 21, 2020
Contributed by: 
S C

In this article