-
Getting Started with Citrix NetScaler
-
Deploy a Citrix NetScaler VPX instance
-
Install a Citrix NetScaler VPX instance on Microsoft Hyper-V servers
-
Install a NetScaler VPX instance on Linux-KVM platform
-
Prerequisites for Installing NetScaler VPX Virtual Appliances on Linux-KVM Platform
-
Provisioning the NetScaler Virtual Appliance by using OpenStack
-
Provisioning the NetScaler Virtual Appliance by using the Virtual Machine Manager
-
Configuring NetScaler Virtual Appliances to Use SR-IOV Network Interface
-
Configuring NetScaler Virtual Appliances to use PCI Passthrough Network Interface
-
Provisioning the NetScaler Virtual Appliance by using the virsh Program
-
-
Deploying NetScaler VPX Instances on AWS
-
Upgrade and downgrade a NetScaler appliance
-
-
-
-
-
-
Overriding Static Proximity Behavior by Configuring Preferred Locations
-
Example of a Complete Parent-Child Configuration Using the Metrics Exchange Protocol
-
Configuring Global Server Load Balancing for DNS Queries with NAPTR records
-
Using the EDNS0 Client Subnet Option for Global Server Load Balancing
-
-
Persistence and persistent connections
-
Advanced load balancing settings
-
Gradually stepping up the load on a new service with virtual server–level slow start
-
Protect applications on protected servers against traffic surges
-
Use source IP address of the client when connecting to the server
-
Set a limit on number of requests per connection to the server
-
Configure automatic state transition based on percentage health of bound services
-
-
Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
-
Use case 3: Configure load balancing in direct server return mode
-
Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
-
Use case 7: Configure load balancing in DSR mode by using IP Over IP
-
Use case 10: Load balancing of intrusion detection system servers
-
Use case 11: Isolating network traffic using listen policies
-
Use case 14: ShareFile wizard for load balancing Citrix ShareFile
-
-
-
Server authentication
-
Support for Gemalto SafeNet Network hardware security module
-
-
-
-
Configuring a CloudBridge Connector Tunnel between two Datacenters
-
Configuring CloudBridge Connector between Datacenter and AWS Cloud
-
Configuring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
-
Configuring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
-
Configuring a CloudBridge Connector Tunnel Between a NetScaler Appliance and Cisco IOS Device
-
CloudBridge Connector Tunnel Diagnostics and Troubleshooting
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已动态机器翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
This content has been machine translated dynamically.
This content has been machine translated dynamically.
This content has been machine translated dynamically.
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.
Este artigo foi traduzido automaticamente.
这篇文章已经过机器翻译.放弃
Translation failed!
Server authentication
Since the NetScaler appliance performs SSL offload and acceleration on behalf of a web server, the appliance does not usually authenticate the Web server’s certificate. However, you can authenticate the server in deployments that require end-to-end SSL encryption.
In such a situation, the appliance becomes the SSL client, carries out a secure transaction with the SSL server, verifies that a CA whose certificate is bound to the SSL service has signed the server certificate, and checks the validity of the server certificate.
To authenticate the server, you must first enable server authentication and then bind the certificate of the CA that signed the server’s certificate to the SSL service on the NetScaler appliance. When binding the certificate, you must specify the bind as CA option.
Enable (or disable) server certificate authentication
You can use the CLI and the GUI to enable and disable server certificate authentication.
Enable (or disable) server certificate authentication using the CLI
At the command prompt, type the following commands to enable server certificate authentication and verify the configuration:
set ssl service <serviceName> -serverAuth ( ENABLED | DISABLED )
show ssl service <serviceName>
Example:
set ssl service ssl-service-1 -serverAuth ENABLED
show ssl service ssl-service-1
Advanced SSL configuration for Back-end SSL Service ssl-service-1:`
DH: DISABLED
Ephemeral RSA: DISABLED
Session Reuse: ENABLED Timeout: 300 seconds
Cipher Redirect: DISABLED
SSLv2 Redirect: DISABLED
Server Auth: ENABLED
SSL Redirect: DISABLED
Non FIPS Ciphers: DISABLED
SSLv2: DISABLED SSLv3: ENABLED TLSv1: ENABLED
1) Cipher Name: ALL
Description: Predefined Cipher Alias
Done
Enable (or disable) server certificate authentication by using the GUI
- Navigate to Traffic Management > Load Balancing > Services, and open an SSL service.
- In the SSL Parameters section, select Enable Server Authentication, and specify a Common Name.
- In Advanced Settings, select Certificates, and bind a CA certificate to the service.
Bind the CA certificate to the service by using the CLI
At the command prompt, type the following commands to bind the CA certificate to the service and verify the configuration:
bind ssl service <serviceName> -certkeyName <string> -CA
show ssl service <serviceName>
Example:
bind ssl service ssl-service-1 -certkeyName samplecertkey -CA
show ssl service ssl-service-1
Advanced SSL configuration for Back-end SSL Service ssl-service-1:
DH: DISABLED
Ephemeral RSA: DISABLED
Session Reuse: ENABLED Timeout: 300 seconds
Cipher Redirect: DISABLED
SSLv2 Redirect: DISABLED
Server Auth: ENABLED
SSL Redirect: DISABLED
Non FIPS Ciphers: DISABLED
SSLv2: DISABLED SSLv3: ENABLED TLSv1: ENABLED
1) CertKey Name: samplecertkey CA Certificate CRLCheck: Optional
1) Cipher Name: ALL
Description: Predefined Cipher Alias
Done
Configure a common name for server certificate authentication
In end-to-end encryption with server authentication enabled, you can include a common name in the configuration of an SSL service or service group. The name that you specify is compared to the common name in the server certificate during an SSL handshake. If the two names match, the handshake is successful. If the common names do not match, the common name specified for the service or service group is compared to values in the subject alternative name (SAN) field in the certificate. If it matches one of those values, the handshake is successful. This configuration is especially useful if there are, for example, two servers behind a firewall and one of the servers spoofs the identity of the other. If the common name is not checked, a certificate presented by either server is accepted if the IP address matches.
Note:
Only domain name, URL, and email ID DNS entries in the SAN field are compared.
Configure common-name verification for an SSL service or service group by using the CLI
At the command prompt, type the following commands to specify server authentication with common-name verification and verify the configuration:
-
To configure common name in a service, type:
set ssl service <serviceName> -commonName <string> -serverAuth ENABLED show ssl service <serviceName>
-
To configure common name in a service group, type:
set ssl serviceGroup <serviceGroupName> -commonName <string> -serverAuth ENABLED show ssl serviceGroup <serviceGroupName>
Example:
set ssl service svc1 -commonName xyz.com -serverAuth ENABLED
show ssl service svc
Advanced SSL configuration for Back-end SSL Service svc1:
DH: DISABLED
Ephemeral RSA: DISABLED
Session Reuse: ENABLED Timeout: 300 seconds
Cipher Redirect: DISABLED
SSLv2 Redirect: DISABLED
Server Auth: ENABLED Common Name: www.xyz.com
SSL Redirect: DISABLED
Non FIPS Ciphers: DISABLED
SNI: DISABLED
SSLv2: DISABLED SSLv3: ENABLED TLSv1: ENABLED
1) CertKey Name: cacert CA Certificate OCSPCheck: Optional
1) Cipher Name: ALL
Description: Predefined Cipher Alias
Done
Configure common-name verification for an SSL service or service group by using the GUI
- Navigate to Traffic Management > Load Balancing > Services or Navigate to Traffic Management > Load Balancing > Service Groups, and open a service or service group.
- In the SSL Parameters section, select Enable Server Authentication, and specify a common name.
Share
Share
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select Do Not Agree to exit.