-
Getting Started with Citrix NetScaler
-
Deploy a Citrix NetScaler VPX instance
-
Install a Citrix NetScaler VPX instance on Microsoft Hyper-V servers
-
Install a NetScaler VPX instance on Linux-KVM platform
-
Prerequisites for Installing NetScaler VPX Virtual Appliances on Linux-KVM Platform
-
Provisioning the NetScaler Virtual Appliance by using OpenStack
-
Provisioning the NetScaler Virtual Appliance by using the Virtual Machine Manager
-
Configuring NetScaler Virtual Appliances to Use SR-IOV Network Interface
-
Configuring NetScaler Virtual Appliances to use PCI Passthrough Network Interface
-
Provisioning the NetScaler Virtual Appliance by using the virsh Program
-
-
Deploying NetScaler VPX Instances on AWS
-
Upgrade and downgrade a NetScaler appliance
-
-
-
-
-
-
Overriding Static Proximity Behavior by Configuring Preferred Locations
-
Example of a Complete Parent-Child Configuration Using the Metrics Exchange Protocol
-
Configuring Global Server Load Balancing for DNS Queries with NAPTR records
-
Using the EDNS0 Client Subnet Option for Global Server Load Balancing
-
-
Persistence and persistent connections
-
Advanced load balancing settings
-
Gradually stepping up the load on a new service with virtual server–level slow start
-
Protect applications on protected servers against traffic surges
-
Use source IP address of the client when connecting to the server
-
Set a limit on number of requests per connection to the server
-
Configure automatic state transition based on percentage health of bound services
-
-
Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
-
Use case 3: Configure load balancing in direct server return mode
-
Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
-
Use case 7: Configure load balancing in DSR mode by using IP Over IP
-
Use case 10: Load balancing of intrusion detection system servers
-
Use case 11: Isolating network traffic using listen policies
-
Use case 14: ShareFile wizard for load balancing Citrix ShareFile
-
-
-
-
-
Configuring a CloudBridge Connector Tunnel between two Datacenters
-
Configuring CloudBridge Connector between Datacenter and AWS Cloud
-
Configuring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
-
Configuring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
-
Configuring a CloudBridge Connector Tunnel Between a NetScaler Appliance and Cisco IOS Device
-
CloudBridge Connector Tunnel Diagnostics and Troubleshooting
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Configuring a CloudBridge Connector tunnel between a NetScaler appliance and Cisco IOS device
You can configure a CloudBridge Connector tunnel between a NetScaler appliance and a Cisco device to connect two datacenters or extend your network to a Cloud provider. The NetScaler appliance and the Cisco IOS device form the end points of the CloudBridge Connector tunnel and are called peers.
Example of CloudBridge Connector tunnel configuration and data flow
As an illustration of the traffic flow in a CloudBridge Connector tunnel, consider an example in which a CloudBridge Connector tunnel is set up between the following devices:
- NetScaler appliance NS_Appliance-1 in a datacenter designated as Datacenter-1
- Cisco IOS device Cisco-IOS-Device-1 in a datacenter designated as Datacenter-2
NS_Appliance-1 and Cisco-IOS-Device-1 enable communication between private networks in Datacenter-1 and Datacenter-2 through the CloudBridge Connector tunnel. In the example, NS_Appliance-1 and Cisco-IOS-Device-1 enable communication between client CL1 in Datacenter-1 and server S1 in Datacenter-2 through the CloudBridge Connector tunnel. Client CL1 and server S1 are on different private networks.
On NS_Appliance-1, the CloudBridge Connector tunnel configuration includes IPSec profile entity NS_Cisco_IPSec_Profile, CloudBridge Connector tunnel entity NS_Cisco_Tunnel, and policy based routing (PBR) entity NS_Cisco_Pbr.
For more information, refer to the CloudBridge Connector tunnel between a NetScaler appliance and Cisco IOS device settings pdf.
Points to Consider for a CloudBridge Connector tunnel configuration
Before configuring a CloudBridge Connector tunnel between a NetScaler appliance and a Cisco IOS device, consider the following points:
- The following IPSec settings are supported for a CloudBridge Connector tunnel between a NetScaler appliance and a Cisco IOS device.
IPSec Properties | Setting |
---|---|
IPSec mode | Tunnel mode |
IKE version | Version 1 |
IKE authentication method | Pre-Shared Key |
IKE encryption algorithm | AES, 3DES |
IKE hash algorithm | HMAC SHA1, HMAC SHA256, HMAC SHA384, HMAC SHA512, HMAC MD5 |
ESP encryption algorithm | AES, 3DES |
ESP hash algorithm | HMAC SHA1, HMAC SHA256, HMAC SHA256, HMAC SHA256, HMAC MD5 |
- You must specify the same IPSec settings on the NetScaler appliance and the Cisco IOS device at the two ends of the CloudBridge Connector.
- NetScaler provides a common parameter (in IPSec profiles) for specifying an IKE hash algorithm and an ESP hash algorithm. It also provides another, and a common parameter for specifying an IKE encryption algorithm and an ESP encryption algorithm. Therefore on the Cisco device, you must specify the same hash algorithm and same encryption algorithm for IKE (while creating IKE policy) and ESP (while creating IPSec transform set).
- You must configure the firewall at the NetScaler end and Cisco device end to allow the following.
- Any UDP packets for port 500
- Any UDP packets for port 4500
- Any ESP (IP protocol number 50) packets
Configuring Cisco IOS device for the CloudBridge Connector tunnel
To configure a CloudBridge Connector tunnel on a Cisco IOS device, use the Cisco IOS command line interface, which is the primary user interface for configuring, monitoring, and maintaining Cisco devices.
Before you begin the CloudBridge Connector tunnel configuration on a Cisco IOS device, make sure that:
- You have a user account with administrator credentials on the Cisco IOS device.
- You are familiar with the Cisco IOS command line interface.
- The Cisco IOS device is UP and running, is connected to the Internet, and is also connected to the private subnets whose traffic is to be protected over the CloudBridge Connector tunnel.
Note:
The procedures for configuring CloudBridge Connector tunnel on a Cisco IOS device might change over time, depending on the Cisco release cycle. Citrix recommends that you follow the official Cisco product documention for more information, see Configuring IPSec VPN tunnels topic.
To configure a CloudBridge connector tunnel between a NetScaler appliance and a Cisco IOS device, perform the following tasks on the Cisco device’s IOS command line:
- Create an IKE Policy. An IKE policy defines a combination of security parameters to be used during the IKE negotiation. For example, parameters such as hash algorithm, encryption algorithm, Diffie-Hellman group, and authentication method to be used in the IKE negotiation are set in this task.
- Configure a Pre-shared key for IKE authentication. A pre-shared key is a text string, which the peers of a CloudBridge Connector tunnel use to mutually authenticate with each other. The pre-shared keys are matched against each other for IKE authentication. Therefore, for the authentication to be successful, you must configure the same pre-shared key on the Cisco device and the NetScaler appliance.
- Define a transform set and configure IPSec in tunnel mode. A transform set defines a combination of security parameters to be used in the exchange of data over the CloudBridge Connector tunnel after the IKE negotiation is successful. Parameters such as hash algorithm and encryption algorithm are set in this task. This task also specifies that IPSec in tunnel mode be used for the CloudBridge tunnel.
- Create a crypto access List. Crypto access lists are used to define the subnets whose IP traffic will be protected over the CloudBridge tunnel. The source and destination parameters in the access list specify the Cisco device side and NetScaler side subnets that are to be protected over the CloudBridge Connector Tunnel. The access list must be set to permit. Any request packet that originates from a device in the Cisco device side subnet and is destined to a device in the NetScaler side subnet, and that matches the source and destination parameters of the access list, is sent across the CloudBridge Connector tunnel.
- Create a crypto map. Crypto maps define the IPSec parameters to be negotiated with peer. They include the following: Crypto access list to identify the subnets whose traffic is to be protected over the CloudBridge tunnel, peer (NetScaler) identification by IP address, and transform set to match the peer security settings.
- Apply the crypto Map to an interface. In this task, you apply a crypto map to an interface through which CloudBridge Connector tunnel traffic will flow. Applying the crypto map to an interface instructs the Cisco IOS device to evaluate all the interface traffic against the crypto map set, and to use the specified policy during connection or SA negotiation on behalf of subnet’s traffic to be protected.
The examples in the following procedures create settings of Cisco IOS device Cisco-IOS-Device-1 used in “Example of CloudBridge Connector Configuration and Data Flow.”
To create an IKE policy, refer to the IKE policy pdf.
To configure a pre-shared key by using the Cisco IOS command line
At the Cisco IOS device’s command prompt, type the following commands, starting in global configuration mode, in the order shown:
Command | Example | Command Description |
---|---|---|
crypto isakmp identity address | Cisco-ios-device-1(config)# crypto isakmp identity address | Specify the ISAKMP identity (address) for the Cisco IOS device to use when communicating with the peer (NetScaler appliance) during IKE negotiations. This example specifies the address keyword, which uses IP address 203.0.113.200 (Gigabit Ethernet interface 0/1 of Cisco-IOS-Device-1) as the identity for the device. |
crypto isakmp key keystringaddress peer-address | Cisco-ios-device-1 (config)# crypto isakmp key examplepresharedkey address 198.51.100.100 | Specify a pre-shared key for the IKE authentication. This example configures shared key examplepresharedkey to be used with the NetScaler appliance NS_Appliance-1 (198.51.100.100). The same pre-shared key must be configured on the NetScaler appliance for IKE authentication to be successful between the Cisco IOS device and the NetScaler appliance. |
To create a crypto access list by using the Cisco IOS command line
At the Cisco IOS device’s command prompt, type the following command in global configuration mode, in the order shown:
Command | Example | Command Description |
---|---|---|
access-listaccess-list-number permit IPsource source-wildcard destination destination-wildcard | Cisco-ios-device-1(config)# access-list 111 permit ip 10.20.20.0 0.0.0.255 10.102.147.0 0.0.0.255 | Specify conditions to determine the subnets whose IP traffic is to be protected over the CloudBridge Connector tunnel. This example configures access list 111 to protect traffic from subnets 10.20.20.0/24 (at the Cisco-IOS-Device-1 side) and 10.102.147.0/24 (at the NS_Appliance-1 side). |
To define a transform and configure IPSec tunnel mode by using the Cisco IOS command line
At the Cisco IOS device’s command prompt, type the following commands, starting in global configuration mode, in the order shown: |Command|Example|Command Description| |–|–|–| |crypto ipsec transform-setname ESP_Authentication_Transform ESP_Encryption_Transform Note: ESP_Authentication_Transform can take the following values:
esp-sha-hmac esp-sha256-hmac esp-sha384-hmac esp-sha512-hmac esp-md5-hmac
ESP_Encryption_Transformcan take the following values:
esp-aes esp-3des|Cisco-ios-device-1(config)# crypto ipsec transform-set NS-CISCO-TS esp-sha256-hmac esp-3des|Define a transform set and specify the ESP hash algorithm (for authentication) and the ESP encryption algorithm to be used during exchange of data between the CloudBridge Connector tunnel peers. This example defines transform set NS-CISCO-TS and specifies ESP authentication algorithm as esp-sha256-hmac, and ESP encryption algorithm as esp-3des.| |mode tunnel|Cisco-ios-device-1 (config-crypto-trans)# mode tunnel|Set IPSec in tunnel mode.| |exit|Cisco-ios-device-1 (config-crypto-trans)# exit, Cisco-ios-device-1 (config)#|Exit back to global configuration mode.|
To create a crypto map by using the Cisco IOS command line
At the Cisco IOS device’s command prompt, type the following commands starting in global configuration mode, in the order shown:
Command | Example | Command Description |
---|---|---|
crypto mapmap-name seq-num ipsec-isakmp | Cisco-ios-device-1 (config)# crypto map NS-CISCO-CM 2 ipsec-isakmp | Enter crypto map configuration mode, specify a sequence number for the crypto map, and configure the crypto map to use IKE to establish security associations (SAs). This example configures sequence number 2 and IKE for crypto map NS-CISCO-CM. |
set peer ip-address | Cisco-ios-device-1 (config-crypto-map)# set peer 172.23.2.7 | Specify the peer (NetScaler appliance) by its IP address. This example specifies 198.51.100.100, which is the CloudBridge Connector endpoint IP address on the NetScaler appliance. |
match addressaccess-list-id | Cisco-ios-device-1 (config-crypto-map)# match address 111 | Specify an extended access list. This access list specifies conditions to determine the subnets whose IP traffic is to be protected over the CloudBridge Connector tunnel. This example specifies access list 111. |
set transform-set transform-set-name | Cisco-ios-device-1 (config-crypto-map)# set transform-set NS-CISCO-TS | Specify which transform sets are allowed for this crypto map entry. This example specifies transform set NS-CISCO-TS. |
exit | Cisco-ios-device-1 (config-crypto-map)# exit | |
Cisco-ios-device-1 (config)# | Exit back to global configuration mode. |
To apply a crypto map to an interface by using the Cisco IOS command line
At the Cisco IOS device’s command prompt, type the following commands starting in global configuration mode, in the order shown:
Command | Example | Command Description |
---|---|---|
interfaceinterface-ID | Cisco-ios-device-1(config)# interface GigabitEthernet 0/1 | Specify a physical interface to which to apply the crypto map and enter interface configuration mode. This example specifies Gigabit Ethernet interface 0/1 of the Cisco device Cisco-IOS-Device-1. IP address 203.0.113.200 is already set to this interface. |
crypto mapmap-name | Cisco-ios-device-1 (config-if)# crypto map NS-CISCO-CM | Apply the crypto map to the physical interface. This example applies crypto map NS-CISCO-CM. |
exit | Cisco-ios-device-1 (config-if)# exit, Cisco-ios-device-1 (config)# | Exit back to global configuration mode. |
Configuring the NetScaler appliance for the CloudBridge Connector tunnel
To configure a CloudBridge Connector tunnel between a NetScaler appliance and a Cisco IOS device, perform the following tasks on the NetScaler appliance. You can use either the NetScaler command line or the NetScaler graphical user interface (GUI):
- Create an IPSec profile. An IPSec profile entity specifies the IPSec protocol parameters, such as IKE version, encryption algorithm, hash algorithm, and authentication method (Pre-Shared key) to be used by the IPSec protocol in the CloudBridge Connector tunnel.
- Create an IP tunnel that uses IPSec protocol, and associate the IPSec profile with it. An IP tunnel specifies the local IP address (CloudBridge Connector tunnel end point IP address (of type SNIP) configured on the NetScaler appliance), remote IP address (CloudBridge Connector tunnel endpoint IP address configured on the Cisco IOS device), protocol (IPSec) used to set up the CloudBridge Connector tunnel, and an IPSec profile entity. The created IP tunnel entity is also called the CloudBridge Connector tunnel entity.
- Create a PBR rule and associate it with the IP tunnel. A PBR entity specifies a set of rules and an IP tunnel (CloudBridge Connector tunnel) entity. The source IP address range and the destination IP address range are the conditions for the PBR entity. Set the source IP address range to specify the NetScaler-side subnet whose traffic is to be protected over the tunnel, and set the destination IP address range to specify the Cisco IOS device side subnet whose traffic is to be protected over the tunnel. Any request packet that originates from a client in the subnet on the NetScaler side and is destined to a server in the Cisco IOS device side subnet, and matches the source and destination IP range of the PBR entity, is sent across the CloudBridge Connector tunnel associated with the PBR entity. Apply the PBR rule to make it functional.
To create an IPSEC profile by using the NetScaler command line
At the Command prompt, type:
add ipsec profile <name> -psk <string> -ikeVersion v1
show ipsec profile <name>
To create an IPSEC tunnel and bind the IPSEC profile to it by using the NetScaler command line
At the Command prompt, type:
add ipTunnel <name> <remote> <remoteSubnetMask> <local> -protocol IPSEC –ipsecProfileName <string>
add ipTunnel <name>
To create a PBR rule and bind the IPSEC tunnel to it by using the NetScaler command line
At the Command prompt, type:
add pbr <pbrName> ALLOW –srcIP <subnet-range> -destIP <subnet-range> -ipTunnel <tunnelName>
apply pbrs
show pbrs <pbrName>
The following commands create settings of NetScaler appliance NS_Appliance-1 in “Example of CloudBridge Connector Configuration and Data Flow.”
> add ipsec profile NS_Cisco_IPSec_Profile -psk examplepresharedkey -ikeVersion v1 –lifetime 315360 –encAlgo 3DES
Done
> add iptunnel NS_Cisco_Tunnel 203.0.113.200 255.255.255.255 198.51.100.100 –protocol IPSEC –ipsecProfileName NS_Cisco_IPSec_Profile
Done
> add pbr NS_Cisco_Pbr -srcIP 10.102.147.0-10.102.147.255 –destIP 10.20.0.0-10.20.255.255 –ipTunnel NS_Cisco_Tunnel
Done
> apply pbrs
Done
<!--NeedCopy-->
To create an IPSEC profile by using the GUI
- Navigate to System > CloudBridge Connector > IPSec Profile.
- In the details pane, click Add.
- In the Add IPSec Profile dialog box, set the following parameters:
- Name
- Encryption Algorithm
- Hash Algorithm
- IKE Protocol Version
- Configure the IPSec authentication method to be used by the two CloudBridge Connector tunnel peers to mutually authenticate: Select the Pre-shared key authentication method and set the Pre-Shared Key Exists parameter.
- Click Create, and then click Close.
To create an IP tunnel and bind the IPSEC profile to it by using the GUI
- Navigate to System > CloudBridge Connector > IP Tunnels.
- On the IPv4 Tunnels tab, click Add.
- In the Add IP Tunnel dialog box, set the following parameters:
- Name
- Remote IP
- Remote Mask
- Local IP Type (In the Local IP Type drop down list, select Subnet IP).
- Local IP (All the configured IPs of the selected IP type are in the Local IP drop down list. Select the desired IP from the list.)
- Protocol
- IPSec Profile
- Click Create, and then click Close.
To create a PBR rule and bind the IPSEC tunnel to it by using the GUI
- Navigate to System > Network > PBR.
- On the PBR tab, click Add.
- In the Create PBR dialog box, set the following parameters:
- Name
- Action
- Next Hop Type (Select IP Tunnel)
- IP Tunnel Name
- Source IP Low
- Source IP High
- Destination IP Low
- Destination IP High
- Click Create, and then click Close.
To apply a PBR by using the GUI
- Navigate to System > Network > PBRs.
- On the PBRs tab, select the PBR, in the Action list, select Apply.
The corresponding new CloudBridge Connector tunnel configuration on the NetScaler appliance appears in the GUI. The current status of the CloudBridge connector tunnel is shown in the Configured CloudBridge Connector pane. A green dot indicates that the tunnel is up. A red dot indicates that the tunnel is down.
Monitoring the CloudBridge Connector Tunnel
You can monitor the performance of CloudBridge Connector tunnels on a NetScaler appliance by using CloudBridge Connector tunnel statistical counters. For more information about displaying CloudBridge Connector tunnel statistics on a NetScaler appliance, see Monitoring CloudBridge Connector Tunnels.
Share
Share
In this article
- Example of CloudBridge Connector tunnel configuration and data flow
- Points to Consider for a CloudBridge Connector tunnel configuration
- Configuring Cisco IOS device for the CloudBridge Connector tunnel
- Configuring the NetScaler appliance for the CloudBridge Connector tunnel
- Monitoring the CloudBridge Connector Tunnel
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select Do Not Agree to exit.