Product Documentation

VLAN configuration for admin partitions

VLANs can be bound to a partition as a “Dedicated” VLAN or a “Shared” VLAN. Based on your deployment, you can bind a VLAN to a partition to isolate its network traffic from other partitions.

Dedicated VLAN – A VLAN bound only to one partition with “Sharing” option disabled and must be a tagged VLAN. For example, in a client-server deployment, for security reasons a system administrator creates a dedicated VLAN for each partition on the server side.

Shared VLAN – A VLAN bound (shared across) to multiple partitions with “Sharing” option enabled. For example, in a client-server deployment, if the system administrator does not have control over the client side network, a VLAN is created and shared across multiple partitions.

Shared VLAN can be used across multiple partitions. It is created in the default partition and you can bind a shared VLAN to multiple partitions. By default, a shared VLAN is bound to the default partition implicitly and hence it cannot be bound explicitly.

Note

If a Citrix ADC Virtual Appliance is deployed on an ESX platform, you must enable the Promiscuous mode for shared VLANs with partition. Otherwise, if the traffic is through a dedicated VLAN, you must enable the VLAN with Portgroup properties of the virtual switch.

In a partitioned (multi-tenant) Citrix ADC appliance, a system administrator can isolate the traffic flowing to a particular partition or partitions by binding one or more VLANs to each partition.  A VLAN can be dedicated to one partition or Shared across multiple partitions.

Dedicated VLANs

To isolate the traffic flowing into a partition, create a VLAN and associate it with the partition.  The VLAN is then visible only to the associated partition, and the traffic flowing through the VLAN is classified and processed only in the associated partition.

localized image

To implement a dedicated VLAN for a particular partition, do the following.

  1. Add a VLAN (V1).
  2. Bind a network interface to VLAN as a tagged network interface.
  3. Create a partition (P1).
  4. Bind partition (P1) to the dedicated VLAN (V1).

To add a VLAN by using the command line interface

At the command prompt, type:

add vlan <id>

add vlan V1

To bind a VLAN by using the command line interface

At the command prompt, type:

bind vlan <id> -ifnum <interface> -tagged

bind vlan V1 –ifnum 1/8 -tagged

To create a partition by using the command line interface

At the command prompt, type:

Add ns partition <partition name> [-maxBandwidth <positive_integer>][-maxConn <positive_integer>] [-maxMemLimit <positive_integer>]

Add ns partition P1 –maxBandwidth 200 –maxconn 50 –maxmemlimit 90

Done

To bind a partition to a VLAN by using the Citrix ADC CLI

At the command prompt, type:

bind partition <partition-id> -vlan <vlan>

bind partition P1 –vlan V1

To configure a dedicated VLAN by using the Citrix ADC GUI

  1. Navigate to Configuration > System > Network > VLANs* and click Add to create a VLAN.
  2. On the Create VLAN page, set the following parameters:
    • VLAN ID
    • Alias Name
    • Maximum Transmission Unit
    • Dynamic Routing
    • IPv6 Dynamic Routing
    • Partitions Sharing
  3. In the Interface Bindings section, select one or more interfaces and bind it to the VLAN.
  4. In the IP Bindings section, select one or more IP addresses and bind to the VLAN.
  5. Click OK and Done.

Shared VLAN

In a shared VLAN configuration, each partition has a MAC address, and traffic received on the shared VLAN is classified by MAC address. Only a Layer3 VLAN is recommended because it can restrict the subnet traffic. A partition MAC address is applicable and important only for a shared VLAN deployment.

Note

Shared VLAN in a partitioned appliance does not support dynamic routing protocol.

The following diagram shows how a VLAN (VLAN 10) is shared across two partitions.

localized image

To deploy a shared VLAN configuration, do the following:

  1. Create a VLAN with the sharing option ‘enabled’, or enable the sharing option on an existing VLAN. By default, the option is ‘disabled’.
  2. Bind partition interface to shared VLAN.
  3. Create the partitions, each with its own PartitionMAC address.
  4. Bind the partitions to the shared VLAN.

To configure a shared VLAN by using the command line interface

At the command prompt, type one of the following commands to add a new VLAN or set the sharing parameter of an existing VLAN:

    add vlan <id> [-sharing (ENABLED | DISABLED)]

    set vlan <id> [-sharing (ENABLED | DISABLED)]

    add vlan V1 –sharing ENABLED

    set vlan V1 –sharing ENABLED

To bind a partition to a Shared VLAN by using the command line interface

At the command prompt, type:

    bind partition <partition-id> -vlan <id>

    bind partition P1 –vlan

    Add ns partition P1 –maxBandwidth 200 –maxconn 50   –maxmemlimit 90 -partitionMAC<mac_addr

Done

To configure a Partition MAC Address

At the command prompt, type:

   set ns partition <partition name> [-partitionMAC<mac_addr>]

   set ns partition P1 –partitionMAC 22:33:44:55:66:77

To bind partitions to a shared VLAN by using the command line interface

At the command prompt, type:

    bind partition <partition-id> -vlan <id>

    bind partition <partition-id> -vlan <id>

    bind partition P1 –vlan V1

    bind partition P2 –vlan V1

    bind partition P3 –vlan V2

    bind partition P4 –vlan V1

To configure Shared VLAN by using the Citrix ADC GUI

  1. Navigate to Configuration > System > Network > VLANs and then select a VLAN profile and click Edit to set the partition sharing parameter.
  2. On the Create VLAN page, select the Partitions Sharing checkbox.
  3. Click OK and then Done.

VLAN configuration for admin partitions

In this article