Product Documentation

Configuring in a NetScaler Partition

Dec 22, 2016

Accessing a partitioned NetScaler is the same as accessing a non-partitioned NetScaler: through the NetScaler IP (NSIP) address or any other management IP address. As a user, after you provide your valid logon credentials, you are taken to the partition to which you are bound. Any configurations that you create are saved to that partition. If you are associated with more than one partition, you are taken to the first partition with which you were associated. If you want to configure entities on one of your other partitions, you must explicitly switch to that partition.

After accessing the appropriate partition, configurations that you perform are saved to that partition and are specific to that partition.

    Note
    NetScaler superusers and other non-partition users are taken to the default partition.
Users of all the 512 partitions can log in simultaneously.

Tip

To access a partitioned NetScaler appliance over HTTPS by using the SNIP (with management access enabled), make sure that each partition has the certificate of its partition administrator. Within the partition, the partition admin must do the following:

Add the certificate to the NetScaler.
> add ssl certKey ns-server-certificate -cert ns-server.cert -key ns-server.key
Bind it to a service named "nskrpcs-<SNIP>-3009", where <SNIP> must be replaced with the SNIP address, in this case 100.10.10.1.
> bind ssl service nskrpcs-100.10.10.1-3009 -certkeyName ns-server-certificate

To configure in a NetScaler partition by using the command line interface

Log on to the NetScaler appliance.
Check if you are in the correct partition. The command prompt displays the name of the currently selected partition.
- If yes, skip to the next step.
- If no, get a list of the partitions with which you are associated and switch over to the appropriate partition.
  - show system user <username>
  - switch ns partition <partitionName>
Now, you can perform the required configurations just as a non-partitioned NetScaler.

To configure in a NetScaler partition by using the configuration utility

Log on to the NetScaler appliance.
Check if you are in the correct partition. The top bar of the graphical user interface displays the name of the currently selected partition.
- If yes, skip to the next step.
- If no, navigate to Configuration > System > Administrative Partitions > Partitions, right-click the partition to which you want to switch, and select Switch.
Now, you can perform the required configurations just as a non-partitioned NetScaler.

Performing Role-based Access (RBA) in an Administrative Partition

In authenticating and authorizating a partitioned NetScaler appliance, a root administrator can assign a partition administrator to one or more partitions. The partition administrator can authorize users to that partition without affecting other partitions. These are partition users and they are authorized to access only that partition using SNIP address. Both the root administrator and the partition administrator can configure role based access (RBA by authorizing users to access different applications.

Administrators and user roles can be described as follows:

Root Administrator: Accesses the partitioned appliance through its NSIP address and can grant user access to one or more partitions. The administrator can also assign partition administrators to one or more partitions. The administrator can create a partition administrator from the default partition using a NSIP address or switch to a partition and then create a user and assign partition admin access using a SNIP address.

Partition Administrator: Accesses the specified partition through a NSIP address assigned by the root administrator. The administrator can assign role-based access to partition user access to that partition and also configure external server authentication using partition specific configuration.

System User: Accesses partitions through the NSIP address. Has access to the partitions and resources specified by the root administrator.

Partition User: Accesses a partition through a SNIP address. This user account is created by the partition administrator and the user has access to resources, only within the partition.

Points to Remember

Following are some points to remember when providing role-based access in a partition.

NetScaler users accessing NetScaler GUI through NSIP address will use default partition authentication configuration to log on to the appliance.
Partition system users accessing NetScaler GUI through partition SNIP address will use partition specific authentication configuration to log on to the appliance.
Partition user created in a partition cannot login using NSIP address.
NetScaler user bound to a partition cannot login using partition SNIP address.
External users accessing a partition through external server configuration as LDAP, Radius, or TACACS added in the partition. The user must access using SNIP address to directly log onto the partition.

Use Case: Providing Role Based Access in an Administrative Partition

Consider a scenario where an enterprise organization, www.example.com has multiple business units and a centralized administrator who manages all instances in their network. However, they want to provide exclusive user privileges and environment for each business unit.

Following are the administrators and users managed by default partition authentication configuration and partition specific configuration in a partitioned appliance.

John: Root Administrator

George: Partition Administrator

Adam: System User

Jane: Partition User

John, is the root administrator of a partitioned NetScaler appliance. John manages all user accounts and administrative user accounts across partitions (for example, P1, P2, P3, P4, and P5) within the appliance. He provides granular role-based access to entities from the default partition of the appliance. John creates user accounts and assigns partition access to each account. George being a network engineer within the organization prefers to have a role based access to few applications running on partition P2. Based on user management, John creates a partition administrator role for George and associates his user account with partition-admin command policy in P2 partition. Adam being another network engineer prefers to access an application running on P2. John creates a system user account for Adam and associates his user account to P2 partition. Once his account is created, Adam can log into the appliance to access the NetScaler Management interface through NSIP address and can switch to partition P2 based on user/group binding.

Suppose, Jane who is another network engineer wants to directly access an application running only on partition P2, George (partition administrator) can create a partition user account for her and associate her account with command policies for authorization privileges. Jane’s user account created within the partition is now directly associated with P2. Now Jane can access the NetScaler Management interface through SNIP address and cannot switch to any other partition.

Note: If Jane’s user account is created by a partition administrator in partition P2, she can access the NetScaler Management interface only through SNIP address (created within the partition) and not permitted to access the interface through NSIP address. Similarly, if Adam’s user account is created by a root administrator in the default partition and is bound to P2 partition, he can access the NetScaler Management interface only through NSIP address or SNIP address created in the default partition (with management access enabled) and not permitted to access the partition interface through SNIP address created in the administrative partition.

Roles and Responsibilities of administrators in a partitioned appliance

Following are the configurations performed by a root administrator in a default partition.

Creating administrative partitions and system users – A root administrator creates administrative partitions and system users in the default partition of the appliance. The administrator then associates the users to different partitions. If you are bound to one or more partitions, you can switch from one partition to another based on user bindings. Also, your access to one or more bound partitions is authorized only by the root administrator.

Authorizing system user as partition administrator for a specific partition – Once a user account is created, the root administrator switches to a specific partition and authorizes the user as the partition administrator. This is done by assigning partition-admin command policy to the user account. Now, the user can access the partition as partition administrator and manage entities within the partition.

Following are the configurations perform by a partition administrator in an administrative partition.

Configuring SNIP address in an administrative partition- The partition administrator logs on to the partition and creates a SNIP address and provides management access to the address.

Creating and Binding a Partition System User with Partition Command Policy -The partition administrator creates partition users and defines the scope of user access. This is done by binding the user account to partition command policies.

Creating and Binding a Partition System User Groups with Partition Command Policy -The partition administrator creates partition user groups and defines the scope of user group access. This is done by binding the user group account to partition command policies.

Configuring External Server authentication for external users (optional)-This configuration is done for authenticating external TACACS users accessing the partition using SNIP address.

Configuring Role-based access in an Administrative Partition

Following are the tasks performed in configuring role-based access for partition users in an Administrative Partition.

Creating an Administrative Partition – Before you create partition users in an administrative partition, you must first create the partition. As a root administrator, you can create a partition from the default partition using the configuration utility or a command line interface.
Switching user access from default partition to partition P2 – If you are partition administrator accessing the appliance from the default partition, you can switch from default partition to a specific partition (for example, partition P2) based on user binding.
Adding SNIP address to the Partition user account with Management access enabled-Once you have switched your access to an administration partition, you must create a SNIP address and provide management access to the address.
Creating and Binding a Partition System User with Partition Command Policy-If you are a partition administrator, you can create partition users and define the scope of user access. This is done by binding the user account to partition command policies.
Creating and Binding Partition user group with Partition Command Policy-If you are a partition administrator, you can create partition user groups and define the scope of user access control. This is done by bind the user group account to partition command policies.

Configuring External Server authentication for external users (optional)-This configuration is done for authenticating external TACACS users accessing the partition using SNIP address.

Adding an Administrative Partition

The root administrator adds an administrative partition from the default partition and binds the partition with VLAN 2.

To create an administrative partition by using the command line interface:

At the command prompt, type:

command Copy

add partition <partitionname>

Switching user access from default partition to bound admin partition

Now switch user access from default partition to partition Par1.

To switch a user account from default partition to an administrative partition by using the command line interface:

At the command prompt, type:

command Copy

Switch ns partition <pname>

Adding SNIP address to the Partition user account with Management access enabled

In the partition, create SNIP address with management access enabled.

To add SNIP address to the partition user account with management access enabled by using the command line interface:

At the command prompt, type:

command Copy

> add ns ip <ip address> <subnet mask> -mgmtAccess enabled

Creating and Binding a Partition System User with Partition Command Policy

In partition, create a partition system user and bind the user with partition-admin command policies.

To create and bind a partition system user with partition command policy by using the command line interface:

At the command prompt, type:

command Copy

> add system user <username> <password>
Done

Creating and Binding Partition user group with Partition Command Policy

In Partition Par1, create a partition system user group and bind the group with partition command policy such as partition admin, partition read-only, partition-operator, or partition-network.

To create and bind a partition user group with partition command policy by using the command line interface:

command Copy

> add system user group <groupname>
> bind system user group <groupname> -policyname <cmdpolicy> <priority value>
> bind system user group <groupname> -username <username>

Configuring External Server authentication for external users

In partition Par1 you can configure an external server authentication to authenticate external TACACS users accessing the partition through SNIP address.

To configure external server authentication for external users by using the command line interface:

At the command prompt, type:

command Copy

add authentication tacacsaction <name> -serverip <IP> -tacacsSecret <secret key> -authorization ON -accounting ON
add authentication policy <policname> -rule true -action <name> 
bind system global <policyname> -priority <value>1

Configuring a Partition System User Accounts in a Partition by using the NetScaler GUI

To configure a partition user account in an administrative partition, you must create a partition user or a partition user group and bind it partition command policies. Also, you can configure the external server authentication for an external user.

To create a partition user account in a partition by using the NetScaler GUI

Navigate to System > User Administration, click Users to add a partition system user and bind the user to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).

To create a partition user group account in a partition by using the NetScaler GUI

Navigate to System > User Administration, click Groups to add a partition system user group and bind the user group to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).

To configure External server authentication for external users by using the NetScaler GUI

Navigate to System > Authentication > Basic Actions and click TACACS to configure TACACS server for authenticating external users accessing the partition.

Sample Configuration

The following configuration shows how to create a partition user or a partition user group and bind it partition command policies. Also, how to configure the external server authentication for authenticating an external user.

command Copy

add partition Par1

switch ns partition Par1

> add ns ip 10.102.29.203 255.255.255.0 -mgmtAccessenabled

> add system user John Password

> bind system user Jane partition-read-only -priority 1

> add system group Retail

> bind system group Retail -policyname partition-network 1 (where 1 is the priority number)

> bind system group Retail –username Jane

> add authentication tacacssaction tacuser –serverip 10.102.29.200 –tacacsSecret Password –authorization ON –accounting ON

> add authentication policy polname –rule true –action tacacsAction

> bind system global polname –priority 1

Command Policies for a Partition Users and Partition User Groups in Administrative Partition

Commands to authorize an user account inside Administrative Partition

Command Policies available inside an Administrative Partition (built-in policies)

User Account access type

add system user

Partition-admin

SNIP