-
Getting Started with Citrix NetScaler
-
Deploy a Citrix NetScaler VPX instance
-
Install a NetScaler VPX instance on Microsoft Hyper-V servers
-
Install a NetScaler VPX instance on Linux-KVM platform
-
Prerequisites for Installing NetScaler VPX Virtual Appliances on Linux-KVM Platform
-
Provisioning the NetScaler Virtual Appliance by using OpenStack
-
Provisioning the NetScaler Virtual Appliance by using the Virtual Machine Manager
-
Configuring NetScaler Virtual Appliances to Use SR-IOV Network Interface
-
Configuring NetScaler Virtual Appliances to use PCI Passthrough Network Interface
-
Provisioning the NetScaler Virtual Appliance by using the virsh Program
-
Provisioning the NetScaler Virtual Appliance with SR-IOV, on OpenStack
-
Configuring a NetScaler VPX Instance on KVM to Use OVS DPDK-Based Host Interfaces
-
-
Upgrade and downgrade a NetScaler appliance
-
-
-
-
-
Persistence and persistent connections
-
Advanced load balancing settings
-
Gradually stepping up the load on a new service with virtual server–level slow start
-
Protect applications on protected servers against traffic surges
-
Use source IP address of the client when connecting to the server
-
Set a limit on number of requests per connection to the server
-
Configure automatic state transition based on percentage health of bound services
-
-
Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
-
Use case 3: Configure load balancing in direct server return mode
-
Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
-
Use case 7: Configure load balancing in DSR mode by using IP Over IP
-
Use case 10: Load balancing of intrusion detection system servers
-
Use case 11: Isolating network traffic using listen policies
-
Use case 14: ShareFile wizard for load balancing Citrix ShareFile
-
-
-
-
-
-
Configuring a CloudBridge Connector Tunnel between two Datacenters
-
Configuring CloudBridge Connector between Datacenter and AWS Cloud
-
Configuring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
-
Configuring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
-
Configuring a CloudBridge Connector Tunnel Between a NetScaler Appliance and Cisco IOS Device
-
CloudBridge Connector Tunnel Diagnostics and Troubleshooting
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已动态机器翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
This content has been machine translated dynamically.
This content has been machine translated dynamically.
This content has been machine translated dynamically.
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.
Este artigo foi traduzido automaticamente.
这篇文章已经过机器翻译.放弃
Translation failed!
Configure admin partitions
Important
- Only superusers are authorized to create and configure admin partitions.
- Unless specified otherwise, configurations to set up an admin partition must be done from the default partition.
By partitioning a NetScaler appliance, you are in-effect creating multiple instances of a single NetScaler appliance. Each instance has its own configurations and the traffic of each of these partitions is isolated from the other by assigning each partition a dedicated VLAN or a shared VLAN.
A partitioned NetScaler has one default partition and the admin partitions that are created. To set up an admin partition, you must first create a partition with the relevant resources (memory, maximum bandwidth, and connections). Then, specify the users that can access the partition and the level of authorization for each of the users on the partition.
Accessing a partitioned NetScaler is the same as accessing a non-partitioned NetScaler: through the NSIP address or any other management IP address. As a user, after you provide your valid logon credentials, you are taken to the partition to which you are bound. Any configurations that you create are saved to that partition. If you are associated with more than one partition, you are taken to the first partition with which you were associated. If you want to configure entities on one of your other partitions, you must explicitly switch to that partition.
After accessing the appropriate partition, configurations that you perform are saved to that partition and are specific to that partition.
Note
- NetScaler superusers and other non-partition users are taken to the default partition.
- Users of all the 512 partitions can log in simultaneously.
Tip
To access a partitioned NetScaler appliance over HTTPS by using the SNIP (with management access enabled), make sure that each partition has the certificate of its partition administrator. Within the partition, the partition admin must do the following:
-
Add the certificate to the NetScaler.
add ssl certKey ns-server-certificate -cert ns-server.cert -key ns-server.key
-
Bind it to a service named “nskrpcs-<SNIP>-3009”, where <SNIP> must be replaced with the SNIP address, in this case 100.10.10.1.
bind ssl service nskrpcs-100.10.10.1-3009 -certkeyName ns-server-certificate
Partition resource limiting
In a partitioned NetScaler appliance, a network administrator can create a partition with partition resources such as memory, bandwidth, and connection limit configured as unlimited. This is done by specifying Zero as the partition resource value, where Zero indicates the resource is unlimited on the partition and it can be consumed up to system limits. Partition resource configuration is useful when you migrate a traffic domain deployment to an administrative partition or if you do not know about resource allocation limit for a partition in a given deployment.
Resource limit for an administrative partition is as follows:
-
Partition memory. This is the maximum allocated memory for a partition. You must make sure to specify the values when creating a partition.
Note
From NetScaler 12.0 onwards, when you create a partition, you can set the memory limit to Zero. If a partition is already created with a specific memory limit, you can reduce the limit to any value or set the limit as Zero.
Parameter: maxMemLimit
Maximum memory is allocated in megabytes in a partition. A zero value indicates the memory is unlimited on the partition and it can consume up to the system limits.
Default value: 10
-
Partition bandwidth. Maximum allocated bandwidth for a partition. If you specify a limit, make sure it is within the appliance’s licensed throughput. Otherwise, you are not limiting the bandwidth that can be used by the partition. The specified limit is accountable for the bandwidth that the application requires. If the application bandwidth exceeds the specified limit, packets are dropped.
Note
From NetScaler 12.0 onwards, when you can create a partition, you can set the partition bandwidth limit to Zero. If a partition is already created with a specific bandwidth, you can reduce the bandwidth or set the limit as Zero.
Parameter: maxBandwidth
Maximum bandwidth is allocated in Kbps in a partition. A zero value indicates the bandwidth is unrestricted. That is, the partition can consume up to the system limits.
Default value: 10240
Maximum Value: 4294967295
-
Partition connection. Maximum number of concurrent connections that can be open in a partition. The value must accommodate the maximum simultaneous flow expected within the partition. The partition connections are accounted from the partition quota memory. Previously, the connections were accounted from the default partition quota memory. It is configured only on the client-side, not on the back-end server-side TCP connections. New connections cannot be established beyond this configured value.
Note
From NetScaler 12.0 onwards, you can create a partition with number of open connections set to Zero. If you have already created a partition with a specific number of open connections, you can reduce the connection limit or set the limit as Zero.
Parameter: maxConnections
Maximum number of concurrent connections that can be open in the partition. A zero value indicates no limit on number of open connections.
Default value: 1024
Minimum value: 0
Maximum Value: 4294967295
Configure an admin partition
To configure an admin partition, complete the following tasks.
Access an admin partition
To access in an admin partition by using the command line interface
-
Log on to the NetScaler appliance.
-
Check if you are in the correct partition. The command prompt displays the name of the currently selected partition.
-
If yes, skip to the next step.
-
If no, get a list of the partitions with which you are associated and switch over to the appropriate partition.
- show system user <username>
- switch ns partition <partitionName>
-
Now, you can perform the required configurations just as a non-partitioned NetScaler.
To access an admin partition by using the configuration utility
-
Log on to the NetScaler appliance.
-
Check if you are in the correct partition. The top bar of the graphical user interface displays the name of the currently selected partition.
-
If yes, skip to the next step.
-
If no, navigate to Configuration > System > Administrative Partitions > Partitions, right-click the partition to which you want to switch, and select Switch.
-
-
Now, you can perform the required configurations just as a non-partitioned NetScaler.
Add an admin partition
The root administrator adds an administrative partition from the default partition and binds the partition with VLAN 2.
To create an administrative partition by using the command line interface**
At the command prompt, type:
add partition <partitionname>
Switch user access from default partition to an admin partition
Now switch user access from default partition to partition Par1.
To switch a user account from default partition to an admin partition by using the command line interface:
At the command prompt, type:
Switch ns partition <pname>
Adding SNIP address to a partition user account with management access enabled
In the partition, create SNIP address with management access enabled.
To add SNIP address to the partition user account with management access enabled by using the command line interface:
At the command prompt, type:
> add ns ip <ip address> <subnet mask> -mgmtAccess enabled
Create and Bind a partition user with partition command policy
In partition, create a partition system user and bind the user with partition-admin command policies.
To create and bind a partition system user with partition command policy by using the command line interface:
At the command prompt, type:
> add system user <username> <password>
Done
Creating and binding partition user group with partition command policy
In Partition Par1, create a partition system user group and bind the group with partition command policy such as partition admin, partition read-only, partition-operator, or partition-network.
To create and bind a partition user group with partition command policy by using the command line interface:
> add system group <groupName>
> bind system group <groupname> (-userName | -policyName <cmdpolicy> <priority> | -partitionName)
Configuring external server authentication for external users
In partition Par1 you can configure an external server authentication to authenticate external TACACS users accessing the partition through SNIP address.
To configure external server authentication for external users by using the command line interface:
At the command prompt, type:
add authentication tacacsaction <name> -serverip <IP> -tacacsSecret <secret key> -authorization ON -accounting ON
add authentication policy <policname> -rule true -action <name>
bind system global <policyname> -priority <value>1
Configure a Partition System User Accounts in a Partition by using the GUI
To configure a partition user account in an administrative partition, you must create a partition user or a partition user group and bind it partition command policies. Also, you can configure the external server authentication for an external user.
To create a partition user account in a partition by using the GUI
Navigate to System > User Administration, click Users to add a partition system user and bind the user to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).
To create a partition user group account in a partition by using the GUI
Navigate to System > User Administration, click Groups to add a partition system user group and bind the user group to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).
To configure External server authentication for external users by using the GUI
Navigate to System > Authentication > Basic Actions and click TACACS to configure TACACS server for authenticating external users accessing the partition.
Sample Configuration
The following configuration shows how to create a partition user or a partition user group and bind it partition command policies. Also, how to configure the external server authentication for authenticating an external user.
add partition Par1
switch ns partition Par1
> add ns ip 10.102.29.203 255.255.255.0 -mgmtAccessenabled
> add system user John Password
> bind system user Jane partition-read-only -priority 1
> add system group Retail
> bind system group Retail -policyname partition-network 1 (where 1 is the priority number)
> bind system group Retail –username Jane
> add authentication tacacssaction tacuser –serverip 10.102.29.200 –tacacsSecret Password –authorization ON –accounting ON
> add authentication policy polname –rule true –action tacacsAction
> bind system global polname –priority 1
Command Policies for a Partition Users and Partition User Groups in Administrative Partition
Commands to authorize an user account inside administrative partition | Command policies available inside an administrative partition (built-in policies) | User account access type |
---|---|---|
add system user | Partition-admin | SNIP (with management access enabled) |
add system group | Partition-network | SNIP (with management access enabled) |
add authentication <action, policy>, bind system global <policy name> | Partition-read-only | SNIP (with management access enabled) |
remove system user | Partition-admin | SNIP(with management access enabled) |
remove system group | Partition-admin | SNIP (with management access enabled) |
bind system cmdpolicy to system user; bind system cmdpolicy to system group | Partition-admin | SNIP (with management access enabled) |
Configure an LACP ethernet channel on the default admin partition
With Link Aggregation Control Protocol (LACP), you can combine multiple ports into a single, high-speed link (also called a channel). An LACP-enabled appliance exchanges LACP Data Units (LACPDU) over the channel.
There are three LACP configuration modes that you can enable in the default partition of a NetScaler appliance:
- Active. A port in active mode sends LACPDUs. Link aggregation is formed if the other end of the Ethernet link is in the LACP active or passive mode.
- Passive. A port in passive mode sends LACPDUs only when it receives LACPDUs. The link aggregation is formed if the other end of the Ethernet link is in the LACP active mode.
- Disable. Link aggregation is not formed.
Note
By default, the link aggregation is disabled in the default partition of the appliance.
LACP exchanges LACPDU between devices connected by an Ethernet link. These devices are typically referred as an actor or partner.
A LACPDU data unit contains the following parameters:
- LACP Mode. Active, passive or disable.
- LACP timeout. The waiting period before timing out the partner or actor. Possible values: Long and Short. Default: Long.
- Port Key. To distinguish between the different channel. When key is 1, LA/1 is created. When key is 2, LA/2 is created. Possible values: Integer from 1 through 8. 4 through 8 is for cluster CLAG.
- Port Priority. Minimum value: 1. Maximum value: 65535. Default: 32768.
- System Priority. Uses this priority along with system MAC to form the system ID to uniquely identify the system during LACP negotiation with the partner. Sets system priority from 1 and 65535. The default value is set to 32768.
- Interface. Supports 8 interfaces per channel on NetScaler 10.1 appliance and supports 16 interfaces per channel on NetScaler 10.5 and 11.0 appliances.
After exchanging LACPDUs, the actor and partner negotiate the settings and decide whether to add the ports to the aggregation.
Configure and verify LACP
To configure and verify LACP on a NetScaler appliance by using the command line
-
Enable LACP on each interface.
At the command prompt, type:
set interface <Interface_ID> -lacpMode PASSIVE -lacpKey 1
When you enable LACP on an interface, the channels are dynamically created. Additionally, when you enable LACP on an interface and set lacpKey to 1, the interface is automatically bound to channel LA/1.
Note
When you bind an interface to a channel, the channel parameters take precedence over the interface parameters, so the interface parameters are ignored. If a channel was created dynamically by LACP, you cannot perform add, bind, unbind, or remove operations on the channel. A channel dynamically created by LACP is automatically deleted when you disable LACP on all interfaces of the channel.
-
Set the system priority.
At the command prompt, type:
set lacp -sysPriority <Positive_Integer>
-
Verify that LACP is working as expected.
show interface <Interface_ID>
show channel
show LACP
Note
In some versions of Cisco IOS, running the switchport trunk native vlan <VLAN_ID> command causes the Cisco switch to tag LACP PDUs. This causes the LACP channel between the Cisco switch and the NetScaler appliance to fail. However, this issue does not affect the static link aggregation channels configured in the above procedure.
Share
Share
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select Do Not Agree to exit.