Product Documentation

Provisioning NetScaler Instances

Jun 13, 2017

You can provision one or more NetScaler instances on the SDX appliance by using the Management Service. The number of instances that you can install depends on the license you have purchased. If the number of instances added is equal to the number specified in the license, the Management Service does not allow provisioning more NetScaler instances.

To provision NetScaler instances on the SDX appliance, first, you need to define an admin profile to attach to the NetScaler instance. This profile specifies the user credentials that are used by the Management Service to provision the NetScaler instance and later, to communicate with the instance to retrieve configuration data. You can also use the default admin profile. Next, you need to upload the .xva image file to the Management Service. After uploading the .xva file, you can begin adding NetScaler instances using the Management Service. The Management Service implicitly deploys the NetScaler instances on the SDX appliance and then downloads configuration details of the instances.

Note: By default, a .xva image file based on the NetScaler 9.3 release is available on the SDX appliance.

Creating Admin Profiles

Admin profiles specify the user credentials that are used by the Management Service when provisioning the NetScaler instances, and later when communicating with the instances to retrieve configuration data. The user credentials specified in an admin profile are also used by the client when logging on to the NetScaler instances through the CLI or the configuration utility.

The default admin profile for an instance specifies a user name of nsroot, and the password is also nsroot. This profile cannot be modified or deleted. However, you should override the default profile by creating a user-defined admin profile and attaching it to the instance when you provision the instance. The Management Service administrator can delete a user-defined admin profile if it is not attached to any NetScaler instance.

Important:

Do not change the password directly on the NetScaler VPX instance. If you do so, the instance becomes unreachable from the Management Service. To change a password, first create a new admin profile, and then modify the NetScaler instance, selecting this profile from the Admin Profile list.

To change the password of NetScaler instances in a high availability setup, first change the password on the instance designated as the secondary node, and then change the password on the instance designated as the primary node. Remember to change the passwords only by using the Management Service.

To create an admin profile

  1. On the Configuration tab, in the navigation pane, expand NetScaler Configuration, and then click Admin Profiles.
  2. In the Admin Profiles pane, click Add.
  3. In the Create Admin Profile dialog box, set the following parameters:
    • Profile Name*—Name of the admin profile. The default profile name is nsroot. You can create user-defined profile names.
    • User Name—User name used to log on to the NetScaler instances. The user name of the default profile is nsroot and cannot be changed.
    • Password*—The password used to log on to the NetScaler instance. Maximum length: 31 characters.
    • Confirm Password*—The password used to log on to the NetScaler instance.

    * A required parameter

  4. Click Create, and then click Close. The admin profile you created appears in the Admin Profiles pane.

    If the value in the Default column is true the default profile is the admin profile. If the value is false, a user-defined profile is the admin profile.

    If you do not want to use a user-defined admin profile, you can remove it from the Management Service. To remove a user-defined admin profile, in the Admin Profiles pane, select the profile you want to remove, and then click Delete.

Uploading NetScaler .Xva Images

You have to upload the NetScaler .xva files to the SDX appliance before provisioning the NetScaler instances. You can also download an .xva image file to a local computer as a backup. The .xva image file format is: NSVPX-XEN-ReleaseNumber-BuildNumber_nc.xva

Note: By default, an .xva image file based on the NetScaler 9.3 release is available on the SDX appliance.

In the NetScaler XVA Files pane, you can view the following details.

Name
Name of the .xva image file. The file name contains the release and build number. For example, the file name NSVPX-XEN-9.3-25_nc.xva refers to release 9.3 build 25.
Last Modified
Date when the .xva image file was last modified.
Size
Size, in MB, of the .xva image file.

To upload a NetScaler .xva file

  1. On the Configuration tab, in the navigation pane, expand NetScaler Configuration, and then click XVA Files.
  2. In the NetScaler XVA Files pane, click Upload.
  3. In the Upload NetScaler Instance XVA dialog box, click Browse and select the XVA image file that you want to upload.
  4. Click Upload. The XVA image file appears in the NetScaler XVA Files pane after it is uploaded.

To create a backup by downloading a NetScaler .xva file

  1. In the NetScaler Build Files pane, select the file that you want to download, and then click Download.
  2. In the File Download message box, click Save.
  3. In the Save As message box, browse to the location where you want to save the file, and then click Save.

Adding a NetScaler Instance

When you add NetScaler instances from the Management Service, you need to provide values for some parameters, and the Management Service implicitly configures these settings on the NetScaler instances.

Typically, the Management Service and the management address (NSIP) of the NetScaler VPX instance are in the same subnetwork, and communication is over a management interface. However, if the Management Service and the instance are in different subnetworks, you have to specify a VLAN ID at the time of provisioning a NetScaler VPX instance, so that the instance can be reached over the network when it starts. If your deployment requires that the NSIP not be accessible through any interface other than the one selected at the time of provisioning the VPX instance, select the NSVLAN option.

Citrix recommends the default setting—NSVLAN not selected. You cannot change this setting after you have provisioned the NetScaler instance.

Note: For a high availability setup (active-active or active-standby), Citrix recommends that you configure the two NetScaler instances on different SDX appliances. Make sure that the instances in the setup have identical resources, such as CPU, memory, interfaces, packets per second (PPS), and throughput.

Name*
The host name assigned to the NetScaler instance.
IP Address*
The NetScaler IP (NSIP) address at which you access a NetScaler instance for management purposes. A NetScaler instance can have only one NSIP. You cannot remove an NSIP address.
Netmask*
The subnet mask associated with the NSIP address.
Gateway*
The default gateway that you must add on the NetScaler instance if you want access through SSH or the configuration utility from an administrative workstation or laptop that is on a different network.
XVA File*
The .xva image file that you need to provision. This file is required only when you add a NetScaler instance.
Feature License*
Specifies the license you have procured for the NetScaler. The license could be Standard, Enterprise, and Platinum.
Admin Profile*
The profile you want to attach to the NetScaler instance. This profile specifies the administrator (nsroot) user credentials that are used by the Management Service to provision the NetScaler instance and later, to communicate with the instance to retrieve configuration data. The user credentials used in this profile are also used while logging on to the NetScaler instance by using the GUI or the CLI. It is recommended that you change the default password of the admin profile. This is done by creating a new profile with a user-defined password. For more information, see Creating Admin Profiles above.
Description
Add a description or comments related to the administrator profile.
Total Memory (MB)*
The total memory allocated to the NetScaler instance.
#SSL chips*
Number of SSL chips assigned to the NetScaler instance. SSL chips cannot be shared. The instance is restarted if you modify this value.
Throughput (Mbps)*
The total throughput allocated to the NetScaler instance. The total used throughput should be less than or equal to the maximum throughput allocated in the SDX license. If the administrator has already allocated full throughput to multiple instances, no further throughput can be assigned to any new instance.
Packets per second*
The maximum number of packets that the instance can receive per second.
CPU
Assign a dedicated core or cores to the instance, or the instance shares a core with other instance(s). If you select shared, then one core is assigned to the instance but the core might be shared with other instances if there is a shortage of resources.
Reboot affected Instances if CPU cores are reassigned
Restart the instances on which CPU cores are reassigned to avoid any performance degradation.
User Name*
The user name for the NetScaler instance administrator. This user has superuser access, but does not have access to networking commands to configure VLANs and interfaces.
Password*
The password for the instance administrator's user name.
Confirm Password*
The password for the instance administrator's user name.
Shell/Sftp/Scp Access*
The access allowed to the NetScaler instance administrator.
Allow L2 Mode
Allow L2 mode on the NetScaler instance. Select this option before you log on to the instance and enable L2 mode. For more information, see Allowing L2 Mode on a NetScaler Instance.
Note: If you disable L2 mode for an instance from the Management Service, you must log on to the instance and disable L2 mode from that instance. Failure to do so might cause all the other NetScaler modes to be disabled after you restart the instance
Management LA
Select to associate the management channel to the instance.
VLAN Tag
Specify a VLAN ID for the management channel member interfaces.
Interface Settings
This specifies the network interfaces assigned to a NetScaler instance. You can selectively assign interfaces to an instance. For each interface, if you select Tagged, specify a VLAN ID.
Important: The interface IDs of interfaces that you add to an instance do not necessarily correspond to the physical interface numbering on the SDX appliance. For example, if the first interface that you associate with instance 1 is SDX interface 1/4, it appears as interface 1/1 when you log on to the instance and view the interface settings, because it is the first interface that you associated with instance 1.
  • If a non-zero VLAN ID is specified for a NetScaler instance interface, all the packets transmitted from the NetScaler instance through that interface will be tagged with the specified VLAN ID. If you want incoming packets meant for the NetScaler instance that you are configuring to be forwarded to the instance through a particular interface, you must tag that interface with a VLAN ID and ensure that the incoming packets specify that VLAN ID.
  • For an interface to receive packets with multiple VLAN tags, you must specify a VLAN ID of 0 for the interface, and you must specify the required VLAN IDs for the NetScaler instance interface.
VLAN ID
An integer that uniquely identifies the VLAN. Minimum value: 2. Maximum value: 4095.
Allowed VLANs
Specify a list of VLAN IDs that can be associated with a NetScaler instance.
VRID IPV4
The IPv4 VRID that identifies the VMAC. Possible values: 1 to 255. For more information, see Configuring VMACs on an Interface.
VRID IPV6
The IPv6 VRID that identifies the VMAC. Possible values: 1 to 255. For more information, see Configuring VMACs on an Interface.
MAC Address Mode
Assign a MAC address. Select from one of the following options:
  • Default—XenServer assigns a MAC address.
  • Custom—SDX Administrator assigns a MAC address. The SDX administrator can use this setting to override the generated MAC address.
  • Generated—Generate a MAC address by using the base MAC address set earlier. For information about setting a base MAC address, see Assigning a MAC Address to an Interface.
MAC Address
Specify a MAC address that overrides the generated MAC address. Used with the Custom mode setting.
NSVLAN
A VLAN to which the subnet of the NetScaler management IP (NSIP) address is bound. The NSIP subnet is available only on interfaces that are associated with the NSVLAN. Select this check box if your deployment requires that the NSIP not be accessible through any interface other than the one you select in the VLAN Settings dialog box. This setting cannot be changed after the NetScaler instance is provisioned.
Note:
  • HA heartbeats will be sent only on the interfaces that are part of the NSVLAN.
  • You can configure an NSVLAN only from VPX XVA build 9.3-53.4 and later.
Important: If NSVLAN is not selected, running the "clear config full" command on the VPX instance deletes the VLAN configuration.
Tagged
Designate all interfaces associated with the VLAN as 802.1q tagged interfaces.
Note: If you select tagged, make sure that management interfaces 0/1 and 0/2 are not added.
Interfaces
Bind the selected interfaces to the VLAN.

To provision a NetScaler instance

  1. On the Configuration tab, in the navigation pane, expand NetScaler Configuration, and then click Instances.
  2. In the NetScaler Instances pane, click Add.
  3. In the Provision NetScaler Wizard follow the instructions on the screen.
  4. Click Create, and then click Close. The provisioning progress and any failures, such as failure to assign a virtual function to the VPX instance, are displayed.

    To modify the values of the parameters of a provisioned NetScaler instance, in the NetScaler Instances pane, select the instance that you want to modify, and then click Modify. In the Modify NetScaler Wizard, modify the parameters.

    Note: If you modify the following parameters: number of SSL chips, interfaces, memory, and feature license, the NetScaler instance implicitly stops and restarts to bring these parameters into effect.
    You cannot modify the Image and User Name parameters.

    If you want to remove a NetScaler instance provisioned on the SDX appliance, in the NetScaler Instances pane, select the instance that you want to remove, and then click Delete. In the Confirm message box, click Yes to remove the NetScaler instance.

Restricting VLANs to Specific Virtual Interfaces

The NetScaler SDX appliance administrator can enforce specific 802.1Q VLANs on the virtual interfaces associated with NetScaler instances. This capability is especially helpful in restricting the usage of 802.1Q VLANs by the instance administrators. If two instances belonging to two different companies are hosted on an SDX appliance, you can restrict the two companies from using the same VLAN ID, so that one company does not see the other company's traffic. If an instance administrator, while provisioning or modifying a VPX instance, tries to assign an interface to an 802.1Q VLAN, a validation is performed to verify that the VLAN ID specified is part of the allowed list.

By default, any VLAN ID can be used on an interface. To restrict the tagged VLANs on an interface, specify the VLAN IDs in the Network Settings at the time of provisioning a NetScaler instance, or later by modifying the instance. To specify a range, separate the IDs with a hyphen (for example 10-12). If you initially specify some VLAN IDs but later delete all of them from the allowed list, you can use any VLAN ID on that interface. In effect, you have restored the default setting.

After creating a list of allowed VLANs, the SDX administrator does not have to log on to an instance to create the VLANs. The administrator can add and delete VLANs for specific instances from the Management Service.

Important: If L2 mode is enabled, the administrator must take care that the VLAN IDs on different NetScaler instances do not overlap.

To specify the permitted VLAN IDs

  1. In the Provision NetScaler Wizard or the Modify NetScaler Wizard, on the Network Settings page, in the Allowed VLANs text box, specify the VLAN ID(s) allowed on this interface. Use a hyphen to specify a range. For example, 2-4094.
  2. Follow the instructions in the wizard.
  3. Click Finish, and then click Close.

To configure VLANs for an instance from the Management Service

  1. On the Configuration tab, navigate to NetScaler > Instances.
  2. Select an instance, and then click VLAN.
  3. In the details pane, click Add.
  4. In the Create NetScaler VLAN dialog box, specify the following parameters:
    • VLAN ID—An integer that uniquely identifies the VLAN to which a particular frame belongs. The NetScaler supports a maximum of 4094 VLANs. ID 1 is reserved for the default VLAN.
    • IPV6 Dynamic Routing—Enable all IPv6 dynamic routing protocols on this VLAN. Note: For the ENABLED setting to work, you must log on to the instance and configure IPv6 dynamic routing protocols from the VTYSH command line.
  5. Select the interfaces that should be part of the VLAN.
  6. Click Create, and then click Close.