Product Documentation

Multiple-Firewall Environment

Aug 31, 2016
Note: This feature is available in NetScaler release 9.3.e and 10.

In a multiple-firewall environment, the NetScaler appliance is placed between two sets of firewalls, the external set connecting to the public Internet, and the internal set connecting to the internal private network. The external set typically handles the egress traffic. These firewalls mainly implement access control lists to allow or deny access to external resources. The internal set typically handles the ingress traffic. These firewalls implement security to safeguard the intranet from malicious attacks apart from load-balancing the ingress traffic. The multiple-firewall environment allows you to load-balance traffic coming from another firewall. By default, the traffic coming from a firewall is not load balanced on the other firewall across a NetScaler. Having firewall load balancing enabled on both the sides of NetScaler improves the traffic flow in both the egress and ingress direction and ensures faster processing of the traffic.

Figure 1 shows a multiple-firewall load balancing environment

Figure 1. Firewall Load Balancing (multiple-firewall)
Multiple-Firewall Environment

With a configuration like the one shown in Figure 1, you can configure the NetScaler to load balance the traffic through the an internal firewall even if it is load balanced by an external firewall. For example, with this feature configured, the traffic coming from the external firewalls (firewalls 1, 2, and 3) is load balanced on the internal firewalls (firewalls 4, 5, and 6) and vice versa.

Firewall load balancing is supported only for MAC mode LB virtual server.

The service type ANY configures the NetScaler to accept all traffic.

To avail benefits related to HTTP and TCP, configure the service and virtual server with type HTTP or TCP. For FTP to work, configure the service with type FTP.

Configuring the NetScaler in a Multiple-Firewall Environment

Updated: 2015-05-18

To configure a NetScaler appliance in a multiple-firewall environment, you have to enable the load balancing feature, configure a virtual server to load balance the egress traffic across the external firewalls, configure a virtual server to load balance the ingress traffic across the internal firewalls, and enable firewall load balancing on the NetScaler. To configure a virtual server to load balance traffic across a firewall in the multiple-firewall environment, you need to:
  1. Configure a wildcard service for each firewall
  2. Configure a monitor for each wildcard service
  3. Configure a wildcard virtual server to load balance the traffic sent to the firewalls
  4. Configure the virtual server in MAC rewrite mode
  5. Bind firewall services to the wildcard virtual server

Enabling the load balancing feature

To configure and implement load balancing entities such as services and virtual servers, you need to enable the load balancing feature on the NetScaler device.

To enable load balancing by using the command line interface

At the command prompt, type the following command to enable load balancing and verify the configuration:

  • enable ns feature <featureName>
  • show ns feature

Example

enable ns feature LoadBalancing 
Done 
show ns feature 
Feature Acronym Status 
------- ------- ------ 
1) Web Logging WL OFF 
2) Surge Protection SP ON 
3) Load Balancing LB ON 
. 
. 
. 
24) NetScaler Push push OFF 
Done 

To enable load balancing by using the configuration utility

  1. In the navigation pane, expand System, and then click Settings.
  2. In the Settings pane, under Modes and Features, click Change basic features.
  3. In the Configure Basic Features dialog box, select the Load Balancing check box, and then click Ok.

Configuring a wildcard service for each firewall

To accept traffic from all the protocols, you need to configure wildcard service for each firewall by specifying support for all the protocols and ports.

To configure a wildcard service for each firewall by using the command line interface

At the command prompt, type the following command to configure support for all the protocols and ports:

add service <name>@ <serverName> <serviceType> <port_number>

Example

add service fw-svc1 10.102.29.5 ANY * 

To configure a wildcard service for each firewall by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Services.
  2. In the details pane, click Add.
  3. In the Create Services dialog box, specify values for the following parameters as shown:

     

    • Service Name—name
    • Server—serverName

    * A required parameter

  4. In Protocol, select Any and in Port, select *.
  5. Click Create, and then click Close. The service you created appears in the Services pane.

Configuring a monitor for each service

A PING monitor is bound by default to the service. You will need to configure a transparent monitor to monitor hosts on the trusted side through individual firewalls. You can then bind the transparent monitor to services. The default PING monitor monitors the connectivity only between the NetScaler appliance and the upstream device. The transparent monitor monitors all the devices existing in the path from the appliance to the device that owns the destination IP address specified in the monitor. If a transparent monitor is not configured and the status of the firewall is UP but one of the next hop devices from that firewall is down, the appliance includes the firewall while performing load balancing and forwards the packet to the firewall. However, the packet is not delivered to the final destination because one of the next hop devices is down. By binding a transparent monitor, if any of the devices (including the firewall) are down, the service is marked as DOWN and the firewall is not included when the appliance performs firewall load balancing.

Binding a transparent monitor will override the PING monitor. To configure a PING monitor in addition to a transparent monitor, after you create and bind a transparent monitor, you need to bind a PING monitor to the service.

To configure a transparent monitor by using the command line interface

At the command prompt, type the following commands to configure a transparent monitor and verify the configuration:

  • add lb monitor <monitorName> <type> [-destIP <ip_addr|ipv6_addr|*>] [-transparent (YES | NO )]
  • bind lb monitor <monitorName> <serviceName>

Example

add monitor monitor-HTTP-1 HTTP -destip 10.10.10.11 -transparent YES 
bind monitor monitor-HTTP-1 fw-svc1

To create and bind a transparent monitor by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Monitors.
  2. In the details pane, click Add.
  3. In the Create Monitor dialog box, specify values for the following parameters as shown:

     

    • Name*
    • Type*—type
    • Destination IP
    • Transparent

    * A required parameter

  4. Click Create, and then click Close. In the Monitors pane, select the monitor that you just configured and verify that the settings displayed at the bottom of the screen are correct.

Configuring a virtual server to load balance the traffic sent to the firewalls

To load balance any kind of traffic, you need to configure a wildcard virtual server specifying the protocol and port as any value.

To configure a virtual server to load balance the traffic sent to the firewalls by using the command line interface

At the command prompt, type the following command:

add lb vserver <name>@ <serviceType> <IPAddress> <port_number>

Example

add lb vserver Vserver-LB-1 ANY * * 

To configure a virtual server to load balance the traffic sent to the firewalls by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, click Add.
  3. In Protocol, select Any, and in IP Address and Port, select *.
  4. Click Create, and then click Close. The virtual server you created appears in the Load Balancing Virtual Servers pane.

Configuring the virtual server to MAC rewrite mode

To configure the virtual server to use MAC address for forwarding the incoming traffic, you need to enable the MAC rewrite mode.

To configure the virtual server in MAC rewrite mode by using the command line interface

At the command prompt, type the following command:

set lb vserver <name>@ -m <RedirectionMode>

Example

set lb vserver Vserver-LB-1 -m MAC 

To configure the virtual server in MAC rewrite mode by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, select the virtual server for which you want to configure the redirection mode (for example, Vserver-LB1), and then click Open.
  3. On the Advanced tab, under the Redirection Mode mode, click Open.
  4. Click Ok.

Binding firewall services to the virtual server

To access a service on NetScaler, you need to bind it to a wildcard virtual server.

To bind firewall services to the virtual server by using the command line interface

At the command prompt, type the following command:

bind lb vserver <name>@ <serviceName>

Example

bind lb vserver Vserver-LB-1 Service-HTTP-1 

To bind firewall services to the virtual server by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, select the virtual server for which you want to configure the redirection mode (for example, Vserver-LB1), and then click Open.
  3. In the Configure Virtual Server (Load Balancing) dialog box, on the Services tab, select the Active check box next to the service that you want to bind to the virtual server(for example, Service-HTTP-1 ).
  4. Click Ok.

Configuring the multiple-firewall load balancing on the NetScaler Appliance

To load balance traffic on both the sides of a NetScaler using firewall load balancing, you need to enable mulitpl-firewall load balancing by using the vServerSpecificMac parameter.

To configure multiple-firewall load balancing by using the command line interface

At the command prompt, type the following command:

set lb parameter -vServerSpecificMac <status>

Example

set lb parameter -vServerSpecificMac ENABLED  

To configure multiple-firewall load balancing by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, select the virtual server for which you want to configure the redirection mode (for example, Configure Load Balancing parameters).
  3. In the Set Load Balancing Parameters dialog box, select the Virtual Server Specific MAC check box.
  4. Click Ok.

Saving and Verifying the Configuration

When you've finished the configuration tasks, be sure to save the configuration. You should also check to make sure that the settings are correct.

To save and verify the configuration by using the command line interface

At the command prompt, type the following commands to configure a transparent monitor and verify the configuration:

  • save ns config
  • show vserver

Example

save config 
show lb vserver FWLBVIP2 
        FWLBVIP2 (*:*) - ANY    Type: ADDRESS 
        State: UP 
        Last state change was at Mon Jun 14 07:22:54 2010 
        Time since last state change: 0 days, 00:00:32.760 
        Effective State: UP 
        Client Idle Timeout: 120 sec 
        Down state flush: ENABLED 
        Disable Primary Vserver On Down : DISABLED 
        No. of Bound Services :  2 (Total)       2 (Active) 
        Configured Method: LEASTCONNECTION 
        Current Method: Round Robin, Reason: A new service is bound 
        Mode: MAC 
        Persistence: NONE 
        Connection Failover: DISABLED 
 
1) fw-int-svc1 (10.102.29.5: *) - ANY State: UP Weight: 1 
2) fw-int-svc2 (10.102.29.9: *) - ANY State: UP Weight: 1 
 Done 
show service fw-int-svc1 
        fw-int-svc1 (10.102.29.5:*) - ANY 
        State: DOWN 
        Last state change was at Thu Jul  8 14:44:51 2010 
        Time since last state change: 0 days, 00:01:50.240 
        Server Name: 10.102.29.5 
        Server ID : 0   Monitor Threshold : 0 
        Max Conn: 0     Max Req: 0      Max Bandwidth: 0 kbits 
        Use Source IP: NO 
        Client Keepalive(CKA): NO 
        Access Down Service: NO 
        TCP Buffering(TCPB): NO 
        HTTP Compression(CMP): NO 
        Idle timeout: Client: 120 sec   Server: 120 sec 
        Client IP: DISABLED 
        Cacheable: NO 
        SC: OFF 
        SP: OFF 
        Down state flush: ENABLED 
 
1)      Monitor Name: monitor-HTTP-1 
                State: DOWN     Weight: 1 
                Probes: 9       Failed [Total: 9 Current: 9] 
                Last response: Failure - Time out during TCP connection establishment stage 
                Response Time: 2000.0 millisec 
2)      Monitor Name: ping 
                State: UP       Weight: 1 
                Probes: 3       Failed [Total: 0 Current: 0] 
                Last response: Success - ICMP echo reply received. 
                Response Time: 1.275 millisec 
 Done

To save and verify the configuration by using the configuration utility

  1. In the details pane, click Save.
  2. In the Save Config dialog box, click Yes.
  3. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  4. In the details pane, select the virtual server that you created in step 5 and verify that the settings displayed in the Details pane are correct.
  5. Navigate to Traffic Management > Load Balancing > Services.
  6. In the details pane, select the service that you created in step 5 and verify that the settings displayed in the Details pane are correct.

Monitoring a Firewall Load Balancing Setup in a Multiple-Firewall Environment

After the configuration is up and running, you should view the statistics for each service and virtual server to check for possible problems.

Viewing the Statistics of a Virtual Server

Updated: 2013-09-05

To evaluate the performance of virtual servers or to troubleshoot problems, you can display details of the virtual servers configured on the NetScaler appliance. You can display a summary of statistics for all the virtual servers, or you can specify the name of a virtual server to display the statistics only for that virtual server. You can display the following details:

  • Name
  • IP address
  • Port
  • Protocol
  • State of the virtual server
  • Rate of requests received
  • Rate of hits

To display virtual server statistics by using the command line interface

To display a summary of the statistics for all the virtual servers currently configured on the NetScaler, or for a single virtual server, at the command prompt, type:

stat lb vserver [-detail] [<name>]

Example

>stat lb vserver -detail 
Virtual Server(s) Summary 
                      vsvrIP  port     Protocol        State    Req/s   Hits/s 
One                        *    80         HTTP           UP      5/s      0/s 
Two                        *     0          TCP         DOWN      0/s      0/s 
Three                      *  2598          TCP         DOWN      0/s      0/s 
dnsVirtualNS    10.102.29.90    53          DNS         DOWN      0/s      0/s 
BRVSERV            10.10.1.1    80         HTTP         DOWN      0/s      0/s 
LBVIP           10.102.29.66    80         HTTP           UP      0/s      0/s 
 Done 
 
 

To display virtual server statistics by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers > Statistics.
  2. If you want to display the statistics for only one virtual server, in the details pane, select the virtual server, and click Statistics.

Viewing the Statistics of a Service

Updated: 2013-08-28

You can view the rate of requests, responses, request bytes, response bytes, current client connections, requests in surge queue, current server connections, and so forth using the service statistics.

To view the statistics of a service by using the command line interface

At the command prompt, type:

stat service <name>

Example

stat service Service-HTTP-1

To view the statistics of a service by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Services > Statistics.
  2. If you want to display the statistics for only one service, select the service, and click Statistics.