To implement the Citrix CloudBridge Connector solution, you connect a datacenter to another datacenter or an external cloud by setting up a tunnel called the CloudBridge Connector tunnel.
To connect a datacenter to another datacenter, you set up a CloudBridge Connector tunnel between two appliances, one in each datacenter.
To connect a datacenter to an external cloud (for example, Amazon AWS cloud), you set up a CloudBridge Connector tunnel between a CloudBridge appliance in the datacenter and a virtual appliance (VPX) that resides in the Cloud. The remote end point can be a CloudBridge Connector or a NetScaler VPX with platinum license.
The following illustration shows a CloudBridge Connector tunnel set up between a datacenter and an external cloud.
The appliances between which a CloudBridge Connector tunnel is set up are called the end points or peers of the CloudBridge Connector tunnel.
A CloudBridge Connector tunnel uses the following protocols:
Generic Routing Encapsulation (GRE) protocol
Open-standard IPSec Protocol suite, in transport mode
The GRE protocol provides a mechanism for encapsulating packets, from a wide variety of network protocols, to be forwarded over another protocol. GRE is used to:
Connect networks running non-IP and non-routable protocols.
Bridge across a wide area network (WAN).
Create a transport tunnel for any type of traffic that needs to be sent unchanged across a different network.
The GRE protocol encapsulates packets by adding a GRE header and a GRE IP header to the packets.
The Internet Protocol security (IPSec) protocol suite secures communication between peers in the CloudBridge Connector tunnel.
In a CloudBridge Connector tunnel, IPSec ensures:
Data origin authentication
Data confidentiality (encryption)
Protection against replay attacks
IPSec uses the transport mode in which the GRE encapsulated packet is encrypted. The encryption is done by the Encapsulating Security Payload (ESP) protocol. The ESP protocol ensures the integrity of the packet by using a HMAC hash function, and ensures confidentiality by using an encryption algorithm. After the packet is encrypted and the HMAC is calculated, an ESP header is generated. The ESP header is inserted after the GRE IP header and, an ESP trailer is inserted at the end of the encrypted payload.
Peers in the CloudBridge Connector tunnel use the Internet Key Exchange version (IKE) protocol (part of the IPSec protocol suite) to negotiate secure communication, as follows:
The two peers mutually authenticate with each other, using one of the following authentication methods:
The peers then negotiate to reach agreement on:
An encryption algorithm.
Cryptographic keys for encrypting data in one peer and decrypting the data in the other.
This agreement upon the security protocol, encryption algorithm and cryptographic keys is called a Security Association (SA). SAs are one-way (simplex). For example, when two peers, CB1 and CB2, are communicating through a Connector tunnel, CB1 has two Security Associations. One SA is used for processing out-bound packets, and the other SA is used for processing inbound packets.
SAs expire after a specified length of time, which is called the lifetime. The two peers use the Internet Key Exchange (IKE) protocol (part of the IPSec protocol suite) to negotiate new cryptographic keys and establish new SAs. The purpose of the limited lifetime is to prevent attackers from cracking a key.
Also, CloudBridge instances on the CloudBridge Connector tunnel end-points provide WAN optimization over the tunnel.