- How Load Balancing Works
- Setting Up Basic Load Balancing
- Load Balancing Algorithms
- Persistence and Persistent Connections
- Customizing a Load Balancing Configuration
- Configuring Diameter Load Balancing
- Protecting a Load Balancing Configuration against Failure
- Managing a Load Balancing Setup
- Managing Client Traffic
- Advanced Load Balancing Settings
- The Built-in Monitors
- Custom Monitors
- Configuring Monitors in a Load Balancing Setup
- Managing a Large Scale Deployment
- Configuring Load Balancing for Commonly Used Protocols
- Use Case 1: SMPP Load Balancing
- Use Case 2: Configuring Rule Based Persistence Based on a Name-Value Pair in a TCP Byte Stream
- Use Case 3: Configuring Load Balancing in Direct Server Return Mode
- Use Case 4: Configuring LINUX Servers in DSR Mode
- Use Case 5: Configuring DSR Mode When Using TOS
- Use Case 6: Configuring Load Balancing in DSR Mode for IPv6 Networks by Using the TOS Field
- Use Case 7: Configuring Load Balancing in DSR Mode by Using IP Over IP
- Use Case 8: Configuring Load Balancing in One-arm Mode
- Use Case 9: Configuring Load Balancing in the Inline Mode
- Use Case 10: Load Balancing of Intrusion Detection System Servers
- Use Case 11: Isolating Network Traffic using Listen Policies
- Use Case 12: Configuring XenDesktop for Load Balancing
- Use Case 13: Configuring XenApp for Load Balancing
- Use Case 14: ShareFile Wizard for Load Balancing Citrix ShareFile
- Troubleshooting
- Load Balancing
- Configuring FIX Load Balancing
Use Case 10: Load Balancing of Intrusion Detection System Servers
Jun 08, 2015
To enable the NetScaler appliance to support load balancing of intrusion detection system (IDS) servers, the IDS servers and clients must be connected through a switch that has port mirroring enabled. The client sends a request to the server. Because port mirroring is enabled on the switch, the request packets are copied or sent to the NetScaler appliance virtual server port. The appliance then uses the configured load balancing method to select an IDS server, as shown in the following diagram.
Figure 1. Topology of
Load Balanced IDS Servers
Note: Currently, the
appliance supports load balancing of passive IDS devices only.
As illustrated in the preceding diagram, the IDS load balancing setup functions as follows:
- The client request is sent to the IDS server, and a switch with a mirroring port enabled forwards these packets to the IDS server. The source IP address is the IP address of the client, and the destination IP address is the IP address of the server. The source MAC address is the MAC address of the router, and the destination MAC address is the MAC address of the server.
- The traffic that flows through the switch is mirrored to the appliance. The appliance uses the layer 3 information (source IP address and destination IP address) to forward the packet to the selected IDS server without changing the source IP address or destination IP address. It modifies the source MAC address and the destination MAC address to the MAC address of the selected IDS server.
Note: When load
balancing IDS servers, you can configure the SRCIPHASH, DESTIPHASH, or
SRCIPDESTIPHASH load balancing methods. The SRCIPDESTIPHASH method is
recommended because packets flowing from the client to a service on the
appliance must be sent to a single IDS server.
Suppose Service-ANY-1, Service-ANY-2, and Service-ANY-3 are created and bound to Vserver-LB-1. The virtual server balances the load on the services. The following table lists the names and values of the entities configured on the appliance.
|
Entity type |
Name |
IP address |
Port |
Protocol |
|---|---|---|---|---|
|
Virtual server |
Vserver-LB-1 |
* |
* |
ANY |
|
Services |
Service-ANY-1 |
10.102.29.101 |
* |
ANY |
|
Service-ANY-2 |
10.102.29.102 |
* |
ANY |
|
|
Service-ANY-3 |
10.102.29.103 |
* |
ANY |
|
|
Monitors |
Ping |
None |
None |
None |
Note: You can use
inline mode or one-arm mode for an IDS load balancing setup.
The following diagram shows the load balancing entities and values of the parameters to be configured on the appliance.
Figure 2. Entity Model
for Load Balancing IDS Servers
To configure an IDS load balancing setup, you must first enable MAC-based forwarding. You must also disable layer 2 and layer 3 modes on the appliance.
To enable MAC-based forwarding by using the command line interface
At the command prompt, type:
enable ns mode <ConfigureMode>
Example
enable ns mode MAC
To enable MAC-based forwarding by using the configuration utility
Navigate to , and select MAC Based Forwarding.
Next, see "Setting Up Basic Load Balancing", to configure a basic load balancing setup.
After you configure the basic load balancing setup, you must customize it for IDS by configuring a supported load balancing method (such as the SRCIPDESTIP Hash method on a sessionless virtual server) and enabling MAC mode. The appliance does not maintain the state of the connection and only forwards the packets to the IDS servers without processing them. The destination IP address and port remains unchanged because the virtual server is in the MAC mode.
To configure LB method and redirection mode for a sessionless virtual server by using the command line interface
At the command prompt, type:
set lb vserver <vServerName> -lbMethod <LBMethodOption> -m <RedirectionMode> -sessionless <Value>
Example
set lb vserver Vserver-LB-1 -lbMethod SourceIPDestIPHash -m MAC -sessionless enabled
To configure LB method and redirection mode for a sessionless virtual server by using the configuration utility
- Navigate to .
- Open a virtual server and, in Redirection Mode, select MAC Based.
- In Advanced Settings, click Methods, and select SRCIPDESTIPHASH. Click Traffic Settings, and select Sessionless Load Balancing.
To set a service to use source IP address by using the command line interface
At the command prompt, type:
set service <ServiceName> -usip <Value>
Example
set service Service-ANY-1 -usip yes
To set a service to use source IP address by using the configuration utility
- Navigate to .
- Open a service, and in Settings select Use Source IP Address.
For USIP to function correctly, you must set it globally. For more information about configuring USIP globally, see "IP Addressing."