Citrix NetScaler Getting Started Guide. Citrix NetScaler 9.0

Transcription

1 Citrix NetScaler Getting Started Guide Citrix NetScaler 9.0

2 Copyright and Trademark Notice CITRIX SYSTEMS, INC., ALL RIGHTS RESERVED. NO PART OF THIS DOCUMENT MAY BE REPRODUCED OR TRANSMITTED IN ANY FORM OR BY ANY MEANS OR USED TO MAKE DERIVATIVE WORK (SUCH AS TRANSLATION, TRANSFORMATION, OR ADAPTATION) WITHOUT THE EXPRESS WRITTEN PERMISSION OF CITRIX SYSTEMS, INC. ALTHOUGH THE MATERIAL PRESENTED IN THIS DOCUMENT IS BELIEVED TO BE ACCURATE, IT IS PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE ALL RESPONSIBILITY FOR THE USE OR APPLICATION OF THE PRODUCT(S) DESCRIBED IN THIS MANUAL. CITRIX SYSTEMS, INC. OR ITS SUPPLIERS DO NOT ASSUME ANY LIABILITY THAT MAY OCCUR DUE TO THE USE OR APPLICATION OF THE PRODUCT(S) DESCRIBED IN THIS DOCUMENT. INFORMATION IN THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT NOTICE. COMPANIES, NAMES, AND DATA USED IN EXAMPLES ARE FICTITIOUS UNLESS OTHERWISE NOTED. The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radiofrequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. Modifying the equipment without Citrix' written authorization may result in the equipment no longer complying with FCC requirements for Class A digital devices. In that event, your right to use the equipment may be limited by FCC regulations, and you may be required to correct any interference to radio or television communications at your own expense. You can determine whether your equipment is causing interference by turning it off. If the interference stops, it was probably caused by the NetScaler Request Switch 9000 Series equipment. If the NetScaler equipment causes interference, try to correct the interference by using one or more of the following measures: Move the NetScaler equipment to one side or the other of your equipment. Move the NetScaler equipment farther away from your equipment. Plug the NetScaler equipment into an outlet on a different circuit from your equipment. (Make sure the NetScaler equipment and your equipment are on circuits controlled by different circuit breakers or fuses.) Modifications to this product not authorized by Citrix Systems, Inc., could void the FCC approval and negate your authority to operate the product. BroadCom is a registered trademark of BroadCom Corporation. Fast Ramp, NetScaler, WANScaler, Citrix XenApp, and NetScaler Request Switch are trademarks of Citrix Systems, Inc. Linux is a registered trademark of Linus Torvalds. Internet Explorer, Microsoft, PowerPoint, Windows and Windows product names such as Windows NT are trademarks or registered trademarks of the Microsoft Corporation. NetScape is a registered trademark of Netscape Communications Corporation. Red Hat is a trademark of Red Hat, Inc. Sun and Sun Microsystems are registered trademarks of Sun Microsystems, Inc. Other brand and product names may be registered trademarks or trademarks of their respective holders. Software covered by the following third party copyrights may be included with this product and will also be subject to the software license agreement: Copyright 1998 Carnegie Mellon University. All rights reserved. Copyright David L. Mills 1993, Copyright 1992, 1993, 1994, 1997 Henry Spencer. Copyright Jean-loup Gailly and Mark Adler. Copyright 1999, 2000 by Jef Poskanzer. All rights reserved. Copyright Markus Friedl, Theo de Raadt, Niels Provos, Dug Song, Aaron Campbell, Damien Miller, Kevin Steves. All rights reserved. Copyright 1982, 1985, 1986, , 1993 Regents of the University of California. All rights reserved. Copyright 1995 Tatu Ylonen, Espoo, Finland. All rights reserved. Copyright UNIX System Laboratories, Inc. Copyright 2001 Mark R V Murray. Copyright Eric Young. Copyright 1995,1996,1997,1998. Lars Fenneberg. Copyright Livingston Enterprises, Inc. Copyright 1992, 1993, 1994, The Regents of the University of Michigan and Merit Network, Inc. Copyright , RSA Data Security, Inc. Created Copyright 1998 Juniper Networks, Inc. All rights reserved. Copyright 2001, 2002 Networks Associates Technology, Inc. All rights reserved. Copyright (c) 2002 Networks Associates Technology, Inc. Copyright The Open LDAP Foundation. All Rights Reserved. Copyright 1999 Andrzej Bialecki. All rights reserved. Copyright 2000 The Apache Software Foundation. All rights reserved. Copyright (C) Robert A. van Engelen, Genivia inc. All Rights Reserved. Copyright (c) University of Cambridge. All rights reserved. Copyright (c) David Greenman. Copyright (c) 2001 Jonathan Lemon. All rights reserved. Copyright (c) 1997, 1998, Bill Paul. All rights reserved. Copyright (c) Matt Thomas. All rights reserved. Copyright 2000 Jason L. Wright. Copyright 2000 Theo de Raadt. Copyright 2001 Patrik Lindergren. All rights reserved. Last Updated: November 2009

3 CONTENTS Preface Chapter 1 Chapter 2 Chapter 3 About This Guide vii Audience ix Formatting Conventions ix Related Documentation x Getting Service and Support xii Knowledge Center xiii Education and Training xiii Documentation Feedback xiv Understanding the Citrix NetScaler What Is a Citrix NetScaler? Switching Features Security and Protection Features Optimization Features Where Does a Citrix NetScaler Fit in the Network? Physical Deployment Modes Citrix NetScaler as an L2 Device Citrix NetScaler as a Packet Forwarding Device How a Citrix NetScaler Communicates with Clients and Servers Understanding NetScaler-owned IP Addresses How Traffic Flows Are Managed Traffic Management Building Blocks A Simple Load Balancing Configuration Understanding Virtual Servers Understanding Services Understanding Policies and Expressions Processing Order of Features Introduction to the Citrix NetScaler Product Line Citrix NetScaler Editions Citrix NetScaler Hardware Platforms Installing the Citrix NetScaler Hardware Reviewing the Pre-Installation Checklist Rack Mounting a Citrix NetScaler Installing an SFP Installing an XFP

4 iv Citrix NetScaler Getting Started Guide Connecting a Citrix NetScaler to the Network Connecting the Console Cable Connecting a Citrix NetScaler to the Power Source Chapter 4 Chapter 5 Chapter 6 Accessing and Configuring a Citrix NetScaler Accessing a Citrix NetScaler Using the Command Line Interface Logging on to the Command Line Interface Using a Console Port Logging on to the Command Line Interface using SSH Using the Graphical User Interface Using the Configuration Utility Using the Statistical Utility Accessing and Configuring a Citrix NetScaler Using the XML API Configuring a Citrix NetScaler for the First Time Configuring a Citrix NetScaler Using the Command Line Interface Configuring a Citrix NetScaler Using the Configuration Utility Setting up a High Availability Pair Configuring a High Availability Pair for the First Time Adding a Node Disabling High Availability Monitoring for Unused Interfaces Understanding Common Network Topologies Setting up Common Two-Arm Topologies Setting up a Simple Two-Arm Multiple Subnet Topology Setting up a Simple Two-Arm Transparent Topology Setting up Common One-Arm Topologies Setting up a Simple One-Arm Single Subnet Topology Setting up a Simple One-Arm Multiple Subnet Topology Configuring System Management Settings Configuring Global Settings Configuring HTTP Traffic Ports Setting the Maximum Connections to Each Server Setting the Maximum Requests per Connection Configuring Client IP Address Insertion Setting HTTP Cookie Version Setting FTP Port Range Verifying the Configuration You have completed configuration of your NetScaler

5 Contents v Configuring Modes of Packet Forwarding Enabling and Disabling Layer 2 Mode Enabling and Disabling Layer 3 Mode Enabling and Disabling MAC-Based Forwarding Mode Configuring Network Interfaces Modifying Network Interfaces Verifying the Configuration Configuring Virtual LANs Creating a VLAN Binding a Network Interface to a VLAN Verifying the Configuration Configuring Link Aggregation Configuring Link Aggregation Manually Verifying the Configuration Configuring Clock Synchronization Configuring DNS Adding a Name Server Verifying the Configuration Configuring SNMP Adding SNMP Managers Adding SNMP Traps Configuring SNMP Alarms Configuring Syslog Chapter 7 Load Balancing Traffic on a Citrix NetScaler How Load Balancing Works Understanding Persistence Understanding Persistence Based on Cookies Understanding Persistence Based on Server IDs in URLs Understanding URL Redirection Understanding Backup Vservers Configuring Load Balancing Configuring Load Balancing Using the Configuration Utility Verifying the Configuration Customizing a Load Balancing Setup Using Persistence Configuring URL Redirection Configuring Backup Vservers Configuring Load Balancing using the Citrix NetScaler Command Line

6 vi Citrix NetScaler Getting Started Guide Chapter 8 Chapter 9 Chapter 10 Accelerating Load Balanced Traffic Using Compression How Compression Works Configuring Compression Configuring Compression Using the Configuration Utility Enabling Compression Globally Enabling Compression on a Service Binding a Default Compression Policy to a Vserver Viewing the Statistics Configuring Compression Using the Citrix NetScaler Command Line Securing Load Balanced Traffic Using SSL How SSL Offloading Works Managing Certificates Supporting Outlook Web Access Configuring SSL Offloading Configuring SSL Offloading using the Configuration Utility Enabling SSL Creating HTTP-based Services Adding an SSL-Based Vserver Binding the HTTP Services to the Vserver Adding a Certificate Key Pair Binding an SSL Certificate Key Pair to the Vserver Verifying the Configuration Configuring Support for Outlook Web Access Configuring SSL Offload Using the Citrix NetScaler Command Line Features at a Glance Application Switching and Traffic Management Features Application Acceleration Features Application Security and Firewall Features Application Visibility Features GlossaryGlossary 119 Index

7 PREFACE Preface About This Guide Before you begin to use the Citrix NetScaler 9.0 release, take a few minutes to review this chapter and learn about related documentation, other support options, and ways to send us feedback. In This Preface About This Guide Audience Formatting Conventions Related Documentation Getting Service and Support Documentation Feedback This guide describes how to initially set up and configure a Citrix NetScaler. It begins with an overview of the core architecture, followed by details about the product line, installation and deployment instructions, and hands-on labs that cover commonly used features. The contents of the guide have been arranged in a simple-to-complex manner. Most chapters begin with a conceptual introduction followed by practical examples. The examples, which include both GUI and CLI procedures, and topology diagrams, are use cases with sample values that you can use in your initial configuration. Diagrams illustrate and reinforce key concepts. A detailed glossary and an index are provided. References and cross-references throughout the guide enhance its usability. This guide provides the following information: Chapter 1, Understanding the Citrix NetScaler. Describes the architecture of the Citrix NetScaler. Begins with a description of what a NetScaler is and where it fits in a network. This is followed by a description of vservers, services, and policies. The chapter concludes with a description of the order in which features are processed.

8 viii Citrix NetScaler Getting Started Guide Chapter 2, Introduction to the Citrix NetScaler Product Line. Provides a brief introduction to the software and hardware platforms. Also covers the feature groups. Chapter 3 Installing the Citrix NetScaler Hardware. Covers the steps to unpack and install the hardware. Includes instructions on rack mounting, connecting SFPs and XFPs, connecting the console cable, connecting to a power source, and connecting to a network. Chapter 4 Accessing and Configuring a Citrix NetScaler. Describes the various access mechanisms that you can use to configure and monitor a NetScaler. Includes both CLI and GUI mechanisms. This chapters also covers the steps to configure a NetScaler for the first time. Chapter 5 Understanding Common Network Topologies. Describes the four common deployment topologies: Two-Arm Multiple Subnet, Two- Arm Transparent, One-Arm Single Subnet, and One-Arm Multiple Subnet. Topology diagrams, sample values, and references have been provided. Chapter 6 Configuring System Management Settings. Covers steps to configure basic system management settings such as VLANs, SNMP, DNS, etc. Chapter 7 Load Balancing Traffic on a Citrix NetScaler. Provides a basic introduction to the load balancing feature. Begins with a conceptual introduction to load balancing and includes common settings such as persistence, URL redirection, and backup vservers. This is followed by procedures to configure a basic load balancing setup to deliver a Web application. The chapter also covers procedures for configuring persistence, URL redirection, and backup vservers. Chapter 8 Accelerating Load Balanced Traffic Using Compression. Provides a basic introduction to the compression feature. Describes how a NetScaler compresses traffic. This is followed by procedures to configure a NetScaler to compress application traffic. Chapter 9 Securing Load Balanced Traffic Using SSL. Provides a basic introduction to the SSL offload feature. Describes how a NetScaler offloads SSL processing. This is followed by procedures to configure a NetScaler to secure application traffic using SSL. Chapter 10 Features at a Glance. Provides a brief description of all the features and links to appropriate chapters in the other guides.

9 Preface ix Audience This guide is intended for system and network administrators who install and configure complex networking equipment. While sales and marketing professionals might find the conceptual information useful, they are advised to refer to the white papers, product brochures, and other literature on our Web site for more details. Formatting Conventions This documentation uses the following formatting conventions. Formatting Conventions Convention Boldface Italics %SystemRoot% Monospace Meaning Information that you type exactly as shown (user input); elements in the user interface. Placeholders for information or parameters that you provide. For example, FileName in a command means you type the actual name of a file. Also, new terms, and words referred to as words (which would otherwise be enclosed in quotation marks). The Windows system directory, which can be WTSRV, WINNT, WINDOWS, or any other name you specify when you install Windows. System output or characters in a command line. User input and placeholders also are formatted using monspace text. { braces } A series of items, one of which is required in command statements. For example, { yes no } means you must type yes or no. Do not type the braces themselves. [ brackets ] Optional items in command statements. For example, in the following command, [-range positiveinteger] means that you have the option of entering a range, but it is not required: add lb vserver name servicetype IPAddress port [-range positiveinteger] Do not type the brackets themselves.

10 x Citrix NetScaler Getting Started Guide Formatting Conventions Convention Meaning (vertical bar) A separator between options in braces or brackets in command statements. For example, the following indicates that you choose one of the following load balancing methods: lbmethod = ( ROUNDROBIN LEASTCONNECTION LEASTRESPONSETIME URLHASH DOMAINHASH DESTINATIONIPHASH SOURCEIPHASH SRCIPDESTIPHASH LEASTBANDWIDTH LEASTPACKETS TOKEN SRCIPSRCPORTHASH LRTM CALLIDHASH CUSTOMLOAD ) (ellipsis) You can repeat the previous item or items in command statements. For example, /route:devicename[, ] means you can type additional DeviceNames separated by commas. Related Documentation A complete set of documentation is available on the Documentation tab of your NetScaler and from (Most of the documents require Adobe Reader, available at To view the documentation 1. From a Web browser, log on to the NetScaler. 2. Click the Documentation tab. 3. To view a short description of each document, hover your cursor over the title. To open a document, click the title. Getting Service and Support Citrix provides technical support primarily through the Citrix Solutions Network (CSN). Our CSN partners are trained and authorized to provide a high level of support to our customers. Contact your supplier for first-line support, or check for your nearest CSN partner at You can also get support from Citrix Customer Service at On the Support menu, click Customer Service. Knowledge Center The Knowledge Center offers a variety of self-service, Web-based technical support tools at

11 Preface xi Knowledge Center features include: A knowledge base containing thousands of technical solutions to support your Citrix environment An online product documentation library Interactive support forums for every Citrix product Access to the latest hotfixes and service packs Knowledge Center Alerts that notify you when a topic is updated Note: To set up an alert, sign in at and, under Products, select a specific product. In the upper-right section of the screen, under Tools, click Add to your Hotfix Alerts. To remove an alert, go to the Knowledge Center product and, under Tools, click Remove from your Hotfix Alerts. Security bulletins Online problem reporting and tracking (for organizations with valid support contracts) Education and Training Citrix offers a variety of instructor-led and Web-based training solutions. Instructor-led courses are offered through Citrix Authorized Learning Centers (CALCs). CALCs provide high-quality classroom learning using professional courseware developed by Citrix. Many of these courses lead to certification. Web-based training courses are available through CALCs, resellers, and from the Citrix Web site. Information about programs and courseware for Citrix training and certification is available at Documentation Feedback You are encouraged to provide feedback and suggestions so that we can enhance the documentation. You can send to the following alias or aliases, as appropriate. In the subject line, specify Documentation Feedback. Be sure to include the document name, page number, and product release version. For NetScaler documentation, send to nsdocs_feedback@citrix.com.

12 xii Citrix NetScaler Getting Started Guide For Command Center documentation, send to For Access Gateway documentation, send to You can also provide feedback from the Knowledge Center at support.citrix.com/. To provide feedback from the Knowledge Center home page 1. Go to the Knowledge Center home page at 2. On the Knowledge Center home page, under Products, click NetScaler Application Delivery, and click NetScaler Application Delivery Software On the Documentation tab, click the guide name, and then click Article Feedback. 4. On the Documentation Feedback page, complete the form and click Submit.

13 CHAPTER 1 Understanding the Citrix NetScaler This chapter provides a conceptual overview of the NetScaler. The main objective is to explain what a NetScaler is and how it works, providing a conceptual basis for all the chapters that follow. The chapter can also be read as a general technical overview. In This Chapter What Is a Citrix NetScaler? Where Does a Citrix NetScaler Fit in the Network? How a Citrix NetScaler Communicates with Clients and Servers Understanding Policies and Expressions Processing Order of Features What Is a Citrix NetScaler? A Citrix NetScaler is an application switch that intelligently distributes, optimizes, and secures Layer 4-Layer 7 (L4-L7) network traffic for Web applications. Features include load balancing, compression, Secure Sockets Layer (SSL) offload, a built-in application firewall, and dynamic content caching. A NetScaler performs application-specific traffic analysis to provide a more effective implementation of the features. For example, a NetScaler makes load balancing decisions on individual HTTP requests rather than on the basis of longlived TCP connections, so that the failure or slowdown of a server is managed much more quickly and with less disruption to clients. Other features can be used to reduce load and simplify server-farm management, and to accelerate end-user performance.

14 2 Citrix NetScaler Getting Started Guide Switching Features Its switching features enable a NetScaler to manage application traffic in an efficient manner. When deployed in front of application servers, a NetScaler ensures optimal distribution of traffic by the way in which it directs client requests. Administrators can segment application traffic according to information in the body of an HTTP or TCP request, and on the basis of L4-L7 header information such as URL, application data type, or cookie. Numerous loadbalancing algorithms and extensive server health checks provide greater application availability by ensuring that client requests are directed to the appropriate servers. Security and Protection Features Security and protection features help block the theft and leakage of data by protecting Web applications from application-layer attacks. A NetScaler allows legitimate client requests and can block malicious requests. It provides built-in defenses against denial of service (DoS) attacks and supports features that protect the application against legitimate surges in application traffic that would otherwise overwhelm the servers. An available built-in firewall protects Web applications from application-layer attacks, including buffer overflow exploits, SQL injection attempts, cross-site scripting attacks, and more. In addition, the firewall provides identity theft protection by securing confidential corporate information and sensitive customer data. Optimization Features Optimization features offload resource-intensive operations such as Secure Sockets Layer (SSL) processing, data compression, and the caching of static and dynamic content from servers. This improves the performance of the servers in the server farm and therefore speeds up applications. A NetScaler supports several transparent TCP optimizations, which mitigate problems caused by high latency and congested network links, accelerating the delivery of applications while requiring no configuration changes to clients or servers. Where Does a Citrix NetScaler Fit in the Network? A NetScaler resides between the clients and the servers, so that client requests and server responses pass through it. In a typical installation, virtual servers (vservers) configured on the NetScaler provide connection points that clients use to access the applications behind the NetScaler. In this case, the NetScaler owns public IP addresses that are associated with its vservers, while the real servers are isolated in a private network. It is also possible to operate the NetScaler in a transparent mode as an L2 bridge or L3 router, or even to combine aspects of these and other modes.

15 Chapter 1 Understanding the Citrix NetScaler 3 Physical Deployment Modes A NetScaler logically residing between clients and servers can be deployed in either of two physical modes: inline and one-arm. In the normal inline mode, multiple network interfaces are connected to different Ethernet segments and the NetScaler is placed between the clients and the servers. The NetScaler has a separate network interface to each client network and a separate network interface to each server network. The NetScaler and the servers can exist on different subnets in this configuration. It is possible for the servers to be in a public network and the clients to directly access the servers through the NetScaler, with the NetScaler transparently applying the L4-L7 features. Usually, vservers (described later) are configured to provide an abstraction of the real servers. The following diagram illustrates a typical inline deployment. Inline Deployment In a less common version of one-arm mode, only one network interface of the NetScaler is connected to an Ethernet segment. The NetScaler in this case does not isolate the client and server sides of the network, but provides access to applications through configured vservers. This version of one-arm mode can simplify network changes needed for NetScaler installation in some environments.

16 4 Citrix NetScaler Getting Started Guide Citrix NetScaler as an L2 Device A NetScaler functioning as an L2 device is said to operate in L2 mode. In L2 mode, the NetScaler forwards packets between network interfaces when all of the following conditions are met: The packets are destined to another device's media access control (MAC) address. The destination MAC address is on a different network interface. The network interface is a member of the same virtual LAN (VLAN). By default all network interfaces are members of a pre-defined VLAN, VLAN 1. Address Resolution Protocol (ARP) requests and responses are forwarded to all network interfaces that are members of the same VLAN. To avoid bridging loops, L2 mode must be disabled if another L2 device is working in parallel with the NetScaler. Citrix NetScaler as a Packet Forwarding Device A NetScaler can function as a packet forwarding device, and this mode of operation is called L3 mode. When a NetScaler in L3 mode receives, on its MAC address, unicast packets that are destined for an unknown IP address, it forwards them if there is a proper route to the destination. A NetScaler can also route packets between VLANs. In both modes of operation, L2 and L3, a NetScaler generally drops packets that are in: Multicast frames Unknown protocol frames destined for a NetScaler's MAC address (non-ip and non-arp) Spanning Tree protocol

17 Chapter 1 Understanding the Citrix NetScaler 5 How a Citrix NetScaler Communicates with Clients and Servers A NetScaler is usually deployed in front of a server farm and functions as a transparent TCP proxy between clients and servers, without requiring any clientside configuration. This basic mode of operation is called Request Switching technology and is the core of NetScaler functionality. Request Switching enables a NetScaler to multiplex and offload the TCP connections, maintain persistent connections, and manage traffic at the request (application layer) level. This is possible because the NetScaler can separate the HTTP request from the TCP connection on which the request is delivered. Depending on the configuration, a NetScaler may process the traffic before forwarding the request to a server. For example, if the client attempts to access a secure application on the server, the NetScaler might perform the necessary SSL processing before sending traffic to the server. To facilitate efficient and secure access to server resources, a NetScaler uses a set of IP addresses collectively known as NetScaler-owned IP addresses. Understanding NetScaler-owned IP Addresses To function as a proxy, a NetScaler a uses a variety of IP addresses. The key NetScaler-owned IP addresses are: Mapped IP address (MIP). The MIP is used for server-side connections. It is not the IP address of the NetScaler. In most cases, when the NetScaler receives a packet, it replaces the source IP address with the MIP before sending the packet to the server. With the servers abstracted from the clients, the NetScaler manages connections more efficiently. Virtual server IP address (VIP). A VIP is the IP address associated with a vserver. It is the public IP address to which clients connect. A NetScaler managing a wide range of traffic may have many VIPs configured. NetScaler IP address (NSIP). The NSIP is the IP address for general system and management access to the NetScaler itself. Subnet IP address (SNIP). When the NetScaler is attached to multiple subnets, SNIPs may be configured for use as MIPs providing access to those subnets.

18 6 Citrix NetScaler Getting Started Guide How Traffic Flows Are Managed Because a NetScaler functions as a TCP proxy, it translates IP addresses before sending packets to a server. When you configure a vserver, clients connect to a VIP on the NetScaler instead of directly connecting to a server. Based on the settings on the vserver, the NetScaler selects an appropriate server and sends the client's request to that server. By default, the NetScaler uses the MIP to establish connections with the server, as illustrated in the following diagram. Vserver-based connections In the absence of a vserver, when a NetScaler receives a request, it transparently forwards the request to the server. This is called the transparent mode of operation. When operating in transparent mode, a NetScaler translates the source IP addresses of incoming client requests to the MIP but does not change the destination IP address. For this mode to work, L2 or L3 mode needs to be configured appropriately. For cases in which the servers need the actual client IP address, the NetScaler can be configured to modify the HTTP header by inserting the client IP address as an additional field, or configured to use the client IP address instead of the MIP for connections to the servers.

19 Chapter 1 Understanding the Citrix NetScaler 7 Traffic Management Building Blocks The configuration of a NetScaleris typically built up with a series of virtual entities that serve as building blocks for traffic management. The building block approach helps separate traffic flows. Virtual entities are abstractions, typically representing IP addresses, ports, and protocol handlers for processing traffic. Clients access applications and resources through these virtual entities. The most commonly used entities are vservers and services. Vservers represent groups of servers in a server farm or remote network, and services represent specific applications on each server. Most features and traffic settings are enabled through virtual entities. For example, you can configure a NetScaler to compress all server responses to a client that is connected to the server farm through a particular vserver. To configure the NetScaler for a particular environment, you need to identify the appropriate features and then choose the right mix of virtual entities to deliver them. Most features are delivered through a cascade of virtual entities that are bound to each other. In this case, the virtual entities are like blocks being assembled into the final structure of a delivered application. You can add, remove, modify, bind, enable, and disable the virtual entities to configure the features.the following diagram illustrates the concepts covered in this section. How traffic management building blocks work

20 8 Citrix NetScaler Getting Started Guide A Simple Load Balancing Configuration In the example shown in the diagram, the NetScaler is configured to function as a load balancer. For this configuration, you need to configure virtual entities specific to load balancing and bind them in a specific order. As a load balancer, a NetScaler distributes client requests across several servers and thus optimizes the utilization of resources. The basic building blocks of a typical load balancing configuration are services and load balancing vservers. The services represent the applications on the servers. The vservers abstract the servers by providing a single IP address to which the clients connect. To ensure that client requests are sent to a server, you need to bind each service to the vserver. That is, you must create services for every server and bind the services to the vserver. Clients use the VIP to connect to a NetScaler. When the NetScaler receives client requests on the VIP, it sends them to a server determined by the load balancing algorithm. Load balancing uses a virtual entity called a monitor to track whether a specific configured service (server plus application) is available to receive requests. Load Balancing vserver, services, and monitor In addition to configuring the load balancing algorithm, you can configure several parameters that affect the behavior and performance of the load balancing configuration. For example, you can configure the vserver to maintain persistence based on source IP address. The NetScaler then directs all requests from any specific client to the same server.

21 Chapter 1 Understanding the Citrix NetScaler 9 Understanding Virtual Servers A vserver represents one or more applications in a server farm. The vserver is a named NetScaler entity that external clients can use to access applications hosted on the servers. It is represented by an alphanumeric name, virtual IP address (VIP), port, and protocol. The name of the vserver is only of local significance and is designed to make the vserver easier to identify. When a client attempts to access applications on a server, it sends a request to the VIP instead of the IP address of the physical server. When the NetScaler receives a request on the VIP, it terminates the connection at the vserver and uses its own connection with the server on behalf of the client. The port and protocol settings of the vserver determine the applications that the vserver represents. For example, a Web server can be represented by a vserver and a service whose port and protocol are set to 80 and HTTP, respectively. Multiple vservers can use the same VIP but different protocols and ports. Vservers are points for delivering features. Most features, like compression, caching, and SSL offload, are normally enabled on a vserver. When the NetScaler receives a request on a VIP, it chooses the appropriate vserver by the port on which the request was received and its protocol. The NetScaler then processes the request as appropriate for the features configured on the vserver.

22 10 Citrix NetScaler Getting Started Guide In most cases, vservers work in tandem with services. You can bind multiple services to a vserver. These services represent the applications running on physical servers in a server farm. After the NetScaler processes requests received on a VIP, it forwards them to the servers as determined by the load balancing algorithm configured on the vserver. The following diagram illustrates these concepts. Multiple vservers on a single VIP The preceding diagram illustrates a configuration consisting of two vservers with a common VIP but different ports and protocols. Each of these vservers has two services bound to it. The services s1 and s2 are bound to VS_HTTP and represent the HTTP applications on Server 1 and Server 2. The services s3 and s4 are bound to VS_SSL and represent the SSL applications on Server 2 and Server 3 (Server 2 provides both HTTP and SSL applications). When the NetScaler receives an HTTP request on the VIP, it processes the request based on the settings of VS_HTTP and sends it to either Server 1 or Server 2. Similarly, when the NetScaler receives an HTTPS request on the VIP, it processes it based on the settings of VS_SSL and it sends it to either Server 2 or Server 3. Vservers are not always represented by specific IP address, port numbers, or protocols. They can be represented by wildcards, in which case they are known as wildcard vservers. For example, when you configure a vserver with a wildcard instead of a VIP, but with a specific port number, the NetScaler intercepts and processes all traffic conforming to that protocol and destined for the predefined port. For vservers with wildcards instead of VIPs and port numbers, the NetScaler intercepts and processes all traffic conforming to the protocol.

23 Chapter 1 Understanding the Citrix NetScaler 11 Vservers can be grouped into the following categories: Load balancing vserver. Receives and redirects requests to an appropriate server. Choice of the appropriate server is based on which of various load balancing methods the user configures. Cache redirection virtual server. Redirects client requests for dynamic content to origin servers and static content to cache servers. Cache redirection vservers often work in conjunction with load balancing vservers. Content switching virtual server. Directs traffic to a server on the basis of the content that the client has requested. For example, you can create a content switching vserver that directs all client requests for images to a server that serves images only. Content switching vservers often work in conjunction with load balancing vservers. Virtual private network (VPN) virtual server. Decrypts tunneled traffic and sends it to intranet applications. Note: For more information about features, see the Citrix NetScaler Traffic Management Guide. Understanding Services Services represent applications on a server. While services are normally combined with vservers, in the absence of a vserver, a service can still manage application-specific traffic. For example, you can create an HTTP service on a NetScaler to represent a Web server application. When the client attempts to access a Web site hosted on the Web server, the NetScaler intercepts the HTTP requests and creates a transparent connection with the Web server. In service-only mode, a NetScaler functions as a transparent proxy. It terminates client connections, uses the MIP to establish a connection to the server, and translates incoming client requests to the MIP. Although the clients send requests directly to the IP address of the server, the server sees them as coming from the MIP. The NetScaler translates the IP addresses, port numbers, and sequence numbers. A service is also a point for applying features. However, only a limited set of features can be configured in the service-only case. Consider the example of SSL acceleration. To use this feature, you must create an SSL service and bind an SSL certificate to the service. When the NetScaler receives an HTTPS request, it decrypts the traffic and sends it, in clear text, to the server.

24 12 Citrix NetScaler Getting Started Guide Services use entities called monitors to track the health of applications. Every service has a default monitor, which is based on the service type, bound to it. As specified by the settings configured on the monitor, the NetScaler sends probes to the application at regular intervals to determine its state. If the probes fail, the NetScaler marks the service as down. In such cases, the NetScaler responds to client requests with an appropriate error message or re-routes the request as determined by the configured load balancing policies. Understanding Policies and Expressions A policy defines specific details of traffic filtering and management on a NetScaler. It consists of two parts: the expression and the action. The expression defines the types of requests that the policy matches. The action tells the NetScaler what to do when a request matches the expression. As an example, the expression might be to match a specific URL pattern to a type of security attack, with the action being to drop or reset the connection. Each policy has a priority, and the priorities determine the order in which the policies are evaluated. When a NetScaler receives traffic to or from any server it manages, the appropriate policy list determines how to process the traffic. Each policy on the list contains one or more expressions, which together define the criteria that a connection must meet to match the policy. For all policy types except Rewrite policies, a NetScaler implements only the first policy that a request matches, not any additional policies that it might also match. For Rewrite policies, the NetScaler evaluates the policies in order and, in the case of multiple matches, performs the associated actions in that order. Policy priority is important for getting the results you want.

25 Processing Order of Features Chapter 1 Understanding the Citrix NetScaler 13 Depending on requirements, you can choose to configure multiple features. For example, you might choose to configure both compression and SSL offload. As a result, an outgoing packet might be compressed and then encrypted before being sent to the client. The following figure shows the interaction and processing order of the NetScalerfeatures. Processing order of features on a NetScaler

26 14 Citrix NetScaler Getting Started Guide

27 CHAPTER 2 Introduction to the Citrix NetScaler Product Line The Citrix NetScaler product line optimizes delivery of applications over the Internet and private networks, combining application-level security, optimization, and traffic management into a single, integrated appliance. You install a Citrix NetScaler in your server room and route all connections to your managed servers through it. The NetScaler then applies the features you enable and the policies you set to incoming and outgoing traffic. In This Chapter Citrix NetScaler Editions Citrix NetScaler Hardware Platforms Citrix NetScaler Editions Citrix NetScaler software consists of the following three editions: Citrix NetScaler, Standard Edition. Provides small and medium enterprises with comprehensive Layer 4- Layer 7 (L4-L7) traffic management, enabling increased Web application availability. Citrix NetScaler, Enterprise Edition. Provides Web application acceleration and advanced L4-L7 traffic management, enabling enterprises to increase Web application performance and availability and reduce data center costs. Citrix NetScaler, Platinum Edition. Provides a Web application delivery solution that reduces data center costs and accelerates application performance, with end-to-end visibility of application performance, and provides advanced application security.

28 16 Citrix NetScaler Getting Started Guide Note: These editions are controlled by licenses. For instructions on how to obtain and install licenses, refer to the Citrix Hardware Installation and Setup Guide. NetScaler functionality is available on the 7000, 9010, 10010, 12000, 15000, and hardware platforms.

29 Chapter 2 Introduction to the Citrix NetScaler Product Line 17 A NetScaler can be integrated into any network as a complement to existing load balancers, servers, caches, and firewalls. It requires no additional client or server side software, and can be configured using the NetScaler Web-based GUI and CLI configuration utilities. The following table summarizes the features supported by the Citrix NetScaler Application Delivery product line: Key Features Application Acceleration Features Platinum Edition Enterprise Edition Standard Edition Citrix AppCompress for HTTP Yes Yes Optional Citrix AppCache Yes Optional Client and Server TCP Optimizations Yes Yes Yes TCP Multiplexing Yes Yes Yes TCP Buffering Yes Yes Yes SSL Offload and Acceleration Yes Yes Yes Application Security and Firewall Features NetScaler Application Firewall Yes Optional L4 DoS Defenses Yes Yes Yes L7 Content Filtering Yes Yes Yes L7 DoS Defenses Yes Yes Surge Protection Yes Yes Citrix Access Gateway, Enterprise Edition Yes Yes HTTP Rewrite Yes Yes Yes Application Switching and Traffic Management Features Layer 4 Load Balancing Yes Yes Yes Layer 7 Content Switching Yes Yes Yes Global Server Load Balancing (GSLB) Yes Yes Optional Dynamic Routing Protocols Yes Yes Cache Redirection Yes Yes Application Visibility Features Citrix EdgeSight for NetScaler Yes Optional Citrix NetScaler Application Delivery Product Line Features

30 18 Citrix NetScaler Getting Started Guide Note: While we have taken care to ensure absolute accuracy when compiling this information, it might change. We strongly recommend that you visit our Web site at for the latest information. Citrix NetScaler Hardware Platforms A NetScaler is available on the following hardware platforms, each of which supports some combination of Fast Ethernet and Gigabit interfaces. Citrix NetScaler 7000 Citrix NetScaler 9010 Citrix NetScaler Citrix NetScaler Citrix NetScaler Citrix NetScaler The following table lists different editions of the NetScaler and the hardware platforms on which they are available. Hardware Platinum Edition Yes Yes Yes Yes Yes Yes Enterprise Edition Yes Yes Yes Yes Yes Yes Standard Edition Yes Yes Yes Yes Product editions and hardware platforms Note: For more information about the hardware platforms, see the Introducing the Citrix NetScaler Hardware Platforms chapter in Citrix Hardware Installation and Setup Guide.

31 CHAPTER 3 Installing the Citrix NetScaler Hardware This chapter describes how to install the Citrix NetScaler hardware and then connect it to a network and the power source. In This Chapter Reviewing the Pre-Installation Checklist Rack Mounting a Citrix NetScaler Installing an SFP Installing an XFP Connecting a Citrix NetScaler to the Network Connecting the Console Cable Connecting a Citrix NetScaler to the Power Source Reviewing the Pre-Installation Checklist Before installing your NetScaler, you should prepare all equipment and materials required for installation. Completing this preparation in advance will help ensure a smooth installation, with minimal interruptions.