Scaling Next-Generation Firewalls with Citrix NetScaler

Transcription

1 Scaling Next-Generation Firewalls with Citrix NetScaler SOLUTION OVERVIEW Citrix NetScaler service and application delivery solutions are deployed in thousands of networks around the globe to optimize and control the delivery of enterprise and cloud services. In this deployment guide, Citrix NetScaler is used to increase the throughput and redundancy of Networks nextgeneration firewalls in networks that require more than 20Gbps firewall throughput. This deployment leverages a typical firewall load-balancing sandwich architecture, where traffic is directed through load balancers in both inbound and outbound directions to a series of firewalls. While testing was completed with a mid-range Citrix NetScaler ADC with a throughput of 36 Gbps, this model can be expanded to increase firewall throughput. A high-end Citrix NetScaler can be deployed with a maximum of four* Networks next-generation firewalls in Active-Active configuration for a total firewalling throughput of 80 Gbps. *Due to the number of interfaces on the NetScaler, only four firewalls are supported. DEPLOYMENT MODELS Networks next-generation firewalls and Citrix NetScaler load balancers can be deployed in multiple modes. The next-generation firewall supports Virtual-Wire, Layer-2, or Layer-3 modes. However, the firewall sandwich topology will have exactly one upstream and one downstream connection per firewall, so Layer-2 deployments are not likely to be common. Testing of the solution has focused on Layer-3 and Virtual-Wire for the nextgeneration firewall The NetScaler can be used in L2 or L3 mode, however, L2 mode is suggested here so that no changes are necessary to the rest of the network. If L3 mode was used, the NetScaler would need to be the default gateway or next hop for adjacent devices, thus requiring a change to adjacent device routing tables. L2 mode does not require this change Citrix NetScaler Networks NGFW Figure 1: Layer 3 Deployment

2 PALO PALO ALTO ALTO NETWORKS: NETWORKS: Technology Technology Partner Partner Solution Program Brief VIRTUAL-WIRE DEPLOYMENT In a virtual-wire deployment, a single subnet connects the load balancers across multiple firewalls. There are two important configuration differences between virtual-wire and layer-3 configurations. First, since there are no IP addresses on the firewall virtual-wire ports, the NetScalers must perform their health checks to the NetScaler ports on the far-end. Second, in order to balance the traffic, each NetScaler must have a unique IP on for each interface that connects to a firewall, and a static ARP entry for the IP on the corresponding interface of the opposite NetScaler. Networks HA Pair NetScaler HA Pair Networks HA Pair NetScaler HA Pair Citrix NetScaler Figure 3: HA Configuration Active Passive :e0:ed:25:95:a :e0:ed:25:95:a01 Networks NGFW CONFIGURATION Configuration of the Citrix NetScaler involves 4 steps: Step 1. Set IP addresses and routing Start by setting IP addresses to the NetScaler and establishing routing to the subnets on the local side." Routes to the far-side subnets aren t necessary because this traffic will be load balanced across the firewalls to the far-side NetScaler where the far-side routing will take place Figure 2: Virtual Wire Deployment HIGH-AVAILABILITY There are several high availability options for the Citrix NetScaler and Networks next-generation firewall. There is protection from a failed firewall or link because the firewall health is monitored by the NetScaler. If a firewall fails, then the service is considered down and does not receive further traffic. Future flows are delivered to the remaining operational firewalls. Both the NetScaler and the Networks next-generation firewalls are also capable of Active-Passive and Active-Active high availability features. When the Citrix NetScalers are paired with a second device and high availability enabled on each NetScaler pair, the system is protected from the failure of a load balancer on either side. The system is already protected from a firewall failure, however, when each firewall is paired with a passive firewall; session state will be maintained during a firewall failure, and firewall capacity will remain constant through the failure. Step 2. Enable the modes and features Enable the load balanciang feature, and set the MAC-Based Forwarding mode. Set the L2 or L3 forwarding mode per the choice of deployment model. (see deployment models above) Step 3. Define a service for each firewall The term service in this case refers to a firewall. Each firewall must have a service defined using the add server and add service commands. If using the virtual wire deployment mode, a static ARP entry is required to bind the IP addresses on the NetScaler to specific interfaces for correct load balancing. Step 4. Define a virtual server The virtual server is created and the load balancing method and parameters set. The services you defined are then bound to the virtual server. See the example configurations for more detail.

3 VERIFICATION On the Citrix NetScaler, check that the services and virtual servers are configured correctly using the show lb vserver and show lb service commands. Correct load balancing of traffic can be verified with the stat lb vserver command. Sample output of these commands is shown below: > show lb vserver VS1 VS1 (*:*) - ANY Type: ADDRESS State: UP Last state change was at Mon Mar 25 05:59: Time since last state change: 1 days, 03:17: Effective State: UP ARP:DISABLED Client Idle Timeout: 120 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED Appflow logging: ENABLED No. of Bound Services : 2 (Total) 0 (Active) Configured Method: SRCIPDESTIPHASH Mode: MAC Persistence: NONE Connection Failover: DISABLED L2Conn: OFF Skip Persistency: None IcmpResponse: PASSIVE 1) LB6 ( : *) - ANY State: UP Weight: 1 2) LB8 ( : *) - ANY State: UP Weight: 1 Done > show service LB8 LB8 ( :*) - ANY State: DOWN Last state change was at Mon Mar 25 05:59: Time since last state change: 1 days, 03:20: Server Name: Server ID : "None" Monitor Threshold : 0 Max Conn: 0 Max Req: 0 Max Bandwidth: 0 kbits Use Source IP: YES Use Proxy Port: NO Client Keepalive(CKA): NO Access Down Service: NO TCP Buffering(TCPB): NO HTTP Compression(CMP): NO Idle timeout: Client: 120 sec Server: 120 sec Client IP: DISABLED Cacheable: NO SC: OFF SP: OFF Down state flush: ENABLED Appflow logging: ENABLED 1) Monitor Name: ping-default State: UP Weight: 1 Probes: 5 Failed [Total: 0 Current: 0] Last response: Success - ICMP echo reply received. Response Time: millisec Done >

4 stat lb vserver <vserver> > stat lb vserver VS1 Virtual Server Summary vsvrip port Protocol State Health VS1 * * ANY UP 0 Virtual Server Statistics Rate (/s) Total Vserver hits 0 0 Requests 0 0 Responses 0 0 Request bytes 0 0 Response bytes 0 0 Total Packets rcvd 0 0 Total Packets sent 0 0 Current client connections -- 0 Current Client Est connections -- 0 Current server connections -- 0 Spill Over Threshold -- 0 Spill Over Hits -- 0 Labeled Connection -- 0 Push Labeled Connection -- 0 Deferred Request 0 0 Invalid Request/Response -- 0 Invalid Request/Response Dropped -- 0 Bound Service(s) Summary IP port Type State Hits Req FW * ANY UP 0 0 FW * ANY UP 0 0 Rsp Throughp ClntConn SurgeQ SvrConn ReuseP MaxConn FW FW ActvTrans SvrTTFB Load FW FW Done > SUMMARY Citrix NetScaler application delivery solutions can increase the throughput and redundancy of Networks next-generation firewalls in networks that require more than 20Gbps firewall throughput. Using a firewall load-balancing sandwich architecture, a high-end Citrix Netscaler can be deployed with a maximum of four Networks next-generation firewalls in Active-Active configuration for a total firewalling throughput of 80 Gbps.

5 APPENDIX: NETSCALER CONFIGURATIONS Layer-3 Configurations Step 1. Set IP addresses and routing Configure local IP addresses. These IP's will be used by adjacent devices as the default gateway or next hop to the far-end networks. These IP addresses will also be the source of health monitoring pings sent to the connected firewall interfaces. Then set routes to the relevant destination subnets on the local side. add ns ip vserver DISABLED add route add route Step 2. Enable the modes and features Turn on the Load Balancing feature (LB). Turn on the Layer-3 forwarding mode (L3) and Mac-based Forwarding (MBF). Disable the Layer-2 forwarding mode (L2) if it is enabled. enable ns feature LB enable ns mode L3 MBF disable ns mode L2 Step 3. Define a service for each firewall Configure one service for each firewall. For each firewall, provide the IP address of the local connected firewall data interfaces. The -usip (Use Source IP) argument ensures that the packet IP addresses are not altered. add server add server add service FW ANY * -usip YES add service FW ANY * -usip YES Step 4. Define a virtual server The virtual server receives the traffic and rewrites the MAC address to that of a service defined above. The virtual service is set to use the source/destination IP as the load balancing method, and to redirect rewriting the destination MAC address to that of the firewall, instead of rewriting the destination IP address (default). Set the load balancing parameters to account for the firewalls as a next hop, instead of a server. Bind each service to the virtual server. The last command changes the Receive Side Scaling to maintain symmetry of flows such that each flow is always processed by the same internal Packet Engine, thus improving performance.

6 PALO ALTO NETWORKS: Technology Partner Program NOTE: The 'set rsskeytype' command is available only in specific NetScaler software versions. For other versions, do not enter the command. The command is available in: 9.3.nc Build e and higher 10.1 Build and higher Not available on 10.0 software version as of this writting. add lb vserver VS1 ANY * * -persistencetype NONE -lbmethod SRCIPDESTIPHASH -m MAC set lb parameter -preferdirectroute NO -vserverspecificmac ENABLED bind lb vserver VS1 FW1 bind lb vserver VS1 FW2 set rsskeytype -rsstype SYMMETRIC Virtual-Wire Configuration Step 1. Set IP addresses and routing Configure local IP addresses. These IP's will be used by the remote NetScaler for monitoring and load balancing. Notice that in virtual wire mode, the NetScaler monitors the health of the far-end NetScaler,t not the health of the firewall. Then set routes to the relevant destination subnets on the local side. add ns ip vserver DISABLED add ns ip vserver DISABLED add route add route Step 2. Enable the modes and features Turn on the Load Balancing feature (LB). Turn on the Layer-2 forwarding mode (L2) and Mac-based Forwarding (MBF). Disable the Layer-3 forwarding mode (L3). The NetScaler can be used in L2 or L3 mode, however, L2 mode is suggested here so that no changes are necessary to the rest of the network. If L3 mode were used here, the NetScaler would need to be the default gateway or next hop for adjacent devices, thus requiring a change to adjacent device routing tables. L2 mode does not require this change. enable ns feature LB enable ns mode L2 MBF disable ns mode L3 Step 3. Define a service for each firewall In virtual-wire mode, the firewall interfaces do not have IP addresses. So the services here are configured with the IP addresses of the far-end NetScaler. These IP addresses are configured during Step 1 while configuring the far-end NetScaler. The -usip (Use Source IP) argument ensures that the packet IP addresses are not altered. Each service must also have a static ARP entry which ties the far-end NetScaler IP address to the corresponding far-end NetScaler MAC address and a local egress interface. These static ARP entries ensure that traffic is load balanced across the firewalls, instead of all traffic being sent to one firewall.

7 add server add server add service LB ANY * -usip YES add service LB ANY * -usip YES add arp -IPAddress mac 00:e0:ed:25:95:a0 -ifnum 10/3 add arp -IPAddress mac 00:e0:ed:25:95:a1 -ifnum 10/4 Step 4. Define a virtual server The virtual server receives the traffic and rewrites the MAC address to that of a service defined above. The virtual service is set to use the source/destination IP as the load balancing method, and to redirect rewriting the destination MAC address instead of rewriting the destination IP address (default). Set the load balancing parameters to account for the firewalls as a next hop, instead of a server. Bind each service to the virtual server. The last command changes the Receive Side Scaling to maintain symmetry of flows such that each flow is always processed by the same internal Packet Engine, thus improving performance. NOTE: The 'set rsskeytype' command is available only in specific NetScaler software versions. For other versions, do not enter the command. The command is available in: 9.3.nc Build e and higher 10.1 Build and higher Not available on 10.0 software version as of this writting. add lb vserver VS1 ANY * * -persistencetype NONE -lbmethod SRCIPDESTIPHASH -m MAC set lb parameter -preferdirectroute NO -vserverspecificmac ENABLED bind lb vserver VS1 LB6 bind lb vserver VS1 LB8 set rsskeytype -rsstype SYMMETRIC 3300 Olcott Street Santa Clara, CA Main: Sales: Support: Copyright 2013, Networks, Inc. All rights reserved. Networks, the Networks Logo, PAN-OS, App-ID and Panorama are trademarks of Networks, Inc. All specifications are subject to change without notice. Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. PAN_TPSB_CNADC_062513