Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Enterprise Environment

March 29, 2021
Contributed by:
C S

In the enterprise setup, the Citrix ADC is placed between the firewalls connecting to the public Internet and the internal private network and handles egress traffic. The Citrix ADC selects the best firewall based on the configured load balancing policy.

The following diagram shows the enterprise firewall load balancing environment

Figure 1. Firewall Load Balancing (Enterprise)

Firewall-load-balancing

The service type ANY configures the Citrix ADC to accept all traffic.

To avail benefits related to HTTP and TCP, configure the service and virtual server with type HTTP or TCP. For FTP to work, configure the service with type FTP.

相依iguring the Citrix ADC in an Enterprise Environment

Perform the following tasks to configure a Citrix ADC in an enterprise environment.

For traffic from the server (egress)

  • Enable the load balancing feature.
  • 相依igure a wildcard service for each firewall.
  • 相依igure a monitor for each wildcard service.
  • 相依igure a wildcard virtual server to load balance the traffic sent to the firewalls.
  • 相依igure the virtual server in MAC rewrite mode.
  • Bind firewall services to the wildcard virtual server.

For traffic across private network servers

  • 相依igure a service for each virtual server.
  • 相依igure a monitor for each service.
  • 相依igure an HTTP virtual server to balance traffic sent to the servers.
  • Bind HTTP services to the HTTP virtual server.
  • Save and Verify the Configuration.

Enable the load balancing feature

You can configure load balancing entities such as services and virtual servers when the load balancing feature is disabled, but they do not function until you enable the feature.

To enable load balancing by using the command line interface

At the command prompt, type the following command to enable load balancing and verify the configuration:

  • enable ns feature LB
  • show ns feature

Example:

> enable ns feature LoadBalancing Done > show ns feature Feature Acronym Status ------- ------- ------ 1) Web Logging WL OFF 2) Surge Protection SP ON 3) Load Balancing LB ON . . . 24) NetScaler Push push OFF Done

To enable load balancing by using the configuration utility

Navigate toSystem > Settingsand, in Configure Basic Features, selectLoad Balancing.

相依igure a wildcard service for each firewall

To configure a wildcard service for each firewall by using the command line interface

At the command prompt, type:

任何*添加服务<名称> < serverName > < !——NeedCopy-->

Example:

add service Service-HTTP-1 10.102.29.5 ANY *

To configure a wildcard service for each firewall by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Services.
  2. In the details pane, click Add.
  3. In the Create Service dialog box, specify values for the following parameters as shown:
    • Service Name—name
    • Server—serverName
  4. In Protocol, select ANY, and in Port, select *.
  5. Click Create, and then click Close. The service you created appears in the Services pane.

相依igure a monitor for each wildcard service

A PING monitor is bound by default to the service. Configure a transparent monitor to monitor hosts on the trusted side through individual firewalls. You can then bind the transparent monitor to services. The default PING monitor monitors the connectivity only between the Citrix ADC appliance and the upstream device. The transparent monitor monitors all the devices existing in the path from the appliance to the device that owns the destination IP address specified in the monitor. If a transparent monitor is not configured and the status of the firewall is UP but one of the next hop devices from that firewall is down, the appliance includes the firewall while performing load balancing and forwards the packet to the firewall. However, the packet is not delivered to the final destination because one of the next hop devices is down. By binding a transparent monitor, if any of the devices (including the firewall) are down, the service is marked as DOWN and the firewall is not included when the appliance performs firewall load balancing.

Binding a transparent monitor overrides the PING monitor. To configure a PING monitor in addition to a transparent monitor, after you create and bind a transparent monitor, you need to bind a PING monitor to the service.

To configure a transparent monitor by using the command line interface

在命令提示符下,键入以下命令to configure a transparent monitor and verify the configuration:

add lb monitor   [-destIP ] [-transparent (YES | NO )] bind lb monitor

Example:

add monitor monitor-HTTP-1 HTTP -destip 10.10.10.11 -transparent YES bind monitor monitor-HTTP-1 fw-svc1

To create and bind a transparent monitor by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Monitors.

  2. In the details pane, click Add.

  3. In the Create Monitor dialog box, specify the values as shown:

    • Name*
    • Type*—type
    • Destination IP
    • Transparent

    -* A required parameter

  4. Click Create, and then click Close. In the Monitors pane, select the monitor that you configured and verify that the settings displayed at the bottom of the screen are correct.

相依igure a wildcard virtual server to load balance the traffic sent to the firewalls

To configure a wildcard virtual server to load balance the traffic sent to the firewalls by using the command line interface

At the command prompt, type:

add lb vserver  ANY * *

Example:

add lb vserver Vserver-LB-1 ANY * *

To configure a wildcard virtual server to load balance the traffic sent to the firewalls by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, click Add.
  3. In the Create Virtual Server (Load Balancing) dialog box, specify values for the following parameters as shown:
    • Name—name
  4. In Protocol, select ANY, and in IP Address and Port, select *.
  5. Click Create, and then click Close. The virtual server you created appears in the Load Balancing Virtual Servers pane.

相依igure the virtual server in MAC rewrite mode

在MAC重写国防部配置虚拟服务器e by using the command line interface

At the command prompt, type:

set lb vserver @ -m

Example:

set lb vserver Vserver-LB-1 -m MAC

在MAC重写国防部配置虚拟服务器e by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, select the virtual server for which you want to configure the redirection mode (for example, Vserver-LB-1), and then click Open.
  3. On the Advanced tab, under Redirection Mode, click MAC-Based.
  4. Click OK.

Bind firewall services to the wildcard virtual server

To bind firewall services to the wildcard virtual server by using the command line interface

At the command prompt, type:

bind lb vserver

Example:

bind lb vserver Vserver-LB-1 Service-HTTP-1

To bind firewall services to the wildcard virtual server by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Virtual Servers, and select a virtual server.
  2. Click in the Service section, and select a service to bind.

Note: You can bind a service to multiple virtual servers.

相依igure a service for each virtual server

To configure a service for each virtual server by using the command line interface

At the command prompt, type:

add service   HTTP

Example:

add service Service-HTTP-1 10.102.29.5 HTTP 80

To configure a service for each virtual server by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Services.
  2. In the details pane, click Add.
  3. In the Create Service dialog box, specify values for the following parameters as shown:
    • Service Name—name
    • Server—serverName
    • Port—port
  4. In Protocol, specify HTTP. Under Available Monitors, select HTTP.
  5. Click Create, and then click Close. The service you created appears in the Services pane.

相依igure a monitor for each service

To bind a monitor to a service by using the command line interface

At the command prompt, type:

bind lb monitor

Example:

bind mon monitor-HTTP-1 Service-HTTP-1

To bind a monitor to a service by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Services.
  2. Open the service, and add a monitor.

相依igure an HTTP virtual server to balance traffic sent to the servers

To configure an HTTP virtual server to balance traffic sent to the servers by using the command line interface

At the command prompt, type:

add lb vserver  HTTP

Example:

add lb vserver Vserver-LB-1 HTTP 10.102.29.60 80

To configure an HTTP virtual server to balance traffic sent to the servers by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, click Add.
  3. In the Create Virtual Server (Load Balancing) dialog box, specify values for the following parameters as shown:
    • Name—name
    • IP Address—IP address Note: If the virtual server uses IPv6, select the IPv6 check box and enter the address in IPv6 format (for example,1000:0000:0000:0000:0005:0600:700a:888b).
    • Port—port
  4. Under Protocol, select HTTP.
  5. Click Create, and then click Close. The virtual server you created appears in the Load Balancing Virtual Servers pane.

Bind HTTP services to the HTTP virtual server

To bind HTTP services to the wildcard virtual server by using the command line interface

At the command prompt, type:

bind lb vserver

Example:

bind lb vserver Vserver-LB-1 Service-HTTP-1

To bind HTTP services to the wildcard virtual server by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Virtual Servers, and select a virtual server.
  2. Click in the Service section, and select a service to bind.

Note: You can bind a service to multiple virtual servers.

Save and Verify the Configuration

When you’ve finished the configuration tasks, be sure to save the configuration. You can also check to make sure that the settings are correct.

To save and verify the configuration by using the command line interface

在命令提示符下,键入以下命令to configure a transparent monitor and verify the configuration:

- save ns config - show vserver

Example:

save config show lb vserver FWLBVIP2 FWLBVIP2 (*:*) - ANY Type: ADDRESS State: UP Last state change was at Mon Jun 14 07:22:54 2010 Time since last state change: 0 days, 00:00:32.760 Effective State: UP Client Idle Timeout: 120 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED No. of Bound Services : 2 (Total) 2 (Active) Configured Method: LEASTCONNECTION Current Method: Round Robin, Reason: A new service is bound Mode: MAC Persistence: NONE Connection Failover: DISABLED 1) fw-int-svc1 (10.102.29.5: *) - ANY State: UP Weight: 1 2) fw-int-svc2 (10.102.29.9: *) - ANY State: UP Weight: 1 Done show service fw-int-svc1 fw-int-svc1 (10.102.29.5:*) - ANY State: DOWN Last state change was at Thu Jul 8 14:44:51 2010 Time since last state change: 0 days, 00:01:50.240 Server Name: 10.102.29.5 Server ID : 0 Monitor Threshold : 0 Max Conn: 0 Max Req: 0 Max Bandwidth: 0 kbits Use Source IP: NO Client Keepalive(CKA): NO Access Down Service: NO TCP Buffering(TCPB): NO HTTP Compression(CMP): NO Idle timeout: Client: 120 sec Server: 120 sec Client IP: DISABLED Cacheable: NO SC: OFF SP: OFF Down state flush: ENABLED 1) Monitor Name: monitor-HTTP-1 State: DOWN Weight: 1 Probes: 9 Failed [Total: 9 Current: 9] Last response: Failure - Time out during TCP connection establishment stage Response Time: 2000.0 millisec 2) Monitor Name: ping State: UP Weight: 1 Probes: 3 Failed [Total: 0 Current: 0] Last response: Success - ICMP echo reply received. Response Time: 1.275 millisec Done

To save and verify the configuration by using the configuration utility

  1. In the details pane, click Save.
  2. In the Save Config dialog box, click Yes.
  3. Navigate toTraffic Management > Load Balancing > Virtual Servers.
  4. In the details pane, select the virtual server that you created in step 5, verify that the settings displayed in the Details pane are correct.
  5. Navigate toTraffic Management > Load Balancing > Services.
  6. In the details pane, select the service that you created in step 5, verify that the settings displayed in the Details pane are correct.

Monitoring a Firewall Load Balancing Setup in an Enterprise Environment

After the configuration is up and running, you can view the statistics for each service and virtual server to check for possible problems.

Viewing the Statistics of a Virtual Server

To evaluate the performance of virtual servers or to troubleshoot problems, you can display details of the virtual servers configured on the Citrix ADC appliance. You can display a summary of statistics for all the virtual servers, or you can specify the name of a virtual server to display the statistics only for that virtual server. You can display the following details:

  • Name
  • IP address
  • Port
  • Protocol
  • State of the virtual server
  • Rate of requests received
  • Rate of requests to the virtual server

To display virtual server statistics by using the command line interface

To display a summary of the statistics for all the virtual servers currently configured on the Citrix ADC appliance, or for a single virtual server, at the command prompt, type:

stat lb vserver [-detail] []

Example:

>stat lb vserver -detail Virtual Server(s) Summary vsvrIP port Protocol State Req/s Hits/s One * 80 HTTP UP 5/s 0/s Two * 0 TCP DOWN 0/s 0/s Three * 2598 TCP DOWN 0/s 0/s dnsVirtualNS 10.102.29.90 53 DNS DOWN 0/s 0/s BRVSERV 10.10.1.1 80 HTTP DOWN 0/s 0/s LBVIP 10.102.29.66 80 HTTP UP 0/s 0/s Done

To display virtual server statistics by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Virtual Servers > Statistics.
  2. If you want to display the statistics for only one virtual server, in the details pane, select the virtual server, and click Statistics.

Viewing the Statistics of a Service

Updated: 2013-08-28

You can view the rate of requests, responses, request bytes, response bytes, current client connections, requests in the surge queue, current server connections, and so forth using the service statistics.

To view the statistics of a service by using the command line interface

At the command prompt, type:

stat service

Example:

stat service Service-HTTP-1

To view the statistics of a service by using the configuration utility

  1. Navigate toTraffic Management > Load Balancing > Services > Statistics.
  2. If you want to display the statistics for only one service, select the service, and click Statistics.
Enterprise Environment
March 29, 2021
Contributed by:
C S
March 29, 2021
Contributed by:
C S

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999-Cloud Software Group, Inc. All rights reserved.