Enterprise Environment
In the enterprise setup, the Citrix ADC is placed between the firewalls connecting to the public Internet and the internal private network and handles egress traffic. The Citrix ADC selects the best firewall based on the configured load balancing policy.
The following diagram shows the enterprise firewall load balancing environment
Figure 1. Firewall Load Balancing (Enterprise)
The service type ANY configures the Citrix ADC to accept all traffic.
To avail benefits related to HTTP and TCP, configure the service and virtual server with type HTTP or TCP. For FTP to work, configure the service with type FTP.
相依iguring the Citrix ADC in an Enterprise Environment
Perform the following tasks to configure a Citrix ADC in an enterprise environment.
For traffic from the server (egress)
- Enable the load balancing feature.
- 相依igure a wildcard service for each firewall.
- 相依igure a monitor for each wildcard service.
- 相依igure a wildcard virtual server to load balance the traffic sent to the firewalls.
- 相依igure the virtual server in MAC rewrite mode.
- Bind firewall services to the wildcard virtual server.
For traffic across private network servers
- 相依igure a service for each virtual server.
- 相依igure a monitor for each service.
- 相依igure an HTTP virtual server to balance traffic sent to the servers.
- Bind HTTP services to the HTTP virtual server.
- Save and Verify the Configuration.
Enable the load balancing feature
You can configure load balancing entities such as services and virtual servers when the load balancing feature is disabled, but they do not function until you enable the feature.
To enable load balancing by using the command line interface
At the command prompt, type the following command to enable load balancing and verify the configuration:
- enable ns feature LB
- show ns feature
Example:
> enable ns feature LoadBalancing Done > show ns feature Feature Acronym Status ------- ------- ------ 1) Web Logging WL OFF 2) Surge Protection SP ON 3) Load Balancing LB ON . . . 24) NetScaler Push push OFF Done
To enable load balancing by using the configuration utility
Navigate toSystem > Settingsand, in Configure Basic Features, selectLoad Balancing.
相依igure a wildcard service for each firewall
To configure a wildcard service for each firewall by using the command line interface
At the command prompt, type:
任何*添加服务<名称> < serverName > < !——NeedCopy-->
Example:
add service Service-HTTP-1 10.102.29.5 ANY *
To configure a wildcard service for each firewall by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Services.
- In the details pane, click Add.
- In the Create Service dialog box, specify values for the following parameters as shown:
- Service Name—name
- Server—serverName
- In Protocol, select ANY, and in Port, select *.
- Click Create, and then click Close. The service you created appears in the Services pane.
相依igure a monitor for each wildcard service
A PING monitor is bound by default to the service. Configure a transparent monitor to monitor hosts on the trusted side through individual firewalls. You can then bind the transparent monitor to services. The default PING monitor monitors the connectivity only between the Citrix ADC appliance and the upstream device. The transparent monitor monitors all the devices existing in the path from the appliance to the device that owns the destination IP address specified in the monitor. If a transparent monitor is not configured and the status of the firewall is UP but one of the next hop devices from that firewall is down, the appliance includes the firewall while performing load balancing and forwards the packet to the firewall. However, the packet is not delivered to the final destination because one of the next hop devices is down. By binding a transparent monitor, if any of the devices (including the firewall) are down, the service is marked as DOWN and the firewall is not included when the appliance performs firewall load balancing.
Binding a transparent monitor overrides the PING monitor. To configure a PING monitor in addition to a transparent monitor, after you create and bind a transparent monitor, you need to bind a PING monitor to the service.
To configure a transparent monitor by using the command line interface
在命令提示符下,键入以下命令to configure a transparent monitor and verify the configuration:
add lb monitor [-destIP ] [-transparent (YES | NO )] bind lb monitor
Example:
add monitor monitor-HTTP-1 HTTP -destip 10.10.10.11 -transparent YES bind monitor monitor-HTTP-1 fw-svc1
To create and bind a transparent monitor by using the configuration utility
Navigate toTraffic Management > Load Balancing > Monitors.
In the details pane, click Add.
In the Create Monitor dialog box, specify the values as shown:
- Name*
- Type*—type
- Destination IP
- Transparent
-* A required parameter
Click Create, and then click Close. In the Monitors pane, select the monitor that you configured and verify that the settings displayed at the bottom of the screen are correct.
相依igure a wildcard virtual server to load balance the traffic sent to the firewalls
To configure a wildcard virtual server to load balance the traffic sent to the firewalls by using the command line interface
At the command prompt, type:
add lb vserver ANY * *
Example:
add lb vserver Vserver-LB-1 ANY * *
To configure a wildcard virtual server to load balance the traffic sent to the firewalls by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Virtual Servers.
- In the details pane, click Add.
- In the Create Virtual Server (Load Balancing) dialog box, specify values for the following parameters as shown:
- Name—name
- In Protocol, select ANY, and in IP Address and Port, select *.
- Click Create, and then click Close. The virtual server you created appears in the Load Balancing Virtual Servers pane.
相依igure the virtual server in MAC rewrite mode
在MAC重写国防部配置虚拟服务器e by using the command line interface
At the command prompt, type:
set lb vserver @ -m
Example:
set lb vserver Vserver-LB-1 -m MAC
在MAC重写国防部配置虚拟服务器e by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Virtual Servers.
- In the details pane, select the virtual server for which you want to configure the redirection mode (for example, Vserver-LB-1), and then click Open.
- On the Advanced tab, under Redirection Mode, click MAC-Based.
- Click OK.
Bind firewall services to the wildcard virtual server
To bind firewall services to the wildcard virtual server by using the command line interface
At the command prompt, type:
bind lb vserver
Example:
bind lb vserver Vserver-LB-1 Service-HTTP-1
To bind firewall services to the wildcard virtual server by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Virtual Servers, and select a virtual server.
- Click in the Service section, and select a service to bind.
Note: You can bind a service to multiple virtual servers.
相依igure a service for each virtual server
To configure a service for each virtual server by using the command line interface
At the command prompt, type:
add service HTTP
Example:
add service Service-HTTP-1 10.102.29.5 HTTP 80
To configure a service for each virtual server by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Services.
- In the details pane, click Add.
- In the Create Service dialog box, specify values for the following parameters as shown:
- Service Name—name
- Server—serverName
- Port—port
- In Protocol, specify HTTP. Under Available Monitors, select HTTP.
- Click Create, and then click Close. The service you created appears in the Services pane.
相依igure a monitor for each service
To bind a monitor to a service by using the command line interface
At the command prompt, type:
bind lb monitor
Example:
bind mon monitor-HTTP-1 Service-HTTP-1
To bind a monitor to a service by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Services.
- Open the service, and add a monitor.
相依igure an HTTP virtual server to balance traffic sent to the servers
To configure an HTTP virtual server to balance traffic sent to the servers by using the command line interface
At the command prompt, type:
add lb vserver HTTP
Example:
add lb vserver Vserver-LB-1 HTTP 10.102.29.60 80
To configure an HTTP virtual server to balance traffic sent to the servers by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Virtual Servers.
- In the details pane, click Add.
- In the Create Virtual Server (Load Balancing) dialog box, specify values for the following parameters as shown:
- Name—name
- IP Address—IP address Note: If the virtual server uses IPv6, select the IPv6 check box and enter the address in IPv6 format (for example,1000:0000:0000:0000:0005:0600:700a:888b).
- Port—port
- Under Protocol, select HTTP.
- Click Create, and then click Close. The virtual server you created appears in the Load Balancing Virtual Servers pane.
Bind HTTP services to the HTTP virtual server
To bind HTTP services to the wildcard virtual server by using the command line interface
At the command prompt, type:
bind lb vserver
Example:
bind lb vserver Vserver-LB-1 Service-HTTP-1
To bind HTTP services to the wildcard virtual server by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Virtual Servers, and select a virtual server.
- Click in the Service section, and select a service to bind.
Note: You can bind a service to multiple virtual servers.
Save and Verify the Configuration
When you’ve finished the configuration tasks, be sure to save the configuration. You can also check to make sure that the settings are correct.
To save and verify the configuration by using the command line interface
在命令提示符下,键入以下命令to configure a transparent monitor and verify the configuration:
- save ns config - show vserver
Example:
save config show lb vserver FWLBVIP2 FWLBVIP2 (*:*) - ANY Type: ADDRESS State: UP Last state change was at Mon Jun 14 07:22:54 2010 Time since last state change: 0 days, 00:00:32.760 Effective State: UP Client Idle Timeout: 120 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED No. of Bound Services : 2 (Total) 2 (Active) Configured Method: LEASTCONNECTION Current Method: Round Robin, Reason: A new service is bound Mode: MAC Persistence: NONE Connection Failover: DISABLED 1) fw-int-svc1 (10.102.29.5: *) - ANY State: UP Weight: 1 2) fw-int-svc2 (10.102.29.9: *) - ANY State: UP Weight: 1 Done show service fw-int-svc1 fw-int-svc1 (10.102.29.5:*) - ANY State: DOWN Last state change was at Thu Jul 8 14:44:51 2010 Time since last state change: 0 days, 00:01:50.240 Server Name: 10.102.29.5 Server ID : 0 Monitor Threshold : 0 Max Conn: 0 Max Req: 0 Max Bandwidth: 0 kbits Use Source IP: NO Client Keepalive(CKA): NO Access Down Service: NO TCP Buffering(TCPB): NO HTTP Compression(CMP): NO Idle timeout: Client: 120 sec Server: 120 sec Client IP: DISABLED Cacheable: NO SC: OFF SP: OFF Down state flush: ENABLED 1) Monitor Name: monitor-HTTP-1 State: DOWN Weight: 1 Probes: 9 Failed [Total: 9 Current: 9] Last response: Failure - Time out during TCP connection establishment stage Response Time: 2000.0 millisec 2) Monitor Name: ping State: UP Weight: 1 Probes: 3 Failed [Total: 0 Current: 0] Last response: Success - ICMP echo reply received. Response Time: 1.275 millisec Done
To save and verify the configuration by using the configuration utility
- In the details pane, click Save.
- In the Save Config dialog box, click Yes.
- Navigate toTraffic Management > Load Balancing > Virtual Servers.
- In the details pane, select the virtual server that you created in step 5, verify that the settings displayed in the Details pane are correct.
- Navigate toTraffic Management > Load Balancing > Services.
- In the details pane, select the service that you created in step 5, verify that the settings displayed in the Details pane are correct.
Monitoring a Firewall Load Balancing Setup in an Enterprise Environment
After the configuration is up and running, you can view the statistics for each service and virtual server to check for possible problems.
Viewing the Statistics of a Virtual Server
To evaluate the performance of virtual servers or to troubleshoot problems, you can display details of the virtual servers configured on the Citrix ADC appliance. You can display a summary of statistics for all the virtual servers, or you can specify the name of a virtual server to display the statistics only for that virtual server. You can display the following details:
- Name
- IP address
- Port
- Protocol
- State of the virtual server
- Rate of requests received
- Rate of requests to the virtual server
To display virtual server statistics by using the command line interface
To display a summary of the statistics for all the virtual servers currently configured on the Citrix ADC appliance, or for a single virtual server, at the command prompt, type:
stat lb vserver [-detail] []
Example:
>stat lb vserver -detail Virtual Server(s) Summary vsvrIP port Protocol State Req/s Hits/s One * 80 HTTP UP 5/s 0/s Two * 0 TCP DOWN 0/s 0/s Three * 2598 TCP DOWN 0/s 0/s dnsVirtualNS 10.102.29.90 53 DNS DOWN 0/s 0/s BRVSERV 10.10.1.1 80 HTTP DOWN 0/s 0/s LBVIP 10.102.29.66 80 HTTP UP 0/s 0/s Done
To display virtual server statistics by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Virtual Servers > Statistics.
- If you want to display the statistics for only one virtual server, in the details pane, select the virtual server, and click Statistics.
Viewing the Statistics of a Service
Updated: 2013-08-28
You can view the rate of requests, responses, request bytes, response bytes, current client connections, requests in the surge queue, current server connections, and so forth using the service statistics.
To view the statistics of a service by using the command line interface
At the command prompt, type:
stat service
Example:
stat service Service-HTTP-1
To view the statistics of a service by using the configuration utility
- Navigate toTraffic Management > Load Balancing > Services > Statistics.
- If you want to display the statistics for only one service, select the service, and click Statistics.