Getting Started with Citrix ADC
-
Deploy a Citrix ADC VPX instance
Install a Citrix ADC VPX instance on Microsoft Hyper-V servers
Install a Citrix ADC VPX instance on Linux-KVM platform
Prerequisites for Installing Citrix ADC VPX Virtual Appliances on Linux-KVM Platform
Provisioning the Citrix ADC Virtual Appliance by using OpenStack
Provisioning the Citrix ADC Virtual Appliance by using the Virtual Machine Manager
配置uring Citrix ADC Virtual Appliances to Use SR-IOV Network Interface
配置uring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
Provisioning the Citrix ADC Virtual Appliance by using the virsh Program
Provisioning the Citrix ADC Virtual Appliance with SR-IOV, on OpenStack
配置uring a Citrix ADC VPX Instance on KVM to Use OVS DPDK-Based Host Interfaces
Deploy a Citrix ADC VPX instance on AWS
Deploy a Citrix ADC VPX instance on Microsoft Azure
Network architecture for Citrix ADC VPX instances on Microsoft Azure
配置multiple IP addresses for a Citrix ADC VPX standalone instance
配置a high-availability setup with multiple IP addresses and NICs
配置a high-availability setup with multiple IP addresses and NICs by using PowerShell commands
配置HA-INC nodes by using the Citrix high availability template with Azure ILB
Upgrade and downgrade a Citrix ADC appliance
Authentication, authorization, and auditing application traffic
配置uring authentication, authorization, and auditing policies
配置uring Authentication, authorization, and auditing with commonly used protocols
Use an on-premises Citrix Gateway as the identity provider for Citrix Cloud
Troubleshoot authentication issues in Citrix ADC and Citrix Gateway with aaad.debug module
-
AppExpert Applications and Templates
-
-
-
-
-
-
Persistence and persistent connections
Advanced load balancing settings
Gradually stepping up the load on a new service with virtual server–level slow start
Protect applications on protected servers against traffic surges
Retrieve location details from user IP address using geolocation database
Use source IP address of the client when connecting to the server
Use client source IP address for backend communication in a v4-v6 load balancing configuration
Set a limit on number of requests per connection to the server
配置automatic state transition based on percentage health of bound services
Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
Use case 3: Configure load balancing in direct server return mode
Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
Use case 7: Configure load balancing in DSR mode by using IP Over IP
Use case 10: Load balancing of intrusion detection system servers
Use case 11: Isolating network traffic using listen policies
Use case 12: Configure Citrix Virtual Desktops for load balancing
Use case 13: Configure Citrix Virtual Apps for load balancing
Use case 14: ShareFile wizard for load balancing Citrix ShareFile
-
-
-
DNS security options
-
Authentication and authorization
-
配置uring a CloudBridge Connector Tunnel between two Datacenters
配置uring CloudBridge Connector between Datacenter and AWS Cloud
配置uring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
配置uring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
配置uring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Cisco IOS Device
CloudBridge Connector Tunnel Diagnostics and Troubleshooting
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde.(Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique.(Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica.(Aviso legal)
此内容已经过机器动态翻译。放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다.책임 부인
Este texto foi traduzido automaticamente.(Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt.(Haftungsausschluss)
Ce article a été traduit automatiquement.(Clause de non responsabilité)
Este artículo ha sido traducido automáticamente.(Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
DNS security options
You can now configure the DNS security options from the Add DNS Security Profile page in the Citrix ADC GUI. To configure the DNS security options from the Citrix ADC CLI or the NITRO API, use the AppExpert components. For instructions, see the NITRO API documentation and the Citrix ADC Command Reference Guide.
One option, cache poisoning protection, is enabled by default and cannot be disabled. You can apply the other options to all DNS endpoints or to specific DNS virtual servers in your deployment, as shown in the following table:
Security option | Can be applied to all DNS endpoints? | Can be applied to specific DNS virtual servers? |
---|---|---|
DNS DDoS protection | Yes | Yes |
Manage exceptions – whitelist/blacklist servers | Yes | Yes |
Prevent random subdomain attacks | Yes | Yes |
Bypass the cache | Yes | No |
Enforce DNS transactions over TCP | Yes | Yes |
Provide root details in the DNS response | Yes | No |
Cache poisoning protection
A cache poisoning attack redirects users from legitimate sites to malicious websites.
For example, the attacker replaces a genuine IP address in the DNS cache with a fake IP address that they control. When the server responds to requests from these addresses, the cache is poisoned and the subsequent requests for the addresses of the domain are redirected to the attacker’s site.
The Cache Poisoning Protection option prevents insertion of corrupt data into the database that caches DNS server requests and responses. This is an inbuilt feature of the Citrix ADC appliances and is always enabled.
DNS DDoS protection
You can configure the DNS DDoS Protection option for each type of request that you suspect might be used in a DDoS attack. For each type, the Citrix ADC appliance drops any requests received after a threshold value for the number of requests received in a specified period of time (time slice) is exceeded. You can also configure this option to log a warning to the SYSLOG server. For example:
- DROP:- Assume that you have enabled A record protection with threshold value 15, time slice as 1 second and chosen DROP. When the incoming requests exceed 15 in 1 second, then the packets start getting dropped.
- WARN:- Assume that you have enabled A record protection with threshold value 15, time slice as 1 second and chosen WARN. When the incoming requests exceeds around 15 queries in 1 second, a warning message is logged indicating a threat and then the packets start getting dropped. It is recommended to set threshold values for WARN smaller than that of DROP for a record type. This will help administrators identify an attack by logging a warning message before the actual attack happens and Citrix ADC starts dropping incoming requests.
Set a threshold for incoming traffic by using the Citrix ADC GUI
- Navigate to配置uration>Security>DNS Security.
- On theDNS Security Profilepage, clickAdd.
- On theAdd DNS Security Profilepage, do the following:
- ExpandDNS DDoS Protection.
- Select the record type and enter the threshold limit and the time slice value.
- SelectDROPorWARN.
- Repeat steps a and b for each of the other record types that you want to protect against.
- ClickSubmit.
Manage exceptions – whitelist/blacklist servers
Manage excepts enables you to add exceptions either to blacklist or whitelist domain name and IP addresses. For example:
- When a particular IP address is identified posting an attack, such IP address can be blacklisted.
- When administrators find that there is unexpectedly high request for a particular domain name, then that domain name can be blacklisted.
- NXDomains and some of the existent domains which can consume the server resources can be blacklisted.
- When administrators whitelist domain names or IP addresses, queries or requests only from these domains or IP addresses are answered and all others are dropped.
创建一个白名单啊r blacklist by using the GUI
- Navigate to配置uration>Security>DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, do the following:
- ExpandManage exceptions – Whitelist/Blacklist Servers.
- SelectBlockto block queries from blacklisted domains/addresses, or selectAllowonly to allow queries from whitelisted domains/addresses.
- In theDomain name / IP Addressbox, enter the domain names, IP addresses, or IP address ranges. Use commas to separate the entries.Note: If you selectAdvanced Option, you can use the “start with,” “contains,” and “ends with” options to set the criteria. For example, you can set criteria to block a DNS query that starts with “image” or ends with “.co.ru” or contains “mobilesites.”
- ClickSubmit.
Prevent random subdomain attacks
In random subdomain attacks, queries are sent to random, nonexistent subdomains of legitimate domains. This increases the load on the DNS resolvers and servers. As a result, they can become overloaded and slow down.
防止随机子域名的选择直接攻击s the DNS responder to drop DNS queries that exceed a specified length.
Assume that example.com is a domain name owned by you and hence the resolution request comes to your DNS server. The attacker can append a random subdomain to example.com and send a request. Based on the specified query length and the FQDN, the random queries will be dropped.
For example, if the query is www.image987trending.example.com, it will be dropped if the query length is set to 20.
Specify a DNS query length by using the GUI
- Navigate to配置uration>Security>DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, do the following:
- ExpandPrevent Random Subdomain Attacks.
- Enter the numerical value for the query length.
- ClickSubmit.
Bypassing the cache
在攻击,已经缓存的数据must be protected. To protect the cache, new requests for certain domains or record types or response codes can be sent to the origin servers instead of cached.
The Bypassing the cache option directs the Citrix ADC appliance to bypass the cache for specified domains, record types, or response codes when an attack is detected.
Bypass the cache for specified domains or record types or response types by using the GUI
- Navigate to配置uration>Security>DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, expandBypassing the cacheand enter the domain names and / or choose the record types or the response types for which the cache has to be bypassed.
- ClickDomainsand enter the domain names. Use commas to separate the entries.
- ClickRecord Typesand choose the record types.
- ClickResponse Typesand choose the response type.
- ClickSubmit.
Enforce DNS transactions over TCP
Some DNS attacks can be prevented if the transactions are forced to use TCP instead of UDP. For example, during a bot attack, the client sends a flood of queries but cannot handle responses. If the use of TCP is enforced for these transactions, then the bots cannot understand the responses and therefore cannot send requests over TCP.
Force domains or record types to operate at the TCP level by using the GUI
- Navigate to配置uration>Security>DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, expandEnforce DNS Transactions over TCPand enter the domain names and / or choose the record types for which the DNS transactions must be enforced over TCP.
- ClickDomainsand enter the domain names. Use commas to separate the entries.
- ClickRecordTypesand choose the record types.
- ClickSubmit.
Provide root details in the DNS response
In some attacks, the attacker sends a flood of queries for unrelated domains that are not configured or cached on the Citrix ADC appliance. lf the dnsRootReferral parameter is ENABLED, it exposes all the root servers.
The Provide Root Details in the DNS Response option directs the Citrix ADC appliance to restrict access to root referrals for a query that is not configured or cached. The appliance sends a blank response.
The Provide Root Details in the DNS Response option can also mitigate or block amplification attacks. When the dnsRootReferral parameter is DISABLED, there will be no root referral in the Citrix ADC responses and hence they do not get amplified.
Enable or disable access to the root server by using the GUI
- Navigate to配置uration>Security>DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, do the following:
- ExpandProvide Root Details in theDNS Response.
- ClickONorOFF允许或限制访问根服务器。
- ClickSubmit.
Share
Share
This Preview product documentation is Citrix Confidential.
你同意这个文档保密pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select Do Not Agree to exit.