Configure admin partitions
Important
- Only superusers are authorized to create and configure admin partitions.
- Unless specified otherwise, configurations to set up an admin partition must be done from the default partition.
By partitioning a Citrix ADC appliance, you are in-effect creating multiple instances of a single Citrix ADC appliance. Each instance has its own configurations and the traffic of each of these partitions is isolated from the other. It is done by assigning each partition a dedicated VLAN or a shared VLAN.
A partitioned Citrix ADC has one default partition and the admin partitions that are created. To set up an admin partition, you must first create a partition with the relevant resources (memory, maximum bandwidth, and connections). Then, specify the users that can access the partition and the level of authorization for each of the users on the partition.
Accessing a partitioned Citrix ADC is the same as accessing a non-partitioned Citrix ADC: through the NSIP address or any other management IP address. As a user, after you provide your valid logon credentials, you are taken to the partition to which you are bound. Any configurations that you create are saved to that partition. If you are associated with more than one partition, you are taken to the first partition with which you were associated. If you want to configure entities on one of your other partitions, you must explicitly switch to that partition.
After accessing the appropriate partition, the configurations that you perform are saved to that partition and are specific to that partition.
Note
- Citrix ADC superusers and other non-partition users are taken to the default partition.
- Users of all the 512 partitions can log in simultaneously.
Tip
To access a partitioned Citrix ADC appliance over HTTPS by using the SNIP (with management access enabled), make sure that each partition has the certificate of its partition administrator. Within the partition, the partition admin must do the following:
将证书添加到Citrix ADC。
add ssl certKey ns-server-certificate -cert ns-server.cert-key ns-server.key
Bind it to a service named
nshttps-
, where-3009
must be replaced with the SNIP address, in this case 100.10.10.1.bind ssl service nshttps-100.10.10.1-3009 -certkeyName ns-server-certificate
Partition resource limiting
In a partitioned Citrix ADC appliance, a network administrator can create a partition with partition resources such as memory, bandwidth, and connection limit configured as unlimited. It is done by specifying Zero as the partition resource value. Where Zero indicates the resource is unlimited on the partition and it can be consumed up to system limits. Partition resource configuration is useful when you migrate a traffic domain deployment to an administrative partition or if you do not know about the resource allocation limit for a partition in a given deployment.
Resource limit for an administrative partition is as follows:
Partition memory. It is the maximum allocated memory for a partition. You make sure to specify the values when creating a partition.
Note
From NetScaler 12.0 onwards, when you create a partition, you can set the memory limit to Zero. If a partition is already created with a specific memory limit, you can reduce the limit to any value or set the limit as Zero.
Parameter: maxMemLimit
Maximum memory is allocated in MB in a partition. A zero value indicates the memory is unlimited on the partition and it can consume up to the system limits.
Default value: 10
Partition bandwidth. Maximum allocated bandwidth for a partition. If you specify a limit, make sure it is within the appliance’s licensed throughput. Otherwise, you are not limiting the bandwidth that is used by the partition. The specified limit is accountable for the bandwidth that the application requires. If the application bandwidth exceeds the specified limit, packets are dropped.
Note
From NetScaler 12.0 onwards, when you can create a partition, you can set the partition bandwidth limit to Zero. If a partition is already created with a specific bandwidth, you can reduce the bandwidth or set the limit as Zero.
Parameter: maxBandwidth
最大带宽分配partit Kbpsion. A zero value indicates the bandwidth is unrestricted. That is, the partition can consume up to the system limits.
Default value: 10240
Maximum Value: 4294967295
Partition connection. Maximum number of concurrent connections that can be open in a partition. The value must accommodate the maximum simultaneous flow expected within the partition. The partition connections are accounted from the partition quota memory. Previously, the connections were accounted from the default partition quota memory. It is configured only on the client-side, not on the back-end server-side TCP connections. New connections cannot be established beyond this configured value.
Note
From NetScaler 12.0 onwards, you can create a partition with the number of open connections set to Zero. If you have already created a partition with a specific number of open connections, you can reduce the connection limit or set the limit as Zero.
Parameter: maxConnections
Maximum number of concurrent connections that can be open in the partition. A zero value indicates no limit on the number of open connections.
Default value: 1024
Minimum value: 0
Maximum Value: 4294967295
Configure an admin partition
To configure an admin partition, complete the following tasks.
To access in an admin partition by using the CLI
- Log on to the Citrix ADC appliance.
- Check if you are in the correct partition. The command prompt displays the name of the currently selected partition.
- If yes, skip to the next step.
If no, get a list of the partitions with which you are associated and switch over to the appropriate partition.
show system user
switch ns partition
- Now, you can perform the required configurations just as a non-partitioned Citrix ADC.
To access an admin partition by using the GUI
Log on to the Citrix ADC appliance.
Check if you are in the correct partition. The top bar of the GUI displays the name of the currently selected partition.
If yes, skip to the next step.
If no, navigate toConfiguration > System > Partition Administration > Partitions, right-click the partition to which you want to switch, and selectSwitch.
Now, you can perform the required configurations just as a non-partitioned Citrix ADC.
Add an admin partition
The root administrator adds an administrative partition from the default partition and binds the partition with VLAN 2.
To create an administrative partition by using the CLI
At the command prompt, type:
add partition
Switch user access from default partition to an admin partition
Now you can switch user access from default partition to partition Par1.
To switch a user account from default partition to an admin partition by using the CLI:
At the command prompt, type:
Switch ns partition
Adding SNIP address to a partition user account with management access enabled
In the partition, create a SNIP address with management access enabled.
To add SNIP address to the partition user account with management access enabled by using the command line interface:
At the command prompt, type:
> add ns ip
Create and Bind a partition user with partition command policy
In partition, create a partition system user and bind the user with partition-admin command policies.
To create and bind a partition system user with partition command policy by using the CLI:
At the command prompt, type:
> add system user
Done
Creating and binding partition user group with partition command policy
In Partition Par1, create a partition system user group and bind the group with partition command policy such as partition admin, partition read-only, partition-operator, or partition-network.
To create and bind a partition user group with partition command policy by using the command line interface:
> add system group > bind system group (-userName | -policyName | -partitionName)
Configuring external server authentication for external users
In partition Par1 you can configure an external server authentication to authenticate external TACACS users accessing the partition through a SNIP address.
To configure external server authentication for external users by using the command line interface:
At the command prompt, type:
<名称> >添加身份验证tacacsaction -serverip -tacacsSecret -authorization ON -accounting ON > add authentication policy -rule true -action > bind system global -priority 1
Configure a partition system user account in a partition by using the GUI
To configure a partition user account in an administrative partition, you must create a partition user or a partition user group and bind it partition command policies. Also, you can configure the external server authentication for an external user.
To create a partition user account in a partition by using the GUI
Navigate toSystem > User Administration, clickUsersto add a partition system user, and bind the user to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).
To create a partition user group account in a partition by using the GUI
Navigate toSystem > User Administration, clickGroupsto add a partition system user group and bind the user group to command policies (partitionadmin/partitionread-only/partition-operator/partition-network).
To configure external server authentication for external users by using the GUI
Navigate toSystem > Authentication > Basic Actionsand clickTACACSto configure a TACACS server for authenticating external users accessing the partition.
桑普le configuration
The following configuration shows how to create a partition user or a partition user group and bind it partition command policies. Also, how to configure the external server authentication for authenticating an external user.
> add partition Par1 > switch ns partition Par1 > add ns ip 10.102.29.203 255.255.255.0 -mgmtAccessenabled > add system user John Password > bind system user Jane partition-read-only -priority 1 > add system group Retail > bind system group Retail -policyname partition-network 1 (where 1 is the priority number) > bind system group Retail –username Jane > add authentication tacacssaction tacuser –serverip 10.102.29.200 –tacacsSecret Password –authorization ON –accounting ON > add authentication policy polname –rule true –action tacacsAction > bind system global polname –priority 1
Command policies for a partition users and partition user groups in administrative partition
Commands to authorize a user account inside administrative partition | Command policies available inside an administrative partition (built-in policies) | User account access type |
---|---|---|
add system user | Partition-admin | SNIP (with management access enabled) |
add system group | Partition-network | SNIP (with management access enabled) |
add authentication , bind system global
|
Partition-read-only | SNIP (with management access enabled) |
remove system user | Partition-admin | SNIP(with management access enabled) |
remove system group | Partition-admin | SNIP (with management access enabled) |
bind system cmdpolicy to system user;bind system cmdpolicy to system group |
Partition-admin | SNIP (with management access enabled) |
Configure an LACP Ethernet channel on the default admin partition
With the Link Aggregation Control Protocol (LACP), you can combine multiple ports into a single, high-speed link (also called a channel). An LACP-enabled appliance exchanges LACP Data Units (LACPDU) over the channel.
There are three LACP configuration modes that you can enable in the default partition of a Citrix ADC appliance:
- Active. A port in active mode sends LACPDUs. Link aggregation is formed if the other end of the Ethernet link is in the LACP active or passive mode.
- Passive. A port in passive mode sends LACPDUs only when it receives LACPDUs. The link aggregation is formed if the other end of the Ethernet link is in the LACP active mode.
- Disable. Link aggregation is not formed.
Note
By default, the link aggregation is disabled in the default partition of the appliance.
LACP exchanges LACPDU between devices connected by an Ethernet link. These devices are typically referred as an actor or partner.
A LACPDU data unit contains the following parameters:
- LACP Mode. Active, passive, or disable.
- LACP timeout. The waiting period before timing out the partner or actor. Possible values: Long and Short. Default: Long.
- Port Key. To distinguish between the different channel. When the key is 1, LA/1 is created. When the key is 2, LA/2 is created. Possible values: Integer from 1 through 8. 4 through 8 is for cluster CLAG.
- Port Priority. Minimum value: 1. Maximum value: 65535. Default: 32768.
- System Priority. Uses this priority along with the system MAC to form the system ID to uniquely identify the system during LACP negotiation with the partner. Sets system priority from 1 and 65535. The default value is set to 32768.
- Interface. Supports 8 interfaces per channel on NetScaler 10.1 appliance and supports 16 interfaces per channel on NetScaler 10.5 and 11.0 appliances.
After exchanging LACPDUs, the actor and partner negotiate the settings and decide whether to add the ports to the aggregation.
Configure and verify LACP
The following section shows how to configure and verify LACP in the admin partition.
To configure and verify LACP on a Citrix ADC appliance by using the CLI
Enable LACP on each interface.
set interface
-lacpMode PASSIVE -lacpKey 1 When you enable LACP on an interface, the channels are dynamically created. Also, when you enable LACP on an interface and set lacpKey to 1, the interface is automatically bound to channel LA/1.
Note
When you bind an interface to a channel, the channel parameters take precedence over the interface parameters, so the interface parameters are ignored. If a channel is created dynamically by LACP, you cannot perform the add, bind, unbind, or remove operations on the channel. A channel dynamically created by LACP is automatically deleted when you disable LACP on all interfaces of the channel.
Set the system priority.
set lacp -sysPriority
Verify that LACP is working as expected.
```show interface
```show channel
show LACP
Note
In some versions of Cisco Internetwork Operating System (iOS), running the switchport trunk native VLAN
command causes the Cisco switch to tag LACP PDUs. It causes the LACP channel between the Cisco switch and the Citrix ADC appliance to fail. However, this issue does not affect the static link aggregation channels configured in the previous procedure.
Save configuration of all admin partitions from the default partition
Administrators can save the configuration of all the admin partitions at once from the default partition.
Save all admin partitions from default partition by using the CLI
At the command prompt, type:
save ns config -all
Support for partition and cluster based custom reports
Citrix ADC GUI displays only the custom reports created in the current viewing partition or in the cluster.
Previously, the Citrix ADC GUI used to store the Custom Report names directly to the back end file without mentioning the partition or cluster name to differentiate.
To view the custom reports of the current partition or cluster in the GUI
Navigate toReportingtab.
ClickCustom Reportsto view the reports created in the current partition or in the cluster.
Support to bind VPN global certificates in a partitioned setup for OAuth IdP
In a Partitioned setup, you can now bind the certificates to VPN global for OAuth IdP deployments.
To bind the certificates in Partitioned setup by using the CLI
At the command prompt, type:
bind vpn global [-certkeyName ] [-userDataEncryptionKey ]
In this article
- Tip
- Partition resource limiting
- Configure an admin partition
- Add an admin partition
- Switch user access from default partition to an admin partition
- Adding SNIP address to a partition user account with management access enabled
- Create and Bind a partition user with partition command policy
- Configuring external server authentication for external users
- Command policies for a partition users and partition user groups in administrative partition
- Configure an LACP Ethernet channel on the default admin partition
- Configure and verify LACP
- Save configuration of all admin partitions from the default partition
- Support for partition and cluster based custom reports
- Support to bind VPN global certificates in a partitioned setup for OAuth IdP