Product Documentation
ADC
Current Release 13.1 13.0 12.1
View PDF

Use Case 3: Log MSSQL transactions in transparent mode

September 14, 2021
Contributed by:
S

You can configure the Citrix ADC appliance to operate transparently between MSSQL clients and servers, and to only log or analyze details of all client-server transactions. Transparent mode is designed so that the Citrix ADC appliance only forwards MSSQL requests to the server, and then relays the server’s responses to the clients. As the requests and responses pass through the appliance, the appliance logs information gathered from them, as specified by the audit logging or AppFlow configuration, or collects statistics, as specified by the Action Analytics configuration. You do not have to add database users to the appliance.

When operating in transparent mode, the Citrix ADC appliance does not perform load balancing, content switching, or connection multiplexing for the requests. However, it responds to a client’s pre-login packet on behalf of the server so that it can prevent encryption from being agreed upon during the pre-login handshake. The login packet and subsequent packets are forwarded to the server.

Summary of configuration tasks

For logging or analyzing MSSQL requests in transparent mode, you have to do the following:

  • 配置ure the Citrix ADC appliance as the default gateway for both clients and servers.
  • Do one of the following on the Citrix ADC appliance:
    • 配置ure the use source IP address (USIP) option globally:Create a load balancing virtual server with a wildcard IP address and the port number on which the MSSQL servers listen for requests (a port-specific wildcard virtual server). Then, enable the USIP option globally. If you configure a port-specific wildcard virtual server, you do not have to create MSSQL services on the appliance. The appliance discovers the services based on the destination IP address in the client requests.
    • If you do not want to configure the USIP option globally:Create MSSQL services with the USIP option enabled on each of them. If you configure services, you do not have to create a port-specific wildcard virtual server.
  • 配置ure audit logging, AppFlow, or Action Analytics to log or collect statistics about the requests. If you configure a virtual server, you can bind your policies either to the virtual server or to the global bind point. If you do not configure a virtual server, you can bind your policies to only the global bind point.

配置ure transparent mode by using a wildcard virtual server

您可以配置透明模式通过配置a port-specific wildcard virtual server and enabling Use Source IP (USIP) mode globally. When a client sends its default gateway (the Citrix ADC appliance) a request with the IP address of an MSSQL server in the destination IP address header, the appliance checks whether the destination IP address is available. If the IP address is available, the virtual server forwards the request to the server. Otherwise, it drops the request.

Create a wildcard virtual server by using the CLI

At the command prompt, type the following commands to create a wildcard virtual server and verify the configuration:

add lb vserver     show lb vserver

Example:

> add lb vserver wildcardLbVs MSSQL * 1433 Done > show lb vserver wildcardLbVs wildcardLbVs (*:1433) - MSSQL Type: ADDRESS State: UP . . . Done >

Create a wildcard virtual server by using the GUI

Navigate toTraffic Management > Load Balancing > Virtual Servers, and create a virtual server. Specify MSSQL as the protocol and * as the IP address.

Enable Use Source IP (USIP) mode globally by using the CLI

At the command prompt, type the following commands to enable USIP mode globally and verify the configuration:

enable ns mode USIP show ns mode

Example:

> enable ns mode USIP Done > show ns mode Mode Acronym Status ------- ------- ------ . . . 3) Use Source IP USIP ON . . . Done >

Enable USIP mode globally by using the GUI

  1. Navigate toSystem > Settingsand, in Modes and Features, select配置ure Modes.
  2. SelectUse Source IP.

配置ure transparent mode by using MSSQL services

您可以配置透明模式通过配置MSSQL services and enabling USIP on each service. When a client sends its default gateway (the Citrix ADC appliance) a request with the IP address of an MSSQL server in the destination IP address header, the appliance forwards the request to the destination server.

Create an MSSQL service and enable USIP mode on the service by using the CLI

At the command prompt, type the following commands to create an MSSQL service, with USIP enabled, and verify the configuration:

add service  ( | )   -usip YES` show service

Example

> add service myDBservice 192.0.2.0 MSSQL 1433 -usip YES Done > show service myDBservice myDBservice (192.0.2.0:1433) - MSSQL State: UP . . . Use Source IP: YES Use Proxy Port: YES . . . Done >

Create an MSSQL service, with USIP enabled, by using the GUI

  1. Navigate toTraffic Management > Load Balancing > Services, and configure a service.
  2. Specify the protocol asMSSQLand, inSettings, selectUse Source IP.
Use Case 3: Log MSSQL transactions in transparent mode
September 14, 2021
Contributed by:
S
September 14, 2021
Contributed by:
S

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999-Cloud Software Group, Inc. All rights reserved.