Deploy a VPX HA pair in the same AWS availability zone
You can configure two Citrix ADC VPX instances on AWS as a high-availability (HA) pair, in the same AWS zone where both VPX instances are on the same subnet. HA is achieved by migrating secondary private IP addresses attached to the NICs (client and server-side NICs) of the primary HA node to the secondary HA node after failover. All the Elastic IP addresses associated with the secondary private IP addresses are also migrated.
The following illustration depicts an HA failover scenario by migrating secondary private IP addresses.
Figure 1. A Citrix ADC VPX HA Pair on AWS, using private IP migration
Before you start your document, read the following docs:
- Prerequisites
- Limitations and usage guidelines
- Deploy a Citrix ADC VPX instance on AWS
- High Availability
如何部署一双VPX HA在同一区
Here is the summary of the steps to deploy a VPX HA pair in the same zone:
- Create two VPX instances on AWS, each with three NICs
- Assign AWS secondary private IP address to VIP and SNIP of primary node
- Configure VIP and SNIP on primary node using AWS secondary private IP addresses
- Configure HA on both nodes
Step 1. Create two VPX instances (primary and secondary nodes) by using the same VPC, each with three NICs (Ethernet 0, Ethernet 1, Ethernet 2)
Follow the steps given inDeploy a Citrix ADC VPX instance on AWS by using the AWS web console.
Step 2. On the primary node, assign secondary private IP addresses for Ethernet 1 (client IP or VIP) and Ethernet 2 (back-end server IP or SNIP)
The AWS console automatically assigns primary private IP addresses to the configured NICs. Assign more private IP addresses to VIP and SNIP, known as secondary private IP addresses.
To assign a secondary private IPv4 address to a network interface, follow these steps:
- Open the Amazon EC2 console athttps://console.aws.amazon.com/ec2/.
- In the navigation pane, choose Network Interfaces, and then select the network interface attached to the instance.
- Choose Actions, Manage IP Addresses.
- Under IPv4 Addresses, choose Assign new IP.
- Enter a specific IPv4 address that’s within the subnet range for the instance, or leave the field blank to let Amazon select an IP address for you.
- (Optional) Choose Allow reassignment to allow the secondary private IP address to be reassigned if it is already assigned to another network interface.
- Choose Yes, Update.
Under the instance description, the assigned secondary private IP addresses appear.
Step 3. Configure VIP and SNIP on the primary node, using secondary private IP addresses
Access the primary node using SSH. Open an ssh client and type:
ssh -i nsroot@ Next, configure VIP and SNIP.
For VIP, type:
add ns ip -type For SNIP, type:
add ns ip -type SNIP Typesave configto save.
To see the configured IP addresses, type the following command:
show ns ip For more information, see the following topics:
Step 4: Configure HA on both instances
On the primary node, open a Shell client and type the following command:
add ha node On the secondary node, type the following command:
add ha node < private IP address of the management NIC of the primary node > Typesave configto save the configuration.
To see the configured HA nodes, typeshow ha node.
Upon failover, the secondary private IP addresses configured as VIP and SNIP on the previous primary node are migrated to the new primary node.
To force a failover on a node, typeforce HAfailover.
Legacy method for deploying a VPX HA pair
Before 13.0 41.x release, HA within the same zone was achieved through AWS elastic network interface (ENI) migration. However, this method is slowly deprecated.
The following figure shows an example of the HA deployment architecture for Citrix ADC VPX instances on AWS.
Figure 1. A Citrix ADC VPX HA Pair on AWS, using ENI migration
You can deploy two VPX instances on AWS as an HA pair by using one of the following options:
- Create the instances with IAM Role manually by using the AWS Management Console and then configure HA on them.
- 由我们或自动化高可用性部署ing the Citrix CloudFormation template.
The CloudFormation template significantly decreases the number of steps involved for creating an HA pair, and it automatically creates an IAM Role. This section shows how to deploy a Citrix ADC VPX HA (active-passive) pair by using the Citrix CloudFormation template.
Keep the following points in mind while deploying two Citrix ADC VPX instances as an HA pair.
点需要注意
- HA on AWS requires the primary node to have at least two ENIs (one for management and the other for data traffic), and the secondary node to have one management ENI. However, for security purposes, create three ENIs on the primary node, because this setup allows you to segregate the private and public network (recommended).
- The secondary node always has one ENI interface (for management) and the primary node can have up to four ENIs.
- The NSIP addresses for each VPX instance in a high availability pair must be configured on the default ENI of the instance.
- Amazon does not allow any broadcast/multicast packets in AWS. As a result, in a HA setup, data-plane ENIs are migrated from the primary to the secondary VPX instance when the primary VPX instance fails.
- Because the default (management) ENI cannot be moved to another VPX instance, do not use the default ENI for client and server traffic (data-plane traffic).
- The message AWSCONFIG IOCTL NSAPI_HOTPLUG_INTF success output 0 in the /var/log/ns.log indicates that the two data ENIs have successfully attached to the secondary instance (the new primary).
- Failover might take up to 20 seconds due to the AWS detach/attach ENI mechanism.
- Upon failover, the failed instance always restarts.
- The heartbeat packets are received only on the management interface.
- The configuration file of the primary and secondary VPX instances is synchronized, including the
nsrootpassword. Thensrootpassword of the secondary node is set to that of the primary node after the HA configuration synchronization. - To have access to the AWS API servers, either the VPX instance must have a public IP address assigned or routing must be set up correctly at VPC subnet level pointing to the internet gateway of the VPC.
- Nameservers/DNS servers are configured at VPC level using DHCP options.
- The Citrix CloudFormation template does not create an HA setup between different availability zones.
- The Citrix CloudFormation template does not create an INC mode.
- The AWS debug messages are available in the log file, /var/log/ns.log, on the VPX instance.
Deploy a high availability pair by using the Citrix CloudFormation template
Before starting the CloudFormation template, ensure that you complete the following requirements:
- A VPC
- Three subnets within the VPC
- A security group with UDP 3003, TCP 3009–3010, HTTP, SSH ports open
- A key pair
- Create an internet gateway
- Edit route tables for client and management networks to point to the internet gateway
Note
The Citrix CloudFormation template automatically creates an IAM Role. Existing IAM Roles do not appear in the template.
To launch the Citrix CloudFormation template:
- Log on to theAWS marketplaceby using your AWS credentials.
- In the search field, typeCitrix ADC VPXto search for the Citrix ADC AMI, and clickGo.
- On the search result page, click the desired Citrix ADC VPX offering.
- 点击thePricingtab, to go toPricing Information.
- Select the region andFulfillment OptionasCitrix ADC VPX – Customer Licensed.
- 点击Continue to Subscribe.
- Check the details in theSubscribepage and clickContinue to Configuration.
- SelectDelivery MethodasCloudFormation Template.
- Select the required CloudFormation template.
SelectSoftware VersionandRegion, and clickContinue to Launch.
- UnderChoose Action, selectLaunch CloudFormation, and clickLaunch. TheCreate stack页面出现。
点击Next.
TheSpecify stack details页面出现。Enter the following details.
- Type aStack name. The name must be within 25 characters.
- UnderNetwork Configuration, perform the following:
- Select米anagement Subnetwork,Client Subnetwork, andServer Subnetwork. Ensure that you select the correct subnetworks you created within the VPC that you selected under VPC ID.
- AddPrimary Management IP,Secondary Management IP,Client IP, andServer IP. The IP addresses must belong to the same subnets of the respective subnetworks. Alternatively, you can let the template assign the IP addresses automatically.
- SelectdefaultforVPCTenancy.
- UnderCitrix ADC Configuration, perform the following:
- Selectm5.xlargeforInstance type.
- Select the key pair that you’ve already created from the menu forKey Pair.
By default, thePublish custom metrics to CloudWatch?option is set toYes. If you want to disable this option, selectNo.
For more information about CloudWatch metrics, see米onitor your instances using Amazon CloudWatch.
- UnderOptional Configuration, perform the following:
- By default, theShould publicIP(EIP) be assigned to management interfaces?option is set toNo.
- By default, theShould publicIP(EIP) be assigned to client interface?option is set toNo.
- 点击Next.
TheConfigure stack options页面出现。This is an optional page.
点击Next.
TheOptions页面出现。(这是一个可选的页面)。点击Next.
TheReview页面出现。Take a moment to review the settings and make any changes, if necessary.
Select theI acknowledge that AWS CloudFormation might create IAM resources.check box, and then clickCreate stack.
TheCREATE-IN-PROGRESSstatus appears. Wait until the status isCREATE-COMPLETE. If the status does not change toCOMPLETE, check theEventstab for the reason of failure, and recreate the instance with proper configurations.
- After an IAM resource is created, navigate toEC2 Management Console > Instances. You find two VPX instances created with IAM role. The primary and secondary nodes are created each with three private IP addresses and three network interfaces.
Log on to the primary node with user name
nsrootand the instance ID as the password. From the GUI, navigate toSystem > High Availability > Nodes. The Citrix ADC VPX is already configured in HA pair by the CloudFormation template.The Citrix ADC VPX HA pair appears.
米onitor your instances using Amazon CloudWatch
You can use the Amazon CloudWatch service to monitor a set of Citrix ADC VPX metrics such as CPU and memory utilization, and throughput. CloudWatch monitors resources and applications that run on AWS, in real time. You can access the Amazon CloudWatch dashboard by using the AWS Management console. For more information, seeAmazon CloudWatch.
点需要注意
- If you deploy a Citrix ADC VPX instance on AWS by using the AWS web console, the CloudWatch service is enabled by default.
- If you deploy a Citrix ADC VPX instance by using the Citrix CloudFormation template, the default option is “Yes.” If you want to disable the CloudWatch service, select “No.”
- 米etrics are available for CPU (management and packet CPU usage), memory, and throughput (inbound and outbound).
How to view CloudWatch metrics
To view CloudWatch metrics for your instance, follow these steps:
- Log on toAWS Management console > EC2 > Instances.
- Select the instance.
- 点击米onitoring.
点击View all CloudWatch metrics.
Under All metrics, click your instance ID.
- 点击the metrics you want to view, set the duration (by minutes, hours, days, weeks, months).
- 点击Graphed metrics查看统计数据的使用。Use theGraph optionsto customize your graph.
Figure. Graphed metrics for CPU usage
Configuring SR-IOV on a high availability setup
Support for SR-IOV interfaces in a high availability setup is available from Citrix ADC release 12.0 57.19 onwards. For more information about how to configure SR-IOV, seeConfiguring Citrix ADC VPX instances to Use SR-IOV Network Interface.