Getting Started with Citrix ADC
-
Deploy a Citrix ADC VPX instance
Optimize Citrix ADC VPX performance on VMware ESX, Linux KVM, and Citrix Hypervisors
Apply Citrix ADC VPX configurations at the first boot of the Citrix ADC appliance in cloud
Install a Citrix ADC VPX instance on VMware ESX
配置uring Citrix ADC Virtual Appliances to use VMXNET3 Network Interface
Citrix ADC配置虚拟设备使用ingle Root I/O Virtualization (SR-IOV) Network Interface
Migrating the Citrix ADC VPX from E1000 to SR-IOV or VMXNET3 Network Interfaces
配置uring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
Install a Citrix ADC VPX instance on Microsoft Hyper-V servers
Install a Citrix ADC VPX instance on Linux-KVM platform
Prerequisites for Installing Citrix ADC VPX Virtual Appliances on Linux-KVM Platform
Provisioning the Citrix ADC Virtual Appliance by using OpenStack
Provisioning the Citrix ADC Virtual Appliance by using the Virtual Machine Manager
配置uring Citrix ADC Virtual Appliances to Use SR-IOV Network Interface
配置uring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
Provisioning the Citrix ADC Virtual Appliance by using the virsh Program
Provisioning the Citrix ADC Virtual Appliance with SR-IOV, on OpenStack
配置uring a Citrix ADC VPX Instance on KVM to Use OVS DPDK-Based Host Interfaces
Deploy a Citrix ADC VPX instance on AWS
Deploy a VPX high-availability pair with elastic IP addresses across different AWS zones
Deploy a VPX high-availability pair with private IP addresses across different AWS zones
配置ure a Citrix ADC VPX instance to use SR-IOV network interface
配置ure a Citrix ADC VPX instance to use Enhanced Networking with AWS ENA
Deploy a Citrix ADC VPX instance on Microsoft Azure
Network architecture for Citrix ADC VPX instances on Microsoft Azure
配置ure multiple IP addresses for a Citrix ADC VPX standalone instance
配置ure a high-availability setup with multiple IP addresses and NICs
配置ure a high-availability setup with multiple IP addresses and NICs by using PowerShell commands
配置ure a Citrix ADC VPX instance to use Azure accelerated networking
配置ure HA-INC nodes by using the Citrix high availability template with Azure ILB
配置ure HA-INC nodes by using the Citrix high availability template for internet-facing applications
配置ure a high-availability setup with Azure external and internal load balancers simultaneously
Upgrade and downgrade a Citrix ADC appliance
Authentication, authorization, and auditing application traffic
Basic components of authentication, authorization, and auditing configuration
On-premises Citrix Gateway as an identity provider to Citrix Cloud
Authentication, authorization, and auditing configuration for commonly used protocols
Troubleshoot authentication and authorization related issues
-
-
-
-
-
-
Persistence and persistent connections
Advanced load balancing settings
Gradually stepping up the load on a new service with virtual server–level slow start
Protect applications on protected servers against traffic surges
Retrieve location details from user IP address using geolocation database
Use source IP address of the client when connecting to the server
Use client source IP address for backend communication in a v4-v6 load balancing configuration
Set a limit on number of requests per connection to the server
配置ure automatic state transition based on percentage health of bound services
使用中科院e 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
使用中科院e 3: Configure load balancing in direct server return mode
使用中科院e 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
使用中科院e 7: Configure load balancing in DSR mode by using IP Over IP
使用中科院e 10: Load balancing of intrusion detection system servers
使用中科院e 11: Isolating network traffic using listen policies
使用中科院e 12: Configure Citrix Virtual Desktops for load balancing
使用中科院e 14: ShareFile wizard for load balancing Citrix ShareFile
使用中科院e 15: Configure layer 4 load balancing on the Citrix ADC appliance
-
-
-
Authentication and authorization for System Users
-
配置uring a CloudBridge Connector Tunnel between two Datacenters
配置uring CloudBridge Connector between Datacenter and AWS Cloud
配置uring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
配置uring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
配置uring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Cisco IOS Device
CloudBridge Connector Tunnel Diagnostics and Troubleshooting
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde.(Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique.(Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica.(Aviso legal)
此内容已经过机器动态翻译。放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다.책임 부인
Este texto foi traduzido automaticamente.(Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt.(Haftungsausschluss)
Ce article a été traduit automatiquement.(Clause de non responsabilité)
Este artículo ha sido traducido automáticamente.(Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
使用中科院e 11: Isolating network traffic using listen policies
Note
The traffic isolation solution using shadow virtual servers to simulate multitenant isolation is no more recommended. Alternatively, Citrix recommends you to use the Citrix ADC Admin Partitioning feature for such deployments. For more information, seeAdmin Partitioning.
A common security requirement in a data center is to maintain network path isolation between the traffic of various applications or tenants. One application or tenant’s traffic must be isolated from the traffic of other applications or tenants. For example, a financial services company would want to keep the traffic of its insurance department’s applications separate from that of its financial services applications. In the past, this was easily achieved through physical separation of network service devices such as firewalls, load balancers, and IdP, and network monitoring and logical separation in the switching fabric.
As data center architectures evolve toward multitenant virtualized data centers, networking services in the aggregation layer of a data center are getting consolidated. This development has made network path isolation a critical component for network service devices and is driving the requirement for ADCs to be able to isolate traffic at the L4 to L7 levels. Furthermore, all the traffic of a particular tenant must go through a firewall before reaching the service layer.
To address the requirement of isolating the network paths, a Citrix ADC appliance identifies the network domains and controls the traffic across the domains. The Citrix ADC solution has two main components: listen policies and shadow virtual servers.
Each network path to be isolated is assigned a virtual server on which a listen policy is defined so that the virtual server listens to traffic only from a specified network domain.
To isolate the traffic, listen policies can be based on several client parameters or their combinations, and the policies can be assigned priorities. The following table lists the parameters that can be used in listen policies for identifying the traffic.
Category | Parameters |
---|---|
Ethernet protocol | Source MAC address, destination MAC address |
Network interface | Network ID, receiving throughput, sending throughput, transmission throughput |
IP protocol | Source IP address, destination IP address |
IPv6 protocol | Source IPv6 address, destination IPv6 address |
TCP protocol | Source port, destination port, maximum segment size, payload, and other options |
UDP protocol | Source port, destination port |
VLAN | ID |
Table 1. Client Parameters Used to Define Listen Policies
On the Citrix ADC appliance, a virtual server is configured for each domain, with a listen policy specifying that the virtual server is to listen only to traffic for that domain. Also configured for each domain is a shadow load balancing virtual server, which listens to traffic destined for any domain. Each of the shadow load balancing virtual servers has a wildcard (*) IP address and port, and its service type is set to ANY.
In each domain, a firewall for the domain is bound as a service to the shadow load balancing virtual server, which forwards all traffic through the firewall. Local traffic is forwarded to its destination, and traffic destined for another domain is forwarded to the firewall for that domain. The shadow load balancing virtual servers are configured for MAC mode redirection.
How network paths are isolated
The following figure shows a typical traffic flow across domains. Consider the traffic flow within Network Domain 1, and between Network Domain 1 and Network Domain 2.
Figure 1. Isolating Network Path
Traffic within network domain 1
Network Domain 1 has three VLANs: VLAN 11, VLAN110, and VLAN120. The following steps describe the traffic flow.
- A client from VLAN 11 sends a request for a service available from the service pool in VLAN 120.
- The load balancing virtual server LB-VIP1, which is configured to listen to traffic from VLAN 11, receives the request and forwards the request to VLAN 110. The virtual server in VLAN 110 forwards the request to shadow load balancing virtual server FW-VIP-1.
- FW-VIP-1, which is configured to listen to traffic from VLAN 110, receives the request and forwards it to VLAN 120.
- The load balancing virtual server in VLAN 120 load balances the request to one of the physical servers, App11, App12, or App13.
- The response sent by the physical server returns by the same path to the client in VLAN 11.
This configuration ensures that traffic is always segregated inside the Citrix ADC for all the traffic that originates from a client.
Traffic between network domain 1 and network domain 2
Network Domain 1 has three VLANs: VLAN 11, VLAN 110, and VLAN 120. Network Domain 2 also has three VLANS: VLAN 22, VLAN 210, and VLAN 220. The following steps describe the traffic flow from VALN 11 to VLAN 22.
- A client from VLAN 11, which belongs to Network Domain 1, sends a request for a service available from the service pool in VLAN 220, which belongs to the Network Domain 2.
- In Network Domain 1, the load balancing virtual server LB-VIP1, which is configured to listen to traffic from VLAN 11, receives the request and forwards the request to VLAN 110.
- Shadow load balancing virtual server FW-VIP-1, which is configured to listen to VLAN 110 traffic destined to any other domain, receives the request and forwards it to firewall virtual server FW-VIP-2 because the request is destined to a physical server in Network Domain 2.
- In Network Domain 2, FW-VIP-2 forwards the request to VLAN 220.
- The load balancing virtual server in VLAN 220 load balances the request to one of the physical servers, App21, App22, or App23.
- The response sent by the physical server returns by the same path through the firewall in Network Domain 2 and then to Network Domain 1 to reach the client in VLAN 11.
配置uration Steps
To configure network path isolation by using listen policies, do the following:
- Add listen policy expressions. Each expression specifies a domain to which traffic is destined. You can use the VLAN ID or other parameters to identify the traffic.
- For each network domain, configure two virtual servers as follows:
Create a load balancing virtual server for which you specify a listen policy that identifies the traffic destined for this domain. You can specify the name of an expression created earlier, or you can create an expression while creating the virtual server.
Create another load balancing virtual server, referred to as shadow virtual server, for which you specify a listen policy expression that applies to traffic destined for any domain. On this virtual server, set the service type to ANY and the IP address and port to an asterisk (*). Enable MAC-based forwarding on this virtual server.
Enable the L2 Connection option on both the virtual servers.
Generally, to identify a connection, the Citrix ADC appliance uses the 4-tuple of client IP address, client port, destination IP address, and destination port. When you enable the L2 Connection option, the Layer 2 parameters of the connection (channel number, MAC address, and VLAN ID) are used in addition to the normal 4-tuple.
- Add services representing the server pools in the domain, and bind them to the virtual server.
- 配置ure the firewall for each domain as a service, and bind all the firewall services to the shadow virtual server.
To isolate network traffic by using the command line interface
At the command prompt, type the following commands:
add policy expression add lb vserver -l2conn ON -listenPolicy
Add a load balancing virtual server for each domain. This virtual server is for traffic of the same domain.
add lb vserver ANY * * -l2conn ON -m MAC -listenPolicy
Add a shadow load balancing virtual server for each domain. This virtual server is for traffic of other domains.
Example:
添加策略表达式e110 client.vlan。id = = 110添加policy expression e210 client.vlan.id==210 add policy expression e310 client.vlan.id==310 add policy expression e11 client.vlan.id==11 add policy expression e22 client.vlan.id==22 add policy expression e33 client.vlan.id==33 add lb vserver LB-VIP1 HTTP 10.1.1.254 80 -persistenceType NONE -listenPolicy e11 -cltTimeout 180 -l2Conn ON add lb vserver LB-VIP2 HTTP 10.2.2.254 80 -persistenceType NONE - listenPolicy e22 -cltTimeout 180 -l2Conn ON add lb vserver LB-VIP3 HTTP 10.3.3.254 80 -persistenceType NONE - listenPolicy e33 -cltTimeout 180 -l2Conn ON add lb vserver FW-VIP-1 ANY * * -persistenceType NONE -lbMethod ROUNDROBIN - listenPolicy e110 -Listenpriority 1 -m MAC -cltTimeout 120 add lb vserver FW-VIP-2 ANY * * -persistenceType NONE -lbMethod ROUNDROBIN - listenPolicy e210 -Listenpriority 2 -m MAC -cltTimeout 120 add lb vserver FW-VIP-3 ANY * * -persistenceType NONE -lbMethod ROUNDROBIN - listenPolicy e310 -Listenpriority 3 -m MAC -cltTimeout 120 add service RD-1 10.1.1.1 ANY * -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport NO -sp ON -cltTimeout 120 -svrTimeout 120 -CKA NO -TCPB NO -CMP NO add service RD-2 10.2.2.1 ANY * -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport NO -sp ON -cltTimeout 120 -svrTimeout 120 -CKA NO -TCPB NO -CMP NO add service RD-3 10.3.3.1 ANY * -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport NO -sp ON -cltTimeout 120 -svrTimeout 120 -CKA NO -TCPB NO -CMP NO bind lb vserver FW-VIP-1 RD-1 bind lb vserver FW-VIP-2 RD-2 bind lb vserver FW-VIP-3 RD-3
To isolate network traffic by using the configuration utility
- Add services representing the servers, as described inCreating a Service.
- Add each firewall as a service:
- Navigate toTraffic Management > Load Balancing > Services.
- Create a service, specifying the protocol as ANY, server as firewall’s IP address, and port as 80.
- 配置ure a load balancing virtual server.
- 配置ure the shadow load balancing virtual server.
- For each network domain, repeat steps 3 and 4.
- From the Load Balancing Virtual Servers pane, open the virtual servers that you created and verify the settings.
Share
Share
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select Do Not Agree to exit.