Getting Started with Citrix ADC
Deploy a Citrix ADC VPX instance
Optimize Citrix ADC VPX performance on VMware ESX, Linux KVM, and Citrix Hypervisors
Apply Citrix ADC VPX configurations at the first boot of the Citrix ADC appliance in cloud
Install a Citrix ADC VPX instance on Microsoft Hyper-V servers
Install a Citrix ADC VPX instance on Linux-KVM platform
Prerequisites for Installing Citrix ADC VPX Virtual Appliances on Linux-KVM Platform
Provisioning the Citrix ADC Virtual Appliance by using OpenStack
Provisioning the Citrix ADC Virtual Appliance by using the Virtual Machine Manager
Configuring Citrix ADC Virtual Appliances to Use SR-IOV Network Interface
Configuring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
Provisioning the Citrix ADC Virtual Appliance by using the virsh Program
Provisioning the Citrix ADC Virtual Appliance with SR-IOV, on OpenStack
Configuring a Citrix ADC VPX Instance on KVM to Use OVS DPDK-Based Host Interfaces
Deploy a Citrix ADC VPX instance on AWS
Deploy a VPX high-availability pair with elastic IP addresses across different AWS zones
Deploy a VPX high-availability pair with private IP addresses across different AWS zones
Configure a Citrix ADC VPX instance to use SR-IOV network interface
Configure a Citrix ADC VPX instance to use Enhanced Networking with AWS ENA
Deploy a Citrix ADC VPX instance on Microsoft Azure
Network architecture for Citrix ADC VPX instances on Microsoft Azure
Configure multiple IP addresses for a Citrix ADC VPX standalone instance
Configure a high-availability setup with multiple IP addresses and NICs
Configure a high-availability setup with multiple IP addresses and NICs by using PowerShell commands
Configure a Citrix ADC VPX instance to use Azure accelerated networking
Configure HA-INC nodes by using the Citrix high availability template with Azure ILB
Configure a high-availability setup with Azure external and internal load balancers simultaneously
Configure address pools (IIP) for a Citrix Gateway appliance
Upgrade and downgrade a Citrix ADC appliance
Solutions for Telecom Service Providers
Load Balance Control-Plane Traffic that is based on Diameter, SIP, and SMPP Protocols
Provide Subscriber Load Distribution Using GSLB Across Core-Networks of a Telecom Service Provider
Authentication, authorization, and auditing application traffic
Basic components of authentication, authorization, and auditing configuration
On-premises Citrix Gateway as an identity provider to Citrix Cloud
Authentication, authorization, and auditing configuration for commonly used protocols
Troubleshoot authentication and authorization related issues
-
-
-
-
-
-
Persistence and persistent connections
Advanced load balancing settings
Gradually stepping up the load on a new service with virtual server–level slow start
Protect applications on protected servers against traffic surges
Retrieve location details from user IP address using geolocation database
Use source IP address of the client when connecting to the server
Use client source IP address for backend communication in a v4-v6 load balancing configuration
Set a limit on number of requests per connection to the server
Configure automatic state transition based on percentage health of bound services
Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
Use case 3: Configure load balancing in direct server return mode
Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
Use case 7: Configure load balancing in DSR mode by using IP Over IP
Use case 10: Load balancing of intrusion detection system servers
Use case 11: Isolating network traffic using listen policies
Use case 12: Configure Citrix Virtual Desktops for load balancing
Use case 13: Configure Citrix Virtual Apps for load balancing
Use case 14: ShareFile wizard for load balancing Citrix ShareFile
Use case 15: Configure layer 4 load balancing on the Citrix ADC appliance
-
-
DNS security options
-
Authentication and authorization for System Users
-
Configuring a CloudBridge Connector Tunnel between two Datacenters
Configuring CloudBridge Connector between Datacenter and AWS Cloud
Configuring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
Configuring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Cisco IOS Device
CloudBridge Connector Tunnel Diagnostics and Troubleshooting
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde.(Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique.(Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica.(Aviso legal)
此内容已经过机器动态翻译。放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다.책임 부인
Este texto foi traduzido automaticamente.(Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt.(Haftungsausschluss)
Ce article a été traduit automatiquement.(Clause de non responsabilité)
Este artículo ha sido traducido automáticamente.(Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
翻译英足总iled!
DNS security options
You can now configure the DNS security options from the Add DNS Security Profile page in the Citrix ADC GUI. To configure the DNS security options from the Citrix ADC CLI or the NITRO API, use the AppExpert components. For instructions, see the NITRO API documentation and the Citrix ADC Command Reference Guide.
One option, cache poisoning protection, is enabled by default and cannot be disabled. You can apply the other options to all DNS endpoints or to specific DNS virtual servers in your deployment, as shown in the following table:
Security option | Can be applied to all DNS endpoints? | Can be applied to specific DNS virtual servers? |
---|---|---|
DNS DDoS protection | 叶s | 叶s |
Manage exceptions – whitelist/blacklist servers | 叶s | 叶s |
Prevent random subdomain attacks | 叶s | 叶s |
Bypass the cache | 叶s | No |
Enforce DNS transactions over TCP | 叶s | 叶s |
Provide root details in the DNS response | 叶s | No |
Cache poisoning protection
A cache poisoning attack redirects users from legitimate sites to malicious websites.
For example, the attacker replaces a genuine IP address in the DNS cache with a fake IP address that they control. When the server responds to requests from these IP addresses, the cache is poisoned. Subsequent requests for the addresses of the domain are redirected to the attacker’s site.
The Cache Poisoning Protection option prevents insertion of corrupt data into the database that caches DNS server requests and responses. This feature is inbuilt in the Citrix ADC appliances and is always enabled.
DNS DDoS protection
您可以配置DNS DDoS保护选择for each type of request that you suspect might be used in a DDoS attack. For each type, the appliance drops any requests received after a threshold value for the number of requests received in a specified time period (time slice) is exceeded. You can also configure this option to log a warning to the SYSLOG server. For example:
- DROP:- Select this option to DROP requests without logging. Assume that you have enabled A record protection with threshold value 15, time slice as 1 second, and chosen DROP. When the incoming requests exceed 15 queries in 1 second, then the packets start getting dropped.
- WARN:- Select this option to LOG and DROP requests. Assume that you have enabled A record protection with threshold value 15, time slice as 1 second, and chosen WARN. When the incoming requests exceed 15 queries in 1 second, a warning message is logged indicating a threat and then the packets are dropped. Citrix recommends you to set threshold values for WARN smaller than the threshold value of DROP for a record type. Such a setting helps administrators identify an attack by logging a warning message before the actual attack happens and Citrix ADC starts dropping incoming requests.
Set a threshold for incoming traffic by using the GUI
- Navigate toConfiguration>Security>DNS Security.
- On theDNS Security Profilepage, clickAdd.
- On theAdd DNS Security Profilepage, do the following:
- ExpandDNS DDoS Protection.
- Select the record type and enter the threshold limit and the time slice value.
- SelectDROPorWARN.
- Repeat steps a and b for each of the other record types that you want to protect against.
- ClickSubmit.
Manage exceptions – allowlist/blocklist servers
Manage exceptions enables you to add exceptions either to block list or allow list domain name and IP addresses. For example:
- When a particular IP address is identified posting an attack, such IP address can be added to the block list.
- When administrators find that there is an unexpectedly high number of requests for a particular domain name, then that domain name can be added to the block list.
NXDomains
and some of the existent domains which can consume the server resources can be blacklisted.- When administrators allow list domain names or IP addresses, queries or requests only from these domains or IP addresses are answered and all others are dropped.
Create an allow list or a block list by using the GUI
- Navigate toConfiguration > Security > DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, do the following:
- ExpandManage exceptions – Whitelist/Blacklist Servers.
- SelectBlock阻止这位ies from blacklisted domains/addresses, or selectAllowonly to allow queries from whitelisted domains/addresses.
- In theDomain name / IP Addressbox, enter the domain names, IP addresses, or IP address ranges. Use commas to separate the entries.Note: If you selectAdvanced Option, you can use the “start with,” “contains,” and “ends with” options to set the criteria. For example, you can set criteria to block a DNS query that starts with “image” or ends with “.co.ru” or contains “mobile sites.”
- ClickSubmit.
Prevent random subdomain attacks
In random subdomain attacks, queries are sent to random, nonexistent subdomains of legitimate domains. This action increases the load on the DNS resolvers and servers. As a result, they can become overloaded and slow down.
The Prevent Random Subdomain Attacks option directs the DNS responder to drop DNS queries that exceed a specified length.
Assume that example.com is a domain name owned by you and hence the resolution request comes to your DNS server. The attacker can append a random subdomain to example.com and send a request. Based on the specified query length and the FQDN, the random queries are dropped.
For example, if the query is www.image987trending.example.com, it is dropped if the query length is set to 20.
Specify a DNS query length by using the GUI
- Navigate toConfiguration > Security > DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, do the following:
- ExpandPrevent Random Subdomain Attacks.
- Enter the numerical value for the query length.
- ClickSubmit.
Bypassing the cache
During an attack, the data that is already cached must be protected. To protect the cache, new requests for certain domains or record types or response codes can be sent to the origin servers instead of cached.
The Bypassing the cache option directs the Citrix ADC appliance to bypass the cache for specified domains, record types, or response codes when an attack is detected.
Bypass the cache for specified domains or record types or response types by using the GUI
- Navigate toConfiguration > Security > DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, expandBypassing the cacheand enter the domain names. Optionally, choose the record types or the response types for which the cache has to be bypassed.
- ClickDomainsand enter the domain names. Use commas to separate the entries.
- ClickRecord Typesand choose the record types.
- ClickResponse Typesand choose the response type.
- ClickSubmit.
Enforce DNS transactions over TCP
Some DNS attacks can be prevented if the transactions are forced to use TCP instead of UDP. For example, during a bot attack, the client sends a flood of queries but cannot handle responses. If the use of TCP is enforced for these transactions, then the bots cannot understand the responses and therefore cannot send requests over TCP.
Force domains or record types to operate at the TCP level by using the GUI
- Navigate toConfiguration > Security > DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, expandEnforce DNS Transactions over TCPand enter the domain names and / or choose the record types for which the DNS transactions must be enforced over TCP.
- ClickDomainsand enter the domain names. Use commas to separate the entries.
- ClickRecordTypesand choose the record types.
- ClickSubmit.
Provide root details in the DNS response
In some attacks, the attacker sends a flood of queries for unrelated domains that are not configured or cached on the Citrix ADC appliance. If thednsRootReferral
parameter is ENABLED, it exposes all the root servers.
The Provide Root Details in the DNS Response option directs the Citrix ADC appliance to restrict access to root referrals for a query that is not configured or cached. The appliance sends a blank response.
The Provide Root Details in the DNS Response option can also mitigate or block amplification attacks. When the dnsRootReferral parameter is DISABLED, there are no root referrals in the Citrix ADC responses and hence they do not get amplified.
Enable or disable access to the root server by using the GUI
- Navigate toConfiguration > Security > DNS Security.
- On theDNS Security Profilespage, clickAdd.
- On theAdd DNS Security Profilepage, do the following:
- ExpandProvide Root Details in theDNS Response.
- ClickONorOFFto allow or restrict access to the root server.
- ClickSubmit.
Share
Share
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select Do Not Agree to exit.