CloudBridge Connector interoperability – F5 BIG-IP
You can configure a CloudBridge Connector tunnel between a Citrix ADC appliance and a F5 BIG-IP appliance to connect two datacenters or extend your network to a cloud provider. The Citrix ADC appliance and the F5 BIG-IP appliance form the end points of the CloudBridge Connector tunnel and are called peers.
Example of a CloudBridge Connector tunnel configuration
As an illustration of the traffic flow in a CloudBridge Connector tunnel, consider an example in which a CloudBridge Connector tunnel is set up between the following devices:
- Citrix ADC appliance NS_Appliance-1 in a datacenter designated as Datacenter-1
- F5 BIG-IP appliance F5-BIG-IP-Appliance-1 in a datacenter designated as Datacenter-2
NS_Appliance-1 and F5-BIG-IP-Appliance-1 enable communication between private networks in Datacenter-1 and Datacenter-2 through the CloudBridge Connector tunnel. In the example, NS_Appliance-1 and F5-BIG-IP-Appliance-1 enable communication between client CL1 in Datacenter-1 and server S1 in Datacenter-2 through the CloudBridge Connector tunnel. Client CL1 and server S1 are on different private networks.
On NS_Appliance-1, the CloudBridge Connector tunnel configuration includes IPSec profile entity NS_F5-BIG-IP_IPSec_Profile, CloudBridge Connector tunnel entity NS_F5-BIG-IP_Tunnel, and policy based routing (PBR) entity NS_F5-BIG-IP_Pbr.
For more information, refer toF5 big IPpdf.
Points to consider for a CloudBridge Connector tunnel configuration
- The Citrix ADC appliance is UP and running, is connected to the Internet, and is also connected to the private subnets whose traffic is to be protected over the CloudBridge Connector tunnel.
- The F5 BIG-IP appliance is UP and running, is connected to the Internet, and is also connected to the private subnets whose traffic is to be protected over the CloudBridge Connector tunnel.
- The following IPSec settings are supported for a CloudBridge Connector tunnel between a Citrix ADC appliance and an F5 BIG-IP appliance.
- IPSec mode: Tunnel mode
- IKE version: Version 1
- IKE authentication method: Pre-Shared Key
- IKE encryption algorithm: AES
- IKE hash algorithm: HMAC SHA1
- ESP encryption algorithm: AES
- ESP hash algorithm: HMAC SHA1
- You must specify the same IPSec settings on the Citrix ADC appliance and the F5 BIG-IP appliance at the two ends of the CloudBridge Connector tunnel.
- Citrix ADC provides a common parameter (in IPSec profiles) for specifying an IKE hash algorithm and an ESP hash algorithm. It also provides another common parameter for specifying an IKE encryption algorithm and an ESP encryption algorithm. Therefore, in the F5 BIG-IP appliance, you must specify the same hash algorithm and same encryption algorithm in IKE (phase 1 configuration) and ESP (phase 2 configuration).
- You must configure the firewall at the Citrix ADC end and F5 BIG-IP end to allow the following.
- Any UDP packets for port 500
- Any UDP packets for port 4500
- Any ESP (IP protocol number 50) packets
Configuring F5 BIG-IP for the CloudBridge Connector tunnel
To configure a CloudBridge connector tunnel between a Citrix ADC appliance and an F5 BIG-IP appliance, perform the following tasks on the F5 BIG-IP appliance:
- Create a forwarding virtual server for IPsec. A forwarding virtual server intercepts IP traffic for the IPsec tunnel.
- Create an IKE peer.An IKE peer specifies the local and remote IPsec tunnel endpoints. It also specifies algorithms and credentials to be used for IPsec IKE phase 1.
- Create a custom IPsec policy.A policy specifies the IPSec protocol (ESP) and the mode (tunnel) to be used for forming the IPsec tunnel. It also specifies the algorithms and security parameters to be used for IKE IPsec phase 2.
- Create a bidirectional IPsec traffic selector. A traffic selector specifies the F5 BIG-IP side and Citrix ADC side subnets whose IP traffic is to be traversed through the IPsec tunnel.
The procedures for configuring IPsec VPN (CloudBridge Connector tunnel) on an F5 BIG-IP appliance might change over time, depending on the F5 release cycle. Citrix recommends that you follow the official F5 BIG-IP documentation for configuring IPSec VPN tunnels, at:
To create a forwarding virtual server for IPsec by using the F5 BIG-IP GUI
- On theMaintab, clickLocal Traffic>Virtual Servers, and then clickCreate.
- OnNew Virtual Server Listscreen, set the following parameters:
- Name. Type a unique name for the virtual server.
- Type. SelectForwarding (IP).
- Destination Address. Type a wildcard network address in CIDR format, for example, 0.0.0.0/0 for IPv4 to accept any traffic.
- Service Port. SelectAll Portsfrom the list.
- 箴tocol list. SelectAll Protocolsfrom the list.
- VLAN and Tunnel Traffic. Retain the default selection,All VLANs and Tunnels.
- ClickFinished.
To create a custom IPsec policy by using the F5 BIG-IP GUI
- On theMaintab, clickNetwork>IPsec>IPsec Policies, and then clickCreate.
- On theNew Policyscreen, set the following parameters:
- Name. Type a unique name for the policy.
- IPsec Protocol. Retain the default selection, ESP.
- Mode. Select Tunnel. The screen refreshes to show additional related settings.
- Tunnel Local Address. Type the local IPsec tunnel endpoint IP address (Configured on the F5 BIG-IP appliance).
- Tunnel Remote Address. Type the remote IPsec tunnel endpoint IP address (Configured on the Citrix ADC appliance).
- For the IKE Phase 2 parameters, retain the default values, or select the options that are appropriate for your deployment.
- ClickFinished.
To create a bidirectional IPsec traffic selector by using the F5 BIG-IP GUI
- On theMaintab, clickNetwork>IPsec>Traffic Selectors, and then clickCreate.
- On theNew Traffic Selectorscreen, set the following parameters:
- Name. Type a unique name for the traffic selector.
- Order. Retain the default value(First). This setting specifies the order in which the traffic selector appears on the Traffic Selector List screen.
- From theConfigurationlist, selectAdvanced, and set the following parameters:
- Source IP Address. ClickHostorNetwork, and inAddressfield, type the address of the F5 BIG-IP side subnet whose traffic is to be protected over the IPsec tunnel.
- Source Port. Select* All Ports.
- Destination IP Address. ClickHost, and in theAddressfield, type the address of the Citrix ADC side subnet whose traffic is to be protected over the IPsec tunnel.
- Destination Port. Select* All Ports.
- 箴tocol. Select*所有协议.
- Direction. SelectBoth.
- Action. Select箴tect. TheIPsec Policy Namesetting appears.
- IPsec Policy Name. Select the name of the custom IPsec policy that you created.
- ClickFinished.
Configuring the Citrix ADC appliance for the CloudBridge Connector tunnel
To configure a CloudBridge Connector tunnel between a Citrix ADC appliance and a F5 BIG-IP appliance, perform the following tasks on the Citrix ADC appliance. You can use either the Citrix ADC command line or the Citrix ADC graphical user interface (GUI):
- Create an IPSec profile. An IPSec profile entity specifies the IPSec protocol parameters, such as IKE version, encryption algorithm, hash algorithm, and authentication method to be used by the IPSec protocol in the CloudBridge Connector tunnel.
- Create an IP tunnel that uses IPSec protocol, and associate the IPSec profile with it. An IP tunnel specifies the local IP address (CloudBridge Connector tunnel end point IP address (of type SNIP) configured on the Citrix ADC appliance), remote IP address (CloudBridge Connector tunnel endpoint IP address configured on the F5 BIG-IP appliance), protocol (IPSec) used to set up the CloudBridge Connector tunnel, and an IPSec profile entity. The created IP tunnel entity is also called the CloudBridge Connector tunnel entity.
- Create a PBR rule and associate it with the IP tunnel. A PBR entity specifies a set of rules and an IP tunnel (CloudBridge Connector tunnel) entity. The source IP address range and the destination IP address range are the conditions for the PBR entity. Set the source IP address range to specify the Citrix ADC-side subnet whose traffic is to be protected over the tunnel, and set the destination IP address range to specify the F5 BIG-IP side subnet whose traffic is to be protected over the tunnel.
To create an IPSEC profile by using the Citrix ADC command line
At the command prompt, type:
add ipsec profile
-psk -ikeVersion v1 -encAlgo AES -hashAlgo HMAC_SHA1 -perfectForwardSecrecyENABLE show ipsec profile**
To create an IPSEC tunnel and bind the IPSEC profile to it by using the Citrix ADC command line
At the command prompt, type:
add ipTunnel
-protocol IPSEC –ipsecProfileName show ipTunnel
To create a PBR rule and bind the IPSEC tunnel to it by using the Citrix ADC command line
At the command prompt, type:
add pbr
ALLOW –srcIP -destIP -ipTunnel apply pbrs
show pbr
To create an IPSEC profile by using the GUI
- Navigate toSystem>CloudBridge Connector>IPSecProfile.
- In the details pane, clickAdd.
- In theAdd IPSec Profilepage, set the following parameters:
- Name
- Encryption Algorithm
- Hash Algorithm
- IKE Protocol Version
- Configure the IPSec authentication method to be used by the two CloudBridge Connector tunnel peers to mutually authenticate: Select thePre-shared key authentication methodand set thePre-Shared Key Existsparameter.
- ClickCreate, and then clickClose.
To create an IP tunnel and bind the IPSEC profile to it by using the GUI
- Navigate toSystem>CloudBridge Connector>IP Tunnels.
- On theIPv4 Tunnelstab, clickAdd.
- In theAdd IP Tunnelpage, set the following parameters:
- Name
- Remote IP
- Remote Mask
- Local IP Type (In the Local IP Type drop-down list, selectSubnet IP).
- Local IP (All the configured IP addresses of the selected IP type are in the Local IP drop down list. Select the desired IP from the list.)
- 箴tocol
- IPSec Profile
- ClickCreate, and then clickClose.
To create a PBR rule and bind the IPSEC tunnel to it by using the GUI
- Navigate toSystem>Network>PBR.
- On thePBRtab, clickAdd.
- In theCreate PBRpage, set the following parameters:
- Name
- Action
- Next Hop Type (SelectIP Tunnel)
- IP Tunnel Name
- Source IP Low
- Source IP High
- Destination IP Low
- Destination IP High
- ClickCreate, and then clickClose.
The corresponding new CloudBridge Connector tunnel configuration on the Citrix ADC appliance appears in the GUI. The current status of the CloudBridge connector tunnel is shown in the Configured CloudBridge Connector pane. A green dot indicates that the tunnel is up. A red dot indicates that the tunnel is down.
以下命令创建Citrix的设置DC appliance NS_Appliance-1 in “Example of a CloudBridge Connector Configuration.:
> add ipsec profile NS_F5-BIG-IP_IPSec_Profile -psk examplepresharedkey -ikeVersion v1 –encAlgo AES –hashalgo HMAC_SHA1 –lifetime 315360 -perfectForwardSecrecy ENABLE Done > add iptunnel NS_F5-BIG-IP_Tunnel 203.0.113.200 255.255.255.255 198.51.100.100 –protocol IPSEC –ipsecProfileName NS_F5-BIG-IP_IPSec_Profile Done > add pbr NS_F5-BIG-IP_Pbr -srcIP 10.102.147.0-10.102.147.255 –destIP 10.20.0.0-10.20.255.255 –ipTunnel NS_F5-BIG-IP_Tunnel Done > apply pbrs Done
Monitoring the CloudBridge Connector tunnel
You can monitor the performance of CloudBridge Connector tunnels on a Citrix ADC appliance by using CloudBridge Connector tunnel statistical counters. For more information about displaying CloudBridge Connector tunnel statistics on a Citrix ADC appliance, seeMonitoring CloudBridge Connector Tunnels.
In this article
- Example of a CloudBridge Connector tunnel configuration
- Points to consider for a CloudBridge Connector tunnel configuration
- Configuring F5 BIG-IP for the CloudBridge Connector tunnel
- Configuring the Citrix ADC appliance for the CloudBridge Connector tunnel
- Monitoring the CloudBridge Connector tunnel