Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Admin Partitioning

August 21, 2024
Contributed by: 
C C

A Citrix ADC appliance can be partitioned into logical entities called admin partitions, where each partition can be configured and used as a separate Citrix ADC appliance. The following figure shows the partitions of a Citrix ADC being used by different customers and departments:

image

A partitioned Citrix ADC appliance has a single default partition and one or more admin partitions. The following table provides further details on the two partition types:

Note: In a partitioned appliance, the mode BridgeBPDUs can be enabled only in the default partition and not in the administrative partitions.

Default Partition

Admin Partitions

Availability:

The Citrix ADC appliance ships with a single partition, which is called a default partition. The default partition is retained even after the Citrix ADC appliance is partitioned.

Must be explicitly created as described in Configure admin partitions.

Number of Partitions:

One

A Citrix ADC appliance can have one or more (maximum of 512) admin partitions.

User Access and Roles:

The default partition can be accessed and configured by all Citrix ADC users who are not associated with a partition-specific command policy. As always, the operations that a user can perform are restricted by the associated command policy.

Can be created only by Citrix ADC superusers who also specify the users for that partition. Only superusers and associated users of the partition can access and configure the admin partition.

Note: Partition users do not have shell access.

File Structure:

All files in a default partition are stored in the default Citrix ADC file structure.

For example, the Citrix ADC configuration file is stored in the /nsconfig directory and Citrix ADC logs are stored in the /var/log/ directory.

All files in an admin partition are stored in directory paths that have the name of the admin partition.

For example, the Citrix ADC configuration file (ns.conf) is stored in the */nsconfig/partitions/<partitionName> directory. Other partition-specific files are stored in the */var/partitions/<partitionName> directories.

Some other paths in an admin partition:

  • Downloaded files: */var/partitions/<partitionName>/download/*
  • Log files: */var/partitions/<partitionName>/log/*

Note: Currently, logging is not supported at partition-level. Therefore, this directory is empty and all logs are stored in the */var/log/* directory.

  • SSL CRL certificate related files: */var/partitions/<partitionName>/netscaler/ssl*

Resources Available:

All Citrix ADC resources.

Citrix ADC resources that are explicitly assigned to the admin partition.

User access and roles

In authenticating and authorizing a partitioned Citrix ADC appliance, a root administrator can assign a partition administrator to one or more partitions. The partition administrator can authorize users to that partition without affecting other partitions. These are partition users and they are authorized to access only that partition using SNIP address.  Both the root administrator and the partition administrator can configure role based access (RBA by authorizing users to access different applications.

Administrators and user roles can be described as follows:

Root Administrator. Accesses the partitioned appliance through its NSIP address and can grant user access to one or more partitions. The administrator can also assign partition administrators to one or more partitions. The administrator can create a partition administrator from the default partition using a NSIP address or switch to a partition and then create a user and assign partition admin access using a SNIP address.

Partition Administrator. Accesses the specified partition through a NSIP address assigned by the root administrator. The administrator can assign role-based access to partition user access  to that partition and also configure external server authentication using partition specific configuration.

System User. Accesses partitions through the NSIP address. Has access to the partitions and resources specified by the root administrator.

Partition User. Accesses a partition through a SNIP address. This user account is created by the partition administrator and  the user has access to resources, only within the partition.

Points to remember

Following are some points to remember when providing role-based access in a partition.

  1. Citrix ADC users accessing the GUI through NSIP address will use default partition authentication configuration to log on to the appliance.
  2. Partition system users accessing the GUI through partition SNIP address will use partition specific authentication configuration to log on to the appliance.
  3. Partition user created in a partition cannot login using NSIP address.
  4. Citrix ADC user bound to a partition cannot login using partition SNIP address.
  5. External users accessing a partition through external server configuration as LDAP, Radius, or TACACS added in the partition. The user must access using SNIP address to directly log onto the partition.

Use case for managing role Based access in an partitioned setup

Consider a scenario where an enterprise organization, www.example.com has multiple business units and a centralized administrator who manages all instances in their network. However, they want to provide exclusive user privileges and environment for each business unit.

Following are the administrators and users managed by default partition authentication configuration and partition specific configuration in a partitioned appliance.

John: Root Administrator

George: Partition Administrator

Adam: System User

Jane: Partition User

John, is the root administrator of a partitioned Citrix ADC appliance. John manages all user accounts and administrative user accounts across partitions (for example, P1, P2, P3, P4, and P5) within the appliance. He provides granular role-based access to entities from the default partition of the appliance. John creates user accounts and assigns partition access to each account. George being a network engineer within the organization prefers to have a role based access to few applications running on partition P2. Based on user management, John creates a partition administrator role for George and associates his user account with partition-admin command policy in P2 partition. Adam being another network engineer prefers to access an application running on P2. John creates a system user account for Adam and associates his user account to P2 partition. Once his account is created, Adam can log into the appliance to access the Citrix ADC Management interface through NSIP address and can switch to partition P2 based on user/group binding.

Suppose, Jane who is another network engineer wants to directly access an application running only on partition P2, George (partition administrator) can create a partition user account for her and associate her account with command policies for authorization privileges. Jane’s user account created within the partition is now directly associated with P2. Now Jane can access the Citrix ADC Management interface through SNIP address and cannot switch to any other partition.

Note

If Jane’s user account is created by a partition administrator in partition P2, she can access the Citrix ADC Management interface only through SNIP address (created within the partition) and not permitted to access the interface through NSIP address. Similarly, if Adam’s user account is created by a root administrator in the default partition and is bound to P2 partition, he can access the Citrix ADC Management interface only through NSIP address or SNIP address created in the default partition (with management access enabled) and not permitted to access the partition interface through SNIP address created in the administrative partition.

Configure roles and responsibilities for partition administrators

Following are the configurations performed by a root administrator in a default partition.

Creating administrative partitions and system users – A root administrator creates administrative partitions and system users in the default partition of the appliance. The administrator then associates the users to different partitions. If you are bound to one or more partitions, you can switch from one partition to another based on user bindings. Also, your access to one or more bound partitions is authorized only by the root administrator.

Authorizing system user as partition administrator for a specific partition – Once a user account is created, the root administrator switches to a specific partition and authorizes the user as the partition administrator.  This is done by assigning partition-admin command policy to the user account. Now, the user can access the partition as partition administrator and manage entities within the partition.

Following are the configurations perform by a partition administrator in an administrative partition.

Configuring SNIP address in an administrative partition- The partition administrator logs on to the partition and creates a SNIP address and provides management access to the address.

Creating and Binding a Partition System User with Partition Command Policy -The partition administrator creates partition users and defines the scope of user access. This is done by binding the user account to partition command policies.

Creating and Binding a Partition System User Groups with Partition Command Policy -The partition administrator creates partition user groups and defines the scope of user group access. This is done by binding the user group account to partition command policies.

Configuring External Server authentication for external users (optional)-This configuration is done for authenticating external TACACS users accessing the partition using SNIP address.

Following are the tasks performed in configuring role-based access for partition users in an Administrative Partition.

  1. Creating an Administrative Partition – Before you create partition users in an administrative partition, you must first create the partition. As a root administrator, you can create a partition from the default partition using the configuration utility or a command line interface.  
  2. Switching user access from default partition to partition P2 – If you are partition administrator accessing the appliance from the default partition, you can switch from default partition to a specific partition (for example, partition P2) based on user binding.
  3. Adding SNIP address to the Partition user account with Management access enabled-Once you have switched your access to an administration partition, you must create a SNIP address and provide management access to the address.
  4. Creating and Binding a Partition System User with Partition Command Policy-If you are a partition administrator, you can create partition users and define the scope of user access. This is done by binding the user account to partition command policies.
  5. Creating and Binding Partition user group with Partition Command Policy-If you are a partition administrator, you can create partition user groups and define the scope of user access control. This is done by bind the user group account to partition command policies.

Configuring External Server authentication for external users (optional)-This configuration is done for authenticating external TACACS users accessing the partition using SNIP address.

Benefits of using admin partitions

You can avail the following benefits by using admin partitions for your deployment:

  • Allows delegation of administrative ownership of an application to the customer.
  • Reduces the cost of ADC ownership without compromising on performance and ease-of-use.
  • Safeguards from unwarranted configuration changes. In a non-partitioned Citrix ADC appliance, authorized users of other application could intentionally or unintentionally change configurations that are required for your application. This could lead to undesirable behavior. This possibility is reduced in a partitioned Citrix ADC appliance.
  • Isolates traffic between different applications by the use of dedicated VLANs for each partition.
  • Accelerates and allows to scale application deployments.
  • Allows application-level or localized management and reporting.

Let us analyze a couple of cases to understand the scenarios in which you can use admin partitions.

User case 1: How Admin partition is used in an enterprise network

Let us consider a scenario faced by a company named Foo.com.

  • Foo.com has a single Citrix ADC.
  • There are five departments and each department has one application that requires to be deployed with the Citrix ADC.
  • Each application must be managed independently by a different set of users or administrators.
  • Other users must be restricted from accessing the configurations.
  • The application or back-end must be able to share resources like IP addresses.
  • The global IT department must be able to control Citrix ADC-level settings which must be common to all partitions.
  • Applications must be independent of one another. An error in configuration of one application must not affect the other.

A non-partitioned Citrix ADC would not be able to satisfy these requirements. However, you can achieve all these requirements by partitioning a Citrix ADC.

Simply create a partition for each of the applications, assign the required users to the partitions, specify a VLAN for each partition, and define global settings on the default partition.

Use case 2: How an admin partition is used by a service provider

Let us consider a scenario faced by a service provider named BigProvider:

  • BigProvider has 5 customers: 3 small enterprises and 2 large enterprises.
  • SmallBiz, SmallerBiz, and StartupBiz need only the most basic Citrix ADC functionality.
  • BigBiz and LargeBiz are larger enterprises and have applications that attract a lot of traffic. They would like to use some of the more complex Citrix ADC functionality.

In a non-partitioned approach, the Citrix ADC administrator would typically use a Citrix ADC SDX appliance and provision a Citrix ADC instance for each customer.

This solution suits BigBiz and LargeBiz because their applications need the undiminished power of the entire non-partitioned Citrix ADC appliance. However, this solution might not be as cost effective for servicing SmallBiz, SmallerBiz, and StartupBiz.

Therefore, BigProvider decides on the following solution:

  • Using a Citrix ADC SDX appliance to bring up dedicated Citrix ADC instances for BigBiz and LargeBiz.
  • Using a single Citrix ADC which is partitioned into three partitions, one each for SmallBiz, SmallerBiz, and StartupBiz.

The Citrix ADC administrator (superuser) creates an admin partition for each of these customers, specifies the users for the partitions, specifies the Citrix ADC resources for the partitions, and specifies the VLAN to be used by the traffic that is destined for each of the partitions.

Admin Partitioning
August 21, 2024
Contributed by: 
C C
August 21, 2024
Contributed by: 
C C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.