Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

VLAN configuration for admin partitions

August 20, 2024
Contributed by: 
C C

VLANs can be bound to a partition as a “Dedicated” VLAN or a “Shared” VLAN. Based on your deployment, you can bind a VLAN to a partition to isolate its network traffic from other partitions.

Dedicated VLAN – A VLAN bound only to one partition with “Sharing” option disabled and must be a tagged VLAN. For example, in a client-server deployment, for security reasons a system administrator creates a dedicated VLAN for each partition on the server side.

Shared VLAN – A VLAN bound (shared across) to multiple partitions with “Sharing” option enabled. For example, in a client-server deployment, if the system administrator does not have control over the client side network, a VLAN is created and shared across multiple partitions.

Shared VLAN can be used across multiple partitions. It is created in the default partition and you can bind a shared VLAN to multiple partitions. By default, a shared VLAN is bound to the default partition implicitly and hence it cannot be bound explicitly.

Note

  • A Citrix ADC appliance deployed on any hypervisor (ESX, KVM, Xen, and Hyper-V) platform must comply with both the following conditions in a partition setup and traffic domain:

    • Enable the promiscuous mode, MAC changes, MAC spoofing, or forged transmit for shared VLANs with partition.
    • Enable the VLAN with port group properties of the virtual switch, if the traffic is through a dedicated VLAN.

  • In a partitioned (multitenant) Citrix ADC appliance, a system administrator can isolate the traffic flowing to a particular partition or partitions by binding one or more VLANs to each partition.  A VLAN can be dedicated to one partition or Shared across multiple partitions.

Dedicated VLANs

To isolate the traffic flowing into a partition, create a VLAN and associate it with the partition.  The VLAN is then visible only to the associated partition, and the traffic flowing through the VLAN is classified and processed only in the associated partition.

Dedicated VLAN

To implement a dedicated VLAN for a particular partition, do the following.

  1. Add a VLAN (100).
  2. Bind a network interface to VLAN as a tagged network interface.
  3. Create a partition (P1).
  4. Bind partition (P1) to the dedicated VLAN (100).

To add a VLAN by using the command line interface

At the command prompt, type:

add vlan <id>

add vlan 100

To bind a VLAN by using the command line interface

At the command prompt, type:

bind vlan <id> -ifnum <interface> -tagged

bind vlan 100 –ifnum 1/8 -tagged

To create a partition by using the command line interface

At the command prompt, type:

add ns partition <partition name> [-maxBandwidth <positive_integer>][-maxConn <positive_integer>] [-maxMemLimit <positive_integer>]

add ns partition P1 –maxBandwidth 200 –maxconn 50 –maxmemlimit 90

To bind a partition to a VLAN by using the Citrix ADC CLI

At the command prompt, type:

bind partition <partition-id> -vlan <id>

bind partition P1 –vlan 100

To configure a dedicated VLAN by using the Citrix ADC GUI

  1. Navigate to Configuration > System > Network > VLANs* and click Add to create a VLAN.
  2. On the Create VLAN page, set the following parameters:
    • VLAN ID
    • Alias Name
    • Maximum Transmission Unit
    • Dynamic Routing
    • IPv6 Dynamic Routing
    • Partitions Sharing
  3. In the Interface Bindings section, select one or more interfaces and bind it to the VLAN.
  4. In the IP Bindings section, select one or more IP addresses and bind to the VLAN.
  5. Click OK and Done.

Shared VLAN

In a shared VLAN configuration, each partition has a MAC address, and traffic received on the shared VLAN is classified by MAC address. Only a Layer3 VLAN is recommended because it can restrict the subnet traffic. A partition MAC address is applicable and important only for a shared VLAN deployment.

The following diagram shows how a VLAN (VLAN 10) is shared across two partitions.

Shared VLAN

To deploy a shared VLAN configuration, do the following:

  1. Create a VLAN with the sharing option ‘enabled’, or enable the sharing option on an existing VLAN. By default, the option is ‘disabled’.
  2. Bind partition interface to shared VLAN.
  3. Create the partitions, each with its own PartitionMAC address.
  4. Bind the partitions to the shared VLAN.

To configure a shared VLAN by using the command line interface

At the command prompt, type one of the following commands to add a new VLAN or set the sharing parameter of an existing VLAN:

    add vlan <id> [-sharing (ENABLED | DISABLED)]

    set vlan <id> [-sharing (ENABLED | DISABLED)]

    add vlan 100 –sharing ENABLED

    set vlan 100 –sharing ENABLED
<!--NeedCopy-->

To bind a partition to a Shared VLAN by using the command line interface

At the command prompt, type:

    bind partition <partition-id> -vlan <id>

    bind partition P1 –vlan 100

    Add ns partition P1 –maxBandwidth 200 –maxconn 50   –maxmemlimit 90 -partitionMAC<mac_addr

Done
<!--NeedCopy-->

To configure a Partition MAC Address

At the command prompt, type:

   set ns partition <partition name> [-partitionMAC<mac_addr>]

   set ns partition P1 –partitionMAC 22:33:44:55:66:77

<!--NeedCopy-->

To bind partitions to a shared VLAN by using the command line interface

At the command prompt, type:

    bind partition <partition-id> -vlan <id>

    bind partition <partition-id> -vlan <id>

    bind partition P1 –vlan 100

    bind partition P2 –vlan 100

    bind partition P3 –vlan 100

    bind partition P4 –vlan 100
<!--NeedCopy-->

To configure Shared VLAN by using the Citrix ADC GUI

  1. Navigate to Configuration > System > Network > VLANs and then select a VLAN profile and click Edit to set the partition sharing parameter.
  2. On the Create VLAN page, select the Partitions Sharing check box.
  3. Click OK and then Done.

Dynamic routing over a shared VLAN across admin partitions

Admin partitions in a Citrix ADC appliance provide a way to host multiple tenants.

Starting from Citrix ADC version 12.1 build 51.16, a shared VLAN in a partitioned appliance supports dynamic routing protocol. Routing can be configured in dedicated or shared VLANs associated with admin partitions.

Dedicated VLAN of an admin partition. In a dedicated VLAN, the data path for the tenant is identified using one or more VLANs. This results in strict configuration and data-path isolation for the tenant. For advertising the health of a VIP address, dynamic routing is enabled in each partition and the routing adjacency is established per partition.

Dynamic routing over a dedicated VLAN per partition

A shared VLAN across admin partitions. In a shared VLAN, VIP addresses configured in non-default partition can be advertised through a single adjacency or peering formed in the default partition. A SNIP address in the non-default partition is used as the next-hop for all the VIP addresses (configured with advertiseOnDefaultPartition option) in that non-default partition. The configured SNIP address is marked as a next-hop IP address in the routing advertisements.

Consider an example setup of admin partitions in a Citrix ADC appliance, VLAN 100 is shared across default partition, and non-default partitions: AP-3 and AP-5. SNIP addresses SNIP1 is added in default partition, SNIP3 is added in AP-3, and SNIP5 is added in AP-5. SNIP1, SNIP3, and SNIP5 are reachable over vlan-100. VIP addresses VIP1 is added in default partition, VIP3 is added in AP-3, and VIP5 is added in AP-5. VIP3 and VIP5 are advertised through the single adjacency or peering formed in the default partition.

Dynamic routing over a shared VLAN across partitions

Before you begin

Before configuring dynamic routing over a shared VLAN in a non-default admin partition, make sure that:

  • Dynamic routing is configured on the shared VLAN in the default partition. Configuring dynamic routing on the shared VLAN in the default partition consists of the following steps:
    1. Enable dynamic routing on the shared VLAN.
    2. Add a SNIP IP address with dynamic routing enabled. This SNIP IP address is used for dynamic routing with the upstream.
    3. Bind the SNIP IP subnet to the shared VLAN.
  • One or more dynamic routing protocol is configured on the default partition. For more information, see configure dynamic routing protocols.

Configuration steps

Configuring dynamic routing over a shared VLAN in a non-default admin partition consists of the following steps:

  1. Add a SNIP IP address in the non-default partition. This SNIP IP address must be in the same subnet of the SNIP IP address that is being used for dynamic routing in the default partition.

  2. Set or enable the following parameters for advertising a VIP address, in a non-default partition, using dynamic routing.

    • Host route gateway (hostRtGw). Set this parameter to the SNIP address added in the above step.
    • Advertise on default partition (advertiseOnDefaultPartition). Enable this parameter.

Sample configuration

Consider an example of an admin partition setup in a Citrix ADC appliance. A non-default admin partition AP-3 is configured on this appliance. A shared VLAN VLAN100 is bound to AP-3. The following sample configuration configures dynamic routing, through VLAN100, in AP-3.

Steps Sample configuration
On default admin partition -
Enable dynamic routing on shared VLAN 100. set vlan 100 -dynamicRouting enabled
Add SNIP IP address 192.0.2.10 with dynamic routing enabled. This SNIP IP address is used for dynamic routing with the upstream. add ns ip 192.0.2.10 255.255.255.0 -type SNIP -dynamicRouting enabled
Bind subnet of 192.0.2.10 to shared VLAN 100. bind vlan 100 -IPAddress 192.0.2.10 255.255.255.0
On non-default admin partition AP-3 -
Add SNIP IP address 192.0.2.30. This SNIP IP address is in the same subnet as the SNIP IP address 192.0.2.10 on the default partition. add ns ip192.0.2.30 255.255.255.0 -type SNIP
For advertising VIP address 203.0.113.300 using dynamic routing, enable advertiseOnDefaultPartition parameter and set hostRtGw parameter to 192.0.2.30. set ns ip 203.0.113.300 255.255.255.255 -hostRoute enabled -advertiseOnDefaultPartition enabled -hostRtGw 192.0.2.30

Shared VLAN with admin partition on Citrix ADC SDX appliance

On SDX appliance, you must generate and configure the PMAC address by using the Management Service user interface, before using the admin partitions with shared VLANs. Management Service enables you to generate partition MAC addresses by:

  • Using a base MAC address
  • Specifying custom MAC addresses
  • Randomly generating MAC addresses

Note

VLAN configuration for admin partitions
August 20, 2024
Contributed by: 
C C
August 20, 2024
Contributed by: 
C C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.