-
Getting Started with NetScaler
-
Solutions for Telecom Service Providers
-
Load Balance Control-Plane Traffic that is based on Diameter, SIP, and SMPP Protocols
-
Provide Subscriber Load Distribution Using GSLB Across Core-Networks of a Telecom Service Provider
-
Authentication, authorization, and auditing application traffic
-
Basic components of authentication, authorization, and auditing configuration
-
Web Application Firewall protection for VPN virtual servers and authentication virtual servers
-
On-premises NetScaler Gateway as an identity provider to Citrix Cloud™
-
Authentication, authorization, and auditing configuration for commonly used protocols
-
Troubleshoot authentication and authorization related issues
-
Troubleshoot authentication, authorization and auditing issues
-
Configure EULA as an authentication factor in NetScaler nFactor system
-
Configure periodic Endpoint Analysis scan as a factor in nFactor authentication
-
Configure post-authentication Endpoint Analysis scan as a factor in NetScaler nFactor authentication
-
Configure pre-authentication Endpoint Analysis scan as a factor in nFactor authentication
-
Configure pre-auth and post-auth EPA scan as a factor in nFactor authentication
-
Configure prefill user name from certificate in NetScaler nFactor authentication
-
Localize error messages generated by NetScaler nFactor system
-
Configure NetScaler Gateway preauthentication EPA scan for the domain check
-
-
-
-
Setting up a NetScaler cluster
-
Setting up inter-node communication
-
-
-
-
Persistence and persistent connections
-
Advanced load balancing settings
-
Gradually stepping up the load on a new service with virtual server–level slow start
-
Protect applications on protected servers against traffic surges
-
Retrieve location details from user IP address using geolocation database
-
Use source IP address of the client when connecting to the server
-
Use client source IP address for backend communication in a v4-v6 load balancing configuration
-
Set a limit on number of requests per connection to the server
-
Configure automatic state transition based on percentage health of bound services
-
-
Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
-
Use case 3: Configure load balancing in direct server return mode
-
Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
-
Use case 7: Configure load balancing in DSR mode by using IP Over IP
-
Use case 10: Load balancing of intrusion detection system servers
-
Use case 11: Isolating network traffic using listen policies
-
Use case 12: Configure Citrix Virtual Desktops for load balancing
-
Use case 13: Configure Citrix Virtual Apps and Desktops for load balancing
-
Use case 14: ShareFile wizard for load balancing Citrix ShareFile
-
Use case 15: Configure layer 4 load balancing on the NetScaler appliance
-
-
-
-
Create a certificate signing request and use SSL certificates on a NetScaler appliance
-
Configure SSL acceleration with HTTP on the front end and SSL on the back end
-
Export certificates used on a NetScaler appliance as PFX file
-
Configure SSL monitoring when client authentication is enabled on the back-end service
-
Configure SSL action to forward client traffic if a cipher is not supported on the ADC
-
Configure synchronization of files in a high availability setup
-
-
-
Authentication and authorization for System Users
-
-
Configuring a CloudBridge Connector Tunnel between two Datacenters
-
Configuring CloudBridge Connector between Datacenter and AWS Cloud
-
Configuring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
-
Configuring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
-
Configuring a CloudBridge Connector Tunnel Between a NetScaler Appliance and Cisco IOS Device
-
CloudBridge Connector Tunnel Diagnostics and Troubleshooting
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Setting up inter-node communication
The nodes in a cluster setup communicate with one another using the following inter-node communication mechanisms:
- Nodes that are within the network (the same subnet) communicate with each other through the cluster backplane. The backplane must be explicitly set up. The following are the detailed steps.
- Across networks, steering of packets is done through a GRE tunnel and other node-to-node communication is routed across nodes as required.
Important
- From Release 11.0 all builds, a cluster can include nodes from different networks.
- From Release 13.0 build 58.3, GRE steering is supported on Fortville NICs in an L3 cluster.
To set up the cluster backplane, do the following for every node
- Identify the network interface that you want to use for the backplane.
- Connect an Ethernet or optical cable from the selected network interface to the cluster backplane switch.
For example, to use interface 1/2 as the backplane interface for node 4, connect a cable from the 1/2 interface of node 4 to the backplane switch.
Important points to note when setting up the cluster backplane
-
Do not use the appliance’s management interface (0/x) as the backplane interface. In a cluster, the interface 0/1/x is read as:
0 -> node ID 0 1/x -> NetScaler interface
-
Use a proper network topology to prevent any loops on the backplane interface. Ensure that the MAC address of the peer node’s backplane interface is correctly resolved to the local node’s backplane interface.
-
Do not use the backplane interfaces for the client or server data planes.
-
Citrix® recommends using the link aggregate (LA) channel for the cluster backplane.
Note:
After you unbind an interface from the LA channel, ensure that you set an appropriate MTU size for the unbound interface.
-
In a two-node cluster, where the backplane is connected back-to-back, the cluster is operationally DOWN under any of the following conditions:
- One of the nodes is rebooted.
- The backplane interface of one of the nodes is disabled.
Therefore, Citrix recommends that you dedicate a separate switch for the backplane, so that the other cluster node and traffic are not impacted. You cannot scale out the cluster with a back-to-back link. You might encounter a downtime in the production environment when you scale out the cluster nodes.
-
Backplane interfaces of all nodes of a cluster must be connected to the same switch and bound to the same L2 VLAN.
-
If you have multiple clusters with the same cluster instance ID, make sure that the backplane interfaces of each cluster are bound to a different VLAN.
-
The backplane interface is always monitored, regardless of the HA monitoring settings of that interface.
-
The state of MAC spoofing on the different virtualization platforms can affect the steering mechanism on the cluster backplane. Therefore, make sure that the appropriate state is configured:
- XenServer® - Disable MAC spoofing
- Hyper-V - Enable MAC spoofing
- VMware ESX - Enable MAC spoofing (also make sure “Forged Transmits” is enabled)
-
The Maximum Transmission Unit (MTU) value for the cluster backplane is automatically updated. However, if jumbo frames are configured on the cluster, the MTU of the cluster backplane must be explicitly configured.
The configured MTU value must be the same across all nodes in the cluster for the following:
- Server data plane (X) - Client data plane (Y) - Backplane: The configured MTU value must be set to 78 + maximum of X and Y.Note:
The MTU values for the server data plane (X) and client data plane (Y) do not need to be the same.
For example, if the MTU of a server data plane is 7500 and of the client data plane is 8922 across the cluster, then the MTU of a cluster backplane must be set to 78 + 8922 = 9000 across the cluster.
To set this MTU, use the following command:
> set interface <backplane_interface> -mtu <value> -
The MTU for the interfaces of the backplane switch must be specified to be greater than or equal to 1,578 bytes. This requirement is applicable for the following:
- All Layer 2 clusters.
- Only within the node group for Layer 3 clusters.
- The cluster that supports features like MBF, L2 policies, ACLs, CLAG routing, and vPath.
Note:
The default MTU size for a backplane interface is 1578. To reset the MTU size to the default value, you must use the
unset interface <backplane_interface> -mtucommand.
UDP based tunnel support for L2 and L3 cluster
Starting from NetScaler release 13.0 build 36.x, NetScaler L2 and L3 cluster can steer the traffic using UDP based tunneling. It is defined for the inter-node communications of two nodes in a cluster. By using the “tunnel mode” parameter, you can set GRE or UDP tunnel mode from the add and set cluster node command.
In an L3 cluster deployment, packets between NetScaler nodes are exchanged over an unencrypted GRE tunnel that uses the NSIP addresses of the source and destination nodes for routing. When this exchange occurs over the internet, in the absence of an IPsec tunnel, the NSIPs are exposed on the internet, and might result in security issues.
Important
Citrix recommends customers to establish their own IPsec solution when using a L3 cluster.
The following table helps you to categorize the tunnel support based on different deployments.
| Steering Types | AWS | Microsoft Azure | On -premises |
|---|---|---|---|
| MAC | Not supported | Not supported | Supported |
| GRE tunnel | Supported | Not supported | Supported |
| UDP tunnel | Supported | Supported | Supported |
Important
In a L3 cluster, the tunnel mode is set to GRE by default.
Configuring a UDP based tunnel
You can add a cluster node by setting the parameters of node ID and mention the state. Configure the backplane by providing the interface name, and select the tunnel mode of your choice (GRE or UDP).
Note:
You must configure the tunnel mode from the Cluster IP address.
CLI procedures
To enable the UDP tunnel mode by using the CLI.
At the command prompt, type:
add cluster node <nodeId>@ [-state <state>] [-backplane <interface_name>] [-tunnelmode <tunnelmode>]set cluster node <nodeId>@ [-state <state>] [-tunnelmode <tunnelmode>]
Note
Possible values for tunnel mode are NONE, GRE, UDP.
Example
add cluster node 1 –state ACTIVE –backplane 1/1/1 -tunnelmode UDPset cluster node 1 –state ACTIVE –tunnelmode UDP
GUI procedures
To enable the UDP tunnel mode by using the GUI.
-
Navigate to System > Cluster > Nodes.
-
In the Cluster Nodes page, click Add.
-
In the Create Cluster Node, set the Tunnel Mode parameter to UDP and click Create.

-
Click Close.
Share
Share
This Preview product documentation is Cloud Software Group Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Cloud Software Group Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Cloud Software Group product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.