Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Enterprise Environment

August 1, 2023
Contributed by: 
S

In the enterprise setup, the NetScaler is placed between the firewalls connecting to the public Internet and the internal private network and handles egress traffic. The NetScaler selects the best firewall based on the configured load balancing policy.

The following diagram shows the enterprise firewall load balancing environment

Figure 1. Firewall Load Balancing (Enterprise)

firewall-load-balancing

The service type ANY configures the NetScaler to accept all traffic.

To avail benefits related to HTTP and TCP, configure the service and vserver with type HTTP or TCP. For FTP to work, configure the service with type FTP.

Configuring the NetScaler in an Enterprise Environment

Perform the following tasks to configure a NetScaler in an enterprise environment.

For traffic from the server (egress)

  • Enable the load balancing feature.
  • Configure a wildcard service for each firewall.
  • Configure a monitor for each wildcard service.
  • Configure a wildcard virtual server to load balance the traffic sent to the firewalls.
  • Configure the virtual server in MAC rewrite mode.
  • Bind firewall services to the wildcard virtual server.

For traffic across private network servers

  • Configure a service for each virtual server.
  • Configure a monitor for each service.
  • Configure an HTTP virtual server to balance traffic sent to the servers.
  • Bind HTTP services to the HTTP virtual server.
  • Save and Verify the Configuration.

In the below configuration example, one of the firewall servers is shown in the network topology diagram (Figure 1) is considered.

Enable the load balancing feature

You can configure load balancing entities such as services and virtual servers when the load balancing feature is disabled, but they will not function until you enable the feature.

To enable load balancing by using the command line interface

At the command prompt, type the following command to enable load balancing and verify the configuration:

  • enable ns feature LB
  • show ns feature

Example:

> enable ns feature LoadBalancing
 Done
> show ns feature

        Feature                        Acronym              Status
        -------                        -------              ------
 1)     Web Logging                    WL                   OFF
 2)     Surge Protection               SP                   ON
 3)     Load Balancing                 LB                   ON
 .
 .
 .
 24)    NetScaler Push                 push                 OFF
 Done
<!--NeedCopy-->

To enable load balancing by using the configuration utility

Navigate to System > Settings and, in Configure Basic Features, select Load Balancing.

Configure a wildcard service for each firewall

To configure a wildcard service for each firewall by using the command line interface

At the command prompt, type:

add service <name> <serverName> ANY *
<!--NeedCopy-->

Example:

add service Service-HTTP-1 192.168.100.10 ANY *
<!--NeedCopy-->

To configure a wildcard service for each firewall by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Services.
  2. In the details pane, click Add.
  3. In the Create Service dialog box, specify values for the following parameters as shown:
    • Service Name—name
    • Server—serverName
  4. In Protocol, select ANY, and in Port, select *.
  5. Click Create, and then click Close. The service you created appears in the Services pane.

Configure a monitor for each wildcard service

A PING monitor is bound by default to the service. You will need to configure a transparent monitor to monitor hosts on the trusted side through individual firewalls. You can then bind the transparent monitor to services. The default PING monitor monitors the connectivity only between the NetScaler appliance and the upstream device. The transparent monitor monitors all the devices existing in the path from the appliance to the device that owns the destination IP address specified in the monitor. If a transparent monitor is not configured and the status of the firewall is UP but one of the next hop devices from that firewall is down, the appliance includes the firewall while performing load balancing and forwards the packet to the firewall. However, the packet is not delivered to the final destination because one of the next hop devices is down. By binding a transparent monitor, if any of the devices (including the firewall) are down, the service is marked as DOWN and the firewall is not included when the appliance performs firewall load balancing.

Binding a transparent monitor will override the PING monitor. To configure a PING monitor in addition to a transparent monitor, after you create and bind a transparent monitor, you need to bind a PING monitor to the service.

To configure a transparent monitor by using the command line interface

At the command prompt, type the following commands to configure a transparent monitor and verify the configuration:

add lb monitor <monitorName> <type> [-destIP <ip_addr|ipv6_addr|*>] [-transparent (YES | NO )]
bind lb monitor <monitorName> <serviceName>
<!--NeedCopy-->

Example:

add monitor monitor-HTTP-1 HTTP -destip 10.10.10.11 -destport 80 -transparent YES
bind monitor monitor-HTTP-1 fw-svc1
<!--NeedCopy-->

To create and bind a transparent monitor by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Monitors.

  2. In the details pane, click Add.

  3. In the Create Monitor dialog box, specify values as shown:

    • Name*
    • Type*—type
    • Destination IP
    • Transparent

    -* A required parameter

  4. Click Create, and then click Close. In the Monitors pane, select the monitor that you just configured and verify that the settings displayed at the bottom of the screen are correct.

Configure a wildcard virtual server to load balance the traffic sent to the firewalls

The traffic passing through firewalls is meant for different proxies or servers that are placed behind the firewalls. These proxies or servers can have different IP addresses and ports. For the traffic to pass transparently through the firewalls, the IP address and port of the virtual server load balancing the firewalls must be set as * to accept traffic for any IP address and port.

To configure a wildcard virtual server to load balance the traffic sent to the firewalls by using the command line interface

At the command prompt, type:

add lb vserver <name> ANY * *
<!--NeedCopy-->

Example:

add lb vserver Vserver-LB-1 ANY * *
<!--NeedCopy-->

To configure a wildcard virtual server to load balance the traffic sent to the firewalls by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, click Add.
  3. In the Create Virtual Server (Load Balancing) dialog box, specify values for the following parameters as shown:
    • Name—name
  4. In Protocol, select ANY, and in IP Address and Port, select *.
  5. Click Create, and then click Close. The virtual server you created appears in the Load Balancing Virtual Servers pane.

Configure the virtual server in MAC rewrite mode

To configure the virtual server in MAC rewrite mode by using the command line interface

At the command prompt, type:

set lb vserver <name>@ -m <RedirectionMode>
<!--NeedCopy-->

Example:

set lb vserver Vserver-LB-1 -m MAC
<!--NeedCopy-->

To configure the virtual server in MAC rewrite mode by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, select the virtual server for which you want to configure the redirection mode (for example, Vserver-LB-1), and then click Open.
  3. On the Advanced tab, under Redirection Mode, click MAC-Based.
  4. Click OK.

Bind firewall services to the wildcard virtual server

To bind firewall services to the wildcard virtual server by using the command line interface

At the command prompt, type:

bind lb vserver <name> <serviceName>
<!--NeedCopy-->

Example:

bind lb vserver Vserver-LB-1 Service-HTTP-1
<!--NeedCopy-->

To bind firewall services to the wildcard virtual server by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers, and select a virtual server.
  2. Click in the Service section, and select a service to bind.

Note: You can bind a service to multiple virtual servers.

Configure a service for each virtual server

To configure a service for each virtual server by using the command line interface

At the command prompt, type:

add service <name> <serverName> HTTP <port>
<!--NeedCopy-->

Example:

add service Service-HTTP-1 192.168.100.10 HTTP 80
<!--NeedCopy-->

To configure a service for each virtual server by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Services.
  2. In the details pane, click Add.
  3. In the Create Service dialog box, specify values for the following parameters as shown:
    • Service Name—name
    • Server—serverName
    • Port—port
  4. In Protocol, specify HTTP. Under Available Monitors, select HTTP.
  5. Click Create, and then click Close. The service you created appears in the Services pane.

Configure a monitor for each service

To bind a monitor to a service by using the command line interface

At the command prompt, type:

bind lb monitor <monitorName> <ServiceName>
<!--NeedCopy-->

Example:

bind mon monitor-HTTP-1 Service-HTTP-1
<!--NeedCopy-->

To bind a monitor to a service by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Services.
  2. Open the service, and add a monitor.

Configure an HTTP virtual server to balance traffic sent to the servers

To configure an HTTP virtual server to balance traffic sent to the servers by using the command line interface

At the command prompt, type:

add lb vserver <name> HTTP <ip> <port>
<!--NeedCopy-->

Example:

add lb vserver Vserver-LB-1 HTTP 10.102.29.60 80
<!--NeedCopy-->

To configure an HTTP virtual server to balance traffic sent to the servers by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. In the details pane, click Add.
  3. In the Create Virtual Server (Load Balancing) dialog box, specify values for the following parameters as shown:
    • Name—name
    • IP Address—IPAddress Note: If the virtual server uses IPv6, select the IPv6 check box and enter the address in IPv6 format (for example, 1000:0000:0000:0000:0005:0600:700a:888b).
    • Port—port
  4. Under Protocol, select HTTP.
  5. Click Create, and then click Close. The virtual server you created appears in the Load Balancing Virtual Servers pane.

Bind HTTP services to the HTTP virtual server

To bind HTTP services to the wildcard virtual server by using the command line interface

At the command prompt, type:

bind lb vserver <name> <serviceName>
<!--NeedCopy-->

Example:

bind lb vserver Vserver-LB-1 Service-HTTP-1
<!--NeedCopy-->

To bind HTTP services to the wildcard virtual server by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers, and select a virtual server.
  2. Click in the Service section, and select a service to bind.

Note: You can bind a service to multiple virtual servers.

Save and Verify the Configuration

When you’ve finished the configuration tasks, be sure to save the configuration. You should also check to make sure that the settings are correct.

To save and verify the configuration by using the command line interface

At the command prompt, type the following commands to configure a transparent monitor and verify the configuration:

  • save ns config
  • show vserver

Example:

save config
show lb vserver FWLBVIP2
        FWLBVIP2 (*:*) - ANY    Type: ADDRESS
        State: UP
        Last state change was at Mon Jun 14 07:22:54 2010
        Time since last state change: 0 days, 00:00:32.760
        Effective State: UP
        Client Idle Timeout: 120 sec
        Down state flush: ENABLED
        Disable Primary Vserver On Down : DISABLED
        No. of Bound Services :  2 (Total)       2 (Active)
        Configured Method: LEASTCONNECTION
        Current Method: Round Robin, Reason: A new service is bound
        Mode: MAC
        Persistence: NONE
        Connection Failover: DISABLED

1) fw-int-svc1 (192.168.100.10: *) - ANY State: UP Weight: 1
 Done
show service fw-int-svc1
        fw-int-svc1 (192.168.100.10:*) - ANY
        State: UP
        Last state change was at Thu Jul  8 14:44:51 2010
        Time since last state change: 0 days, 00:01:50.240
        Server Name: 192.168.100.10
        Server ID : 0   Monitor Threshold : 0
        Max Conn: 0     Max Req: 0      Max Bandwidth: 0 kbits
        Use Source IP: NO
        Client Keepalive(CKA): NO
        Access Down Service: NO
        TCP Buffering(TCPB): NO
        HTTP Compression(CMP): NO
        Idle timeout: Client: 120 sec   Server: 120 sec
        Client IP: DISABLED
        Cacheable: NO
        SC: OFF
        SP: OFF
        Down state flush: ENABLED

1)      Monitor Name: monitor-HTTP-1
                State: UP     Weight: 1
                Probes: 9       Failed [Total: 0 Current: 0]
                Last response: Success - HTTP response code 200 received
                Response Time: 100.0 millisec
2)      Monitor Name: ping
                State: UP       Weight: 1
                Probes: 3       Failed [Total: 0 Current: 0]
                Last response: Success - ICMP echo reply received.
                Response Time: 1.275 millisec
 Done
<!--NeedCopy-->

To save and verify the configuration by using the configuration utility

  1. In the details pane, click Save.
  2. In the Save Config dialog box, click Yes.
  3. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  4. In the details pane, select the virtual server that you created in step 5 and verify that the settings displayed in the Details pane are correct.
  5. Navigate to Traffic Management > Load Balancing > Services.
  6. In the details pane, select the service that you created in step 5 and verify that the settings displayed in the Details pane are correct.

Monitoring a Firewall Load Balancing Setup in an Enterprise Environment

After the configuration is up and running, you should view the statistics for each service and virtual server to check for possible problems.

Viewing the Statistics of a Virtual Server

To evaluate the performance of virtual servers or to troubleshoot problems, you can display details of the virtual servers configured on the NetScaler appliance. You can display a summary of statistics for all the virtual servers, or you can specify the name of a virtual server to display the statistics only for that virtual server. You can display the following details:

  • Name
  • IP address
  • Port
  • Protocol
  • State of the virtual server
  • Rate of requests received
  • Rate of hits

To display virtual server statistics by using the command line interface

To display a summary of the statistics for all the virtual servers currently configured on the NetScaler appliance, or for a single virtual server, at the command prompt, type:

stat lb vserver [-detail] [<name>]
<!--NeedCopy-->

Example:

>stat lb vserver -detail
Virtual Server(s) Summary
                      vsvrIP  port     Protocol        State    Req/s   Hits/s
One                        *    80         HTTP           UP      5/s      0/s
Two                        *     0          TCP         DOWN      0/s      0/s
Three                      *  2598          TCP         DOWN      0/s      0/s
dnsVirtualNS    10.102.29.90    53          DNS         DOWN      0/s      0/s
BRVSERV            10.10.1.1    80         HTTP         DOWN      0/s      0/s
LBVIP           10.102.29.66    80         HTTP           UP      0/s      0/s
 Done


<!--NeedCopy-->

To display virtual server statistics by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers > Statistics.
  2. If you want to display the statistics for only one virtual server, in the details pane, select the virtual server, and click Statistics.

Viewing the Statistics of a Service

Updated: 2013-08-28

You can view the rate of requests, responses, request bytes, response bytes, current client connections, requests in surge queue, current server connections, and so forth using the service statistics.

To view the statistics of a service by using the command line interface

At the command prompt, type:

stat service <name>
<!--NeedCopy-->

Example:

stat service Service-HTTP-1
<!--NeedCopy-->

To view the statistics of a service by using the configuration utility

  1. Navigate to Traffic Management > Load Balancing > Services > Statistics.
  2. If you want to display the statistics for only one service, select the service, and click Statistics.
Enterprise Environment
August 1, 2023
Contributed by: 
S
August 1, 2023
Contributed by: 
S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.