ADC

Test the application traffic on a single node during cluster upgrade

April 16, 2025

Contributed by:

C C

During cluster upgrades, verifying application traffic on individual nodes is essential to ensure stability and data integrity. Sequentially upgrading nodes within a maintenance window is considered the best practice. In cases where application traffic failures occur post-upgrade, a full cluster downgrade is time-consuming. To streamline this process, NetScaler 14.1 Build 43.x introduces a node-specific traffic testing command using policy-based backplane steering (PBS) and the nodeid parameter. This process significantly reduces the upgrade risks.

Important:

Use this feature only during the upgrade process. You must remove the Access Control List (ACL) after the upgrade is completed. Do not use this feature in normal cluster operations. Using this feature outside of upgrade scenarios can cause uneven distribution of application traffic across nodes.

Avoid conflicting ACLs by carefully selecting the target node ID. Consider factors such as spotted and striped IPs, node states (PASSIVE, SPARE), and whether the process is local, to ensure proper configuration and behavior.

Before upgrading a specific node, run the following command on the CLIP:

add ns acl <name_of_ACL> ALLOW -srcIP = <source_IP> -destIP = <destination_ip> -type DFD -nodeid <node_id> 
apply acls -type DFD
 

Example:

add ns acl Sample_ACL ALLOW -srcIP = 10.1.1.150 -destIP = 24.1.1.1 -type DFD -nodeid 2
apply acls -type DFD
 

The general upgrade process includes the following steps:

Identify the maintenance window.

Apply the ACL on CLIP. Use the following command on CLIP before upgrading a node. Save the configuration.

add ns acl <name_of_ACL> ALLOW -srcIP = <source_IP> -destIP = <destination_ip> -type DFD -nodeid <node_id> 
apply acls -type DFD
 

Upgrade and reboot the node for which you applied the ACL.
Test the application traffic that matches the attributes mentioned in the ACL. It must be steered to the specific node id.
Verify if the application traffic is functioning properly.
If the application traffic works as expected, proceed with upgrading the remaining nodes.
After completing the upgrade, remove the ACL from CLIP using:
```
rm ns acl <name_of_ACL> 
apply acls -type DFD
 
```

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NetScaler Secure Deployment Guide

Test the application traffic on a single node during cluster upgrade

April 16, 2025

Contributed by:

C C

Was this helpful

NetScaler Secure Deployment Guide

Test the application traffic on a single node during cluster upgrade

In this article