ADC

Deploy a NetScaler cluster on AWS

September 15, 2026

Contributed by:

Clustering NetScaler VPX instances on Amazon Web Services (AWS) provides scalability and load distribution across multiple instances. In a cluster deployment, the NetScaler VPX instances function as a single system. Configuration is managed through a Configuration Coordinator (CCO), and state management is synchronized across nodes through a dedicated cluster backplane.

Architecture

A NetScaler cluster on AWS uses the following components:

Cluster nodes: Multiple NetScaler VPX instances deployed within a VPC within the same availability zone.
Network layout: Segregated subnets for management (backplane), client (VIPs), and backend (server) traffic.
Cluster IP (CLIP): A floating management IP address used to manage the cluster as a single entity.
Traffic flow: Integration with AWS components, such as Network Load Balancers (NLB), for distributing traffic to the cluster nodes.

Prerequisites

Licenses: Subscribe to the required NetScaler license in the AWS Marketplace (BYOL or hourly models).

IAM role policies: Create IAM roles that grant permissions to NetScaler instances to perform operations on your AWS account.

The IAM role assigned to the nodes must include the ec2:AssignPrivateIpAddress permission. This permission is required for CLIP failover, allowing the new CCO to remap the floating IP address.

For more information, see Configure AWS IAM roles on NetScaler VPX instance. Add the required IAM role policies as described in the following example.

 "Statement": [

 {

 "Action": [
 "ec2 : DescribeAddresses"
 "ec2 : AssociateAddress"
 "ec2 : DisassociateAddress"
 "ec2 : DescribeInstances"
 "ec2 : DescribeNetworkInterfaces"
 "ec2: DetachNetworkInterface",
 "ec2: AttachNetworkInterface"
 "ec2: StartInstances"
 "ec2: StopInstances"
 "ec2 : RebootInstances"
 "ec2:AssignPrivateIpAddresses",
 "autoscaling :* ",
 "sns :* "
 "sqs : *"
 "iam: GetRole",
 "iam: SimulatePrincipalPolicy",
 "cloudwatch : *"

 ]

 "Resource": "*"
 "Effect": "Allow"

 }

 ],

 <!--NeedCopy-->

Set up the infrastructure

To deploy a NetScaler cluster on AWS, you must configure the underlying network infrastructure and security components. Follow these steps to set up your VPC, subnets, gateways, and security groups.

Step 1: Create the VPC and subnets.

Establish three distinct subnets within your VPC:

Management subnet: For the cluster backplane and internal management traffic.
Client subnet: For receiving application traffic from the internet or internal clients.
Backend subnet: For communication between NetScaler and application servers.

Step 2: Configure gateways and routing.

Configure gateways to manage ingress and egress traffic for the cluster subnets:

Internet gateway: Attach to the client subnet and update the route tables to allow NetScaler to receive application traffic from the internet.
NAT gateway: Configure a NAT gateway for the management subnet to enable the outbound internet access required for licensing and firmware updates.

Step 3: Configure security groups.

Define security rules for the following groups:

Cluster security group: Allow UDP/TCP traffic between all nodes for synchronization.
Client security group: Allow HTTP/HTTPS traffic to the VIPs from client networks.

Step 4: Reserve IP addresses.

Ensure IP addresses for NSIP, CLIP, and SNIPs are reserved in the management and client subnets before deployment:

NSIP: Individual management IP address for each node.
CLIP: The shared cluster IP address for cluster management.
SNIP: Subnet IP addresses for each node to communicate with backend servers.
VIP: Virtual IP addresses for load balancing services.

Deploy NetScaler VPX instances on AWS

Launch instance: Use the AWS EC2 console to launch the NetScaler VPX AMIs.
Configure networking: Assign the primary interface to the management subnet and the secondary interface to the client subnet.
Associate security groups: Attach both the cluster and client security groups to the instances.

For more information, see Deploy a NetScaler VPX standalone instance on AWS.

Create the cluster IP (CLIP) in AWS

To assign a floating IP address for the CLIP in the AWS console:

Navigate to the first cluster node instance in the EC2 console.
Select the Networking tab and click Manage IP addresses.
Select the management interface.
Select Assign new IP address and click Save.
Verify that the IP address appears in the Secondary IP field within the Networking section.

Configure the NetScaler cluster

Step 1: Initialize the first cluster node.

SSH into the first NetScaler node using its NSIP address and initialize the cluster:

```
add cluster instance 1
add cluster node 1 10.0.1.10 -state ACTIVE -backplane 1/1 -tunnelmode UDP
add ns ip 10.0.1.15 255.255.255.255 -type CLIP
enable cluster instance 1
save config
reboot -w -f
<!--NeedCopy--> ```

Step 2: Join subsequent nodes.

From the CLIP, add the next node to the cluster:

add cluster node 2 10.0.1.11 -state PASSIVE -backplane 1/1 -tunnelmode UDP
save ns config
<!--NeedCopy-->

On the joining node’s CLI, run the join command:

join cluster -clip 10.0.1.15 -password <nsroot_password>
save config
reboot -w -f
<!--NeedCopy-->

Post-configuration tuning

After forming the cluster, apply the following mandatory settings to ensure correct traffic handling and performance:

MAC-based forwarding: Enable MAC-based forwarding to ensure that NetScaler replies using the same interface it received traffic on.
```
 enable mbf
 
```
Process local: Enable process local to optimize packet processing within the cluster instance.
```
 set cluster instance 1 -processLocal ENABLED
 
```

Verification

Cluster status: Run show cluster instance 1 to ensure that the cluster is enabled and synchronized.
Node membership: Run show cluster node to verify that all nodes are in the ACTIVE or PASSIVE state.
CLIP ownership: Run show ns ip to verify which node currently owns the floating CLIP.

Configure cluster networking and load balancing

To configure load balancing in an AWS cluster environment, follow these steps:

Step 1: Configure spotted SNIPs.

Configure spotted SNIPs on each node to ensure reachability to the backend server network. Use the -ownerNode parameter to pin the SNIP to a specific instance.

add ns ip <IP_Node0> 255.255.255.0 -ownerNode 0
add ns ip <IP_Node1> 255.255.255.0 -ownerNode 1
add ns ip <IP_Node2> 255.255.255.0 -ownerNode 2
<!--NeedCopy-->

Step 2: Configure VIPs and IP sets.

Create an IP set and bind your IPv4 VIPs to it. This configuration ensures that the cluster nodes correctly handle the traffic that the AWS NLB distributes.

add ipset ipset1
add ns ip <VIP_1> 255.255.255.0 -type VIP
add ns ip <VIP_2> 255.255.255.0 -type VIP
bind ipset ipset1 <VIP_1>
bind ipset ipset1 <VIP_2>
add lb vserver lbvs HTTP <VIP_Cluster> 80 -ipset ipset1
<!--NeedCopy-->

Step 3: Configure the service and bind it.

Define your backend service using an IPv4 address from the server network and bind it to the load balancing virtual server.

add service s1 <Server_IP> HTTP 80
bind lb vserver lbvs s1
<!--NeedCopy-->

Note:

Ensure that your AWS security groups are configured to allow HTTP traffic for the defined VIPs and backend server IPs.

Troubleshooting and best practices

The following table lists common issues and their solutions:

Issue	Cause	Solution
Nodes cannot communicate	Security group blocking traffic	Verify that the security group allows inter-node UDP/TCP traffic.
CLIP not responding	CCO is down or not synchronized	Restart the CCO or check the status with `show cluster instance`.
Backend servers unreachable	SNIP or routing issue	Verify the SNIP configuration and the AWS route tables.

Follow these best practices when you deploy a NetScaler cluster on AWS:

Use CLIP for management: Always perform configuration changes through the CLIP to ensure cluster-wide synchronization.
Regional proximity: Deploy nodes within the same AWS region, and preferably the same Availability Zone (AZ), to minimize backplane latency.
Monitor the CCO: Frequently monitor CCO ownership transitions to identify potential network stability issues.

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

NetScaler Secure Deployment Guide

Deploy a NetScaler cluster on AWS

September 15, 2026

Contributed by:

September 15, 2026

Contributed by:

Deploy a NetScaler cluster on AWS

Architecture

Prerequisites

Set up the infrastructure

Deploy NetScaler VPX instances on AWS

Create the cluster IP (CLIP) in AWS

Configure the NetScaler cluster

Post-configuration tuning

Verification

Configure cluster networking and load balancing

Troubleshooting and best practices

In this article