ADC

Prerequisites

Before attempting to create a VPX instance in AWS, ensure you have the following:

  • An AWS account: to launch a NetScaler VPX AMI in an AWS Virtual Private Cloud (VPC). You can create an AWS account for free at www.aws.amazon.com.
  • An AWS Identity and Access Management (IAM) user account: to securely control access to AWS services and resources for your users. For more information about how to create an IAM user account, see Creating IAM Users (Console). An IAM role is mandatory for both standalone and high availability deployments.

    The IAM role associated with your AWS account must have the following IAM permissions for various scenarios.

    HA pair with IPv4 addresses in the same AWS zone:

     "ec2:DescribeInstances",
     "ec2:AssignPrivateIpAddresses",
     "iam:SimulatePrincipalPolicy",
     "iam:GetRole",
     "ec2:CreateTags"
     <!--NeedCopy-->
    

    HA pair with IPv6 addresses in the same AWS zone:

     "ec2:DescribeInstances",
     "ec2:AssignIpv6Addresses",
     "ec2:UnassignIpv6Addresses",
     "iam:SimulatePrincipalPolicy",
     "iam:GetRole",
     "ec2:CreateTags"
     <!--NeedCopy-->
    

    HA pair with both IPv4 and IPv6 addresses in the same AWS zone:

     "ec2:DescribeInstances",
     "ec2:AssignPrivateIpAddresses",
     "ec2:AssignIpv6Addresses",
     "ec2:UnassignIpv6Addresses",
     "iam:SimulatePrincipalPolicy",
     "iam:GetRole",
     "ec2:CreateTags"
     <!--NeedCopy-->
    

    HA pair with elastic IP addresses across different AWS zones:

     "ec2:DescribeInstances",
     "ec2:DescribeAddresses",
     "ec2:AssociateAddress",
     "ec2:DisassociateAddress",
     "iam:SimulatePrincipalPolicy",
     "iam:GetRole",
     "ec2:CreateTags"
     <!--NeedCopy-->
    

    HA pair with private IP addresses across different AWS zones:

     "ec2:DescribeInstances",
     "ec2:DescribeRouteTables",
     "ec2:DeleteRoute",
     "ec2:CreateRoute",
     "ec2:ModifyNetworkInterfaceAttribute",
     "iam:SimulatePrincipalPolicy",
     "iam:GetRole",
     "ec2:CreateTags"
     <!--NeedCopy-->
    

    HA pair with both private IP and elastic IP addresses across different AWS zones:

     "ec2:DescribeInstances",
     "ec2:DescribeAddresses",
     "ec2:AssociateAddress",
     "ec2:DisassociateAddress",
     "ec2:DescribeRouteTables",
     "ec2:DeleteRoute",
     "ec2:CreateRoute",
     "ec2:ModifyNetworkInterfaceAttribute",
     "iam:SimulatePrincipalPolicy",
     "iam:GetRole",
     "ec2:CreateTags"
     <!--NeedCopy-->
    

    AWS backend autoscaling:

     "ec2:DescribeInstances",
     "autoscaling:*",
     "sns:CreateTopic",
     "sns:DeleteTopic",
     "sns:ListTopics",
     "sns:Subscribe",
     "sqs:CreateQueue",
     "sqs:ListQueues",
     "sqs:DeleteMessage",
     "sqs:GetQueueAttributes",
     "sqs:SetQueueAttributes",
     "iam:SimulatePrincipalPolicy",
     "iam:GetRole",
     "ec2:CreateTags"
     <!--NeedCopy-->
    

    Note:

    • If you use any combination of the preceding features, use the combination of IAM permissions for each of the features.
    • If you use the Citrix CloudFormation template, the IAM role is automatically created. The template does not allow selecting an already created IAM role.
    • When you log on to the VPX instance through the GUI, a prompt to configure the required privileges for the IAM role appears. Ignore the prompt if you’ve already configured the privileges.
  • AWS CLI: To use all the functionality provided by the AWS Management Console from your terminal program. For more information, see the AWS CLI user guide. You also need the AWS CLI to change the network interface type to SR-IOV.

  • Elastic Network Adapter (ENA): For ENA driver-enabled instance type, for example M5, C5 instances, the firmware version must be 13.0 and above.

  • You must configure Instance Metadata Service (IMDS) on the EC2 instance for NetScaler VPX. IMDSv1 and IMDSv2 are two modes available for accessing instance metadata from a running AWS EC2 instance. IMDSv2 is more secure than IMDSv1. You can configure the instance either to use both methods (the default option) or only the IMDSv2 mode (by disabling IMDSv1). Citrix ADC VPX supports IMDSv2 only mode from NetScaler VPX release 13.1.48.x onwards.
Prerequisites

In this article