ADC

Prerequisites

August 11, 2023

Contributed by:

C S

Before attempting to create a VPX instance in AWS, ensure you have the following:

An AWS account: to launch a NetScaler VPX AMI in an AWS Virtual Private Cloud (VPC). You can create an AWS account for free at www.aws.amazon.com.

An AWS Identity and Access Management (IAM) user account: to securely control access to AWS services and resources for your users. For more information about how to create an IAM user account, see Creating IAM Users (Console). An IAM role is mandatory for both standalone and high availability deployments.

The IAM role associated with your AWS account must have the following IAM permissions for various scenarios.

HA pair with IPv4 addresses in the same AWS zone:

 "ec2:DescribeInstances",
 "ec2:AssignPrivateIpAddresses",
 "iam:SimulatePrincipalPolicy",
 "iam:GetRole",
 "ec2:CreateTags"
 <!--NeedCopy-->

HA pair with IPv6 addresses in the same AWS zone:

 "ec2:DescribeInstances",
 "ec2:AssignIpv6Addresses",
 "ec2:UnassignIpv6Addresses",
 "iam:SimulatePrincipalPolicy",
 "iam:GetRole",
 "ec2:CreateTags"
 <!--NeedCopy-->

HA pair with both IPv4 and IPv6 addresses in the same AWS zone:

 "ec2:DescribeInstances",
 "ec2:AssignPrivateIpAddresses",
 "ec2:AssignIpv6Addresses",
 "ec2:UnassignIpv6Addresses",
 "iam:SimulatePrincipalPolicy",
 "iam:GetRole",
 "ec2:CreateTags"
 <!--NeedCopy-->

HA pair with elastic IP addresses across different AWS zones:

 "ec2:DescribeInstances",
 "ec2:DescribeAddresses",
 "ec2:AssociateAddress",
 "ec2:DisassociateAddress",
 "iam:SimulatePrincipalPolicy",
 "iam:GetRole",
 "ec2:CreateTags"
 <!--NeedCopy-->

HA pair with private IP addresses across different AWS zones:

 "ec2:DescribeInstances",
 "ec2:DescribeRouteTables",
 "ec2:DeleteRoute",
 "ec2:CreateRoute",
 "ec2:ModifyNetworkInterfaceAttribute",
 "iam:SimulatePrincipalPolicy",
 "iam:GetRole",
 "ec2:CreateTags"
 <!--NeedCopy-->

HA pair with both private IP and elastic IP addresses across different AWS zones:

 "ec2:DescribeInstances",
 "ec2:DescribeAddresses",
 "ec2:AssociateAddress",
 "ec2:DisassociateAddress",
 "ec2:DescribeRouteTables",
 "ec2:DeleteRoute",
 "ec2:CreateRoute",
 "ec2:ModifyNetworkInterfaceAttribute",
 "iam:SimulatePrincipalPolicy",
 "iam:GetRole",
 "ec2:CreateTags"
 <!--NeedCopy-->

AWS backend autoscaling:

 "ec2:DescribeInstances",
 "autoscaling:*",
 "sns:CreateTopic",
 "sns:DeleteTopic",
 "sns:ListTopics",
 "sns:Subscribe",
 "sqs:CreateQueue",
 "sqs:ListQueues",
 "sqs:DeleteMessage",
 "sqs:GetQueueAttributes",
 "sqs:SetQueueAttributes",
 "iam:SimulatePrincipalPolicy",
 "iam:GetRole",
 "ec2:CreateTags"
 <!--NeedCopy-->

Note:

If you use any combination of the preceding features, use the combination of IAM permissions for each of the features.

If you use the Citrix CloudFormation template, the IAM role is automatically created. The template does not allow selecting an already created IAM role.

When you log on to the VPX instance through the GUI, a prompt to configure the required privileges for the IAM role appears. Ignore the prompt if you’ve already configured the privileges.

AWS CLI: To use all the functionality provided by the AWS Management Console from your terminal program. For more information, see the AWS CLI user guide. You also need the AWS CLI to change the network interface type to SR-IOV.
Elastic Network Adapter (ENA): For ENA driver-enabled instance type, for example M5, C5 instances, the firmware version must be 13.0 and above.
You must configure Instance Metadata Service (IMDS) on the EC2 instance for NetScaler VPX. IMDSv1 and IMDSv2 are two modes available for accessing instance metadata from a running AWS EC2 instance. IMDSv2 is more secure than IMDSv1. You can configure the instance either to use both methods (the default option) or only the IMDSv2 mode (by disabling IMDSv1). Citrix ADC VPX supports IMDSv2 only mode from NetScaler VPX release 13.1.48.x onwards.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Prerequisites

August 11, 2023

Contributed by:

C S

August 11, 2023

Contributed by:

C S

Prerequisites

In this article