ADC

Client IP address in TCP option

May 2, 2023

Contributed by:

S C S

The NetScaler appliance uses many ways to send the client information to the back-end server. One such method is by sending the client IP address in the TCP option. The appliance uses the TCP option number in the TCP profile, if the back-end server is using the TCP option to read the client IP address.

The NetScaler appliance sends the client IP address, in the TCP option header, only in the following packets:

final ACK packet of the three-way handshake
first data packet.

Following are some of the usage scenarios for the TCP option configuration in a NetScaler appliance.

Learning original client IP address
Selecting a language for a website
Block listing the selected IP addresses

Following are the two modes of operation for sending the client IP address in the TCP option:

Insert. In insert mode, the appliance adds the client details in the TCP option 28 (configurable but the preferable value is 28) field and sends it to the back-end server.
Forward. In forward mode, the virtual server receives the client IP details in the TCP option from a proxy device. For the virtual server, you must configure the same TCP option, which the proxy device has used to send the client IP details.

The appliance then sends the client details in the TCP option field to the back-end server. For the service representing the back-end server, you can set any TCP option but the preferable value is 28.

The NetScaler appliance also supports sending the client port in the TCP option for insert mode configuration.

Notes:

Multiplexing is not supported for the received traffic on a virtual server if the Client IP TCP option is enabled on the bound TCP profile.

For a TCP or HTTP virtual server, the TCP option number is forwarded with or without this feature enabled in transparent mode.

Limitations

The TCP option configuration feature is not supported in TFO, MultiPath TCP, and HTTP2 features.

How TCP option configuration in a NetScaler appliance

The following flow diagrams show how you can configure the TCP option in the NetScaler appliances for Insert and forward operations.

Insert operation:

Insert operation

The component interact is as follows:

A client sends a request to NetScaler.
In the Insert operation, the NetScaler appliance inserts the client IP address and port in the configured TCP option of the following packets to the back-end server.
- final ACK packet of the three-way handshake
- first data packet
Note:

If the incoming traffic is HTTPS, the client IP address and the client port in the TCP option is sent in the SSL client hello message, which is the first data packet at the TCP level.

Forward operation:

Forward operation

The component interact is as follows:

A client sends a HTTP/HTTPS request to the NetScaler appliance.
For the Forward operation, the TCP option is enabled on a load balancing virtual server or a content switching virtual server and also enabled on the service. The appliance receives the client details in the TCP option number specified in the virtual server.
The NetScaler appliance then inserts the client IP address and port in the configured TCP option (for the service) of the following packets to the back-end server.
- final ACK packet of the three-way handshake
- first data packet

Configure TCP option for Insert operation

Configuring the TCP option for Insert operation consists of the following steps:

Configure a TCP profile. Enable the Client IP TCP option (clientIpTcpOption), and specify the TCP option number (clientIpTcpOptionNumber). Optionally, enable the sendClientPortInTcpOption to send the client port in the TCP option header.

Note:

Citrix recommends configuring TCP option number as 28 in the TCP profile.
Bind the TCP profile to a service

To configure a TCP profile by using CLI:

At the command prompt, type:

add tcpprofile <name> -clientIpTcpOption (ENABLED | DISABLED) -clientIpTcpOptionNumber <positive_integer> -sendClientPortInTcpOption (ENABLED | DISABLED)
show tcpprofile <name>

To bind the TCP profile to the service by using CLI:

At the command prompt, type:

set service <name> –tcpprofileName <name>
show service <name>

Sample configuration

add tcpprofile TCP-PROFILE-1 -clientIpTcpOption ENABLED -clientIpTcpOptionNumber 28 -sendClientPortInTcpOption ENABLED
set service SERVICE-1 –tcpprofileName TCP-PROFILE-1
<!--NeedCopy-->

Configure the TCP option for Forward operation

Configuring the TCP option for forward operation consists of the following steps:

Configure a TCP profile. Enable the Client IP TCP option (clientIpTcpOption), and specify the TCP option number (clientIpTcpOptionNumber).
Bind the TCP profile to a load balancing or content switching virtual server
Bind the TCP profile to the services.

To configure a TCP profile by using CLI:

At the command prompt, type:

add tcpprofile <name> -clientIpTcpOption (ENABLED | DISABLED) -clientIpTcpOptionNumber <positive_integer>
show tcpprofile <name>

To Bind the TCP profile to a load balancing or content switching virtual server by using CLI:

At the command prompt, type:

set lb vserver <name> -tcpprofileName <name>
show lb vserver <name>

To bind TCP profile to service by using CLI:

At the command prompt, type:

set service <name> -tcpprofileName p1
show service <name>

Sample configuration

add tcpprofile TCP-PROFILE-2 -clientIpTcpOption ENABLED -clientIpTcpOptionNumber 29
set lb vserver LBVS-2 –tcpprofileName TCP-PROFILE-2
set service SERVICE-2 -tcpprofileName TCP-PROFILE-2
<!--NeedCopy-->

Configure TCP option by using NetScaler GUI

Navigate to System > Profiles.
In the TCP Profile tab page, click Add.
In the Configure TCP profile page, configure the following parameters:
- clientIptcpoption. Enables the TCP option to send or receive client IP address.
- clientiptcpoptionnumber. Sets TCP option number.
- sendClientPortInTcpOption Sends client port in the TCP option for insert mode configuration.
Click OK and Close.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Client IP address in TCP option

May 2, 2023

Contributed by:

S C S

May 2, 2023

Contributed by:

S C S

Client IP address in TCP option

Limitations

How TCP option configuration in a NetScaler appliance

Configure TCP option for Insert operation

Sample configuration

Configure the TCP option for Forward operation

Sample configuration

Configure TCP option by using NetScaler GUI

In this article