Citrix Cloud Connector
The Citrix Cloud Connector feature of the Citrix SD-WAN WANOP appliance connects enterprise datacenters to external clouds and hosting environments, making the cloud a secure extension of your enterprise network. Cloud-hosted applications appear as though they are running on one contiguous enterprise network. With Citrix Cloud Connector, you can augment your datacenters with the capacity and efficiency available from cloud providers.
The Citrix Cloud Connector enables you to move your applications to the cloud to reduce costs and increase reliability.
The WAN optimization feature of the Citrix SD-WAN WANOP appliance accelerates traffic, providing LAN-like performance for applications running across enterprise datacenters and clouds.
In addition to using Citrix Cloud Connector between a datacenter and a cloud, you can use it to connect two datacenters for a high-capacity secure and accelerated link.
To implement the Citrix Cloud Connector solution, you connect a datacenter to another datacenter or an external cloud by setting up a tunnel called the Citrix Cloud Connector tunnel.
To connect a datacenter to another datacenter, you set up a Citrix Cloud Connector tunnel between two appliances, one in each datacenter.
To connect a datacenter to an external cloud (for example, Amazon AWS cloud), you set up a Citrix Cloud Connector tunnel between a Citrix SD-WAN WANOP appliance in the datacenter and a virtual appliance (VPX) that resides in the Cloud. The remote end point can be a Citrix Cloud Connector or a Citrix VPX with platinum license.
The following illustration shows a Citrix Cloud Connector tunnel set up between a datacenter and an external cloud.
The appliances between which a Citrix Cloud Connector tunnel is set up are called the end points or peers of the Citrix Cloud Connector tunnel.
A Citrix Cloud Connector tunnel uses the following protocols:
-
Generic Routing Encapsulation (GRE) protocol
-
Open-standard IPSec Protocol suite, in transport mode
The GRE protocol provides a mechanism for encapsulating packets, from a wide variety of network protocols, to be forwarded over another protocol. GRE is used to:
-
Connect networks running non-IP and non-routable protocols.
-
Bridge across a wide area network (WAN).
-
Create a transport tunnel for any type of traffic that needs to be sent unchanged across a different network.
The GRE protocol encapsulates packets by adding a GRE header and a GRE IP header to the packets.
The Internet Protocol security (IPSec) protocol suite secures communication between peers in the Citrix Cloud Connector tunnel.
In a Citrix Cloud Connector tunnel, IPSec ensures:
-
Data integrity
-
Data origin authentication
-
Data confidentiality (encryption)
-
Protection against replay attacks
IPSec uses the transport mode in which the GRE encapsulated packet is encrypted. The encryption is done by the Encapsulating Security Payload (ESP) protocol. The ESP protocol ensures the integrity of the packet by using a HMAC hash function, and ensures confidentiality by using an encryption algorithm. After the packet is encrypted and the HMAC is calculated, an ESP header is generated. The ESP header is inserted after the GRE IP header and, an ESP trailer is inserted at the end of the encrypted payload.
Peers in the Citrix Cloud Connector tunnel use the Internet Key Exchange version (IKE) protocol (part of the IPSec protocol suite) to negotiate secure communication, as follows:
-
The two peers mutually authenticate with each other, using one of the following authentication methods:
-
Pre-shared key authentication. A text string called a pre-shared key is manually configured on each peer. The pre-shared keys of the peers are matched against each other for authentication. Therefore, for the authentication to be successful, you must configure the same pre-shared key on each of the peers.
-
Digital certificates authentication. The initiator (sender) peer signs message interchange data by using its private key, and the other receiver peer uses the sender’s public key to verify the signature. Typically, the public key is exchanged in messages containing an X.509v3 certificate. This certificate provides a level of assurance that a peer’s identity as represented in the certificate is associated with a particular public key.
-
-
The peers then negotiate to reach agreement on:
-
An encryption algorithm.
-
Cryptographic keys for encrypting data in one peer and decrypting the data in the other.
-
This agreement upon the security protocol, encryption algorithm and cryptographic keys is called a Security Association (SA). SAs are one-way (simplex). For example, when two peers, CB1 and CB2, are communicating through a Connector tunnel, CB1 has two Security Associations. One SA is used for processing out-bound packets, and the other SA is used for processing inbound packets.
SAs expire after a specified length of time, which is called the lifetime. The two peers use the Internet Key Exchange (IKE) protocol (part of the IPSec protocol suite) to negotiate new cryptographic keys and establish new SAs. The purpose of the limited lifetime is to prevent attackers from cracking a key.
Also, Citrix SD-WAN WANOP instances on the Citrix Cloud Connector tunnel end-points provide WAN optimization over the tunnel.
Prerequisites to configure Citrix Cloud Connector tunnel
Before setting up a Citrix Cloud Connector tunnel between AWS Cloud and a Citrix SD-WAN WANOP appliance configured for one-arm mode in the data center, verify that the following tasks have been completed:
-
Make sure that the Citrix SD-WAN WANOP appliance in the datacenter is set up correctly. For more information on deploying a Citrix SD-WAN appliance in one-arm mode that uses WCCP/Virtual Inline protocol, see Sites with One WAN Router.
-
Install, configure, and launch a Citrix virtual appliance (VPX instance) on AWS cloud. For more information, see Installing NetScaler VPX on AWS.
-
Install, configure, and launch an instance of Citrix SD-WAN WANOP virtual appliance (VPX) on AWS cloud. For more information, see Installing SD-WAN VPX S AMI on Amazon AWS.
-
On AWS, bind the Citrix SD-WAN WANOP VPX instance on AWS to a load balancing virtual server in the Citrix VPX instance on AWS. This binding is required for sending traffic through the Citrix SD-WAN WANOP VPX instances, to achieve WAN optimization over the Citrix Cloud Connector tunnel.
To create a load balancing virtual server by using the command line interface:
At the command prompt, type:
-
enable ns mode l2
-
add lb vserver <cbvpxonaws_vs_name> ANY * * -l2Conn ON -m MAC</span>
To add the Citrix SD-WAN WANOP VPX instance on AWS as a service and bind it to the load balancing virtual server by using the command line interface:
At the command prompt, type:
-
add service < cbvpxonaws_service_name> <cbvpxonaws_IP> ANY * -cltTimeout 14400 -svrTimeout 14400</span>
-
bind lb vserver <cbvpxonaws_vs_name> <cbvpxonaws_service_name></span>