Provisioning NetScaler VPX instances on Google Cloud

Applications or services hosted on Google Cloud require secure traffic management and efficient optimization of network resources along with cloud benefits. NetScaler VPX instances provisioned on Google Cloud provide secure traffic management, optimized resource consumption, and reduced web application ownership costs.

NetScaler Console allows you to automate the deployment, setup, and management of the NetScaler VPX instances on Google Cloud. Provisioning NetScaler VPX instances using NetScaler Console combines the elasticity and flexibility of cloud with the control features of NetScaler.

NetScaler Console Deployment Architecture

The following image provides an overview of how NetScaler Console connects with Google Cloud to provision NetScaler VPX instances in Google Cloud.

You require three Virtual Private Cloud (VPC) networks to provision and manage the NetScaler VPX instance in Google Cloud. A VPC network contains a subnet and firewall. The firewall has rules that govern the incoming and outgoing traffic to a subnet.

The agent helps you to provision and manage the NetScaler VPX instance.

Prerequisites

This section describes the prerequisites that you must complete in Google Cloud and NetScaler Console before you provision NetScaler VPX instances.

This document assumes you possess a Google Cloud account. For more information on how to create an account, see Google Cloud Documentation.

Set up Google Cloud components

Before you provision NetScaler VPX instances in NetScaler Console, do the following tasks in Google Cloud:

1. Enable APIs
2. Create a Service Account
3. Create a VPC network
4. Create a firewall
5. Subscribe to the NetScaler VPX license in Google Cloud

Enable APIs

NetScaler Console requires programmatic access to deploy and provision the required resources in Google Cloud. So, enable the following APIs on your Google Cloud project:

• Compute Engine API

• Cloud DNS API

For more information about how to enable APIs in Google Cloud, see Enabling APIs.

Create a Service Account

The NetScaler Console uses a Service Account to access your Google Cloud resources. Do the following to create a service account:

1. Log in to your Google Cloud account.

2. Go to IAM & Admin > Service Accounts.

3. Click +CREATE SERVICE ACCOUNT.

   Create two service accounts, one service account is used for NetScaler Console. And, another is used for NetScaler instances. Do the following steps to create a service account.

   1. Specify the name, ID, and description and click Create.

   2. Assign the following predefined roles:

      • IAM roles required for NetScaler Console

         roles/iam.serviceAccountUser
         roles/compute.instanceAdmin.v1
         roles/compute.networkAdmin
         roles/dns.admin
         <!--NeedCopy-->
        

      • IAM roles required for the NetScaler instances that are created by NetScaler Console:

         roles/compute.instanceAdmin.v1
         roles/compute.networkAdmin
         <!--NeedCopy-->
        

      These roles allow your service account to access Google Cloud resources.

   3. Click Done.

Create a VPC network

Create three subnets in your VPC network - one each for the management, client, and server connections. Select the custom option to create a subnet. Specify an address range for each of the subnets. Specify the region in which you want the subnet to reside.

• Management: A subnet in your management VPC Network dedicated for management. NetScaler has to contact Google Cloud services and requires internet access.

• Client: A subnet in your client VPC network dedicated for the client side. Typically, NetScaler receives client traffic for the application via a public subnet from the internet.

• Server: A subnet where the application servers are provisioned. All your application servers are present in this subnet and receives application traffic from the NetScaler through this subnet. For more information on how to create a subnet in Google Cloud, see VPC network overview.

Create a firewall

The firewall has rules that control the inbound and outbound traffic in the NetScaler VPX instance. You can add as many rules as you want. To Autoscale NetScaler instances, you must create three firewalls:

• Management: A firewall is dedicated for the management of NetScaler VPX. NetScaler has to contact Google Cloud services and requires internet access. Inbound rules are allowed on the following TCP and UDP ports.

  • TCP: 80, 22, 443, 3008–3011, 4001, 27000, 7279
  • UDP: 67, 123, 161, 500, 3003, 4500, 7000

  Note

  Ensure that the firewall allows the agent to be able to access the VPX.

• Client: A firewall is dedicated for client-side communication of NetScaler VPX instances. Typically, inbound rules are allowed on the TCP ports 80, 22, and 443.

• Server: A firewall is dedicated for server-side communication of NetScaler VPX. For more information on how to create a firewall in Google Cloud, see VPC firewall rules overview.

Subscribe to the NetScaler VPX license in Google Cloud

1. Log on to your Google Cloud portal.

2. In Marketplace, search NetScaler and select the required product version.

3. Select one of the following license types:

   • Customer Licensed
   • Enterprise
   • Platinum

   Note

   If you select the Customer Licensed option, the Autoscale group checks out the licenses from the NetScaler Console while provisioning NetScaler instances.

Set up NetScaler Console components

Before provisioning NetScaler VPX instances in NetScaler Console, do the following tasks in NetScaler Console:

1. Create a site.

2. Provision NetScaler agent on Google Cloud.

3. Attach the site to a NetScaler agent.

Create a site

Create a site in NetScaler Console and add the VNet details associated with your Google Cloud.

1. In NetScaler Console, navigate to Infrastructure > Sites.

2. Click Add.

3. In the Select Cloud pane,

   1. Select Data Center as a Site type.

   2. Choose Google Cloud from the Type list.

   3. Check the Fetch regions from the Google Cloud check box.

      This option helps you to retrieve the existing regions information from your Google Cloud account.

   4. Click Next.

4. In the Choose Region pane,

   1. In Cloud Access Profile, select the profile created for your Google Cloud account. If there are no profiles, create a profile.

   2. To create a cloud access profile, click Add.

   3. In Name, specify a name to identify your Google Cloud account in NetScaler Console.

   4. In Key of the Service Account, specify the Service Account JSON created in Google Cloud.

      

   5. Click Create.

      For more information, see Create a Service Account.

   6. In Regions, select the region that contains the VPC network containing NetScaler VPX instances that you want to manage.

   7. Specify a Site Name.

   8. Click Finish.

Provision NetScaler agent on Google Cloud

The agent works as an intermediary between the NetScaler Console and the discovered instances in the data center or on the cloud.

1. Navigate to Infrastructure > Instances > Agents.

2. Click Provision.

3. Select Google Cloud and click Next.

4. In the Provision Parameters tab, specify the following:

   • Name - specify the agent name.

   • Site - select the site you have created to provision an agent and NetScaler VPX instances.

   • Cloud Access Profile - select the cloud access profile from the list.

   • Zone - Select the zones in which you want to create the Autoscale groups. Depending on the cloud access profile that you have selected, the zones of that profile are populated.

   • Network- Select the VPC network where you want to create Autoscale groups.

   • Subnet - Select the management subnet to provision an agent.

   • Tags - Type the key-value pair for the Autoscale group tags. A tag consists of a case-sensitive key-value pair. These tags enable you to organize and identify the Autoscale groups easily. The tags are applied to both Google Cloud and NetScaler Console.

5. Click Finish.

Alternatively, you can install the agent from Google Cloud Marketplace. For more information, see Install a NetScaler agent on the Google Cloud.

Attach the site to a NetScaler agent

1. In NetScaler Console, navigate to Infrastructure > Instances > Agents.

2. Select the agent for which you want to attach a site.

3. Click Attach Site.

4. Select the site from the list that you want to attach.

5. Click Save.

Configuration tasks

To provision a standalone NetScaler VPX instance on Google Cloud, do the following steps:

1. In NetScaler Console, navigate to Infrastructure > Instances > NetScaler.

2. Click Provision.

3. Select Google Cloud and click Next. Specify the required parameters to provision an instance.

4. Specify the basic parameters, licenses, and provision parameters.

Configure basic parameters

1. In the Basic Parameters tab, specify the following:

   • Name - Specify the name of an NetScaler VPX instance.

   • Site - Select the site that you created earlier.

   • Agent - select the agent that is created to manage the NetScaler VPX instance.

   • Cloud Access Profile - Select the cloud access profile created during site creation.

   • NetScaler Profile - Select the profile to provide authentication.

     NetScaler Console uses the device profile when it requires to log on to the NetScaler VPX instance.

2. Click Next.

Configure licenses

Select one of the following modes to apply license to a NetScaler instance:

• Using NetScaler Console: The instance that you want to provision checks out the licenses from the NetScaler Console.

• Using Google Cloud: The Allocate from Cloud option uses the NetScaler product licenses available in the Google Cloud Marketplace. The instance that you want to provision uses the licenses from the marketplace.

  If you choose to use licenses from Google Cloud Marketplace, specify the product or license in the Provision Parameters tab.

For more information, see Licensing Requirements.

Use licenses from NetScaler Console

To use this option, ensure that you have subscribed to the NetScaler product with the Bring your own license software plan in Google Cloud. See, Subscribe to the NetScaler VPX license in Google Cloud.

1. In the License tab, select Allocate from NetScaler Console.

2. In License Type, select one of the following options from the list:

   • Bandwidth Licenses: You can select one of the following options from the Bandwidth License Types list:

     • Pooled Capacity: Specify the capacity to allocate to an instance.

       From the common pool, the NetScaler instance checks out one instance license and only as much bandwidth is specified.

     • VPX Licenses: When a NetScaler VPX instance is provisioned, the instance checks out the license from the NetScaler Console.

   • Virtual CPU Licenses: The provisioned NetScaler VPX instance checks out licenses depending on the number of CPUs running in the instance.

   Note

   When the provisioned instances are removed or destroyed, the applied licenses return to the NetScaler Console license pool. These licenses can be reused to provision new instances.

3. In License Edition, select the license edition. The NetScaler Console uses the specified edition to provision instances.

4. Click Next.

Configure provision parameters

1. In the Provision Parameters tab, specify the following:

   • NetScaler Service Account: Select the service account that you have created in Google Cloud. The NetScaler Console uses a Service Account to access your Google Cloud resources.

   • Product / License: Select the NetScaler product version that you want to provision. For more information, see Subscribe to the NetScaler VPX license in Google Cloud.

   • Machine types: Select the required machine type from the list.

     This list displays the supported machine types for the selected NetScaler image.

   • Image: Select the required NetScaler version image. Click Add New to add a NetScaler image.

   • Configuration Template – Select the configuration template that you want to use to deploy on the NetScaler instances.

   • IPs in Server Subnet per instance – Specify how many SNIP addresses each instance can have in the server subnet.

   

   In this tab, you can also specify and configure the required NICs. Each NIC contains a dedicated firewall and subnet.

   For more information, see Create a VPC network and Create a firewall.

   

2. Click Finish.

View the provisioned NetScaler VPX instances

To view in NetScaler Console:

1. In NetScaler Console, navigate to Infrastructure > Instances > NetScaler.

2. Select the NetScaler VPX tab.

   The NetScaler VPX instance provisioned in Google Cloud is listed here.

To view in Google Cloud:

1. Log on to your Google Cloud portal.

2. Navigate to the Resources tab that displays the provisioned NetScaler VPX instance.

Note

The name of the NetScaler VPX instance is the same that you provided while provisioning an instance in the NetScaler Console.