Deploy a NetScaler VPX instance on AWS
Note:
This tech preview feature is provided for evaluation purposes only and is not intended for production use.
Overview
NetScaler VPX 15.1 Tech Preview introduces the Linux-based NetScaler VPX platform on Amazon Web Services (AWS). The image is delivered as an Amazon Machine Image (AMI) and runs as an Amazon Elastic Compute Cloud (Amazon EC2) instance in an Amazon Virtual Private Cloud (VPC). Use this article to choose an evaluation topology, understand its principal design requirements, and then follow the linked deployment procedure.
Choose a deployment model
NetScaler VPX on AWS supports a standalone deployment and several high availability (HA) models. Select the model that matches the resilience and traffic-continuity requirements of your evaluation.
| Deployment model | Recommended use | Traffic continuity mechanism |
|---|---|---|
| Standalone | Functional evaluation, proofs of concept, and policy validation | A single NetScaler VPX instance processes management, client, and server traffic. |
| HA in the same availability zone | Node-level resilience within one availability zone | Secondary private IP addresses on the client and server NICs move to the new primary during failover. |
| HA across availability zones using Elastic IP | Public applications that require zone-level resilience | The Elastic IP address associated with the active VIP is reassociated with the new primary. |
| HA across availability zones using private IP | Private applications, Transit Gateway, and routed VPC designs | VPC route tables direct traffic to the client interface of the active node. |
Standalone deployment
A standalone deployment is the simplest way to evaluate NetScaler VPX on AWS. The NetScaler VPX instance runs inside a VPC and typically uses three subnets: a management subnet for the NSIP, a client-facing subnet for VIP traffic, and a server-facing subnet for SNIP traffic. Deploy through the AWS Management Console, a NetScaler CloudFormation template, or the AWS CLI. Prepare the VPC, subnets, security groups, route tables, network connectivity, and EC2 key pair before you launch the AMI.
For more information, see Deploy a standalone VPX instance on AWS.
HA in the same availability zone
Use this model to evaluate active-passive failover while keeping both nodes in the same availability zone. Both nodes must use the same number of NICs, the same NIC order, and matching subnet mappings. Configure secondary private IP addresses for the VIP and SNIP functions. During failover, these addresses and the associated Elastic IP addresses move to the new primary. AWS Identity and Access Management (IAM) permissions are required for the address movement.
For more information, see Deploy a VPX HA pair in the same AWS availability zone.
HA across availability zones using Elastic IP addresses
Use this model for internet-facing applications that require zone-level resilience. Deploy the two nodes in different subnets or availability zones, enable Independent Network Configuration (INC), configure an IP set, and associate an Elastic IP address with the active VIP. On failover, AWS reassociates that Elastic IP address with the private VIP on the new primary.
For more information, see Deploy cross-zone HA using Elastic IP addresses.
HA across availability zones using private IP addresses
Use this routed model for private application traffic or designs integrated with AWS Transit Gateway. Deploy equal-NIC nodes across availability zones, enable INC mode, use a VIP subnet that does not overlap the VPC, and add a VPC route that points the VIP subnet to the client elastic network interface (ENI) of the primary node. During failover, the route is updated to the new primary. The deployment procedure covers both non-shared and shared VPCs and their IAM requirements.
For more information, see Deploy cross-zone HA using private IP addresses.
Prepare the AWS environment
- Use separate subnets for management, client, and server traffic.
- Keep only the NSIP on the management ENI.
- Open the required ports in security groups, and associate every subnet with an appropriate route table.
- Use an Elastic IP address on the NSIP, or provide management internet access through a NAT device, for HA operations.
- For HA, attach IAM roles with the permissions required by the selected address-movement or route-update model.
- Allocate secondary private IP addresses in AWS before you configure them as NetScaler VPX VIPs or SNIPs.
For more information, see AWS prerequisites and IAM permissions.
Sizing
Size the EC2 instance for both the licensed throughput and workload characteristics such as packets per second and SSL transactions. NetScaler recommends the M6i instance family for lower bandwidth tiers and C5n for higher bandwidth tiers. The support matrix lists the complete instance-family envelope and region availability.
For more information, see AWS VPX support matrix.
Limitations and usage guidelines
- Clustering is not supported.
- Data and management traffic must use ENIs in different subnets, and only the NSIP must be present on the management ENI.
- Dynamic addition of ENIs is not supported. Stop the instance, attach the ENI, and then restart the instance.
- Because of AWS limitations, the AWS architecture does not support GARP, L2 mode, tagged VLAN, and virtual MAC.
- Disable the Source/Destination Check for Reverse Network Address Translation (RNAT).
- Hot plug is not supported with Elastic Network Adapter (ENA) interfaces. Hot removal is not supported with paravirtual (PV), SR-IOV, or ENA interfaces.
For more information, see AWS limitations and usage guidelines.