High availability across AWS availability zones

You can configure two Citrix ADC VPX instances on two different subnets or two different AWS availability zones, as a high availability active-passive pair in Independent Network Configuration (INC) mode. If for any reason, the primary node is unable to accept connections, the secondary node takes over.

For more information about high availability, see High availability. For more information about INC, see Configuring high availability nodes in different subnets.

Points to note

• Read the following documents before you start your deployment:
  • AWS terminology
  • Prerequisites
  • Limitations and usage guidelines
• The VPX high availability pair can either reside in the same availability zone in a different subnet or in two different AWS availability zones.
• Citrix recommends that you use different subnets for management (NSIP), client traffic (VIP), and back-end server (SNIP).
• High availability must be set in Independent Network Configuration (INC) mode for a failover to work.
• The two instances also should have port 3003 open for UDP traffic as that is used for heartbeats.
• The management subnets of both the nodes should also have access to internet or to AWS API server through internal NAT so that the rest APIs are functional.
• IAM role should have E2 permission for the public IP or elastic IP (EIP) migration.

How high availability across AWS availability zones works

Upon failover, the EIP of the VIP of the primary instance migrates to the secondary, which takes over as the new primary. In the failover process, AWS API

1. Checks the virtual servers that have IPSets attached to them.
2. Finds the IP address that has an associated public IP, from the two IP addresses the virtual server is listening on. One that is directly attached to the virtual server, and one that is attached through the IP set.
3. Reassociates the public IP (EIP) to the private IP belonging to the new primary VIP.

Note:

To protect your network from attacks such as denial-of-service (DoS), when using an EIP, you can create security groups in AWS to restrict the IP access. For high availability, you can switch from EIP to a private IP movement solution as per your deployments.

How to deploy a VPX high availability pair across different AWS zones

The following is the summary of steps for deploying a VPX pair on two different subnets or two different AWS availability zones.

1. Create an Amazon virtual private cloud.
2. Deploy two VPX instances in two different availability zones or in the same zone but in different subnets.
3. Configure high availability
   1. Set up high availability in INC mode in both the instances.
   2. Add IP set in both the instances.
   3. Bind IP set in both the instances to the VIP.
   4. Add a virtual server in the primary instance.

For steps 1 and 2, use the AWS console. For steps 3, use the Citrix ADC VPX GUI or the CLI.

Step 1. Create an Amazon virtual private cloud (VPC).

Step 2. Deploy two VPX instance in two different availability zones or in the same zone but in different subnets. Attach an EIP to the VIP of the primary VPX.

For more information about how to create a VPC and deploy a VPX instance on AWS, see Deploy a Citrix ADC VPX standalone instance on AWS and Scenario: standalone instance.

Step 3. Configure high availability. You can use the Citrix ADC VPX CLI or the GUI to set up high availability.

Configure high availability by using the CLI

1. Set up high availability in INC mode in both the instances.

   On the primary node:

   add ha node 1 <sec_ip> -inc ENABLED

   On the secondary node:

   add ha node 1 <prim_ip> -inc ENABLED

   <sec_ip> refers to the private IP address of the management NIC of the secondary node

   <prim_ip> refers to the private IP address of the management NIC of the primary node

2. Add IP set in both the instances.

   Type the following command on both the instances.

  add ipset <ipsetname>

1. Bind IP set to the VIP set on both the instances.

   Type the following command on both the instances:

   add ns ip <secondary vip> <subnet> -type VIP

   bind ipset <ipsetname> <secondary VIP>

   Note:

   You can bind the IP set to the primary VIP or to the secondary VIP. However, if you bind the IP set to the primary VIP, use the secondary VIP to add to the virtual server, and conversely.

2. Add a virtual server on the primary instance.

   Type the following command:

   add <server_type> vserver <vserver_name> <protocol> <primary_vip> <port> -ipset <ipset_name>

Configure high availability by using the GUI

1. Set up high availability in INC mode on both the instances

2. Log on to the primary node with user name nsroot and instance ID as password.

3. From the GUI, go to Configuration > System > High Availability. Click Add.

4. At the Remote Node IP address field, add the private IP address of the management NIC of the secondary node.

5. Select Turn on NIC (Independent Network Configuration) mode on self node.

6. Under Remote System Login Credential, add the user name and password for the secondary node and click Create.

7. Repeat the steps in the secondary node.

8. Add IP set and bind IP set to the VIP set on both the instances.

9. From the GUI, navigate to System > Network > IPs > Add.

10. Add the required values for IP Address, Netmask, IP Type (virtual IP) and click Create.

11. Navigate to System > Network > IP Sets > Add. Add an IP set name and click Insert.

12. From the IPV4s page, select the virtual IP and click Insert. Click Create to create the IP set.

13. Add a virtual server in the primary instance

    From the GUI, go to Configuration > Traffic Management > Virtual Servers > Add.

    

Scenario

In this scenario, a single VPC is created. In that VPC, two VPX instances are created in two availability zones. Each instane has three subnets - one for management, one for client, and one for back-end server. An EIP is attached to the VIP of the primary node.

Diagram: This diagram illustrates the Citrix ADC VPX high availability setup in INC mode, on AWS

For this scenario, use CLI to configure high availability.

1. Set up high availability in INC mode on both the instances.

   Type the following commands on the primary and the secondary nodes.

   On primary:

   add ha node 1 192.168.6.82 -inc enabled

   Here, 192.168.6.82 refers to the private IP address of the management NIC of the secondary node.

   On secondary:

   add ha node 1 192.168.1.108 -inc enabled

   Here, 192.168.1.108 refers to the private IP address of the management NIC of the primary node.

2. Add an IP set and bind the IP set to the VIP on both the instances

   On primary:

   add ipset ipset123

   add ns ip 192.168.7.68 255.255.255.0 -type VIP

   bindipset ipset123 192.168.7.68

   On secondary:

   add ipset ipset123

   add ns ip 192.168.7.68 255.255.255.0 -type VIP

   bind ipset ipset123 192.168.7.68

3. Add a virtual server on the primary instance.

   Type the following command:

   add lbvserver vserver1 http 192.168.2.129 80 -ipset ipset123

4. Save the configuration.

   

5. After a forced failover, the secondary becomes the new primary.