Deploy a high availability pair on AWS

You can configure two Citrix ADC VPX instances on AWS as a high availability (HA) active-passive pair. When you configure one instance as the primary node and the other as the secondary node, the primary node accepts connections and manages servers. The secondary node monitors the primary. If for any reason, the primary node is unable to accept connections, the secondary node takes over.

For more information on HA, see High availability.

Before you start your deployment, read the following topics:

• Prerequisites for the required IAM role privileges.
• Limitations and usage guidelines

The following figure shows an example of the HA deployment architecture for Citrix ADC VPX instances on AWS.

Figure 1. A Citrix ADC VPX HA Pair on AWS

You can deploy two VPX instances on AWS as an HA pair by using one of the following options:

• Create the instances with IAM Role manually by using the AWS Management Console and then configure HA on them.
• Or automate the high availability deployment by using the Citrix CloudFormation template.

The CloudFormation template significantly decreases the number of steps involved for creating an HA pair, and it automatically creates an IAM Role. This section shows how to deploy a Citrix ADC VPX HA (active-passive) pair by using the Citrix CloudFormation template.

Keep the following points in mind while deploying two Citrix ADC VPX instances as an HA pair.

Points to note

• HA on AWS requires the primary node to have at least two ENIs (one for management and the other for data traffic), and the secondary node to have one management ENI. However, for security purposes, create three ENIs on the primary node, because this setup allows you to segregate private and public network (recommended).
• The secondary node always has one ENI interface (for management) and the primary node can have up to four ENIs.
• The NSIP addresses for each VPX instance in a high availability pair must be configured on the default ENI of the instance.
• Because Amazon does not allow any broadcast/multicast packets in AWS, HA is implemented by migrating data-plane ENIs from the primary to the secondary (new primary) VPX instance when the primary VPX instance fails.
• Because the default (management) ENI cannot be moved to another VPX instance, do not use the default ENI for client and server traffic (data-plane traffic).
• The message AWSCONFIG IOCTL NSAPI_HOTPLUG_INTF success output 0 in the /var/log/ns.log indicates that the two data ENIs have successfully attached to the secondary instance (the new primary).
• Failover might take up to 20 seconds due to the AWS detach/attach ENI mechanism.
• Upon failover, the failed instance always restarts.
• The heartbeat packets are received only on the management interface.
• The configuration file of the primary and secondary VPX instances is synchronized, including the nsroot password. The nsroot password of the secondary node is set to that of the primary node after the HA configuration synchronization.
• To have access to the AWS API servers, either the VPX instance must have a public IP address assigned or routing must be set up correctly at VPC subnet level pointing to internet gateway of the VPC
• Nameservers/DNS servers are configured at VPC level using DHCP options.
• The Citrix CloudFormation template does not create an HA setup between different availability zones.
• The Citrix CloudFormation template does not create an INC mode.
• The AWS debug messages are available in the log file, /var/log/ns.log, on the VPX instance.

Deploy a high availability pair by using the Citrix CloudFormation template

Before start the CloudFormation template, ensure that you complete the following requirements:

• A VPC
• Three subnets within the VPC
• A security group with UDP 3003, TCP 3009–3010, HTTP, SSH ports open
• A key pair
• Create an internet gateway
• Edit route tables for client and management networks to point to the internet gateway

Note:

The Citrix CloudFormation template automatically creates an IAM Role. Existing IAM Roles do not appear in the template.

To launch the Citrix CloudFormation template:

1. Log on to the AWS marketplace by using your AWS credentials.
2. In the search field, type NetScaler ADC VPX to search for the Citrix ADC AMI, and click Go.
3. On the search result page, click the desired Citrix ADC VPX offering.
4. Click the Pricing tab, to go to Pricing Information.
5. Select the region and Fulfillment Option as Netscaler AWS-VPX Cluster.
6. Click Continue to Subscribe.
7. Check the details in the Subscribe page and click Continue to Subscribe.

8. Select Fulfillment Option as CloudFormation Template.

9. Select Software Version and click Continue to Launch.

10. Under Choose Action, select Launch CloudFormation, and click Launch.

11. The Select Template page appears.  Click Next.

12. The Specify Details appears. Enter the following details.

    1. Type a Stack name. The name must be within 25 characters.

    2. Under High Availability Configuration, select Yes from the menu for Create HA pair?.

    3. Under Virtual Private Network Configuration, select the VPC that you’ve already created for VPC ID.

       Type Remote SSH CIDR IP.

       Type Remote HTTP CIDR IP.

       Type Remote HTTPS CIDR IP.

    4. Select the key pair that you’ve already created from the drop-down menu for Key Pair.

    5. Under Network Interface Configuration

       Select Management Subnetwork, Client Subnetwork, and Server Subnetwork. Ensure that you select the correct subnetworks you created within the VPC that you selected under VPC ID in step c.

       Add Primary Management IP, Secondary Management IP, Client IP, and Server IP. The IP addresses must belong to the same subnets of the respective subnetworks.  Alternatively, you can let the template assign the IP addresses automatically.

    6. Under Other Parameters

       Select m4.large for Instant Type.

       Select default for Tenancy Type.

    7. Click Next.

13. The Options page appears. (This is an optional page.). Click Next.

14. The Review page appears. Take a moment to review the settings and make necessary changes if necessary.

15. Select the I acknowledge that AWS CloudFormation might create IAM resources. check box, and then click Create.

16. The CREATE-IN-PROGRESS status appears. Wait until the status is CREATE-COMPLETE. If the status does not change to “COMPLETE,” check the Events tab for the reason of failure and recreate the instance with proper configurations.

    

17. After an IAM resource is created, go to EC2 Management Console > Instances. You will find two VPX instances created with IAM role. The primary node is created with three private IP addresses and three network interfaces.

    

    The secondary node is created with one private IP address and one network interface.

    Note:

    The secondary node is created with one interface by default in AWS. During failover, the interface from the primary node gets attached to the secondary node (the new primary node) and gets detached from the original primary node (the new secondary node).

18. Log on to the primary node with user name nsroot and the instance ID as the password. From the GUI, go to System > High Availability. The Citrix ADC VPX HA pair appears.

Next, configure the HA pairing on both the instances. Configure the instance with three ENIs before configuring HA on the instance with one ENI). Use the add HA node command, from within the VPX CLI, or from the GUI.

add HA node <private IP of the first instance>

add HA node <private IP of the second instance>

After you run the “add HA node” commands, the two nodes form an HA pair, and configuration information is synchronized between the two VPX instances.

Configuring SR-IOV on a high availability setup

Support for SR-IOV interfaces in a high availability setup is available from Citrix ADC release 12.0 57.19 onwards. For more information about how to configure SR-IOV, see Configuring Citrix ADC VPX instances to Use SR-IOV Network Interface.

Related resources

High availability across AWS availability zones