Reference: Citrix Product Load Balancing Configurations for Citrix ADC (NetScaler)

citrix adc netscaler vip meme

Introduction

This guide is intended to act as a centralized repository of Citrix server load balancing configurations for use on Citrix ADC (formerly NetScaler). Additionally, common authentication load balancing configurations such as LDAPS and RADIUS are covered. As with our centralized Citrix logs article, this article is intended to be a living document and will be updated as needed as recommendations change, products are introduced, or errors and omissions are identified.

This article is broken up into two sections; load balancing configurations, and custom monitor configurations.

Notes Sept 13 2020: Citrix Endpoint Management (XenMobile) and Content Collaboration (ShareFile) are pending addition to this article.

Load Balancing Configurations

Citrix Delivery Controllers and Cloud Connectors

The following table contains load balancing configuration for Citrix Delivery Controller (aka DDC or XDC) and Citrix Cloud Connectors (if being enumerated by customer-managed StoreFront servers) which provide XML broker services for Citrix resource enumeration:

Component Category Configuration Notes
Virtual Server Protocol SSL Required for load balancing Desktop Delivery Controllers. As per Citrix Leading practices, XML should be secured.
Port 443 Default port is recommended.
Persistence None Not required for XML.
Method Least Connection Default configuration.
Certificate Required Yes Required on “SSL” VIPs. A SAN certificate can be used on both XML Brokers and the load balancing VIP to ensure end-to-end encryption. Steps for securing XML on the Delivery Controllers’ Broker Service can be found here.
Service Group Protocol SSL Required to match virtual server protocol.
Monitor Custom Citrix XML Monitor Custom monitor to determine the availability of the XML brokers. Monitor details can be found here.
Service Group Member Port 443 Default configuration.

 

Citrix StoreFront

The following table contains load balancing configuration for Citrix StoreFront:

Component Category Configuration Notes
Virtual Server Protocol SSL As per Citrix Leading practices StoreFront services should be secured. Required for load balancing Citrix StoreFront Servers. HTTP is not recommended.
Port 443 Default port is recommended.
Persistence SOURCEIP or COOKIEINSERT Citrix guidance on this has varied over the years. Currently, official guidance is COOKIEINSERT. Early on in StoreFront’s life, COOKIEINSERT was the standard. Later in StoreFront 2.x, COOKIEINSERT broke sessions and SOURCEIP was the recommended method. Recently, this guidance reverted back. With that said, there have been issues reported with COOKIEINSERT and Android Citrix clients. Our guidance tends to favour SOURCEIP.
Timeout 20 Minutes* This should match the timeout of Receiver for Web pages in StoreFront.

*This is the default StoreFront value. If StoreFront is configured with any RfW pages as higher than 20, ensure the persistence timeout is greater or equal to whatever is set in StoreFront.

Method Least Connection Default configuration.
Certificate Required Yes Required on “SSL” VIPs. A SAN certificate can be used on both StoreFront servers and the load balancing VIP to ensure end-to-end encryption.
Service Group Protocol SSL Required to match virtual server protocol.
Monitor Citrix StoreFront Monitor Custom monitor to determine the availability of the StoreFront instances. More information on custom monitor setup for Citrix StoreFront can be found here.
Service Group Member Port 443 Default configuration.
Insert Client IP Header Yes Citrix leading practice. This feature allows the appliance to insert the client’s IP address while forwarding requests to the backend servers. The server inserts client IP in the header of the responses, thus the server is aware of the client, provided the application can make use of this header. StoreFront can.
Header X-Forwarded-For Allows for Client IP address to be included in the header of the server responses.

 

Citrix Workspace Environment Management (WEM)

The following table contains load balancing configuration for Citrix WEM Infrastructure Services. Note that Citrix quietly introduced a new port for WEM 1912 and up; 8288. If this port is not load balanced (either missed or not addressed when upgrading from a prior version of WEM to 1912 or newer), WEM servers may exhibit excessive CPU usage and unanticipated operation. WEM required several ports to be load balanced, so creating multiple VIPs (can use the same IP for each) or a single VIP with an “ANY” port configuration is workable. We generally prefer the former, as presented below:

Component Category Configuration Notes
Virtual Server (Create one for each port) Protocol TCP Required for load balancing Citrix WEM Infrastructure Service.
IP Address IP address of each of the WEM Infrastructure services VIP IP address assigned to each of the WEM Infrastructure services VIP
Port 8284-8288 WEM Infrastructure services utilize the following ports:

·       Administration Console Service -Port 8284

·       Agent Cache Synchronization Service – Port 8285 in WEM 1909 and earlier, Port 8288 in WEM 1912 and later

·       Agent Service – Port 8286

·       Monitor Service -Port 8287

Persistence None No persistence is needed for WEM infrastructure service load balancing as per CTX227144
Method Least Connection Default configuration.
Certificate Required No N\A
Service Group (Create one for each port) Protocol TCP Required to match virtual server protocol.
Monitor tcp-default Default tcp monitor will auto-probe on the port specified on the Service Group. Citrix ADC does not presently offer application-level (L7) monitors for WEM.
Service Group Member Port 8284-8288 Set the port for each respective Service Group.

 

Citrix Director

The following table contains load balancing configuration for Citrix Director (for on-prem aka non-Citrix Cloud deployments). It is assumed that Director is running on its own server(s) vs. being collocated with Citrix Delivery Controllers as per Citrix recommendations. This is both to reduce the attack surface and to reduce the load on the Delivery Controllers. Collocation is generally accepted if building a POC, or deploying a very small environment where financially, having separate servers is not feasible.

Component Category Configuration Notes
Virtual Server Protocol SSL Citrix recommendation. Although not required, strongly recommended.
Port 443 As per Citrix Leading practices, it is recommended to use port 443 for load balancing Citrix Director. This requires for SSL certificates to be installed on each of the Citrix Director instances.
Persistence SOURCEIP or COOKIEINSERT Citrix documentation favours COOKIEINSERT. However, if integrating Citrix Director with Citrix ADM for single-pane-of-glass view that includes HDX Insight, SOURCEIP is needed. Otherwise sporadically only one Director server will ever properly render the HDX Insight data on-screen within Director.
Timeout 245 or TBD Timeout set for Director; default value is 245 minutes.
Method Least Connection Traffic is sent to the least loaded server.
Certificate Required Yes Required on “SSL” VIPs. A SAN certificate can be used on both Director servers and the load balancing VIP to ensure end-to-end encryption.
Service Group Protocol SSL Required to match virtual server protocol.
Monitor Citrix Director Monitor Custom monitor is used to monitor for the availability of Citrix Director. More information on custom monitor setup for Citrix Director can be found here.
Service Group Member Port 443 Default configuration.

 

RADIUS

The following table contains load balancing configuration for RADIUS Servers. This is general guidance, and elements such as port configuration may vary between implementations. Note that in some environments, there may be a need to bind a NETPROFILE to the virtual server, one that specifies the SNIP that should be used to interface with the back-end RADIUS servers as documented here. Be sure the NSIPs as well as SNIP are added as RADIUS clients on the RADIUS server.

Component Category Configuration Notes
Virtual Server Protocol RADIUS Required for load balancing RADIUS Servers. Transmits over UDP.
Port 1812 RADIUS uses port 1812 by default, however, use of other ports is not uncommon.
Persistence Not required RADIUS does not require persistence. If required in a given implementation, mirror the “Method” configurations below.
Method TOKEN Selection of service is based on the token extracted from the client request. For subsequent requests with the same token, the virtual server chooses the same server that handled the initial request.
Expression CLIENT.UDP.RADIUS.USERNAME Expression used with TOKEN load balancing method for RADIUS. Directs all requests that match the expression to the service selected by the load balancing method.
Certificate Required No N\A
Service Group Protocol RADIUS Required for load balanced RADIUS instances.
Monitor UDP or RADIUS Monitor (Preferred) Custom monitor is used to monitor for the availability of RADIUS Servers. More information on monitor setup can be found here.
Service Group Member Port 1812 Port to match the VIP’s RADIUS port.

 

LDAPS

The following table contains load balancing configuration for LDAPS (from now-retired LDAPv2). These configurations would work just as well for LDAP over TLS (uses StartTLS, and part of LDAPv3) which uses TCP 389. In the table below, we are assuming the VIP will be used only by the Citrix ADC itself, thus using TCP is more practical, allowing the client (in this case ADC) to negotiate SSL with the back-end server. If the LDAPS VIP is intended to be used by other clients, SSL_TCP should be used (and will require a certificate on the virtual server) to terminate traffic at the ADC.

Component Category Configuration Justifications
Virtual Server Protocol TCP Suitable for use by Citrix Gateway or AAA vServer (which also allows the use of an APIPA VIP like 169.254.100.x to save firewall rules and IPs).
Port 636 LDAPS uses port 636.
Persistence None No persistence needs to be configured.
Method Least Connection Default configuration.
Certificate Required No N\A
Service Group Protocol TCP Required to match virtual server protocol.
Monitor LDAPS Monitor Custom monitor is used to monitor for the availability of LDAP Servers. More information on monitor setup can be found here.
Service Group Member Port 636 Port which LDAPS is generally listening on.

 

Monitors

The following table contains the configuration details of the monitors configured for the various load balancing virtual servers:

Component Category Configuration Notes
Citrix XML Monitor Type CITRIX-XD-DDC Type of monitor being used.
IP Source SNIP Monitor traffic sources from SNIP.
Destination IP Bound Service Default configuration.
Port N\A Not applicable.
Secure Yes It is assumed XML is secured.
Down Time 30 Seconds Default value.
Response Time Out 2 Seconds Default value.
Interval 5 second Default value.
Validate Credentials Optional Added monitoring capability to ensure Delivery controllers are online even if the standard monitor probe is successful. Service account credentials used should have access to the Delivery controllers.
Citrix StoreFront Monitor Type STOREFRONT Type of the Monitor being used.
IP Source SNIP and NSIP Monitor traffic sources from SNIP as well as NSIP depending on configuration. Assume both.
Destination IP Bound Service Default configuration.
Port N\A Not applicable.
Secure Yes It is assumed StoreFront servers are secured with certificates.
Down Time 30 Seconds Default value.
Response Time Out 2 Seconds Default value.
Interval 5 second Default value.
Store Name TBD Name assigned to a StoreFront Store. If the Store does not exist, the monitor will fail.
StoreFront Account Service Enabled Used to probe account service to determine the state of StoreFront store. May use TCP 8000 for monitoring.
Citrix Director Monitor Type HTTPS Type of monitor being used.
IP Source SNIP Monitor traffic sources from SNIP.
Destination IP Bound Service Default configuration.
Port N\A Not applicable.
Secure Yes SSL is being used.
Down Time 30 Seconds Default value.
Response Time Out 2 Seconds Default value.
Interval 5 second Default value.
HTTP Request GET /Director/LogOn.aspx?cc=true Custom HTTP request.
Response code 200

302

HTTP response codes to check for availability of backend Director servers. Response code 302 is used when Single Sign-On is enabled on Director.
RADIUS Monitor Type RADIUS Type of monitor being used.
IP Source SNIP Monitor traffic sources from SNIP.
Destination IP Bound Service Default configuration.
Port N\A Not applicable.
Secure N\A Not applicable.
Down Time 30 Seconds Down Time value set to default value.
Response Time Out 4 Seconds Increase default timeout to accommodate for RADIUS Response.
Interval 5 second Default Value.
Response Code 2

3

RADIUS response code 2 indicates success and 3 indicates failure. Either result means that the RADIUS server is functional.
RADIUS Key RADIUS key value RADIUS key configured on the RADIUS server with ADC as the RADIUS client.
RADIUS Credentials Username and Password Credentials to login against RADIUS servers. Ensure credentials do not expire or change. If using Microsoft NPS for radius use fake Ping User-Name.
LDAPS Monitor Type LDAP Type of monitor being used.
IP Source NSIP As the LDAPS monitor uses a Perl script, monitor traffic sources from NSIP.
Destination IP Bound Service Default configuration.
Port N\A Not applicable.
Secure Yes To be used when employing LDAPS.
Down Time 30 Seconds Down Time value set to default value.
Response Time Out 2 Seconds Default value.
Interval 5 second Default Value
Base DN dc=<value>, dc=<value> Domain name in LDAP format.
Bind DN <Service account UPN> UPN login of a service account in the domain that can browse all objects in that domain. Alternatively sAMAccountName can be used in format <DOMAIN>\<serviceacct>
Filter cn=builtin Ensures search results do not return the entire domain, which is unneeded for a monitor.
Password <Service account password> Service account password. Ensure no semicolon in the password as Perl will not be able to parse the parameter.

 

0 0 vote
Article Rating
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x