Best Practices for Transitioning to IPv6

Register for this live webinar, featuring Forrester Research and hear expert advice on the benefits and best practices of migrating to iPv6.

In this webinar you will learn:

• The reasons and hurdles why enterprises haven't shifted over to IPv6 already
• Business and IT benefits of transitioning to IPv6
• How other companies have made the transition.
• Who should be the most concerned and put the transition on the fast track
• What actions can be taken to minimize the cost and disruption to your infrastructure.

Details:

Webinar: Best Practices for Transitioning to IPv6
When: Tuesday, June 7, 2011
Where: Register at https://www1.gotomeeting.com/register/283262625

The Citrix Community is powerful!

Using Wavemaker

I previously posted about the Citrix and Wavemaker partnership. The NetScaler Nitro APIs are available now in NetScaler v9.3. Cloud Providers are deploying NetScaler within their cloud offerings. Cloud Providers can now provide a web-based user interface to their Subscribers, allowing the Subscribers to manage and monitor their NetScaler instances. WaveMaker has built a web application to manage and monitor NetScaler instances when deployed within a cloud environment.

Each Cloud Provider can tailor the application to suit their particular operating requirements and to deliver Provider-specific benefits to their Subscribers. Therefore, we have provided the WaveMaker project (i.e. source code) as a download so you can customize the management application to deliver a customized solution to your Subscribers. The application is customizable using WaveMaker Studio, a visual environment for developing enterprise cloud applications. Wavemaker Studio uses the NetScaler Nitro APIs in the NetScaler Cloud Management Application to retrieve information from NetScaler instances and configure NetScaler instances.

The solution has the following components

• Citrix NetScalers running in the cloud
• Wavemaker Studio
  • MySQL
  • Tomcat or other Java Server
  • NetScaler Cloud Management Application project
    

Benefits

• An easy to use and deploy development/test environment
• Provides end-users a customizable configuration, management and monitoring UI
• View, Create and terminate virtual instances in the cloud
• Manage multiple Virtual NetScalers

How it works

1. Import the NetScaler Cloud Management Application project into Wavemaker Studio
2. The NetScaler Nitro API is used to retrieve monitoring information and send down configuration information
3. Use Wavemaker Studio to customize NetScaler Cloud Management Application
4. Use Wavemaker Studio to generate a WAR file
5. Use Wavemaker Studio to deploy to Tomcat server
   

Watch it in action

Download the latest release of Wavemaker Studio here

Download the Citrix Cloud Management Application for Wavemaker Studio here

Download the Citrix NetScaler Cloud Management Documentation here

Wavemaker is Citrix Ready Certified!

Citrix NetScaler

It's powerful!

Citrix and Sourcefire together

I previously posted about the Citrix and Sourcefire partnership. Sourcefire and Citrix have partnered together to provide a unique approach to securing and protecting this critical infrastructure. Through this collaboration, Sourcefire can enhance Citrix NetScaler security policies on the fly in near-realtime in response to network security events.

The Sourcefire Intrusion Prevention integration with Citrix NetScaler provides Intrusion Prevention and Detection capabilities for NetScaler where there may be compliance requirements for IDS/IPS. So far, we know that PCI, FISMA and SOX all require Intrusion Detection Systems.

The solution has the following components

• Citrix NetScaler front-ending web applications and web sites
• Sourcefire 3D Sensor
• Sourcefire Defense Center

Benefits

• Take immediate action to manage and minimize web application security risk with automated policy Changes
• Extend your investment in your current solution and enhance your network security with greater levels of protection
• Lower your TCO with flexible deployment options and the ability to tune protection to minimize damage and the time and effort required for response

How it works

1. Sourcefire 3D Sensor detects an attack
2. Sourcefire Defense Center creates a policy and sends it to Citrix NetScaler through the API
3. Citrix NetScaler applys the policy and blocks the attack

Watch it in action

Sourefire is Citrix Ready Certified!

Citrix NetScaler

It's powerful!

Simplifying complex certificate and key management

If you are at all concerned about data security, you are familiar with certificates. You know, those cryptographic puzzles you have to deal with to get HTTPS running on your web sites. The complexity of certificates might not change anytime soon, but the way to manage them has been simplified. This should be of concern now that websites are required to migrate from 1024-bit keys to 2048-bit keys. Citrix and Venafi have partnered to create a turnkey certificate and key management solution that eliminates enterprise risks associated with Key and Certificate management while also enhancing network and application performance. The result is improved security, compliance and operational efficiency.

Venafi works intricately with the SSL offloading, Citrix Access Gateway Enterprise Edition (SSL VPN) and Application Firewall features integrated in Citrix NetScaler. NetScaler has been tightly integrated with Venafi for automated key generation and certificate distribution.

Administrators can set up NetScaler hardware and virtual appliances to work closely with Venafi in the generation of keys, configuration of certificates, provisioning and installation of these on NetScaler. With Venafi and NetScaler, organizations can scale encryption deployments and management functionality across the enterprise. Venafi support and manages hundreds of thousands of keys and certificates at many of the world's most prestigious Global 2000 organizations while NetScaler powers over 10 gigabits of SSL traffic per appliance with 2048 bit keys.

The solution has the following components

• Citrix NetScaler front-ending web applications and web sites
• Venafi Director Certificate Manager
  
  

Benefits

• Enhanced security
• Reduced operational complexity
• Reduced regulatory and compliance risks
• Increased network and operational performance

How it works

1. Venafi discover's certificates in your network
2. Venafi validates inventory daily
3. Venafi monitors for & reports on inventory expirations, policy violations
4. Venafi acts as the intermediary to manage the enrollments, approvals and issuances of certificates
5. Venafi automatically issues, uploads and binds new certificates in the Citrix NetScaler
6. Venafi regularly rotates certificates, providing increased security agility

Watch it in action

Venafi is Citrix Ready Certified!

Citrix NetScaler

It's powerful!

Analyze Risk and Adapt

Citrix and RSA have partnered to integrate RSA's Adaptive Authentication methods with NetScaler's AAA and Access Gateway Enterprise Edition (SSLVPN) systems to protect portals, applications, and networks. This also works with Citrix applications and technologies like XenDesktop and XenApp providing secure, remote access to user enterprise applications.

Solution

A common deployment topology is shown with the NetScaler appliance in the DMZ providing access to the RSA Adaptive authentication service components in the trusted zone. Other deployment topologies are possible depending on whether the RSA Adaptive Authentication components are located on-premise or hosted.

The solution has the following components:

• Citrix NetScaler - Version 9.2 or later running on either MPX hardware appliances or VPX virtual appliances. This provides the primary authentication service against the Identity provider for the enterprise and integrates with RSA AA to provide the enhanced authentication services. NetScaler also load balances RSA AA components using RADIUS load balancing for the RADIUS adapter and HTTP load-balancing schemes for the Adaptive Authentication adapter and the Data Protection Server components.
• Identity Provider: Provides primary authentication services for the user. This is usually Active Directory or equivalent LDAP based system though NetScaler supports multiple Identity providers.
• RSA Adaptive Authentication Server (Hosted or On-Premise): Provides the secondary authentication of users based on behavioral and other inputs.

Benefits

Integrating the advanced Authentication features in RSA's Adaptive Authentication services with Citrix NetScaler substantially enhances the security of the enterprise and cloud applications delivered through the NetScaler while providing a seamless end-user experience.

How it works

1. User attemtpts to access a system protected by Adaptive Authentication
2. User's activity is analyzed by the RSA Risk Engine and is assigned a Risk Score
3. RSA Policy Manager determines Risk using Behavioral Analysis
4. User is directed to "Step-Up Authentication"
   

Watch it in action

RSA Adaptive Authentication is Citrix Ready Certified!

NetScaler Web Application Firewall

It's powerful!

Turn-key Web Application Security Solution

Anti-virus, network firewalls and malware protection alone do not protect web applications or websites from hackers. Whether it's politically motivated attacks from rogue states, or financially motivated attacks, there is a continuous stream of new security threats. With approximately 75% of all Internet attacks targeting web applications, it's critical for companies to be prepared to defend their information assets diligently. This is becoming even more important, and more challenging, as these applications are developed and deployed within cloud environments.

Solution

I have been waiting for this type of solution for a long time. I always thought the best solution would be able to discover the weaknesses of a web application by scanning, and then use the results of that scan to block hackers from exploiting the vulnerabilities. It's finally here. The Cenzic / Citrix integration does just that by protecting websites against hacker attacks by detecting and then protecting them against a broad range of threats. Cenzic's web testing (vulnerability scanning) solutions combined with the Citrix's web application firewall is a powerful combination that prevents breaches and secures websites for both on-premise and cloud based application deployments. The integration provides a "1-2 punch" against website hackers, as Cenzic identifies the website weaknesses and Citrix blocks against them.

Benefits

• Turnkey Web Application Security Solution
  • Reduces risk by identifying and blocking vulnerabilities in websites and web applications that hackers exploit
  • Integrated solution allows faster set-up of NetScaler WAF and easier on-going web application security
  • Does not require deep security expertise
• Compliance
  • Citrix and Cenzic provide compliance testing and reports to meet GLBA, PCI, HIPAA, SOX & other regulations
• Solutions for companies that need to protect their data
  • On-premise or SaaS solutions from Cenzic and Citrix
  • Entry-level to enterprise—all industries
  • Protects customer information, meets government regulations and secures web commerce from hackers

How it works

1. Websites are tested for security flaws using Cenzic
2. Results are imported into the Citrix Web Application Firewall (WAF)
3. The Citrix WAF blocks attacks directed at those security flaws
4. Users routinely run website security tests to stay ahead of the hacker curve
   

Watch it in action

Cenzic is Citrix Ready Certified!

NetScaler Web Application Firewall

It's powerful!

Eliminates response time issues

The NetScaler provides the ability to ensure the response from an application in spite of server capacity or processing speed, called SureConnect. SureConnect eliminates the gap between the client expectations and their browsing experience and improves the real and perceived availability of a Web site.

You can use the SureConnect feature of the Citrix® NetScaler® appliance to service all incoming connections with either the requested content or a custom Web page that displays information about a delay in the request being serviced.

When servers are overloaded with the requests, the servers might either respond slowly or not at all. The SureConnect feature enables the NetScaler appliance to detect and compensate such conditions by ensuring that every client request gets serviced in some way, such as either a custom Web page or actual content is sent to the client.

SureConnect is activated when the response time or maximum server connections to a client request exceeds a limit that you have set. The SureConnect browser window displays one of the following:

• A progress bar with the amount of time remaining until the requested content will be available.
• Alternate Web content of your choice (alternate page).
• Both a progress bar and alternate page.
• Complete custom content of your choice.

When the load balanced servers become responsive again, the original request for content is served.

SureConnect is advantageous in the following situations:

• Full server queue: The server can respond fast, but there are too many users. This results in the server's queue being full and unable to process additional client requests. In this situation, the SureConnect window is displayed, showing the time left until the content will be available. The alternate page is displayed under the progress bar, if an alternate page has been configured.
• Large response delay: The server response is slow. If a Web server does not respond to a client request quickly, the user will leave the site. When the predicted delay reaches a configured time threshold, the SureConnect window displays the progress bar and the optional alternate page in the client browser.
• Client time-out: When the client requests content from a very slow Web site, a time-out message displays in the client browser, and the content is not delivered. The user may leave the site. The appliance stores the request until the server is no longer busy and delivers the requested content to the client.
• Server experiencing a traffic surge: The server typically responds quickly, but the current load of open connections is greater than the server capacity to serve them. Therefore, the server response is delayed. A SureConnect window is displayed in the client browser, showing the time left. The alternate page from the server is also displayed if it has been configured.

To set SureConnect on a virtual server by using the NetScaler command line

set lb vserver <vServerName> -sc <Value>
Example

set lb vserver Vserver-LB-1 -sc yes

To set SureConnect on a virtual server by using the configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane appears, select the virtual server for which you want to configure SureConnect (for example, Vserver-LB-1), and then click Open.
3. In the Configure Virtual Server (Load Balancing) dialog box, click the Advanced tab.
4. Select the SC check box, and then click OK.

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download the Citrix Load Balancer

It's powerful!

Directing Requests Based on Priority

The NetScaler provides the priority queuing option for prioritizing client requests to serve important requests first. The NetScaler places the requests in a queue based on the configured priority, thereby providing an uninterrupted flow of transactions through dynamic traffic flows.

The priority queuing feature also lets you filter incoming HTTP traffic on the basis of categories that you create and define, and prioritize those HTTP requests accordingly. Priority queuing directs high-priority requests to the server ahead of low-priority requests, so that users who need resources for important business uses receive expedited access to your protected Web servers.

To set priority queueing on a virtual server using the NetScaler Load Balancer command line

set lb vserver <vServerName> -pq <Value>
Example

set lb vserver Vserver-LB-1 -pq yes

To set priority queueing on a virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure priority queuing (for example, Vserver-LB-1), and then click Open.
3. In the Configure Virtual Server (Load Balancing) dialog box, click the Advanced tab.
4. Select the PQ check box, and then click OK.

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download the Citrix Load Balancer

The Citrix Community is powerful!

Redefining traditional Application Delivery Controllers (ADCs)

Citrix Systems today announced NetScaler® SDX, a groundbreaking new virtualized networking platform designed from the ground up to serve as the "front door" for virtual datacenters and clouds. With the new NetScaler SDX platform, customers can now run numerous virtualized NetScaler instances on a single purpose-built physical appliance with full multi-service, multi-tenant support. This innovative new architecture helps customers move from traditional application delivery to far richer "service delivery" required by the adoption of cloud computing, and growing user demand for new services delivered to a wide range of consumer devices.

Creating a service delivery fabric requires understanding and redefining traditional application delivery controllers (ADCs), such as Citrix® NetScaler®, in a services context. For example, application availability becomes service availability, while application optimization becomes service optimization.

More than just a name change, the transition to a service delivery fabric needs infrastructure and user-centric delivery capabilities that enable the delivery of services as well as applications. Since this fabric will become the foundation of enterprise IT and an essential element of an organization's competitive differentiation, it needs enterprise-class power, flexibility and manageability too.

In some instances developers will be able to meet the new requirements by transforming an existing capability, typically by extending its scope of coverage. In other cases, though—such as with the need for broader and deeper visibility—developers are likely to have to create entirely new capabilities.

Highlights

• NetScaler SDX is a groundbreaking new platform that uses advanced hardware and software virtualization to run multiple "virtual NetScaler instances" on a single hardware appliance - each optimized for different apps, services, sites and customers.
• Each virtual instance is a complete NetScaler environment, incorporating all the functions needed to deliver apps and services with the best performance, security and reliability, including load balancing, caching, compression, SSL VPN, SSL offload, federated identity and app firewall.
• NetScaler SDX provides full network, CPU, memory and SSL acceleration isolation for each virtual NetScaler instance, as well as per-instance (rather than per-appliance) high availability, version control and lifecycle management.
• NetScaler SDX incorporates SR-IOV (single root I/O virtualization) capabilities from Intel to provide fast, multi-tenant, multi-service appliance capable of running at native wire speeds.
• The next-generation NetScaler SDX architecture provides the foundation for further consolidation of adjacent service delivery capabilities such as WAN optimization, network security and virtual desktop delivery.
• A single control plane within the NetScaler SDX platform provides unified provisioning, monitoring and management of all virtual NetScaler instances, while also enabling administrative privileges to be delegated per instance.
• The NetScaler SDX 17500, 19500 and 21500 models share a common hardware platform with the existing NetScaler MPX 17500, 19500 and 21500 models, enabling MPX appliances to be easily upgraded in the field to all the new NetScaler SDX functionality.

Availability

NetScaler SDX platforms include the SDX-17500, SDX-19500 and SDX-21500, offering performance up to 50Gbps, and will be available in April 2011.

Overview

Architecture

Read the NetScaler for Multi-Tenancy whitepaper here

Read the NetScaler Service Delivery Whitepaper here

The Citrix Community is powerful!

With Unlimited ICA Connections

I previously posted how to get 1-Year Licenses for NetScaler and followed up with a post on how to get Licenses for other Citrix Products through the Citrix Ready program. Starting with NetScaler release 9.2, all MPX's and VPX's include a platform license for unlimited AGEE access to XenApp and XenDesktop. However, some customers have trouble finding the unlimited access license for the ICA Proxy in their MPX or VPX. Even the SE-issued license doesn't show the unlimited access for ICA.

Background

The reason this license exists is because the AGEE functionality counts ICA proxy only connections against the CCUs. The traditional Secure-Gateway (on IIS Server) never had a concept of CCUs to count against and the legacy Net6 - Access-Gateway Standard and Advanced also did not count the ICA proxy only connections against any CCU count. The resolution for the NetScaler version of Access-Gateway (AGEE) was to create this license to make the ICA proxy only connection's "free" in the sense that you do not have to pay for the CCUs with any kind of access license (it's a compatibility thing to match the other products). This is why the license is separate from the platform license and the feature license. For the record, the NetScaler still does count these connections, the limit is just set to 10,000, assuming I guess that an individual NetScaler will not exceed that count (nor be needed), although I suspect it might be possible on larger platforms to better than 10,000 in which case the NS will throttle connections until it falls below 10,000.

There are four licenses that the customer may have

1. NetScaler Platform: Proper retail NetScaler (physical box) license (which is responsible for enabling all necessary features + 5 SSL VPN connections) is allocated by default to Hostname "ANY" in MyCitrix website and you cannot change this allocation. This is different from internal licenses (see 2).
2. NetScaler Features: The remainder of NetScaler licenses (Internal/Partner USE/DEMO/EVALUATION or VPX) need to be allocated to Host ID (MAC) of the appliance (articles CTX121062 page 11 and 16 and article CTX122426 page 9 and 22). The function (AGEE) is licensed/enabled by the MAC or HostID of the NetScaler. Two licenses are required for HA.
3. Access Gateway CCU license: To increase SSL VPN concurrent usage, CCUs, you must upload an AG Universal License. This license floats across HA pairs. This license needs to be allocated to the NetScaler Licensing Hostname, which is configured in /nsconfig/rc.conf file. This is NOT necessarily the same hostname as the created by 'set ns hostname' unless specifically made so by the customer. By default the hostname in /nsconfig/rc.conf is "ns".
4. Access Gateway ICA license: To increase connections for ICA Connections you must upload an AG Platform License (to increase ICA connections up to 10000). This license floats across HA. This license needs to be allocated to the NetScaler Licensing Hostname, which is configured in /nsconfig/rc.conf file. This is NOT necessarily the same hostname as the created by 'set ns hostname' unless specifically made so by the customer. By default the hostname in /nsconfig/rc.conf is "ns". Please reference article http://support.citrix.com/article/CTX125567.

   If you have an issue with hostname allocated for AG Platform License, you will see something like 34 (CITRIX) Wrong hostid on SERVER line for license file: In /var/log/license.log.

Frequently asked questions

Q: Is it possible to know whether the unlimited access has already been included in the NETSCALER Platform license (like license of VPX-3000, MPX-7500, etc...)? Or, we (or our partners/customers) need to do

anything to retrieve that license?"
A: Unlimited remote ICA access is an entitlement of all Access Gateway or NetScaler appliance purchases (MPX or VPX). It is not included in the NetScaler Platform license. You need to retrieve the Access Gateway Platform license separately which enables the entitlement. This is in addition to the NetScaler Platform license. Both need to be present on the appliance.

Q: Do I need to install the AGEE platform license into a NetScaler?
A: Yes, you need to install the Access Gateway Platform license on NetScaler .

Q: If I set up the AGEE Vserver in BASIC MODE, there is no need for any AGEE license (platform or CCU) installed in that NetScaler?
A: If you create an AGEE vServer in Basic Mode without the Access Gateway Platform license, it will consume Access Gateway Universal Licenses. (Note: NS Standard and Enterprise come with 5 AGEE Universal CCUs per appliance and NS Platinum comes with 100 AGEE Universal CCUs per appliance.)

Q: Can I ignore the "show license" information, stating that "Maximum ICA User=0"?
A: You cannot ignore the 'Show License' information if it shows 'Maximum ICA User=0'. If that is the case you have not applied an Access Gateway Platform license or the Access Gateway Platform license was not recognized by the system and any Access Gateway vServers will use AG Universal CCUs.

Q: If AGEE platform license is needed specifically in the NetScaler, is it the "CNS_AGEE_Server_Retail.lic"?
A: The confusion here may be because prior to AGEE / NS 8.1, there was an Access Gateway Platform license that enabled the base Access Gateway functionality on NetScaler. However, this older 'Platform' license is no longer required because all editions of NetScaler now ship with the base AG functionality already enabled. However, you need to apply the new Access Gateway Platform license if you plan to use 'Basic' (ICA Proxy / SG Mode-only) vServers. If you plan to use 'SmartAccess' (SSL VPN, SmartAccess, Clientless VPN, etc) vServers you need to apply an Access Gateway Universal CCU license.

Read more in this article, CTX129117

It's powerful!

Citrix NetScaler for Lync Server 2010

Microsoft® Lync™ ushers in a new connected user experience transforming every communication into an interaction that is more collaborative, engaging, and accessible from anywhere. Citrix® NetScaler® improves the Lync server performance and end user experience through its advanced Application Delivery Controller techniques such as Load Balancing, SSL Bridging & Offload, Advanced Health Monitoring, TCP & SSL Multiplexing, GSLB and High Availability. Deployed in front of the Lync Edge Servers in the DMZ and between the Lync Edge and Front End servers on the internal network, Citrix NetScaler enables a new level of scalability, performance, security, availability and ease of use for Microsoft Lync. At the same time, NetScaler reduces time to deployment, simplifies management and reduces the cost of operations.

Load Balancing

Citrix NetScaler's advanced Multiplexing software distributes traffic across multiple Lync servers to improve performance and ensure availability. When a Lync server goes down, Citrix NetScaler routes traffic around it to other servers that are up and running. Citrix NetScaler Load Balancing defaults to the Least Connections algorithm, but can also be setup to use Round Robin, Least Response Time, Hash Method, Least Bandwidth, Custom Load and Token based algorithms among others.

SSL Bridging & SSL Offloading

SSL bridging enables the NetScaler to bridge all secure traffic directly to the Lync server, without having to import Certificates. When using SSL Briding, NetScaler does not offload the Certificate processing from the Lync servers, enabling a new level of ease-of-deployment and ease-of-use.

A Citrix® NetScaler® appliance configured for SSL Offloacing accelerates SSL transactions by offloading SSL processing from the Lync servers. Configuring SSL offloading requires an SSL certificate and key pair. Other related SSL capabilities include managing certificates, CRLs, client authentication and SSL Policies.

Advanced Health Monitoring

The Citrix NetScaler tracks the state of each Load Balanced Lync server in real-time, so that it can divert traffic from an unresponsive Lync server to a server that is responding. Lync servers are removed from the list of available servers, until they become responsive again. Citrix NetScaler allows for the creation of custom monitors specific tor Lync servers.

GSLB

The Citrix NetScaler provides Global Server Load Balancing for disaster recovery and ensures continuous availability of applications by protecting against points of failure in a Wide Area Network (WAN). GSLB performs Load Balancing across geographically disparate data centers, by directing traffic to the closest or best performing data center.

High Availability

Citrix NetScaler High Availability (HA) provides uninterrupted operation for Lync server traffic, by designating a Primary NetScaler and a Secondary NetScaler. The Secondary NetScaler monitors the Primary, and if the Primary goes down, the Secondary takes over.

Microsoft Lync 2010 Details

To see the ports and protocols used in a Microsoft Lync Server 2010 environment, go here. A poster of the Lync Server 2010 workloads, describing the relationships and traffic flow can be found here. To download and use the Lync Server 2010
Topology Builder tool, go here

NetScaler for Lync Server 2010 Deployment Guide

We recently spent some time in Redmond, WA with Microsoft's Lync 2010 team to certify the Citrix NetScaler for deployment with Lync 2010. The deployment guide walks the user through simple steps of configuring the Citrix NetScaler for Lync 2010. Additionally, the user can download the pre-built configuration for Lync Server 2010 used in the deployment guide and upload it to Citrix NetScaler to serve as an example.

Download the Citrix NetScaler for Lync Server 2010 here.

Download the Citrix NetScaler configuration here.

The Citrix Community is powerful!

Scaling the Data Tier with Citrix NetScaler DataStream Technology

Native support and intelligence of SQL transactions is the key to extending the scalability, availability, and security benefits that the ADC brings to the web tier to the data tier, as noted in Sunil Potti's blog. Similar to the benefits of HTTP load balancing, a data tier load balancer should provide these key benefits:

• A native SQL proxy like solution to perform SQL connection management and offload for database scale up scenarios to increase SQL connection limit.
• A TDS protocol and SQL transaction intelligent load balancer that can accurately monitor backend server status including slave replication backlog to optimally distribute load in database scale out setups.
• High Availability that can address both Master/Master and Master/Slave replication deployments to complete the database scaling solution. Both scaling approaches also need advanced, clustering-like automated IP failover for lower cost high availability with commodity hardware.
• Database security encompassing transaction activity logging tied to user logins for compliance purposes to be generated from a central location to simplify record management.

NetScaler DataStream Technology

Leveraging its expertise in web applications, NetScaler with DataStream technology is the first ADC that justifiably addresses data tier challenges. With DataStream technology, NetScaler introduces the industry's first "true" load balancer for data that offers native SQL protocol, data format and transaction support for scaling database infrastructures. Structured Query Language (SQL) which is the de-facto data format, TDS (Tabular Data Stream) and Oracle MySQL, protocols that are widely deployed, are natively parsed and interpreted in NetScaler's high speed processing engine, providing all of the advance policy framework available to act on data connections and transactions. Applying all of the same HTTP acceleration technologies to SQL, NetScaler is able to provide the same benefits to the data tier, such as SQL Connection Multiplexing, SQL Load Balancing, SQL Content Switching, SQL Health Monitoring, Automated Failover and Security.

Features

• SQL connection multiplexing: NetScaler's SQL transaction intelligence enables NetScaler to act as a SQL proxy and terminate SQL connections from both client and server. Client to server connection multiplexing ratios of 50:1 or more is achievable depending on the application, number of unique database user logins and character sets in use.
• SQL Load balancing: Armed with SQL transaction awareness, NetScaler can switch one client's many SQL transactions in a single TCP connection to several different servers. This delivers more optimal load balancing of SQL traffic since the load distribution is more granular when compared to a TCP load balancer.
• SQL Content switching (read/write split): NetScaler can interpret SQL transactions and decipher between "select", "drop", "insert", "update" and other SQL statements and perform a split between read and write transactions. Splitting the reads and writes simplifies application server deployments by offloading the decision making and policy enforcement to NetScaler.
• SQL Health monitoring: NetScaler intelligently load balances SQL requests, by selecting the database server that will return up-to-date data the fastest at the time of the request and sending the read request to only that server.
• Automated IP failover: NetScaler's Virtual IP address solution is based on automated IP failover implementation where the virtual IP is assigned to the master node is switched over to the secondary node upon detection of heartbeat/monitor failure.
• Security: NetScaler can apply granular user access policies to each database user. It also provides a consolidated log of all SQL transactions and user accesses for complete visibility, without taxing the database server. SQL protocol validation is also available with advanced Policy Infrastructure (PI) regular expressions.

As the industry's first SQL aware load balancing solution, NetScaler addresses the scaling and availability needs of the data tier, leveraging its HTTP ADC technology for the web tier. NetScaler's SQL connection multiplexing scales connection limits for database scale up, native SQL load balancing optimizes database scale-out, SQL transaction logs simplifies database security and replication aware monitors with Virtual IP based failover enables cost-effective high-availability.

For more details about the new NetScaler DataStream technology, see the latest blog posts by Sunil Potti and Roger Klorese.

The Citrix Community is powerful!

Including VPX's with Commvault

Operational spending on IT, primarily Data Protection, continues to be highly correlated around staff and infrastructure. Whether your data storage is local or in the cloud, driving down costs suggests that any approach must be highly automated and work toward containing those costs.

Data Growth remains an uphill battle as the amount of data is growing at rates far faster than the operational budget can support. That disparity means you are in a constant struggle to work smarter and more efficiently squeezing more utilization out of the resources you already own.

Cutting costs and managing growth are two leading drivers in the mass migration IT is undergoing in the move to virtualized infrastructures. This ongoing shift is now making your data dynamic by nature. Workloads, applications and data now float over servers and locations which pose problems for those older legacy backup tools which expected to find the same data in the same scripted location each night.

That problem is exacerbated by the viral nature of Virtual Machines which magically pop up on the network overnight without any advanced notice - we refer to this condition as dynamic sprawl. Combine this with the dynamic nature of Virtual Disks, shared or dedicated, and unquestionably any modernized data management system must have a way to overcome this sprawl by automatically discovering and adjusting to changes in the applications and systems. This ensures you are capturing and indexing everything you need, so you can immediately turn around and drive a successful recovery of that system, machine, application or a lost document.

Time is also critical and it is the one resource that is continuing to shrink - redcuing your backup window - and dictate how long you need to preserve those copies of data to meet compliance or governance requirements.

Shrinking backup windows, rentention, recovery, SLA's, cost management and data growth are colliding with the drive to virtualization. Traditional backup approaches are clearly not up to the challenge & a new way forward is needed.

This is where CommVault comes in to play. Simpana 9 software from CommVault delivers a centrally managed, scalable and automated data protection solution that Bridges data protection and data management capabilities for both physical and virtual server environments in a single console.

This unified solution for managing and protecting data is emerging as a key requirement in the drive to a modern data management solution. However, it is important for that data protection solution to be more than just a single pane of glass for management. This requirement implies that customers demand (and rightfully so) a solution that meets the same business and service level requirements for virtual server environments - like Citrix Xen - that they get today in their physical environment.

This is the value of the Simpana 9 Virtual Server Protection capabilities for CommVault. Not only does Simpana 9 deliver a singular management solution that bridges both physical and virtual environments. It delivers industry leading data protection and data management capabilities that meet the most demanding business and service level requirements.

We did a proof of concept in the Citrix Santa Clara lab, to show that CommVault easily backs up the Citrix Virtual environment - consisting of XenServer, XenApp, XenDesktop, NetScaler VPX, Branch Repeater VPX, and Access Gateway VPX.

Integrated protection for Citrix Xen Server environments

• Full VM-level backups:
• For all supported OSes including Windows vdisks, NetScaler VPX, Access Gateway VPX, Branch Repeater VPX, XenApp VM's, XenDesktop VM's
• VM or file-level recovery
• Autodiscovery of VMs:

How it works

• A VSA deployed on a proxy VM (guest) inside each physical Xen server
• Backup queisces VM, snaps VM and attached to the proxy VM.
• Proxy VM mounts the snapshot as a volume and transfers to backup media
  

The Citrix Community is powerful!

Citrix Tech Talk

In this TechTalk, you will learn about proven methods for delivering 100% availability to any XenApp or XenDesktop Infrastructure, while simultaneously providing the foundation for rapid growth. XenApp and XenDesktop are ground breaking technologies. They are even more amazing when front-ended by a NetScaler to provide Enterprise scalability and performance. If Virtual Desktops and Apps are on your roadmap, you need to tune in to this webinar.

Topics Include:

• How Citrix NetScaler brings unparalleled robustness for critical XenApp and XenDesktop components, including Web Interface, XML Broker, and Desktop Delivery Controller.
• Proven strategies for scaling XenApp & XenDesktop environments
• The benefits of global load balancing for disaster recovery, and how to leverage multiple XenApp & XenDesktop farms

Details:

TechTalk: Guarantee Availability for XenApp and XenDesktop Deployments
When: Wednesday, March 16th, 2011 2:00pm Eastern/11:00am Pacific
Where: Register at https://www1.gotomeeting.com/register/734221352
Speaker: Florin Lazurca, Architect

Get the Citrix Load Balancer here

The Citrix Community is powerful!

Visit Citrix at RSA Conference USA 2011

Cybercrime. Malware incidents. Data breaches. Compliance legislation. Today's changing security landscape means you can't leave anything to chance. You need a balanced perspective. You need to separate speculation from fact. One event brings all the security issues, answers and thought leaders together. RSA Conference 2011 will feature over 350 leading information security companies and Citrix will be there.

Booth 1843: Venafi and Citrix have partnered to create a turnkey certificate management solution. Venafi works intricately with the SSL offloading, Citrix Access Gateway Enterprise Edition (SSL VPN) and Application Firewall features integrated in Citrix NetScaler. NetScaler has been tightly woven with Venafi Director for automated key generation and distribution. Administrators can set up NetScaler hardware and virtual appliances to work closely with Venafi Director in the generation of keys, configuration of certificates, provisioning and installation of these on NetScaler. With Venafi and NetScaler, organizations can scale encryption deployments and management functionality across the enterprise. Venafi supports hundreds of thousands of keys and certificates worldwide while NetScaler powers over 10 gigabits of SSL traffic per appliance with 2048 bit keys.

Booth 332: Using Cenzic solutions with NetScaler deployments is a fully validated and straightforward process. Initially the Hailstorm or ClickToSecure solution performs an automatic security scan to identify any weaknesses within the tested web applications. The administrator then receives a detailed vulnerability report to initiate remedial action. The detected vulnerabilities are exported from the Cenzic product to the NetScaler Application Firewall module via an XML file. After receiving the rules, NetScaler automatically generates policy settings to protect the application and bind the Application Firewall profile within minutes. No additional configuration or learning is needed.

Booth 1725: RSA and Citrix have collaborated to integrate RSA's Adaptive Authentication with NetScaler AAA system for Citrix Access Gateway (SSL VPN) and web applications. The Adaptive Authentication Integration Adapter from RSA is a Java web application that gathers device forensics and fingerprint information from client browsers and forwards it to the Adaptive Authentication Web Server. The Adapter lets administrators incorporate additional invisible and visible authentication methods as a secondary authentication to complement the primary authentication of NetScaler against standard user identity systems such as Active Directory or LDAP. The Adapter collects data from users for situations in which additional authentication is required, further protecting portals, applications and networks behind a firewall. The Adapter has been fully tested and validated to work with NetScaler (version 9.2) on all editions including Citrix Access Gateway Enterprise Edition and NetScaler Application Firewall.

Booth 2552: The NetScaler web application firewall works on the application layer, seeking and blocking attacks against specific web-based applications. Sourcefire 3D® Sensors serve as a second line of defense, identifying threats and changes to protocols, operating systems, and database servers and passing critical information from the Sourcefire Defense Center® management console to Citrix NetScaler to reconfigure security policies for increased protection. For example, Defense Center can trigger a configuration change on the Citrix NetScaler appliance to block a machine or machines that Sourcefire identifies as malicious. On Sourece 3D systems, a Citrix NetScaler Remediation module would perform an ACL command based in the information provided by the Sourcefire 3D system. Remediations execute when the rules included in a compliance policy and associated with that remediation trigger, violating the compliance policy. When the compliance policy is violated, the Remediation subsystem launches an instance of the associated remediation.

See you there!

The Citrix Community is powerful!

for all Citrix Products

I previously showed how to get a 1-Year License for the Citrix NetScaler VPX Express. Our partners don't only use the NetScaler VPX, and may need 1-Year Licenses for other Citrix products as well. These can be obtained by joining the Citrix Ready program. To join Citrix Ready and obtain 1-Year Licenses for your Citrix products, follow the procedure below.

Citrix Ready Process

1. Sign up for a new Citrix user account http://mycitrix.com
2. Sign up for Citrix Ready at http://citrix.com/joincitrixready
3. Questions? Send email to citrixready@citrix.com
4. Wait for Citrix Ready approval (about 72 hours)
5. Receive approval email from Citrix Ready
6. Login to MyCitrix at http://mycitrix.com
7. Select Choose a Toolbox -> Partner Demo Licenses -> Get Software
8. Select Citrix Product to license -> Retrieve Serial Numbers
9. Select and copy Serial Number to clipboard
10. Select Choose a Toolbox -> Activate System/Manage Assets -> Activate/Allocate
11. Paste in Serial Number -> Continue
12. Allocate, Download and Install License
    
    

See how easy it is

Citrix Ready NFR License Matrix

The benefits of Citrix Ready can be found here. The following shows the Citrix Ready NFR License allocations.

The complete Citrix Ready process can be viewed here

Frequently Asked Questions can be answered here

The Citrix Community is powerful!

Citrix and Aptimize introduce NS-WAX

Aptimize is a Citrix Ready partner with software products that provide extra website acceleration on top of NetScaler. We have just completed benchmarking of NetScaler with Aptimize Website Accelerator for NetScaler (NS-WAX) and will link to the benchmark results soon. In the meantime, here is some background on NS-WAX and steps for getting started.

Background

NS-WAX is an on-server software product - installed on the web front end servers, and accelerates websites using content optimization (WCO), applying the following techniques dynamically in real-time:

• Reduces HTTP requests by merging JavaScript files and StyleSheets into fewer files, creating image sprites for HTML images, inlining CSS background images and removing duplicate resource files
• Reduces data traffic by shrinking (minifying) JavaScript and StyleSheets, resampling images, and removing redundant image metadata
• Speeds up repeat views by turning on far-future-expires headers on non-HTML resource files - causing the browser to cache the files long-term. NS-WAX uses auto-URL versioning to refresh the cached files if they change on the server
• Dynamic layout effects - techniques that display the page quicker, such as repositioning stylesheets to the top of the HTML, asynchronous JavaScript loading, and on-demand image loading - where only images within the browser's current viewport are loaded initially.

These optimizations are all done on-the-fly, without any changes to the website.

See how fast SharePoint is with NetScaler and NS-WAX

Integration with NetScaler

Aptimize has added features to integrate with NetScaler. Server health reporting means server health statistics are published to NetScaler and can be used for dynamic load balancing - based on the current load of the server. In addition, Aptimize has special pricing for co-deployment with NetScaler.

Initial availability is for the Microsoft platform versions of Aptimize's software - in particular SharePoint and ASP.NET. Aptimize's software is widely adopted to accelerate SharePoint, with implementations including Microsoft who use Aptimize to accelerate sharepoint.microsoft.com and lync.microsoft.com.

Get Started

Aptimize NS-WAX is available by contacting Aptimize. You can learn more on the Aptimize for Citrix section of their website, or download a technical whitepaper for configuring NetScaler with NS-WAX here.

The Citrix Community is powerful!

NetScaler VPX Express supports SSL Offload; however, NetScaler VPX does all SSL processing in software, so NetScaler VPX will not offer the same SSL performance as NetScaler appliances. NetScaler VPX can easily support up to 500 new SSL transactions per second, and the same encryption ciphers that the NetScaler appliances use are supported. The main difference between the NetScaler VPX and NetScaler MPX appliances is performance and L2 networking on the VPX is done in the Hypervisor. NetScaler VPX Express throughput is limited to 1 Mbps (Full Duplex). If you need more throughput, just download a 90-day eval license for NetScaler VPX-1000 Platinum, here.

Packaging

Capacity

View the NetScaler VPX Express FAQ

Download NetScaler VPX Express & License

The Citrix Community is powerful!

The Citrix NetScaler VPX provides the complete NetScaler all-in-one feature set in a simple, easy-to-install virtual appliance. IT organizations of any size can deploy NetScaler VPX on demand, anywhere in the datacenter, using industry standard servers. The simplicity and flexibility of NetScaler VPX make it easy and cost effective to fully optimize every web application and more effectively integrate networking services with application delivery.

Download Citrix NetScaler VPX

Download Citrix XenServer

The Citrix Community is powerful!

Redirecting HTTP Requests to a Cache

When the NetScaler performs load balancing, The NetScaler provides a cache redirection option for redirecting HTTP requests to a cache. A cache stores frequently requested HTTP content. When you configure cache redirection on a virtual server, the NetScaler sends cacheable HTTP requests to the caches and non-cacheable HTTP requests to the origin Web servers.

To set cache redirection on a virtual server using the NetScaler Load Balancer command line

set lb vserver <vServerName> -cacheable <Value>
Example

set lb vserver Vserver-LB-1 -cacheable yes

To set cache redirection on a virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual
   Servers.
2. In the details pane, select the virtual server for which you want to configure
   cache redirection (for example, Vserver-LB-1), and click Open.
3. In the Configure Virtual Server (Load Balancing) dialog box, click the
   Advanced tab.
4. Select the Cache Redirection check box, and then click OK.

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download the Citrix Load Balancer

The Citrix Community is powerful!

For Virtualized Apps

As you can see from Chris Fleck's post from CES, virtualized everything is here, delivered to any device, anywhere, anytime, using Citrix Receiver. A key component of that infrastructure, is the Citrix Receiver and Citrix Merchandising Server. Citrix Receiver for Windows, Receiver for Mac, and Merchandising Server are components of the Citrix Delivery Center solution. While Citrix Delivery Center provides the application delivery infrastructure to the IT administrator, Citrix Merchandising Server and Citrix Receiver for Windows work together to streamline the installation and management of application delivery to the user desktops. Merchandising Server provides the administrative interface for configuring, delivering, and upgrading plug-ins for your users' computers.

The system consists of the Receiver application that is installed on your users' computers, the Merchandising Server that is installed on a virtual machine in your data center, and the Citrix Update Service that is hosted on Citrix.com. The Merchandising Server Administrator Console is the interface on the Merchandising Server that you use to configure plug-ins and schedule their delivery to your users. The Merchandising Server delivers the plug-ins and their installation instructions to your users on the scheduled date.

It guys often ask, how do I protect the Merchandising Server? The answer to that is by using the Citrix NetScaler to frontend the Receiver connections to the Merchandising Server. The Citrix NetScaler contains security policies to protect the Merchandising Server. We have created an NetScaler AppExpert Template for Merchandising Server. Just upload the AppExpert Template to your NetScaler VPX, tweak the policy for your domain/ip address scheme, and your are ready to start delivery apps out to your user base.

Download the NetScaler AppExpert Template for Merchandising Server here.

Download Citrx Receiver here.

The Citrix Community is powerful!

and the ADC State of the Art

Load Balancing in its infancy emerged to improve the availability and reliability of websites and to offload SSL computation from the web servers. Innovation has advanced these machines to provide an assortment of benefits in addition to Load Balancing, and are thus classed into Application Delivery Controllers. The Citrix Load Balancer has advanced the state of the art by combining the benefits of basic Application Acceleration through the use of TCP Multiplexing, SSL Offload, Caching, Compression, Content Switching. The Load Balancer evolved to provide these benefits for Enterprise Applications in addition to websites, such as SAP, Oracle, Microsoft Sharepoint and OCS (Lync).

The Citrix ADC was the first to advance the state of the art in the virtualization realm, by coming to market with the first virtual appliance for load balancing, the NetScaler VPX. While the innovation of this continues to develop, the Virtual ADC (vADC) has broken down barriers to entry into sales engagements and partner relationships, thus increasing the overall bottom line.

The Virtual ADC incorporates rule-based extensibility through the use of NetScaler Expressions, and simplifies the rule-based language through the use of AppExpert Templates - prebuilt configurations and rules for all types of Enterprise Applications and Websites. Just import the AppExpert Template, and the application will be automatically accelerated. Applicaiton acceleration can achieve between 5% - 90% improvement depending on the measurement. When you spend money on bandwidth and users depend on low latency - this translates directly to the bottom line.

The NetScaler division at Citrix Systems has been successful at maintaining a rigid stance in the Load Balancing, Application Delivery Controller market, and continues to invest in the product by advancing the state of the art through innovation. State of the Art is integration of the Application Firewall, XML Firewall, AppExpert Templates, SOA and the Virtual ADC.

Download the Citrix Load Balancer

The Citrix Community is powerful!

Configuring Sessionless Load Balancing Virtual Servers

When the NetScaler performs load balancing, it creates and maintains a number of sessions between the client and servers. In scenarios such as DSR setup or intrusion detection system (IDS) load balancing, the NetScaler can perform load balancing without creating sessions. To prevent creation of sessions, you must configure a sessionless virtual server in the NetScaler. The sessionless virtual server does not allocate any resources on the NetScaler, thereby saving the memory that the specific deployment consumes.

When you enable the sessionless option, the NetScaler performs load balancing on a per-packet basis. When a sessionless virtual server is configured, the sessionless virtual server forwards the packets to a server selected using load balancing methods. While forwarding the packet, the NetScaler changes the destination MAC address to the server MAC address.

For sessionless load balancing

• Enable MBF mode
• Enable MAC-Based mode on the sessionless load balancing virtual server
• Enable USIP mode on services (because the IP address of the source is not changed)

To set a sessionless virtual server by using the NetScaler command line

set lb vserver <vServerName> -m <RedirectionMode> -sessionless <Value>
Example

set lb vserver Vserver-LB-1 -m MAC -sessionless enabled

To set a sessionless virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the Load Balancing Virtual Servers page, select the virtual server for which you want to configure sessionless load balancing (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, under Redirection Mode, click MAC Based.
4. Select the Sessionless check box, and click OK.

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download the Citrix Load Balancer

The Citrix Community is powerful!

A Load Balancer such as the Citrix NetScaler has monitors built in, to automatically redirect Client requests to the back-end servers that are up and running. But, what happens if the front-end is down? Load Balancing can fail when a Virtual Server or Vserver fails, or when the VIP is unable to handle excessive traffic. Protecting the LB setup against failure helps ensure the availablility of the websites and applications.

Configuring Connection-Based Spillover

You can use connection-based spillover to configure a maximum threshold for the number of active client connections on a virtual server. When the client connections exceed the configured threshold limit, new client connections are diverted to the backup virtual server.

To configure connection-based spillover, follow the steps described in the section Diverting Excess Traffic to a Backup Load Balancing Virtual Server. In the Method list, select Connection.

Global Server Load Balancing (GSLB) virtual servers do not support connection-based spillover.

Configuring Dynamic Spillover

Dynamic spillover depends on the maximum client setting configured on the services. If the number of client connections at the virtual server exceeds the sum of the maximum client values, the new connections are diverted to the services of the backup virtual server. To configure dynamic spillover, you must enable it on a virtual server. You must configure the services with appropriate maximum client values. If the value for maximum client is set to 0, the spillover limit is treated as infinity, and spillover never occurs. To configure dynamic spillover, follow the steps described in the section Diverting Excess Traffic to a Backup Load Balancing Virtual Server. In the Method list, select Dynamic connection.

Configuring Bandwidth-Based Spillover

Bandwidth-based spillover allows you to configure a bandwidth threshold value. When the bandwidth on the primary virtual server exceeds the bandwidth threshold value, the NetScaler diverts new connections to a backup virtual server. For example, if you create a primary virtual server, a backup virtual server, and two services, and bind the services to the virtual servers, you can configure bandwidth spillover on the primary virtual server. You can also configure the backup virtual server with a threshold value. When the threshold for the backup virtual server is reached, the NetScaler diverts new client connections to the next backup virtual server. To configure bandwidth-based spillover, follow the steps described in the section Diverting Excess Traffic to a Backup Load Balancing Virtual Server. In the Method list, select Bandwidth.

Configuring Stateful Connection Failover

The NetScaler enables TCP or UDP connections to survive a failover event in high availability (HA) mode. This functionality is called connection failover. After adding a secondary node and configuring HA, you can choose to configure either stateless or stateful connection failover. You can configure connection failover on any LB virtual server.

To configure a stateful connection failover by using the NetScaler command line

At the NetScaler command prompt, type:

• set lb vserver <vServerName> -connFailover <Value>

Example

set lb vserver Vserver-LB-1 -connFailover stateful

To configure a stateful connection failover by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the Load Balancing Virtual Servers page, select the virtual server for which you want to configure connection failover (for example, Vserver-LB-1), and click Open.
3. On the Advanced tab, in the Connection Failover drop-down list, select Stateful.
4. Click OK.
   
   Detailed instructions can be found in the NetScaler Traffic Management Guide
   
   NetScaler Documentation can be found here
   
   Download the Citrix Load Balancer
   
   The Citrix Community is powerful!
   
   
   

A Load Balancer such as the Citrix NetScaler has monitors built in, to automatically redirect Client requests to the back-end servers that are up and running. But, what happens if the front-end is down? Load Balancing can fail when a Virtual Server or Vserver fails, or when the VIP is unable to handle excessive traffic. Protecting the LB setup against failure helps ensure the availablility of the websites and applications.

Diverting Excess Traffic to a Backup Load Balancing Virtual Server

The spillover option diverts new connections to a backup virtual server when the number of connections to the primary virtual server exceeds the configured threshold value. The threshold value is dynamically calculated, or you can set the value. The number of established connections (in case of TCP) on the virtual server is compared with the threshold value. When the number of connections reaches the threshold, new connections are diverted to the backup virtual server.

You can configure persistence with spillover. In this configuration, connections are diverted to the backup virtual server based on the persistence settings configured on the backup virtual server. These connections are not moved back to the primary virtual server after the number of connections drops below the threshold. Instead, the primary virtual server accepts new client connections.

If the backup virtual servers reach the configured threshold and are unable to take additional load, the primary virtual server diverts all requests to the redirect URL. If a redirect URL is not configured on the primary virtual server, subsequent requests are dropped.

With RTSP virtual servers, the NetScaler uses only data connections for spillover. If the backup RTSP virtual server is not available, the requests are redirected to an RTSP URL and an RTSP redirect message is sent to the client.

To set a primary virtual server to divert new connections to a backup virtual server by using the NetScaler command line

At the NetScaler command prompt, type:

• set lb vserver <vServerName> -soMethod <spillOverType> -soThreshold <positiveInteger> -soPersistence ENABLED -soPersistenceTimeout <positiveInteger>

Example

set lb vserver Vserver-LB-1 -soMethod Connection -soThreshold 1000 -soPersistence 
enabled -soPersistenceTimeout 2

To set a primary virtual server to divert new connections to a backup virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure the spillover (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, in the Method list, select the type of spillover, and in Threshold text box, type the threshold value (for example, Connection and 1000).
4. Under Spillover, select the Persistence check box, and in Persistence Time-out (min) text box type the time-out (for example, 2).
5. Click OK.
   
   Detailed instructions can be found in the NetScaler Traffic Management Guide
   
   NetScaler Documentation can be found here
   
   Download the Citrix Load Balancer
   
   The Citrix Community is powerful!
   
   
   

A Load Balancer such as the Citrix NetScaler has monitors built in, to automatically redirect Client requests to the back-end servers that are up and running. But, what happens if the front-end is down? Load Balancing can fail when a Virtual Server or Vserver fails, or when the VIP is unable to handle excessive traffic. Protecting the LB setup against failure helps ensure the availablility of the websites and applications.

Configuring a Backup Load Balancing Virtual Server

If the primary virtual server is marked down or disabled, the NetScaler directs the connections or client requests to a backup virtual server that forwards the client traffic to the services. It can also send a notification message to the client regarding the site outage or maintenance. The backup virtual server is a proxy and is transparent to the client. If a load balancing virtual server is configured with both a backup virtual server and a redirect URL, the backup virtual server takes precedence over the redirect URL. A redirect is used when the primary and backup virtual servers are down. You can configure a backup virtual server when you create a virtual server, or when you change the optional parameters of an existing virtual server. You can also configure a backup virtual server for an existing backup virtual server, thus creating cascaded backup virtual servers. The maximum depth of cascading backup virtual servers is 10.

If you have multiple virtual servers that connect to two servers, you have a choice of which virtual server takes over if the primary virtual server goes down and then comes back up. The default behavior is for the primary virtual server to resume its role as the primary. However, you may want to designate the backup virtual server to remain in control in the event that it takes over. For example, you may want to sync updates to the backup server to the primary server and then manually force the original primary server to resume its role. In this case, you can designate the backup virtual server to remain in control in the event that the primary virtual server goes down.

If the backup virtual server does not exist, an error message appears. You can use redirect URL on the primary when the primary and the backup virtual servers are down or have reached their threshold for handling requests. When a service bound to the virtual server is in an out of service state, use the redirect URL on the virtual server.

To set a backup virtual server by using the NetScaler command line

At the NetScaler command prompt, type:

• set lb vserver <vServerName> -backupVserver <BackupVServerName> [-disablePrimaryOnDown]

  If you enable the Disable Primary When Down option, the backup virtual server maintains control after the primary virtual server comes up. To enable the primary virtual server to retake control, you must manually re-enable it.

Example

set lb vserver Vserver-LB-1 -backupVserver Vserver-LB-2 -disablePrimaryOnDown

To set a backup virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure the backup virtual server (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, in the Backup Virtual Server list, select the backup virtual server (for example, Vserver-LB-2).
4. If the primary server goes down and then comes back up, and you want the backup virtual server to function as the primary server until you explicitly reestablish the primary virtual server, select the Disable Primary When Down check box.
5. Click OK.
   
   Detailed instructions can be found in the NetScaler Traffic Management Guide
   
   NetScaler Documentation can be found here
   
   Download the Citrix Load Balancer
   
   The Citrix Community is powerful!
   
   
   

A Load Balancer such as the Citrix NetScaler has monitors built in, to automatically redirect Client requests to the back-end servers that are up and running. But, what happens if the front-end is down? Load Balancing can fail when a Virtual Server or Vserver fails, or when the VIP is unable to handle excessive traffic. Protecting the LB setup against failure helps ensure the availablility of the websites and applications.

Redirecting Client Requests to an Alternate URL

You can configure a redirect URL to communicate the status of the NetScaler in the event that a virtual server (only of type HTTP or HTTPS) is down or disabled. This URL can be a local or remote link. The NetScaler uses HTTP 302 redirect. Redirects can be absolute URLs or relative URLs. If the configured redirect URL contains an absolute URL, the HTTP redirect is sent to the configured location, regardless of the URL specified in the incoming HTTP request. If the configured redirect URL contains only the domain name (relative URL), the HTTP redirect is sent to a location after appending the incoming URL to the domain configured in the redirect URL.

If a load balancing virtual server is configured with both a backup virtual server and a redirect URL, the backup virtual server takes precedence over the redirect URL. A redirect is used when the primary and backup virtual servers are down.

To configure a virtual server to redirect the client request to a URL by using the NetScaler command line

At the NetScaler command prompt, type:

• set lb vserver <vServerName> -redirectURL <URLValue>

Example

set lb vserver Vserver-LB-1 -redirectURL http://www.newdomain.com/mysite/maintenance

To configure a virtual server to redirect the client request to a URL by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure redirect URL (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, in the Redirect URL text box, type the URL (for example, http://www.newdomain.com/mysite/maintenance).
4. Click OK.
   
   Detailed instructions can be found in the NetScaler Traffic Management Guide
   
   NetScaler Documentation can be found here
   
   Download the Citrix Load Balancer
   
   The Citrix Community is powerful!
   
   
   

PHD Virtual Backup that is

In August, 2010, PHD Virtual announced support for PHD Virtual Backup for Citrix XenServer. The backup and recovery solution is built specifically for XenServer environments. They are a Citrix Ready partner, meaning the solution has been verified to work with Citrix XenServer in our labs. PHD Virtual provides the ability to back up and restore business critical information quickly and efficiently, directly within the XenCenter management console, providing a single pane of glass to manage virtual machine backups. With support for XenServer, XenDesktop and XenApp, customers can leverage the same solution across their entire virtual environment.

Releasing this month

Is PHD Virtual Backup 5.1 for XenServer. It is built on the next generation of PHD Virtual's award winning VBA architecture and extends their XenServer backup and recovery solution with new capabilities providing:

• The fastest and most cost effective virtualization backup to meet RPO, RTO and SLA requirements
• Dramatically reduced storage requirements and efficient network backup with TrueDedupe™ Technology
• The most reliable solution for backup data integrity with TrueRestore™ Technology
• Seamless, integrated management of backup and restore directly from Citrix XenCenter
• Backup and recovery of XenApp and XenDesktop deployments on XenServer
• Completely virtualized solution footprint leveraging the PHD VBA (Virtual Backup Appliance)
  
  

PHD VBA Architecture

Provides a purpose-built virtualization backup solution giving you the ability to simultaneously backup and restore multiple VMs concurrently. The PHD VBA deploys as a small virtual appliance on XenServer that autonomously conducts hot backups of all your virtual machines.

• Purpose built for virtual environments and integrated with XenCenter
• Backs up and restores any VM running on XenServer
• Does not compromise hypervisor performance or impact Dom0
• Does not require dedicated proxy servers, additional hardware or software agents
  
  

New in version 5.1:

• Flexible Backup Storage Options
• Set it and Forget it Job Scheduling
• File Level Restore (FLR) Any OS, Any File System
• Application Object Recovery Enabling Existing Tools to Restore Application Objects from Backups
• Support for Tape Backup Solutions via Backup Data Connector
• Backup Retention and Archiving - Meet DR Objectives and Retention Policies
  
  

Read more about PHD Virtual here

PHD Virtual is Citrix Ready

Download Citrix XenServer here

Download Citrix XenDesktop here

Download Citrix XenApp here

Download Citrix Virtual Load Balancer & SSL VPN here

The Citrix Community is powerful!

Configuring a backup persistence method

The NetScaler Load Balancer uses the backup persistence option when the primary persistence fails. For example, the primary persistence type is set to Cookie Insert, and backup persistence is set to Source IP. When the client browsers do not support cookies, Source IP persistence is used. To set the backup persistence option to Source IP, you must set the primary persistence to Cookie Insert.

If the traffic comes from behind a Network Address Translation (NAT) device or proxy, the traffic appears to come from a single source IP address and cannot be distributed evenly.

Backup persistence has a time-out value that you can set when the primary persistence type is set to COOKIEINSERT or RTSP session ID persistence, and the backup persistence type is set to SOURCEIP.

The NetScaler uses the backup persistence if the cookie or RTSP session ID is missing in the header.

To set backup persistence for a virtual server by using the NetScaler command line

At the NetScaler command prompt, type:
set lb vserver <vserverName> -persistenceType <PersistenceType> -persistenceBackup <BackupPersistenceType>
Example
set lb vserver Vserver-LB-1 -persistenceType CookieInsert -persistenceBackup SourceIP

To set backup persistence for a virtual server by using the configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure backup persistence (for example, Vserver-LB-1), and then click Open.
3. The Configure Virtual Server (Load Balancing) dialog box, click the Method and Persistence tab.
4. In the Persistence list, select COOKIEINSERT and in the Time-out text box, type the time-out value (for example, 20).
5. In the Backup Persistence list, select the backup persistence that you want to configure (for example, SOURCEIP).
6. In the Backup Time-out and Netmask text boxes type the backup time-out value and netmask (for example, 20 and 255.255.255.255).
7. Click OK.

Download the Citrix Load Balancer here

The Citrix Community is powerful!

hacking tool for Wordpress

Since the rollout of social media and blogging, I have wondered "why aren't these sites using SSL". When I told my wife my facebook account got hacked, she didn't believe me. Then her's got hacked. Session Hijacking has been around for a while now, so it's nothing new, but the hacking tool Firesheep, an extension to Firefox, is a new illustration of that vulnerability. It has built in strings to capture session keys from all of the favorite web sites, including twitter, facebook and wordpress among others. This is not just about social sites, it is about Enterprise apps also, being exposed. Companies are using Twitter, Facebook and Wordpress as business tools. So it is now an Enterprise security issue, a real risk to applications that run the business. And with many of our execs going mobile, they are using these tools from places with open WiFi such as airports, coffee shops and hotels. Fixing the threat is easy, by putting a NetScaler VPX in front of these site(s) and automatically redirecting HTTP to HTTPS. Here are the steps necessary to implement the fix, along with a video that shows how easy it is to hack using session hijacking, and how easy it is to fix this problem.

Steps for securing Wordpress with SSL - Wordpress hosted at a service provider:

1. Download and install XenServer
2. Download and install NetScaler VPX for XenServer
3. Install SSL Certificate on the NetScaler
4. Create a Load Balancing VIP with new publicly routable IP Address
5. Edit DNS entry for your wordpress site to point to the NetScaler Load Balancing VIP
6. Set Service to the IP Address of your wordpress site at the service provider
7. Set Load Balancing VIP port 80 to automatically redirect to port 443

Connect to http://<yourwordpresssite.com> and it should automatically redirect to https://<yourwordpresssite.com>.

Steps for securing Wordpress with SSL - Wordpress hosted in your own DMZ:

1. Download and install XenServer
2. Download and install NetScaler VPX for XenServer
3. Install SSL Certificate on the NetScaler
4. Create a Load Balancing VIP with a new publicly routable IP Address
5. Edit DNS entry for your wordpress site to point to the NetScaler Load Balancing VIP
6. Set the Service to point to the IP Address of your locally hosted wordpress site
7. Set Load Balancing VIP port 80 to automatically redirect to port 443

Connect to http://<yourwordpresssite.com> and it should automatically redirect to https://<yourwordpresssite.com>.

Its easy

Download XenServer here

Donwload NetScaler VPX here

The Citrix Community is powerful!

for Video over WAN

The Citrix Branch Repeater plays a critical role in optimizing an existing WAN connection and improving the overall virtual desktop user experience in the branch office. The following key findings from a recent report emphasize the strategic cost savings and performance improvement a Branch Repeater solution can provide for any branch office XenDesktop deployment.

• Citrix Branch Repeater can reduce the overall average bandwidth consumed per session by up to 89%.
• Citrix Branch Repeater can reduce the amount of time it takes for a XenDesktop session to launch on a congested WAN connection by up to 40%.
• Citrix Branch Repeater can double the number of users able to execute similar virtual desktop activities on the same congested WAN connection.
• Citrix Branch Repeater can reduce the amount of time it takes for the print request to spool from the virtual desktop to the branch office print server by up to 60%.

Optimized Video Delivery

Citrix Branch Repeater is a branch optimization solution that accelerates and simplifies branch infrastructure. Branch Repeater solutions reduce IT costs and increase user productivity by simplifying branch startup and management, and providing users the best access experience. The Branch Repeater products achieve WAN optimization by combining a variety of technologies:

• TCP Optimization: Branch Repeater is a symmetric solution, where a Branch Repeater is located at each end of the WAN connection (in the datacenter and in the branch office) recognize each other's presence and employ RFC compliant TCP optimization techniques that ensure optimal utilization of the network bandwidth.
• Traffic Prioritization (QoS): Administrators can classify network bandwidth based on TCP port numbers and IP ranges to prioritize the delivery of TCP segments based on the classification. Furthermore, Branch Repeater recognizes the priorities of the various ICA virtual channels and can ensure preferential treatment of real-time critical data such as audio.
• Compression: Branch Repeater can detect repeating patterns in the transmitted data and utilize very small tokens across the WAN to identify such repeating data patterns and serve the data to the user out of the appliance memory; therefore, restricting the amount of data required to traverse the WAN and improving user experience.
• Protocol Optimization: Branch Repeater can optimize a variety of common application protocols. Citrix XenDesktop leverages the ICA protocol, which employs a variety of optimization and security features natively. In order to apply compression, a WAN optimizer must be able to decrypt the ICA workload, identify repeating patterns within the ICA virtual channels, apply the optimization, and re-encrypt the data stream. This is why Citrix Branch Repeater is the only WAN optimization product capable of directly optimizing the ICA payloads on the protocol level.

Citrix High Definition (HDX)

Citrix is committed to providing the best high definition user experience through the introduction of HDX technology. Citrix HDX technology builds on existing Citrix user experience innovations from the datacenter to the device, adding enhancements for multimedia, voice, video and 3D graphics. Citrix HDX is comprised the following categories:

• HDX Broadcast - Ensures high-performance of virtual desktops and applications over any network, including high-latency and low-bandwidth environments.
• HDX WAN Optimization - Optimizes performance by utilizing Citix Branch Repeater to cache bandwidth intensive data and graphics and deliver them from the most efficient location.
• HDX MediaStream - Accelerates multimedia performance through compression or, when possible, redirection and client-side rendering.
• HDX RealTime - Enhances real-time voice and video using advanced encoding and streaming to ensure a no compromise end-user experience.
• HDX 3D - Optimizes the performance of everything from graphics-intensive 2D environments to advanced 3D geospatial applications using software and hardware based rendering in the datacenter and on the device.
• HDX Plug-n-Play - Enables simple connectivity for all local devices in a virtualized environment, including USB, multi-monitor, printers and peripherals.

Read the performance report here

Download the free Branch Repeater VPX Express virtual appliance

Read about HDX here

Get the optimized video delivery technology here

The Citrix Community is powerful!

Recommended by NIST for January 2011

Beginning January 1st, 2011, the NIST (National Institute of Standards & Technology) recommends all SSL certificates be upgraded to 2048-bit strength To protect data confidentiality. This transition can have a significant impact on performance and capacity of your SSL infrastructure.

Join us Wednesday, November 10th, 2:00pm Eastern/11:00am Pacific and discover how to efficiently manage this change and what actions you need to take now that will ease the transition to 2048-bit, and still maintain the highest performance and security standards.

In this TechTalk, learn about:

• Why SSL/TLS is moving to 2048-bit certificates and the impact on your organization
• How a major web hosting provider, GoDaddy.com is managing the transition to 2K certificates
• Recommendations and examples of Citrix NetScaler SSL/TLS features

Details:

TechTalk: 2048 bit SSL Certificates - Are you ready?
When: Wednesday, November 10, 2010 2:00 PM - 3:00 PM EST
Where: Register at http://www.citrix.com/sslcertwebinar
Speaker: Kurt Roemer, Chief Security Strategist, Citrix Systems

Get the most powerful SSL Performance here.

The Citrix Community is powerful!

Sprint, HTC, RIM, Samsung, Motorola

If you've been paying attention, you know that Citrix Receiver runs anyapplication, on anydevice, anywhere. If you are in Silicon Valley, you can see it in action by attending the session to be delivered by Chris Fleck of Citrix, at the Sprint Developer Conference. Mobile devices continue to proliferate across the enterprise creating new business challenges for users, IT and developers. Users want their devices to empower them to do more than just read e-mail and browse the web. They want simple and fast access to documents and the ability to run their business applications. IT needs a secure and scalable infrastructure for delivering business apps to mobile devices, anytime and anywhere. Developers want a common platform to create applications without duplication and little additional resources.

With Citrix Receiver™, accessing applications hosted on Citrix XenApp provides a common platform that both IT and developers can utilize to minimize development, run applications centrally and securely deliver apps to any device. The Citrix Receiver connects securely to the XenApp server using Citrix NetScaler SSL VPN technology.

In this session you will learn

• How to use existing development tools and resources like Visual Studio, Flash and Java to create business applications for any device
• How to use alternative, non-development tools to create compelling business applications and dashboards
• How Citrix Receiver enables tablets, smartphones, and other devices to quickly and securely enter the workplace
• How to optimize existing applications for Android, BlackBerry and even iPhone
  Session Demos: Citrix Receiver on Android and Blackberry devices: www.citrix.com/receiver

Session: Citrix: Build Once, Run Centrally and Deliver Business Applications Anywhere with Citrix Receiver
When: Tuesday, October 26, 2010 | 4:15 - 5:15 p.m.
Where: Santa Clara Convention Center, Room K
Who: Chris Fleck - VP Community & Solutions Development, Citrix Systems

Samsung Devices (Epic 4G Handsets, Transform Sprint ID Handset, Galaxy Tab)

Stop by the Samsung booth in the exhibit hall or attend the Samsung session Wed Oct 27, 10:00-11:00, and provide your contact information via business card to be eligible to win one of multiple Samsung Epic 4G handsets or Samsung Galaxy Tab Android Tablets via a business card drawing in the Samsung Booth and Samsung breakout session.

In addition, Samsung Epic and Transform handsets will be raffled off to attendees of the Android Coding Session, Thur 2:30-5:30.

A limited number of Samsung Galaxy Tab (Sprint's first Android powered tablet) will be raffled off to Android Coding session attendees who have downloaded the Samsung Galaxy Tab SDK/Emulator http://innovator.samsungmobile.com/galaxyTab.do. Sprint employees will validate the emulator configuration on android coding session attendee laptops as attendees enter the android coding session.

HTC EVO 4G

Stop by the HTC booth in the exhibit hall or attend the HTC session Wed Oct 27, 11:15-12:15, and provide your contact information via business card to be eligible to win one of multiple HTC EVO 4G handsets via a business card drawing.

HTC will also be raffling off a limited number of HTC EVO 4G handsets following their presentation in the Android Coding Camp, Thur 2:30-5:30.

Motorola I1 (the first iDEN Android PTT capable handset.)

Forty attendees of the Motorola Motodev Session on Wed, Oct 27, 4:00-5:00 will be eligible to receive a Motorola I1 device. Specific information about how the devices will be awarded will be shared in the session itself. Must be present at the breakout session to be eligible for the device giveaway.

RIM Style (first Sprint RIM Blackberry 6.0 OS device, not yet available to the public)

This information is COMING SOON.

Get Citrix Receiver here

Get Citrix XenApp here

Get the most powerful Citrix Receiver Proxy here.

The Citrix Community is powerful!

Integrated with NetScaler HTTP Callout

Ever wonder, with all of this networking security, who is protecting the information at the endpoint, before it enters the VPN stack? Ever heard of Keyloggers and Framegrabbers? API's that can read your passwords? (Even when connected to an SSL VPN or to a web application using HTTPS). You're not out of the woods yet until you secure your internet browser, on your local machine. Internet Explorer, Chrome, Safari and Firefox don't have this protection natively, so you will want to read this.

Quaresso Protect On Q enables web sites to mitigate information compromise risks introduced by web browsers, and by extension end users. Browsers have become the target or vector of many styles of attacks. While SSL protected packets (i.e., HTTP/S) and data center security solutions (e.g., web application firewalls) can significantly increase protections against compromise, the end point has become the relative weak link in this three link chain. Why? Some of the reasons:

• Breadth and depth of attacks - the monetization of malware have increased the number and sophistication level of attacks. Vulnerabilities, both in the code of browsers as well as plug-ins along with new methods of social engineering have increased year over year.
• Decreased efficacy of traditional anti-virus solutions - many recent studies have shown that the growth in the number of in-the-wild attacks have increased the vulnerability window for users.
• Increase in data at risk - more and more organizations are making heretofore sensitive content available across the Internet, whether customer-focused content like banking transactions, health care information or equity trades or enterprise content such as product design documents, customer account databases, internal communications like email. This creates a financial motivation for attackers.
• Lack of visibility - Although browser vendors have done a credible job of adding security features to their products in an attempt to mitigate the browsers' vulnerabilities, high assurance web sites have very few tools to ensure users have enabled such features or have configured them correctly.

Protect On Q takes a fundamentally different approach to solve the problem of browser insecurity. Instead of relying on end users or the security state of users' PCs, web sites with Protect On Q can take control of the client side risk by quickly delivering an ephemeral (i.e., temporary) security layer around the browsers that connect to their site. This layer - implemented as a protected browser - is controlled by the web sites via a site specific policy. It requires no extraordinary requirements of the end user or local system and does not require permanent software installation, minimizing operational overhead and desktop support complexity.

POQ provides the following security features:

• Keylogger/Framegrabber Defense
• Browser Privacy
• Browser Process Integrity
• SSL Certificate White Listing
• SSL User Orverride
• Network Destination Controls
• Hostname Resolution Bypass
• Information Leakage and Auditing
• Session Time Limits
• Blocking COM Snooping

The diagram below depicts the Protect On Q (POQ) architecture in a typical POQ usage scenario

• The NetScaler automatically redirects HTTP (cleartext) requests to HTTPS (encrypted). This protects the information in transit to the website.
• Request is made to https://citrix.demo.quaresso.com.
• The NetScaler intercepts the request, and determines if the browser is armored already. If not,...
• A page appears that explains to the user that they need the POQ armored browser before they access that application/website.
• The armored browser is started.
• The users session is then sent to the original request https://citrix.demo.quaresso.com using the armored browser.
• All requests to that website are sent to the HTTP Callout, including HTML, images, css, Javascript, etc.
• The NetScaler checks for a POQ-Verified value.
• The value is extracted from the "QuaressoPOQSessionID" and an HTTP Callout request is sent to the REST API, to verify that the POQ server did in fact sign that user agent value, and then allows or denies further access.

During the armored browser session:

• User must use an armored browser for the website/application https://citrix.demo.quaresso.com.
• User cannot navigate to other sites while using the armored browser.
• User cannot navigate to invalid certificate sites (certificate whitelisting).
• Information controls prevent saving, printing, pasting or copying information from the application/website through the armored browser.
• Malware detection is enabled preventing screen captures and keyloggers (however, we made a whitelist exception to record the video).

Watch it in action

Citrix NetScaler Process Flow

Citrix NetScaler Configuration

# HTTP Callout Policies
add policy httpCallout QuaressoCallout
add policy httpCallout poq_valid_session_id
set policy httpCallout QuaressoCallout -IPAddress 63.110.51.85 -port 8080 -returnType TEXT -hostExpr "\"63.110.51.85\"" -urlStemExpr "\"/poqserver/rest/\" + HTTP.REQ.HEADER(\"QuaressoPOQSessionID\") + \"/isValid\"" -resultExpr "HTTP.RES.BODY(5)"
set policy httpCallout poq_valid_session_id -IPAddress 63.110.51.85 -port 8080 -returnType TEXT -hostExpr "\"QuaressoCallout.ns.com\"" -urlStemExpr "\"/poqserver/rest/session/\" + HTTP.REQ.HEADER(\"QuaressoPOQSessionID\") + \"/isValid\"" -resultExpr "HTTP.RES.BODY(5)"
# Server Setup
add server 63.110.51.85 63.110.51.85
add server 63.110.51.87 63.110.51.87
add service HTTPS 63.110.51.87 SSL 443 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
add service POQServer 63.110.51.85 HTTP 8080 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
add service badstore 63.110.51.87 HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
set rewrite param -undefAction NOREWRITE
# Load Balancing Virtual Servers
add lb vserver QuaressoVIP HTTP 63.110.51.92 80 -persistenceType NONE -redirectURL "https://citrix.demo.quaresso.com/" -cltTimeout 180
add lb vserver QuaressoVIP-HTTPS SSL 63.110.51.92 443 -persistenceType NONE -cltTimeout 180
add lb vserver QuaressoVIP-POQServer SSL 63.110.51.92 8443 -persistenceType NONE -cltTimeout 180
# Responder Policies
add responder action invalidPOQKey_action respondwith "\"HTTP/1.1 200 OK\r\\r\\nContent-length: 116\\r\\n\\r\\n<HTML><HEAD><TITLE>Invalid POQ Session key </TITLE></HEAD><BODY><h1>Invalid POQ Session key found</h1></BODY></HTML>\""
add responder action noPOQKey_action redirect "\"https://citrix.demo.quaresso.com:8443/poqserver/client/citrixtest/poqRequired.html\""
add responder policy noPOQKey_policy "HTTP.REQ.HEADER(\"QuaressoPOQSessionID\").EXISTS.NOT && HTTP.REQ.HOSTNAME.EQ(\"QuaressoCallout.ns.com\").NOT" noPOQKey_action
add responder policy invalidPOQKey_policy "HTTP.REQ.HOSTNAME.EQ(\"QuaressoCallout.ns.com\").NOT && SYS.HTTP_CALLOUT(poq_valid_session_id).EQ(\"true\").NOT" invalidPOQKey_action
set responder param -undefAction NOOP
# Bind Policies to VServers
bind lb vserver QuaressoVIP-HTTPS HTTPS
bind lb vserver QuaressoVIP-POQServer POQServer
bind lb vserver QuaressoVIP-HTTPS -policyName noPOQKey_policy -priority 101 -gotoPriorityExpression END
bind lb vserver QuaressoVIP-HTTPS -policyName invalidPOQKey_policy -priority 102 -gotoPriorityExpression END
# SSL Certs
add ssl certKey ns-server-certificate -cert ns-server.cert -key ns-server.key
add ssl certKey quaresso-self-signed-cert -cert quaresso.cert -key quaresso.key
add ssl certKey quaresso-demo-cert -cert demo_quaresso_com.crt -key demo_quaresso_com.key
set ssl service HTTPS -eRSA DISABLED
# Bind SSL Certs to VServer
bind ssl service HTTPS -certkeyName quaresso-demo-cert
bind ssl vserver QuaressoVIP-HTTPS -certkeyName quaresso-demo-cert
bind ssl vserver QuaressoVIP-POQServer -certkeyName quaresso-demo-cert

To see how these threat protections work and read about additional security protections, scalability, and performance, go to www.quaresso.com or contact them at info@quaresso.com.

Get the most powerful HTTP Callout controller here.

Quaresso is Citrix Ready!

Configuring Persistence for RTSP

The Citrix NetScaler initially selects a server by using a load balancing method. With persistence configured, enabling the NetScaler to send any subsequent client requests to the selected server, the server can access state information for that client. If persistence is configured, it overrides the load balancing methods once the server has been selected. If the configured persistence applies to a service that is down, the NetScaler uses the load balancing methods to select a new service, and the new service becomes persistent for subsequent requests from the client. If the state of the selected service is "out of service", it continues to serve the outstanding requests, but it does not allow new requests or connections. After the shutdown period elapses, no new requests or connections are directed to the service and the existing connections are closed.

The NetScaler uses Real-Time Streaming Protocol (RTSP) session ID persistence for Real-Time Streaming Protocol (RTSP) virtual servers, and you cannot change this setting on RTSP virtual servers. There is no reason to change it anyway. The NetScaler selects an RTSP service based on the load balancing method and uses the RTSP session ID to send the subsequent requests. RTSP is stateful, and when the client issues a SETUP command to the server, the server negotiates RTSP session IDs in the SETUP response message. The NetScaler creates a session between the client and the servers by using the RTSP session ID. The RTSP requests and responses must have the session ID header to identify the session.

Sometimes multiple servers can have the same session ID, and, therefore, unique sessions cannot be created between the client and the server. In such cases, you can configure the NetScaler to append the server IP address and port to the session ID so that the session ID is unique. The following table describes the parameter that the NetScaler can use to append the server IP address and port.

Parameters for RTSP Session ID-Based Persistence

If the client sends multiple SETUP requests on one TCP connection, the NetScaler sends the SETUP requests to the same server because the NetScaler makes the load balancing decision for every TCP connection. In this case, the NetScaler does not forward the SETUP requests to different servers based on the session ID.

Get the most powerful RTSP Load Balancer here.

It's powerful!

Configuring Persistent Connections Between Clients and Servers

The Citrix NetScaler initially selects a server by using a load balancing method. With persistence configured, enabling the NetScaler to send any subsequent client requests to the selected server, the server can access state information for that client. If persistence is configured, it overrides the load balancing methods once the server has been selected. If the configured persistence applies to a service that is down, the NetScaler uses the load balancing methods to select a new service, and the new service becomes persistent for subsequent requests from the client. If the state of the selected service is "out of service", it continues to serve the outstanding requests, but it does not allow new requests or connections. After the shutdown period elapses, no new requests or connections are directed to the service and the existing connections are closed.

Configurable Persistence Types

Configuring Persistence Types

If the configured persistence cannot be maintained because of lack of resources on the NetScaler, the load balancing methods are used for server selection. Persistence is maintained for a configured period of time, depending on the persistence type. Some persistence types are specific to certain virtual servers.

Relationship of Persistence Type to Virtual Server Type

To configure persistence on a virtual server by using the NetScaler command line

At the NetScaler command prompt, type:

set lb vserver <name> -PersistenceType <type>

Example:

set lb vserver Vserver-LB-1 -persistenceType SOURCEIP

Persistence Parameters

To configure persistence on a virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual
   Servers.
2. In the details pane, select the virtual server for which you want to configure
   persistence (for example, Vserver-LB-1), and then click Open.
3. In the Configure Virtual Server (Load Balancing) dialog box, on the
   Method and Persistence tab, in the Persistence list, select the persistence
   type you want to use (for example, SOURCEIP).
4. In the Time-out and Netmask text boxes type the time-out and netmask
   values (for example, 2 and 255.255.255.255).
5. Click OK.

Note: After configuring persistence for a virtual server, you can view the persistence type by viewing the virtual server from the configuration utility or using the show lb vserver command. You can also use the show ns persistencesession command to view persistence sessions.

Get the most powerful Persistence Load Balancer here.

It's powerful!

Configuring Persistence Based on SSL Session IDs

The Citrix NetScaler initially selects a server by using a load balancing method. With persistence configured, enabling the NetScaler to send any subsequent client requests to the selected server, the server can access state information for that client. If persistence is configured, it overrides the load balancing methods once the server has been selected. If the configured persistence applies to a service that is down, the NetScaler uses the load balancing methods to select a new service, and the new service becomes persistent for subsequent requests from the client. If the state of the selected service is "out of service", it continues to serve the outstanding requests, but it does not allow new requests or connections. After the shutdown period elapses, no new requests or connections are directed to the service and the existing connections are closed.

The NetScaler creates a session-based persistence on the arriving SSL Session ID that is part of the SSL handshake process. The requests with the same SSL session ID are directed to the initially selected service. This persistence is used for SSL bridge type of services, and the NetScaler does not encrypt or decrypt data when it forwards the requests to the services. The NetScaler must maintain the data structures to keep track of the sessions. Keep in mind that persistence based on SSL session ID depends upon SSL sessions not renegotiating session IDs during a transaction.

To configure persistence based on SSL session IDs, in the Persistence list, select SSLSESSION.

Get the most powerful Persistence Load Balancer here.

It's powerful!

Configuring Persistence Based on User-Defined Rules

The Citrix NetScaler initially selects a server by using a load balancing method. With persistence configured, enabling the NetScaler to send any subsequent client requests to the selected server, the server can access state information for that client. If persistence is configured, it overrides the load balancing methods once the server has been selected. If the configured persistence applies to a service that is down, the NetScaler uses the load balancing methods to select a new service, and the new service becomes persistent for subsequent requests from the client. If the state of the selected service is "out of service", it continues to serve the outstanding requests, but it does not allow new requests or connections. After the shutdown period elapses, no new requests or connections are directed to the service and the existing connections are closed.

The NetScaler maintains persistence based on the contents of the matched rule. This persistence type requires configuration of a classic expression that evaluates the request payload or a policy infrastructure expression that evaluates requests or responses. For example, you can configure persistence based on application session information in a response cookie or header. You can configure persistence rules using classic or advanced expressions.

If a request matches the criteria in the expression, a persistence session is created and subsequent client requests are directed to the previously selected server. To configure rule-based persistence, use the parameters described in the following table.

Parameters for Rule-Based Persistence

(rule)

(resRule)

Example: Classic Expression for a Request Payload
The expression, "httpheader user agent contains MyBrowser" directs any client requests containing, "user agent: MyBrowserV1.1" to the initially selected server.

Example: Advanced Expression for a Request Header
The expression, "HTTP.REQ.HEADER ("user agent").CONTAINS ("MyBrowser") directs client requests containing, "user-agent: MyBrowserV1.1" to the initially selected server.

Example: Advanced Expression for a Response Cookie
The expression, "HTTP.RES.HEADER("SET-COOKIE").VALUE(0).TYPECAST_NVLIST_T('=',';').VALUE("server")" examines server responses containing "server" cookies to the initially selected server.

To configure persistence based on user-defined rules by using the command line At the NetScaler command line, type:

set lb vserver <vserverName> [-rule expression][-resRuleexpression]

Examples

set lb vserver vsvr_name -rule 
http.req.header("cookie").value(0).typecast_nvlist_t('=',';').value("server")

set lb vserver vsvr_name -resrule
http.res.header("set-cookie").value(0).typecast_nvlist_t('=',';').value("server")

To configure persistence based on user-defined rules by using the GUI configuration utility

1. In the Persistence list, select RULE.
2. To configure a rule that analyzes requests, click the Configure button next to the Rule field. To configure a rule that analyzes responses from the server, click the Configure button next to the Response Rule field.
3. Select Classic Syntax or Advanced Syntax, and configure the rule.
   
   Get the most powerful Persistence Load Balancer here.
   
   It's powerful!
   
   
   

Configuring Persistence based on Server IDs in URLs

The Citrix NetScaler initially selects a server by using a load balancing method. With persistence configured, enabling the NetScaler to send any subsequent client requests to the selected server, the server can access state information for that client. If persistence is configured, it overrides the load balancing methods once the server has been selected. If the configured persistence applies to a service that is down, the NetScaler uses the load balancing methods to select a new service, and the new service becomes persistent for subsequent requests from the client. If the state of the selected service is "out of service", it continues to serve the outstanding requests, but it does not allow new requests or connections. After the shutdown period elapses, no new requests or connections are directed to the service and the existing connections are closed.

The NetScaler can maintain persistence based on the server ID in the URLs. In a technique called URL passive persistence type, the NetScaler extracts the server ID from the server response and embeds it in the URL query of the client request. The server ID is its IP address and port specified as a hexadecimal number. The NetScaler extracts the server ID from subsequent client requests and uses it to select the server.

Example: Payload Expression
The expression, URLQUERY contains sid= configures the NetScaler to extract the server ID from the URL query of a client request, after matching token sid=. Thus, a request with the URL http://www.citrix.com/index.asp?&sid=c0a864100050 is directed to the server with the IP address 10.102.29.10 and port 80. The time-out value does not affect this persistence type. This persistence type is maintained as long as the server ID can be extracted from the client requests. This persistence type does not consume any NetScaler resources, so it can accommodate an unlimited number of persistent clients. To configure persistence based on server IDs in a URL, in the Persistence list, select URLPASSIVE.

Configuring Persistence Based on Server IDs in Client Requests

The NetScaler can maintain persistence based on the server ID that you provide. The persistence type requires you to provide the server ID and embeds the server ID in the response. The NetScaler extracts the server ID from subsequent requests and uses it to choose a server. The server ID value must be in the range 0 through 65535. You must configure the same number in the NetScaler for the corresponding service. This persistence type is called Custom Server ID persistence. The Custom Server ID persistence type requires a payload expression, or an advanced expression to be configured that specifies the location of the server ID in the client requests.

If a server ID cannot be extracted from the client requests, server selection is performed based on the load balancing method. Avoid using the same server ID for multiple services.

Example: Payload Expression
Two servers, Server-1 and Server-2, are configured, where Server-1 has the Server-ID=5 and Server-2 has the Server-ID=6. The services for these servers are bound to the virtual server Vserver-LB-1. The expression URLQUERY contains sid= configures the NetScaler to extract the Server-ID from the URL query of the client requests, after matching token "sid=". Thus, a request with the URL http://www.citrix.com/index.asp?&sid=6 that arrives on Vserver-LB-1 is directed to the server Server-2. The time-out value does not affect this persistence type. Persistence is maintained for as long as a server ID can be extracted from the client requests. This persistence type does not consume any NetScaler resources, so it can accommodate an unlimited number of persistent clients. To configure persistence based on server IDs in client requests, in the Persistence list, select CUSTOMSERVERID.

Get the most powerful Persistence Load Balancer here.

It's powerful!

Configuring Persistence Based on Destination IP Addresses

The Citrix NetScaler initially selects a server by using a load balancing method. With persistence configured, enabling the NetScaler to send any subsequent client requests to the selected server, the server can access state information for that client. If persistence is configured, it overrides the load balancing methods once the server has been selected.

If the configured persistence applies to a service that is down, the NetScaler uses the load balancing methods to select a new service, and the new service becomes persistent for subsequent requests from the client. If the state of the selected service is "out of service", it continues to serve the outstanding requests, but it does not allow new requests or connections. After the shutdown period elapses, no new requests or connections are directed to the service and the existing connections are closed.

This persistence type is used with link load balancing. With destination IP addresses (DESTIP) configured, the NetScaler chooses a service based on the configured load balancing method. It then directs all subsequent packets to the selected service based on the DEST IP. To configure persistence based on destination IP addresses, in the Persistence list, select DESTIP.

Get the most powerful Persistence Load Balancer here.

It's powerful!

Configuring Persistence Based on Source and Destination IP Addresses

The Citrix NetScaler initially selects a server by using a load balancing method. With persistence configured, enabling the NetScaler to send any subsequent client requests to the selected server, the server can access state information for that client. If persistence is configured, it overrides the load balancing methods once the server has been selected. If the configured persistence applies to a service that is down, the NetScaler uses the load balancing methods to select a new service, and the new service becomes persistent for subsequent requests from the client. If the state of the selected service is "out of service", it continues to serve the outstanding requests, but it does not allow new requests or connections. After the shutdown period elapses, no new requests or connections are directed to the service and the existing connections are closed.

With source and destination IP addresses (SRCIPDESTIP) configured, the NetScaler chooses a service based on the configured load balancing method and directs subsequent packets with the same source and destination IP addresses to the same service. To configure persistence based on source and destination IP addresses, in the Persistence list, select SRCIPDESTIP.

Get the most powerful Persistence Load Balancer here.

It's powerful!

Protection against DOS and DDOS

I previously discussed the concept of DOS and DDOS. This post describes the procedures to configure HTTP DoS protection on the Citrix Next Generation Firewall.

• Enable HTTP DoS
• Add an HTTP DoS policy
• Add a service
• Bind the monitor
• Bind the service to the policy
  Note: For information about using the CLI to configure this feature, see the Command Reference Guide.

To enable HTTP DoS in the GUI Configuration Utility:

1. In the left pane, expand System, and click Settings. The System Settings Overview page appears in the right pane.
2. Click advanced features. The Configure Advanced Features dialog box appears.
3. Select HTTP DoS Protection check box, click OK, and click Yes on the Enable/Disable Feature(s) dialog box.
4. The status bar displays a message indicating that the selected feature is enabled.

To add an HTTP DoS policy

1. In the left pane, expand Protection Features, and click HTTP DoS. The HTTP DoS page appears in the right pane.
2. Click Add. The Create HTTP DoS Policy dialog box appears.
3. Type a name for the policy in the Name text box, for example, dospol_1.
4. Type a numeric value in the QDepth text box that denotes the queue size, for example, 200.
5. Type a numeric value in the Client Detect Rate text box, for example, 1, and click OK.
   Note: The client detect rate value denotes the percentage of traffic to which the HTTP DoS policy is applied.
   The policy that you created appears in the right pane and the status bar displays a message indicating that the DoS policy is successfully configured.

To add a service

1. In the left pane, expand Load Balancing, and click Services. The Services page appears in the right pane.
2. Click Add. The Create Service dialog box appears.
3. In the Service Name text box type a name, for example, HTTP_DoS_service1.
4. In the Server text box type the IP address of the server that the service represents, for example, 10.102.29.1.
5. In the Protocol drop-down list box, select the protocol type, for example, HTTP.
6. Type the port number in the Port text box, for example, 80. Ensure that Enable Service check box is selected.
7. Select the Advanced tab, and select the Override Global check box.
8. Type numeric values in the Max Clients text box and Client text box respectively, for example, 200 and 60.
9. Click Create and click Close. The service you create appears in the list of services.

To bind a monitor and a policy to the service

1. In the left pane, expand Load Balancing, and click Services. The Services page displays the list of services in the right pane.
2. Select the service that you want to bind and click Open. The Configure Service dialog box appears.
3. Select the Monitor tab, click tcp in the Monitors list, and click Add. The selected monitor tcp is added to the Configured frame.
4. Select the Policies tab, click a policy from the Available Policies list, for example, dospol_1 that you created in the previous section, and click Add.
5. The policy appears in the Configured Policies list.
6. Click OK and click Close. A message in the status bar indicates that the service is configured.

In the previous procedure, if more than 200 clients are waiting in the system surge queue for the service HTTP_DoS_service1, the HTTP DoS protection function is triggered. The default rate of challenged JavaScript responses sent to the client is one percent of the server response rate. For example, if the server generates 100 responses per second, and there are 200 clients in the surge queue, the HTTP DoS protection feature picks one pending client request per second from the surge queue (1% of 100) and sends a challenge JavaScript response to the suspect client at the rate of one JavaScript per second.

If the client executes the received challenge JavaScript, generates the cookie, and re-sends the original HTTP request with the JavaScript-generated cookie, it proves that it is a legitimate browser-based client. The HTTP DoS Protection feature queues the HTTP requests of the client in its higher-priority legitimate client queue, so that it is served faster.

Tuning the Client Detection/JavaScript Challenge Response Rate

The default client detection/JavaScript challenge response rate of one percent is inadequate in many real attack scenarios, therefore, it needs to be tuned. For example, there are 500 responses/sec from the server, and the server is under attack with 10000 Gets/sec. If 1% of the server responses are sent as JavaScript challenges, responses are reduced to almost none: 5 client (500 *0.01) Javascript responses, for 10000 waiting client requests, approximately 0.05% of the real clients receive JavaScript challenge responses.

If the client detection/Javascript challenge response rate is very high (for example, 10%, generating 1000 challenge Javascript responses per second), it may saturate the upstream links or harm the upstream network devices. Citrix recommends that an administrator exercise care when choosing Client Detect Rate values.

If the configured triggering surge queue depth is, for example, 200, and the surge queue size is toggling between 199 and 200, the system toggles between the "attack" and "no-attack" scenario, which is not desirable.

To prevent the "attack" and "no attack" scenario from occurring, a window mechanism is provided. When the surge queue size reaches 200, and the "attack" scenario is detected, the surge queue size must fall for the system to enter

"noattack" mode. If the value of WINDOW_SIZE is set to 20, the surge queue size must fall under 180 before the system enters "no-attack" mode. During configuration, you must specify a value more than the WINDOW_SIZE for the QDepth parameter when adding a DoS policy or setting a DoS policy.

The triggering surge queue depth should be configured based on prior knowledge of the traffic characteristics.

Guidelines for HTTP DoS Protection Deployment

Citrix recommends you deploy the HTTP DoS protection feature in a tested and planned manner, and closely monitor after the initial deployment. Use the following information to fine-tune the deployment of HTTP DoS Protection:

• The maximum number of concurrent connections supported by your
  servers.
• The average and normal values of the concurrent connections supported by
  your servers
• The maximum output rate (responses/sec) that your server can generate.
• The average traffic that your server handles.
• The typical bandwidth of your network.
• The maximum bandwidth available upstream.
• The limits faced by the bandwidth, for example, external link, router and so on. The critical devices on the path that may suffer from a traffic surge.
• Whether allowing a greater number of clients to connect is more important than protecting upstream network devices.
  Attack Characteristics
• What is the rate of incoming fake requests that you have experienced in the past?
• What types of requests have you received (complete posts, incomplete gets)?
• Did previous attacks saturate your downstream links? If not, what was the bandwidth?
• What types of source IP addresses and source ports did the HTTP requests have (e.g., IP addresses from one subnet, constant IP, ports increasing by one).
• What types of attacks do you expect in future? What type have you seen in the past?
• Any or all information that can help you tune DoS attack protection.
  
  Get the most powerful DDOS Protection here.
  
  It's powerful!
  
  
  

Configuring Redirection Mode

You can configure a Load Balancing HTTP or HTTPS VServer with a redirect URL on the Citrix NetScaler Load Balancing VIP. This URL can be sent as a response to the client HTTP or HTTPS request if the VServer is not available. The common usage of this option is to direct the client to a customized Site Down Web page or to an external backup Web site. Another common use it to redirect HTTP requests to HTTPS requests, forcing clients to use HTTPS.

The redirection mode determines the destination address to forward the incoming traffic. The NetScaler provides the following redirection modes:

• IP-Based forwarding (default)
• MAC-Based forwarding
  Note: By default, the NetScaler uses IP-Based forwarding. You can set MAC-Based forwarding in case of direct server return (DSR) topology, link load balancing, and firewall load balancing.

To configure Redirection for a Load Balancing Vserver or VIP:

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure the redirection mode (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, Enter the Redirect URL. ex: http://<redirect.domain.tld>
4. Click OK.

To force HTTP to HTTPS traffic for a Load Balancing Vserver or VIP:

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure the redirection mode (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, Enter the Redirect URL. ex: https://<domain.tld>
4. Mark the state of the HTTP Vserver to Down. (By forcing the HTTP Vserver down, it will automatically send all requests to the HTTPS URL you configure here).
5. Click OK.

When the state of the VServer is DOWN or DISABLED, then the NetScaler appliance responds to HTTP(S) requests with the HTTP/1.x 302 - Object Moved response code and the configured redirect URL specified in the Location header of the HTTP response. The exact URL specified in the response depends on the following configuration options:

• If the configured redirect URL only contains the domain name, such as http://www.sample1.example.com, the redirect URL specified in the HTTP response appends the Uniform Resource Identifier (URI) specified in the HTTP request to the configured domain name. For example, if the request contains the GET http://www.sample2.example.com/images/site_nav.gif header, then the Location header in the redirect response specifies the Location: http://www.sample1.example.com/images/site_nav.gif header.

Note: The domain names in the request and response can differ. In this document, the two domains are referred to as sample1.example.com and sample2.example.com to explain the concept. If the configured redirect URL contains a complete path, then the redirect response specifies the complete configured URL, irrespective of the URI in the request. For example, the following are such URLs:

• http://www.redirect.com/en/site_down.html
• http://www.redirect.com/ (<- trailing slash)

Note: It is worth noting that when configuring a redirect URL, the http://example.com URL is not the same as the http://example.com/ URL because the latter contains the complete path to the Web root, /.

Configuring the Redirect URL Option using CLI commands:

• Run the following command from the command line interface of the appliance:*

  set vserver <VServer_Name> -redirectURL <URL>

• To verify that the redirect URL option is working as expected, disable the VServer. Run the following command to disable the VServer:

  disable vserver <VServer_Name>

• Access the Web site URL from a Web browser to verify that the request is being redirected as expected. You might need to clear the Web browser cache and make a new connection before accessing the Web site.
• From the command line interface of the NetScaler appliance, run the following command to re-enable the VServer (or leave it disabled to permanently redirect HTTP to HTTPS:

  enable vserver <VServer_Name>

Note:
If you have configured extensive redirect infrastructures by using artificially downed Load Balancing VServers with redirect URLs, then Citrix recommends that you use the Responder feature. An example of using responder to send the 404 response code is available in the Knowledge Center article How to Configure the NetScaler Appliance to Respond with the 404 Not Found Response Code Depending on Certain Parameters in the Client Request. You can customize the procedure in this article to send the 302 response code, or any other response you might want to configure.

The Redirect feature is not applicable for the non-HTTP or non-HTTPS protocols.

Get the most powerful Redirector here.

It's powerful!

Preventing Denial of Service

Back in the day when I first began setting up labs on the internet, in the DMZ, outside of the firewall, I was warned. I threw caution to the wind and continued forward with my work. About a year later my methods had changed due to all of my experiences and all that I had witnessed. Some of the threats have changed, but many are the same. We live safely behind our firewalls, until an accident happens. I got to witness many dangerous attempts to bring down my company's infrastructure, among other things. I think the most interesting event happened when we were able to trace an attack against a University in the USA originating from somewhere deep in China. We live in a dangerous world.

I remember reading about Denial of Service attacks, and later the Ditributed Denial of Service attacks, early in my career and thought they were the toys of script kiddies (kids who write scripts for fun and jokes). If you believe this, put some hosts out in your DMZ or outside the firewall with some open ports and time how long it takes to get slammed. I kid you not, there are people/organizations out there, port scanning 24/7/365 looking for vulnerable sites to destroy, using the simplest of methods. Protection against DOS and DDOS is fundamental and can be implemented with the Citrix NetScaler.

The technology for DOS and DDOS prevention has existed for some time now, but the attacks have become more sophisticated, which is why you really need the Next Generation Firewall offered by the NetScaler. The Citrix Next Gen Firewall not only protect you at Layer 3/4, but also at Layer 7 - the Application Layer.

How Layer 7 Denial of Service Protection Works

Internet hackers can bring down a site by sending a surge of GET requests or other HTTP-level requests. Layer 7 Denial of Service Protection provides an effective way to prevent such attacks from being relayed to the server. This feature also ensures that a Citrix NetScaler System located between the internet and the servers is not brought down by the attack while protecting the servers.

Most attackers on the Internet use applications that discard responses to reduce computation costs, and minimize their size to avoid detection. The attackers focus on speed, devising ways to send attack packets, establish connections or send HTTP requests as rapidly as possible.

A typical approach to prevent these attacks is effective in most cases. However, for more complicated attack methodologies including the use of real HTTP clients as attacking tool, the simpler prevention approaches can fail to protect the servers.

Real HTTP clients such as Internet Explorer, Firefox, or NetScape browsers can understand HTML Refresh meta tags, Java scripts, and cookies. In standard HTTP the clients have most of these features enabled. However, the dummy clients used in DoS attacks cannot parse the response from the server. If the malicious clients attempt to parse and send requests intelligently, it becomes difficult for them to launch the attack aggressively.

When the Citrix NetScaler System detects an attack, it responds to 0% to 100% of incoming requests based on the value of the Client Detect Rate parameter with a Java or HTML script containing a simple refresh and cookie. Real clients can parse the request and return the request with the cookie. Spurious clients drop the response, and are therefore dropped by the system. When a POST request is received, it is first checked for a valid cookie. If the request has a valid cookie, the request goes through, but, if the request does not have a valid cookie, the system sends a Javascript to the client asking it to resend the information with a new cookie. If the client sends a new cookie, this cookie becomes invalid after four minutes, and every response to the client is sent with the new cookie. The cookie in a POST request can become invalid in the following conditions:

• If the POST request is made when the system is under attack, and the preceding GET request is made when the system is not under attack.
• When the think time of the client exceeds four minutes.

Priority Queuing/Surge Protection

Under an attack, requests without proper cookies are queued by the system, this protects the servers from false clients.

Memory/Performance Implications

There is minimal effect on throughput, since the JavaScript is sent to the client at a very slow rate (default: 1% of the server's HTTP response rate). This rate can be changed by tuning the -Client Detect Rate parameter of the HTTP DoS protection policy. The latency of the requests is increased, because the client must re-issue the request after the JavaScript is returned. This takes time, since the requests are also queued.

Get the most powerful DOS protection here.

It's powerful!

The Splunk for Citrix NetScaler app is a set of field extractions, reports, lookups and dashboards which provide visibility into the Citrix NetScaler Application Delivery Controller, Application Firewall and VPN. This App is configured to work with version 9.1+ of the Citrix netScaler. To view versions, release notes and download the app, click on the image at left, or the link below.

Download the Splunk for Citrix NetScaler here.

It's powerful!

Preventing overload

When you configure a NetScaler to use a metric-based load balancing method such as Least Connections, Least Response Time, Least Bandwidth, Least Packets, or Custom Load, the load balancing method will initially start out as Round Robin for what is called a slow start period.

NetScaler appliances use the configured load balancing method to determine the appropriate service for forwarding an incoming request. Load balancing environments are dynamic, however, and the NetScaler needs to manage the events that may overload the server. For example, when you configure the Least Connections load balancing method, the NetScaler selects the service that has the least number of connections. If a new server is added to the server farm, the NetScaler selects the new server with the least number of connections, and, therefore, may overload the new server.

To avoid overloading servers, the NetScaler performs slow start. During the slow start phase, the NetScaler distributes requests by using Round Robin, regardless of the metric-based load balancing method configured on the virtual server. However, the weight assigned on the services is used by Round Robin. After the number of incoming requests or connections per second exceeds a given threshold, the NetScaler stops slow start and operates using the configured load balancing method.

Slow start occurs when:

• You configure a new metric-based load balancing method.
• You bind a service to the virtual server.
• The state of the server changes from DOWN to UP.

To compute slow start, the number of services bound to the virtual server is multiplied by 100. For a new virtual server with the load balancing method determined by dynamic traffic parameters, slow start allows time to collect a valid data sample before the correct method is applied.

Note: When slow start is in operation, the output for the show lb vserver <vserver name> command will specify the current method as Round Robin.

Get the most powerful Load Balancer here.

It's powerful!

or Load Balancing Method

The load balancing algorithm (or load balancing method) defines the criteria that the NetScaler uses to select the server to which to send client requests. When the configured criteria are met for the selected server, the NetScaler then selects a different server. Load balancing granularity refers to the criteria that the NetScaler uses to decide the load balancing method in a given situation. The NetScaler performs request-based, connection-based, or time-based load balancing, depending on the protocol of the service it is load balancing.

Within each type of load balancing, there are various load balancing methods. For example, the least connection method selects the service with the least number of active connections to ensure that the load of the active requests is balanced on the services.

Load Balancing methods available on the Citrix NetScaler:

• Least Connections Method (default)
• Round Robin
• Least Response Time
• Hash Method
• Least Bandwidth Method
• Least Packets Method
• Token Method
• Custom Load
• VLAN Method
• Persistence
• Weighted
• Wildcard
  

To set load balancing methods by using the configuration utility:

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure an LB method (for example, Vserver-LB-1), and then click Open.
3. In the Configure Virtual Server (Load Balancing) dialog box, click the Method and Persistence tab.
4. From the drop-down menu under LB Method, select a method, (for example, Least Response Time).
5. Click OK.

Get the most powerful Load Balancer here.

It's powerful!

Application Delivery Controllers

The Citrix NetScaler is an all-in-one application delivery controller that makes applications run five times better, reduces web application ownership costs, optimizes the user experience, and makes sure that applications are always available by using:

• Proven application acceleration such as HTTP compression and caching.
• High application availability through advanced L4-7 load balancer.
• Application security with an integrated application firewall.
• Server offloading to significantly reduce costs and consolidate servers.

Solutions that require multiple point products such as discrete load balancers, web application firewalls, and SSL VPN are difficult and far more costly to deploy and manage when compared to the NetScaler all-in-one web application delivery controller solution.

The best application delivery controllers must be flexible

NetScaler is available in two form factors. NetScaler comes in built-for-purpose MPX-series hardware appliances powered by Citrix nCore technology for the most demanding applications. NetScaler is also available in an economical virtual appliance, Citrix NetScaler VPX, that operates with any Intel®-VT or AMD®-v capable server using Citrix XenServer technology. Customers can start at VPX and grow into the MPX-series or deploy both within the same environment, an option that is especially valuable for multi-tenant environments like those of application service and cloud providers.

To help protect your investment, NetScaler Pay-as-You-Grow offers a simple, on-demand licensing model to easily scale NetScaler performance from VPX through MPX deployments, provide investment protection, avoid costly hardware upgrades, and minimize TCO.

How Citrix web application delivery controllers work

Deployed in front of web servers, NetScaler application delivery controllers can handle up to 18 Gbps using a combination of built-in load balancing and context switching for intelligent traffic management. NetScaler multiplexes thousands of incoming connections to a smaller number of back-end server farm sessions within your datacenter and employs HTTP compression, static and dynamic content caching, and network WAN protocol optimization to accelerate application delivery by five times and more.

Application security is provided with a built-in web application firewall which uses a positive security model and automatically learns proper application behavior to ensure protection against day-zero attacks. Encrypted SSL traffic is no problem as NetScaler provides not only SSL acceleration but full SSL VPN tunnel support with certificate management and granular access control.

To provide advanced warning in the event of a drop in user application performance, NetScaler monitors application performance, allowing administrators to take proactive action to guarantee that solid user experience is maintained. The integrated server monitoring and health checks ensure that applications and databases are functioning properly and at maximum throughput, performance, and efficiency.

View NetScaler VPX performance numbers here.

View NetScaler MPX performance numbers here.

Get the most flexible, highest performing Application Delivery Controller here.

It's powerful!

Viewing Load Balancing using the Visualizer

The Visualizer is a tool you can use to view load balancing configuration in graphical format and to modify the configuration in the Citrix NetScaler.

You can use the visualizer to do the following:

• View the services and service groups that are bound to a virtual server.
• View the monitors that are bound to the services.
• View policies that are bound to the virtual server.
• View policies labels, if configured.
• View configuration details of any displayed element.
• View load balancing virtual server statistics.
• View statistical information such as the number of requests received per
  second by the virtual server and the number of hits per second for rewrite,
  responder, and cache policies.
• View a comparative list of all the parameters whose values either differ or
  are not defined across service containers.
• Add, Modify, Remove resources in the load balancing configuration.

Modifying a Load Balancing Configuration Using the Visualizer

You can use the Visualizer to add and bind new objects, modify existing ones, and enable or disable objects. The tasks that you can perform using the Visualizer are, for the most part, the same tasks that you can perform using the configuration dialog boxes in other parts of the Load Balancing feature. The Visualizer treats groups of services in a somewhat unique manner. It displays services that have the same configuration details and monitor bindings as a single group known as a service container. Next to the service container is a number that shows the number of services in the group. A service container is set of similar services and service groups that are bound to a load balancing virtual server. The services in the container have the same properties, with the exception of the name, IP address, and port, and their monitor bindings should have the same weight and binding state. When you bind a new service to a virtual server, it is placed into an existing container if its configuration and monitor bindings match those of other services; otherwise, it is placed in its own container.

Get the most powerful Load Balancer here.

It's powerful!

Use of Wildcards instead of IP Addresses and Ports

When you configure a virtual server on the Citrix NetScaler, in some cases you can specify a wildcard for the IP address or port. The following situations may require this type of configuration:

• When the NetScaler is configured as a transparent pass through.
• If servers listen on ports that are not well known.
• If servers change ports over time.
• If you are reaching the limit for the number of IP addresses and ports that you can configure on a single NetScaler.
• If you want to create virtual servers that listen for all traffic on a specific VLAN.

When the NetScaler receives traffic using a wildcard-based virtual server, it determines the actual IP address and port for the physical server and creates new records for the physical server. This is known as dynamically learned server information. A wildcard server can also use an asterisk as the port number. For example, a firewall load balancing configuration can use wildcards for both the IP address and port. If you bind a wildcard TCP server to this type of load balancing virtual server, the virtual server picks up all TCP traffic that does not match any other server or virtual server.

Order of Evaluation of Wildcards in Virtual Server Addresses and Ports.

The NetScaler attempts to locate virtual servers and servers by first attempting an exact match and if none is found, continuing to find a match based on wildcards, as follows:
1. Specific IP address and specific port number
2. Specific IP address and a * (wildcard) port
3. * (wildcard) IP address and a specific port
4. * (wildcard) IP address and a * (wildcard) port

If the NetScaler is unable to select a virtual server based on its IP address, it selects the virtual server based on the protocol used in a request, in the following order:
1. HTTP
2. TCP
3. ANY

Get the most powerful Wildcard Load Balancer here.

It's powerful!