Citrix ADC CPX 12.1

70 Pages·2017·2.88 MB·English

Citrix ADC CPX 12.1
CitrixProductDocumentation|docs.citrix.com November30,2022
CitrixADCCPX12.1
Contents
AboutCitrixADCCPX 3
ArchitectureandTrafficFlow 3
CitrixADCCPXlicensing 7
DeployingaCitrixADCCPXInstanceinDocker 15
AddingCitrixADCCPXInstancestoCitrixADM 21
ConfiguringCitrixADCCPX 24
ConfiguringCitrixADCCPXUsingaConfigurationFile 28
ConfiguringDockerLoggingDrivers 29
DynamicRoutingsupportinCitrixADCCPX 30
UpgradingaNetScalerCPXInstance 34
UsingWildcardVirtualServersinNetScalerCPXInstance 36
DeployCitrixADCCPXasaProxytoEnableEast‑WestTrafficFlow 37
DeployCitrixADCCPXinaSingleHostNetwork 40
DeployCitrixADCCPXinaMulti‑HostNetwork 42
DeployCitrixADCCPXwithdirectaccesstothenetwork 47
ConfigureCitrixADCCPXinKubernetesUsingConfigMaps 48
DeployCitrixADCCPXProxyonGoogleComputeEngine 51
CitrixADCCPXtroubleshooting 74
©1999–2022CitrixSystems,Inc.Allrightsreserved. 2
CitrixADCCPX12.1
AboutCitrixADCCPX
September9,2020
CitrixADCCPXisacontainer‑basedapplicationdeliverycontrollerthatcanbeprovisionedonaDocker
host.CitrixADCCPXenablescustomerstoleverageDockerenginecapabilitiesanduseNetScalerload
balancingandtrafficmanagementfeaturesforcontainer‑basedapplications. Youcandeployoneor
moreCitrixADCCPXinstancesasstandaloneinstancesonaDockerhost.
ACitrixADCCPXinstanceprovidesthroughputofupto1Gbps.
ThisdocumentassumesthatyouarefamiliarwithDockerandhowitworks. Forinformationabout
Docker,seetheDockerdocumentationathttps://docs.docker.com.
SupportedFeatures
CitrixADCCPXsupportsthefollowingfeatures:
• Applicationavailability
– L4loadbalancingandL7contentswitching
– SSLOffloading
– IPv6protocoltranslation
• Applicationsecurity
– L7rewriteandresponder
• Simplemanageability
– Weblogging
– AppFlow
ArchitectureandTrafficFlow
September9,2020
WhenyouprovisionaCitrixADCCPXinstanceonaDockerhost,theDockerenginecreatesavirtual
interface, eth0, on the CPX instance. This eth0 interface is directly connected to a virtual interface
(veth*)on the docker0bridge. The Dockerengine also assigns an IP address tothe Citrix ADC CPX
instanceinthenetwork172.17.0.0/16.
ThedefaultgatewayfortheCPXinstanceistheIPaddressofthedocker0bridge,whichmeansthatany
communicationwiththeCitrixADCCPXinstanceisdonethroughtheDockernetwork. Allincoming
trafficreceivedfromthedocker0bridgeisreceivedbytheeth0interfaceontheCitrixADCCPXinstance
andprocessedbytheCitrixADCCPXpacketengine.
©1999–2022CitrixSystems,Inc.Allrightsreserved. 3
CitrixADCCPX12.1
ThefollowingfigureillustratesthearchitectureofaCitrixADCCPXinstanceonaDockerhost.
HowSingleIPAddressWorksonCitrixADCCPX
AregularNetScalerMPXorVPXappliancerequiresatleastthreeIPaddressestofunction:
• ManagementIPaddresscalledtheNetScalerIP(NSIP)address
• SubnetIP(SNIP)addressforcommunicatingwiththeserverfarm
• VirtualserverIP(VIP)address(es)foracceptingclientrequests
ACitrixADCCPXinstanceoperateswithonesingleIPaddressthatisusedformanagementaswellas
fordatatraffic.
Duringprovisioning, only one privateIP address(single IP address)is assigned toa Citrix ADCCPX
instancebytheDockerengine. ThethreeIPfunctionsofaNetScalerinstancearemultiplexedonto
oneIPaddress. ThissingleIPaddressusesdifferentportnumberstofunctionastheNSIP,SNIP,and
VIP(s).
ThefollowingimageillustrateshowasingleIPaddressisusedtoperformthefunctionsofNSIP,SNIP,
andVIP(s).
©1999–2022CitrixSystems,Inc.Allrightsreserved. 4
CitrixADCCPX12.1
TrafficFlowforRequestsOriginatingfromtheCitrixADCCPXInstance
DockerimplicitlyconfiguresIPtablesandaNATruletodirecttrafficoriginatingfromtheCitrixADC
CPXinstancetothedocker0IPaddress.
ThefollowingfigureillustrateshowapingrequestoriginatingfromaCitrixADCCPXinstancereaches
thedestination.
©1999–2022CitrixSystems,Inc.Allrightsreserved. 5
CitrixADCCPX12.1
Inthisexample,thepingrequestissentbythepacketengineoneth0interfacewithsourceIPaddress
astheCitrixADCCPXIPaddress(172.17.0.4).TheDockerhost,then,performsnetworkaddresstrans‑
lation(NAT)toaddthehostIPaddress(192.68.x.x)asthesourceIPaddressandsendstherequestto
thedestination(216.58.x.x). TheresponsefromthedestinationIPaddressfollowsthesamepathin
reverse. TheDockerhostperformsNATontheresponseandforwardstheresponsetotheCitrixADC
CPXinstanceontheeth0interface.
TrafficFlowforRequestsOriginatingfromtheExternalNetwork
To enable external communication, while provisioning Citrix ADC CPX, you have to set parameters
suchthatDockerexposescertainportssuchas80,22,andanyotherportyouwant. Ifyouhavenot
setanyporttobeexposedduringprovisioning,thenyouhavetoconfigureNATrulesontheDocker
hosttomaketheseportsavailable.
TheclientrequestthatoriginatesfromtheInternetisreceivedbytheDockerhost, whichthenper‑
formsportaddresstranslation(PAT)tomapthepublicIPaddressandporttothesingleIPaddress
andportoftheCitrixADCCPXinstance,andforwardsthetraffictotheinstance.
ThefollowingfigureshowshowtheDockerhostperformsportaddresstranslationtodirecttrafficto
theCitrixADCCPXsingleIPaddressandport.
©1999–2022CitrixSystems,Inc.Allrightsreserved. 6
CitrixADCCPX12.1
Inthisexample,theDockerhostIPaddressis192.68.x.xandthesingleIPaddressoftheCitrixADC
CPXinstanceis172.17.0.4. TheSSHport22ofCitrixADCCPXinstanceismappedtoport1100onthe
Dockerhost. TheSSHrequestfromtheclientisreceivedonIPaddress192.68.x.xatport1100. The
DockerhostperformsportaddresstranslationtomapthisaddressandporttothesingleIPaddress
172.17.0.4onport22andforwardstheclientrequest.
CitrixADCCPXlicensing
May19,2021
CitrixADCCPXisacontainer‑basedapplicationdeliverycontrollerthatcanbeprovisionedonaDocker
hosttoloadbalancemicroservicebasedapplications. YouneedlicensedCPXforbetterperformance
of application delivery. Citrix ADC CPX supports pool licensing. Citrix ADM can act as your license
servertolicenseyourCitrixADCCPXinstances.
CitrixADMisavailablebothon‑premisesandacloudserviceaswell. YoucanusetheCitrixADMto
managepooledcapacitylicensesforallCitrixADCformfactors.
ForinformationaboutCitrixADMon‑premises, seeCitrixADMon‑premises. Forinformationabout
CitrixADMservice,seeCitrixADMservice.
©1999–2022CitrixSystems,Inc.Allrightsreserved. 7
CitrixADCCPX12.1
TypesofCitrixADCCPXlicensing
CitrixADCCPXsupportsbandwidthandvirtualCPU(core)poollicensingforon‑premandcloudbased
deployments.
Bandwidthpool: CitrixADCCPXlicensescanbeallocatedbasedonthebandwidthconsumptionby
theinstances. Youcanusepooledlicensingtomaximizethebandwidthutilizationbyensuringthe
necessarybandwidthallocationtoaninstanceandnotmorethanitsrequirement.Formoreinforma‑
tionaboutthebandwidthpool,seeBandwidthbasedlicensing.
vCPUpool:InthevirtualCPU‑usage‑basedlicensing,thelicensespecifiesthenumberofCPUsthata
particularCitrixADCCPXinstanceisentitledto.So,theCitrixADCCPXcancheckoutlicensesforonly
thenumberofvirtualCPUsfromthelicenseserver.CitrixADCCPXchecksoutlicensesdependingon
thenumberofCPUsrunninginthesystem.FormoreinformationaboutthevCPUpool,seeCitrixADC
virtualCPUlicensing.
SupportedpooledcapacityforCitrixADCCPXinstances
Minimum
Maximum Minimum Minimum Maximum bandwidth
Product bandwidth bandwidth instances instances unit
CitrixADC 40000Note: 20Mbps 1 16 10Mbps
CPX Itdependson
CPU
frequency,
generation,
andsoon.
Note: CitrixiscurrentlyworkingonaCitrixADCCPXconsumptionbasedorpay‑as‑you‑growbased
licensingmodelforpubliccloud‑basedofferings. Onceready,itwillbeavailableonthepubliccloud
marketplacetoconsume.
HowdoesCitrixADCCPXlicensingwork?
CitrixADCCPXpooledcapacity: AcommonlicensepoolfromwhichyourCitrixADCCPXinstance
cancheckoutoneinstancelicenseandonlyasmuchbandwidthasitneeds. Whentheinstanceno
longerrequirestheseresources,itchecksthembackintothecommonpool,makingtheresources
availabletootherinstanceswhichneedtheselicenses.
CitrixADC CPXcheck‑inand check‑outlicensing: CitrixADM allocateslicensesCitrix ADCCPXin‑
stancesondemand. ACitrixADCCPXinstancecancheckoutthelicensefromtheCitrixADMwhena
©1999–2022CitrixSystems,Inc.Allrightsreserved. 8
CitrixADCCPX12.1
CitrixADCCPXinstanceisprovisionedandcheckbackinitslicensetoCitrixADMwhenaninstanceis
destroyed.
CitrixADCCPXbehavior: AsingleCitrixADCCPXinstancechecking‑outupto1Gbpsthroughput,
checks‑outonlyfromtheinstancepoolandnotfromthebandwidthlicensepool. CitrixADCCPXop‑
eratesinthiswayuptothe1Gbpsofbandwidthutilization.Forexample,ifaCPXinstanceconsumes
a200Mbpsbandwidth,itusestheinstancepooloflicense,insteadofthebandwidthpool. However,
ifaCitrixADCCPXinstanceconsumes1200Mbpsofthroughput,thefirst1000Mbpsisutilizedfrom
theinstancepoolandtheremaining200Mbpsisconsumedfromthebandwidthpool.
CitrixADCCPXExpress
Citrix ADC CPX Express is a software edition that is free‑of‑cost for on‑premises and cloud deploy‑
ments. When you download Citrix ADC CPX instance from the Quay repository, this is the default
capacity available for POCs which do not require a license file and it comes with the following fea‑
tures:
• 20Mbpsbandwidth
• Maximum250SSLsessions
• 20MbpsSSLthroughput
YoumustlicenseyourCitrixADCCPXinstancetoupgradeforbetterperformanceandproductionde‑
ployments.
CitrixADCCPXlicensingmodels
CitrixoffersarangeofproductlicensingmodelsforCitrixADCCPXtomeetyourorganization’srequire‑
ments.YoucanselectoptionssuchasvCPUorbandwidthandon‑premisesorcloud.
Basedonyourrequirements,youcanchooseanyofthefollowingmodels:
• BandwidthbasedlicensingforCitrixADCCPXfromADMservice
• vCPUbasedlicensingforCitrixADCCPXfromADMservice
• BandwidthbasedlicensingforCitrixADCCPXfromADMon‑premises
• vCPUbasedlicensingforCitrixADCCPXfromADMon‑premises
Provisionbandwidth‑basedandvCPU‑basedlicensingfromCitrixADMserviceforCitrixADC
CPX
Performthefollowingstepstoprovisionbandwidth‑basedlicenseandvCPU‑basedlicenseforCitrix
ADCCPXfromCitrixADMservice.
1. SetupCitrixADM.
©1999–2022CitrixSystems,Inc.Allrightsreserved. 9
CitrixADCCPX12.1
EnsurethattheCitrixADMservicesetupisoperationalwiththeCitrixADMagent.Youmusthave
aCitrixADMserviceandCitrixADMagentaccountforCitrixADCCPXlicensingtobefunctional.
ForinformationaboutsettingupCitrixADMserviceandCitrixADMagent,seeCitrixADMservice.
Note: Inthisprocedure,ahypervisor(on‑premises)CitrixADMagentsetupisused. Inthefol‑
lowingimage,10.106.102.199istheon‑premisesagentusedforlicensingCitrixADCCPX.
2. AddCitrixADCinstancelicensepooltoCitrixADMservice.
ItisassumedthatyouhaveapoolofbandwidthlicensesavailableforADMservice.Forinforma‑
tionaboutuploadingalicensefiletoCitrixADM,seeConfigurepooledcapacity.Inthefollowing
image,CNS_INST_200CC_Retail.licisusedasthebandwidthandinstancelicensepool.
©1999–2022CitrixSystems,Inc.Allrightsreserved. 10