Load Balancing Archive – Deyda Consulting Blog

NetScaler ADC Firmware Upgrade

Regular firmware updates are one of the most important maintenance tasks in a NetScaler ADC infrastructure. In addition to new features, current firmware releases include important bug fixes and security-related patches. Especially in the case of security advisories or actively exploited vulnerabilities, firmware updates should be scheduled promptly.

Because a firmware upgrade can affect production services such as NetScaler Gateway, Load Balancing, Content Switching, AAA, GSLB, or SSL Offloading, it should never be performed without proper preparation. A structured approach reduces downtime and minimizes the risk of unexpected issues.

This article describes the recommended upgrade process for production NetScaler ADC environments.

Web Authentication Action in NetScaler

On one of my recent deployments, I needed to set up external access using NetScaler to an internally hosted web application (Grafana).

Grafana is a cross-platform open source application for graphical representation of data from various data sources such as InfluxDB, MySQL, PostgreeSQL, Prometheus and Graphite.

The challenge here was that the customer wanted to pre-install authentication on the NetScaler, but the users were only known to the web application itself.

The question that therefore came to me was:
How can I check the user of the web application if only the web application itself has access to the user data?

I had only used standards like LDAP, RADIUS, CERT, SAML etc. for user authentication on NetScaler, but these were not useful here because the target system should not be changed.

Citrix ADC 101 – Fundamentals

The following is a collection of basic information about Citrix ADC. From licensing, to the most important commands, to the update procedures that can be performed.

General Information

Here is some basic information about Citrix ADC.

Operating System and Architecture

Citrix ADC is based on the open source operating system FreeBSD. Unlike the very similar Linux, FreeBSD has a modular kernel and Citrix has taken advantage of this to modify FreeBSD’s Bash shell by removing the networking subsystem and replacing it with its own. The modifications were placed in a custom kernel module called NetScaler Core Packet Processing Engine (PPE).

Copy a Citrix ADC configuration to a new machine

In one of my recent projects, I had to build several Citrix ADCs in a new data center. After consultation with the customer, the same services and functions should be configured as in the old data center. The only difference was that the new data center should use different IP ranges and therefore all network settings of the Citrix ADCs and the connected services had to be adapted.

Requirements

Same version and build on all Citrix ADC
Same Citrix ADC license version on all Citrix ADC
IP addresses of the new Citrix ADC should be defined and free (NSIP, SNIP & VIP).
IP addresses of the connected machines should be known (server or server groups)
Basic configuration of the new Citrix ADC should be done (NSIP, SNIP, DNS, Timezone & License)

Citrix ADC as AD FS Proxy

This article is about creating an AD FS Proxy from Citrix ADC (version 12). The AD FS Proxy is used to authenticate e.g. external SaaS applications or websites via AD FS. The following should be achieved by the AD FS Proxy:

URL / DoS Protection
Suitable external authentication (MFA, Forms instead of Kerberos)
Account Lockout Protection
Availability (Load Balancing)

What is AD FS ?

Active Directory Federation Services (AD FS) is a feature in the Windows Server operating system that allows identity information to be shared outside of the corporate network. Users can access applications (e.g. Office365, Salesforce.com, etc.) without being prompted to provide credentials again. These applications can be hosted locally, in the cloud, or even by other companies. The user accounts can be managed by the administrator in a single location, the Active Directory.

A normal deployment of AD FS for external clients consists of AD FS Proxy and AD FS Server. The AD FS Server is a member of the domain and perform the authentication. The AD FS Proxy is usually located in a separate network zone (DMZ) so that it can be reached externally and forward the requests inwards.

Tag: Load Balancing