Category: Uncategorized

Navigation

• Overview
• RADIUS Monitor
• Server Objects
• Service Groups
• Virtual Server

RADIUS Load Balancing Overview

Two-factor authentication to NetScaler Gateway requires the RADIUS protocol to be enabled on the two-factor authentication product.

On your RADIUS servers you’ll need to add the NetScaler appliances as RADIUS Clients. When NetScaler uses a local (same appliance) load balanced Virtual Server for RADIUS authentication, the traffic is sourced from the NetScaler SNIP (Subnet IP). When NetScaler uses a direct connection to a RADIUS Server without going through a load balancing Virtual Server, or uses a remote (different appliance) Load Balancing Virtual Server, the traffic is sourced from the NetScaler NSIP (NetScaler IP). Use the correct IP(s) when adding the NetScaler appliances as RADIUS Clients. And adjust firewall rules accordingly.

For High Availability pairs, if you locally load balance RADIUS, then you only need to add the SNIP as a RADIUS Client since the SNIP floats between the two appliances. However, if you are not locally load balancing RADIUS, then you’ll need to add the NSIP of both appliances as RADIUS Clients. Use the same RADIUS Secret for both appliances.

When load balancing RADIUS, you’ll want a monitor that verifies that the RADIUS server is functional. The RADIUS monitor will login to the RADIUS server and look for a response. You will need static credentials that the RADIUS monitor can use to login to the RADIUS server.

If you don’t want your monitor to login to RADIUS, then the only other monitoring option is Ping. Adjust the firewall accordingly.

If you have RADIUS Servers in multiple datacenters, you can create multiple load balancing Virtual Servers and cascade them so that the local RADIUS Servers are used first and if they’re not available then the Virtual Server fails over to RADIUS Servers in remote datacenters.

RADIUS Monitor

The RADIUS Monitor attempts to successfully log into the RADIUS server. For RSA, create an account on RSA with the following parameters as mentioned by Jonathan Pitre:

• Setup a user with a fixed passcode in your RSA console.
• Ensure you login with that user at least once to the RSA console because you’ll be asked to change it the first time.
• There is no need to assign a token to your monitor user as long as you are using a fixed passcode. You don’t want to waste a token on a user just for monitoring.

Henny Louwers – Configure RSA RADIUS monitoring on NetScaler:

1. In the NetScaler Configuration Utility, on the left under Traffic Management > Load Balancing, click Monitors.
   
2. On the right, click Add.
   
3. Name the monitor RSA or similar. Change the Type drop-down to RADIUS.
   
4. On the Standard Parameters tab, you might have to increase the Response Time-out to 4.
   
5. On the Special Parameters tab, enter valid RADIUS credentials. Make sure these credentials do not change or expire. For RSA, in the Password field, enter the fixed passcode.
6. Also enter the RADIUS key configured on the RADIUS server for the NetScaler as RADIUS client.
7. For Response Codes, add both 2 and 3. 2 means success while 3 indicates some kind of failure. Either result means that the RADIUS server is responding and thus is probably functional. But 2 is the ideal response.
8. Click Create when done.
   

   add lb monitor RSA RADIUS -respCode 2-3 -userName ctxsvc -password Passw0rd -radKey Passw0rd -resptimeout 4

Servers

1. On the left, expand Traffic Management, expand Load Balancing, and click Servers.
   
2. On the right, click Add.
   
3. Enter a descriptive server name, usually it matches the actual server name.
4. Enter the IP address of the server.
5. Enter comments to describe the server. Click Create.
   

   add server RSA01 10.2.2.42
   add server RSA02 10.2.2.43

6. Continue adding RADIUS servers.
   

Service Groups

1. On the left, expand Traffic Management, expand Load Balancing, and click Service Groups.
   
2. On the right click Add.
   
3. You will create one Service Group per datacenter. Enter a name reflecting the name of the datacenter.
4. Change the Protocol to RADIUS.
   
5. Click OK.
   
6. On the left, in the Service Group Members section, click where it says No Service Group Member.
   
7. If you did not create server objects then enter the IP address of a RADIUS Server in this datacenter. If you previously created a server object then change the selection to Server Based and select the server object.
8. In the Port field, enter 1812 (RADIUS).
9. Click Create.
   
   
10. To add more members, in the Service Group Members section, click where it says 1 Service Group Member.
    
11. Click Add to add another member. Click Close when done.
    
12. On the right, in the Advanced Settings column, click Monitors.
    
13. On the left, in the Monitors section, click where it says No Service Group to Monitor Binding.
    
14. Click the arrow next to Click  to select.
    
15. Select your new RADIUS monitor, and click OK.
    
16. Click Bind.
    
17. To verify the member is up, click in the Service Group Members section.
    
    
18. Highlight a member and click Monitor Details.
    
19. It should say Radius response code 2 (or 3) received. Click OK.
    
20. Click Done to finish creating the Service Group.
    

    add serviceGroup svcgrp-RSA RADIUS
    bind serviceGroup svcgrp-RSA RSA01 1812
    bind serviceGroup svcgrp-RSA -monitorName RSA

21. The Service Group is displayed as UP.
    
22. Add additional service groups for Radius servers in each data center.
    

Virtual Server

1. On the left, expand Traffic Management, expand Load Balancing, and click Virtual Servers.
   
   
2. On the right, click Add.
   
3. Name it RADIUS-HQ-LB or similar. You will create one Virtual Server per datacenter so include the datacenter name.
4. Change the Protocol drop-down to RADIUS.
5. Enter a Virtual IP. This VIP cannot conflict with any other IP/Port already being used. You can use an existing VIP that is not already listening on UDP 1812.
6. Enter 1812 as the Port. Click OK.
   
7. In the Services and Service Groups section, click where it says No Load Balancing Virtual Server ServiceGroup Binding.
   
8. Click the arrow next to Click to select.
   
9. Select a previously created Service Group and click OK.
   
10. Click Bind.
    
11. Click Continue.
    
12. Configuring RADIUS Load Balancing with Persistence at Citrix Docs recommends Rule Based Load Balancing. On the right, in the Advanced Settings column, add the Method section.
    
13. Change the Load Balancing Method to TOKEN.
14. In the Expression field, enter CLIENT.UDP.RADIUS.USERNAME and click OK.
    
15. Click Done to finish creating the Virtual Server.
    
16. If you are configuring this RADIUS Load Balancer for more than just NetScaler Gateway, you can add another Load Balancer on port 1813 for RADIUS Accounting. Then you need a Persistency Group to tie the two load balancers together. See Configuring RADIUS Load Balancing with Persistence at Citrix Docs.

    add lb vserver lbvip-RSA RADIUS 10.2.2.210 1812 -persistenceType RULE -lbMethod TOKEN -rule CLIENT.UDP.RADIUS.USERNAME
    bind lb vserver lbvip-RSA svcgrp-RSA

17. The new Virtual Server should show as Up. If not, click the Refresh icon.
    
18. Create additional Virtual Servers for each datacenter. These additional Virtual Servers do not need a VIP so change the IP Address Type to Non Addressable. Only the first Virtual Server will be directly accessible.
    

    add lb vserver lbvip-RSA-Backup RADIUS 0.0.0.0 0 -persistenceType NONE -cltTimeout 120

    Notice that the additional datacenter Virtual Servers show up with an IP Address of 0.0.0.0 and port of 0.

    

19. After you are done creating a Virtual Server for each datacenter, right-click the primary datacenter’s Virtual Server and click Edit.
    
20. On the right, in the Advanced Settings column, click Protection.
    
21. On the left, in the Protection section, change the Backup Virtual Server to one of the other datacenter Virtual Servers. If all of the services in this datacenter are DOWN, the backup Virtual Server will be used instead. You can cascade multiple Virtual Servers using this method. Click OK and Done.
    

    set lb vserver lbvip-RSA -backupVServer lbvip-RSA-Backup

22. You may now use this Virtual IP in your RADIUS authentication policies for NetScaler Gateway or NetScaler management login.

Navigation

• Monitor to verify that StoreFront is UP
• Server Objects
• Service Group
• Virtual Server
• SSL Redirect
• StoreFront Base URL
• Subscriptions/Favorites Replication Load Balancing

Monitor

Note: This is a Perl monitor, which uses the NSIP as the source IP.

1. On the left, expand Traffic Management, expand Load Balancing, and click Monitors.
   
2. On the right, click Add.
   
3. Name it StoreFront or similar.
4. Change the Type drop-down to STOREFRONT.
   
5. If you will use SSL to communicate with the StoreFront servers, then scroll down, and check the box next to Secure.
   
6. Scroll up, and switch to the Special Parameters tab.
7. In the Store Name field, enter the name of your store (e.g. MyStore) without spaces.
8. Click Create.
   

   add lb monitor StoreFront STOREFRONT -scriptName nssf.pl -dispatcherIP 127.0.0.1 -dispatcherPort 3013 -secure YES -storename Store

Servers

1. On the left, expand Traffic Management, expand Load Balancing, and click Servers.
   
2. On the right, click Add.
   
3. Enter a descriptive server name, usually it matches the actual server name.
4. Enter the IP address of the server.
5. Enter comments to describe the server. Click Create.
   
6. Continue adding StoreFront servers.
   

   add server SF01 10.2.2.57
   add server SF02 10.2.2.58

Service Group

1. On the left, expand Traffic Management, expand Load Balancing, and click Service Groups.
   
   
2. On the right, click Add.
   
3. Give the Service Group a descriptive name (e.g. svcgrp-StoreFront-SSL).
4. Change the Protocol to HTTP or SSL. If the protocol is SSL, ensure that the StoreFront Monitor has Secure checked.
5. If the protocol is SSL, then from Netscaler 11 and Storefront 3.0 load balancing broken at discussions.citrix.com: “Uncheck TLS1.2 and then check it again on Service Group, then it work!”
6. Scroll down and click OK.
   
7. Click where it says No Service Group Member.
   
8. If you did not create server objects then enter the IP address of a StoreFront Server. If you previously created a server object then change the selection to Server Based and select the server objects.
9. Enter 80 or 443 as the port. Then click Create.
   
   
10. To add more members, click where it says 1 Service Group Member and then click Add. Click Close when done.
    
    
11. On the right, under Advanced Settings , click Monitors.
    
12. Click where it says says No Service Group to Monitor Binding.
    
13. Click the arrow next to Click to select.
    
14. Select the StoreFront monitor and click Select.
    
15. Then click Bind.
    
16. To verify that the monitor is working, on the left, in the Service Group Members section, click the Service Group Members line.
    
17. Highlight a member and click Monitor Details.
    
18. The Last Reponse should be Success – Probe succeeded. Click Close twice.
    
19. On the right, under Advanced Settings, click Settings.
    
20. Check the box for Client IP and enter X-Forwarded-For as the Header. Then click OK.
    
21. Then click Done.
    

    add serviceGroup svcgrp-StoreFront-SSL SSL -maxClient 0 -maxReq 0 -cip ENABLED X-Forwarded-For
    
    bind serviceGroup svcgrp-StoreFront-SSL SF01 443
    bind serviceGroup svcgrp-StoreFront-SSL SF02 443
    bind serviceGroup svcgrp-StoreFront-SSL -monitorName StoreFront

22. If the Service Group is http and you don’t have certificates installed on your StoreFront servers (aka SSL Offload), then you’ll need to enable loopback in StoreFront.
    1. In StoreFront 3.5, you enable it in the GUI console.
    2. In StoreFront 3.0, run the following commands on the StoreFront 3.0 servers as detailed at Citrix Blog Post What’s New in StoreFront 3.0.

       & "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"
       
       Set-DSLoopback -SiteId 1 -VirtualPath /Citrix/StoreWeb -Loopback OnUsingHttp

Load Balancing Virtual Server

1. Create or install a certificate that will be used by the SSL Offload Virtual Server. This certificate must match the DNS name for the load balanced StoreFront servers. For email discovery in Citrix Receiver, the certificate must either be a wildcard (*.corp.local) or have a subject alternative name for discoverReceiver.domain.com (domain.com = email address suffix)
   
2. On the left, under Traffic Management > Load Balancing, click Virtual Servers.
   
   
3. On the right click Add.
   
4. Name it lbvip-StoreFront-SSL or similar.
5. Change the Protocol to SSL.
6. Specify a new internal VIP.
7. Enter 443 as the Port.
8. Click OK.
   

   add lb vserver lbvip-StoreFront-SSL SSL 10.2.2.221 443 -persistenceType SOURCEIP -timeout 60

9. On the left, in the Services and Service Groups section, click where it says No Load Balancing Virtual Server ServiceGroup Binding.
   
10. Click the arrow next to Click to select.
    
11. Select your StoreFront Service Group, and click Select.
    
12. Click Bind.
    

    bind lb vserver lbvip-StoreFront-SSL svcgrp-StoreFront-SSL

13. Click OK.
    
14. Click where it says No Server Certificate.
    
15. Click the arrow next to Click to select.
    
16. Select the certificate for this StoreFront Load Balancing Virtual Server, and click Select.
    
17. Click Bind.
    

    bind ssl vserver lbvip-StoreFront-SSL -certkeyName WildCorpCom

18. Click Continue.
    
19. On the right, in the Advanced Settings column, click Persistence.
    
20. Select SOURCEIP.  Do NOT use COOKIEINSERT persistence or Android devices will not function correctly.
21. Set the timeout to match the timeout of Receiver for Web.
22. The IPv4 Netmask should default to 32 bits.
23. Click OK.
    
24. If the NetScaler communicates with the StoreFront servers using HTTP (aka SSL Offload – 443 on client-side, 80 on server-side), and if you have enabled the Default SSL Profile, then you’ll either need to edit the default profile to include the SSL Redirect option or create a new SSL Profile with the SSL Redirect option enabled and bind the SSL Profile to this vServer.
25. If the default SSL Profile is not enabled then you’ll need to edit the SSL Parameters section here and at the top right, check the box next to SSL Redirect. Otherwise the Receiver for Web page will never display.
    

    set ssl vserver lbvip-StoreFront-SSL -sslRedirect ENABLED -ssl3 DISABLED

26. If you haven’t enabled the Default SSL Profile, then perform other normal SSL configuration including: disable SSLv3, bind a Modern Cipher Group, and enable Strict Transport Security.

    bind ssl vserver lbvip-StoreFront-SSL -certkeyName MyCert
    
    set ssl vserver lbvip-StoreFront-SSL -ssl3 DISABLED -tls11 ENABLED -tls12 ENABLED
    
    unbind ssl vserver lbvip-StoreFront-SSL -cipherName ALL
    
    bind ssl vserver lbvip-StoreFront-SSL -cipherName Modern
    
    bind ssl vserver lbvip-StoreFront-SSL -eccCurveName ALL
    
    bind lb vserver lbvip-StoreFront-SSL -policyName insert_STS_header -priority 100 -gotoPriorityExpression END -type RESPONSE

When connecting to StoreFront through load balancing, if you want to put the server name on the StoreFront webpage so you can identify the server, see Nicolas Ignoto Display server name with Citrix StoreFront 3.

SSL Redirect – Down vServer Method

If you created an SSL Offload Virtual Server that only listens on SSL 443, users must enter https:// when navigating to the website. To make it easier for the users, create another load balancing Virtual Server on the same VIP that listens on HTTP 80 and then redirects the user’s browser to reconnect on SSL 443.

This procedure details the Down vServer method of performing an SSL redirect. An alternative is to use the Responder method.

1. On the left, under Traffic Management > Load Balancing, click Virtual Servers.
   
   
2. On the right, find the SSL Virtual Server you’ve already created, right-click it and click Add. Doing it this way copies some of the data from the already created Virtual Server.
   
3. Change the name to indicate that this new Virtual Server is an SSL Redirect.
4. Change the Protocol to HTTP on Port 80.
5. The IP Address should already be filled in. It must match the original SSL Virtual Server.
6. Click OK.
   
7. Don’t select any services. This vServer must intentionally be marked down so the redirect will take effect. Click Continue.
   
8. On the right, in the Advanced Settings column, click Protection.
   
9. In the Redirect URL field, enter the full URL including https://. For example: https://storefront.company.com/Citrix/StoreWeb. Click OK.
   
   
10. Click Done.
    

    add lb vserver lbvip-storefront-HTTP-SSLRedirect HTTP 10.2.2.201 80 -redirectURL "https://storefront.corp.com"

11. When you view the SSL redirect Virtual Server in the list, it will have a state of DOWN. That’s OK. The Port 80 Virtual Server must be DOWN for the redirect to work.
    

StoreFront Base URL

1. Create a DNS Host record that resolves to the new VIP.
   
2. The DNS name for StoreFront load balancing must be different than the DNS name for NetScaler Gateway. Unless you are following the Single FQDN procedure.
   
   
3. In the Citrix StoreFront console, right-click Server Group and click Change Base URL.
   
4. Enter the new Base URL in https://storefront.corp.com format. This must match the certificate that is installed on the load balancer. Click OK.
   

Subscription Replication Load Balancing

If you have multiple StoreFront clusters (separate datacenters), you might want to replicate subscriptions between them. StoreFront subscription replication uses TCP port 808. To provide High Availability for this service, load balance TCP port 808 on the StoreFront servers. See Configure subscription synchronization at Citrix Docs for more information.

1. On the left, expand Traffic Management, expand Load Balancing, and click Service Groups.
   
   
2. On the right, click Add.
   
3. Give the Service Group a descriptive name (e.g. svcgrp-StoreFront-SubRepl).
4. Change the Protocol to TCP.
   
5. Scroll down and click OK.
   
6. Click where it says No Service Group Member.
   
7. In the IP Address field, enter the IP address of a back-end StoreFront server.
8. Enter 808 as the port. Then click Create.
   
   
9. To add more members,  on the left, in the Service Group Members section, click where it says 1 Service Group Member.
   
10. Click Add to add a member. Click Close when done.
    
11. On the right, under Advanced Settings, click Monitors.
    
12. Click where it says No Service Group to Monitor Binding.
    
13. Click the arrow next to Click to select.
    
14. Select the tcp monitor, and click Select.
    
15. Then click Bind, and click Done.
    
    

    add serviceGroup svcgrp-StoreFront-FavRepl TCP
    bind serviceGroup svcgrp-StoreFront-FavRepl SF01 808
    bind serviceGroup svcgrp-StoreFront-FavRepl SF02 808

16. On the left, under Traffic Management > Load Balancing, click Virtual Servers.
    
    
17. On the right click Add.
    
18. Name it lbvip-StoreFront-SubRepl or similar.
19. Change the Protocol to TCP.
20. Specify the same VIP that you used for SSL Load Balancing of StoreFront.
21. Enter 808 as the Port.
22. Click OK.
    
23. Click where it says No Load Balancing Virtual Server ServiceGroup Binding.
    
24. Click the arrow next to Click to select.
    
25. Select your StoreFront Subscription Replication Service Group, and click Select.
    
26. Click Bind.
    
27. Click Continue.
    
28. Then click Done.
    

    add lb vserver lbvip-StoreFront-FavRepl TCP 10.2.2.201 808 -persistenceType SOURCEIP -timeout 5
    
    bind lb vserver lbvip-StoreFront-FavRepl svcgrp-SF-FavRepl

Related Posts

• NetScaler Gateway Session Policies for StoreFront
• StoreFront Server Configuration