StoreFront Load Balancing – NetScaler 10.5

Last Modified: Nov 6, 2020 @ 6:57 am

50 Comments

Navigation

Monitor to verify that StoreFront is UP
Server Objects
Service Group
Virtual Server
SSL Redirect
StoreFront Base URL
Subscriptions/Favorites Replication Load Balancing

Monitor

Note: This is a Perl monitor, which uses the NSIP as the source IP.

On the left, expand Traffic Management, expand Load Balancing, and click Monitors.
On the right, click Add.
Name it StoreFront or similar.
Change the Type drop-down to STOREFRONT.
If you will use SSL to communicate with the StoreFront servers, then scroll down, and check the box next to Secure.
Scroll up, and switch to the Special Parameters tab.
In the Store Name field, enter the name of your store (e.g. Store).

The other two checkboxes are not working with StoreFront 2.6. Click Create.

add lb monitor StoreFront STOREFRONT -scriptName nssf.pl -dispatcherIP 127.0.0.1 -dispatcherPort 3013 -secure YES -storename Store

Servers

On the left, expand Traffic Management, expand Load Balancing, and click Servers.
On the right, click Add.
Enter a descriptive server name, usually it matches the actual server name.
Enter the IP address of the server.
Enter comments to describe the server. Click Create.

Continue adding StoreFront servers.

add server SF01 10.2.2.57
add server SF02 10.2.2.58

Service Group

On the left, expand Traffic Management, expand Load Balancing, and click Service Groups.
On the right, click Add.
Give the Service Group a descriptive name (e.g. svcgrp-StoreFront-SSL).
Change the Protocol to HTTP or SSL. If the protocol is SSL, ensure that StoreFront Monitor has Secure checked.
Scroll down and click OK.
On the right, under Advanced, click Members.
Click where it says No Service Group Member.
If you did not create server objects, then enter the IP address of a StoreFront Server. If you previously created a server object then change the selection to Server Based and select the server objects.
Enter 80 or 443 as the port. Then click Create.
To add more members, click where it says 1 Service Group Member and then click Add. Click Close when done.
On the right, under Advanced, click Monitors.
Click where it says No Service Group to Monitor Binding.
Click the arrow next to Click to select.
Select your StoreFront monitor, and click OK.
Then click Bind.
To verify that the monitor is working, on the left, in the Service Group Members section, click the Service Group Members line.
Highlight a member, and click Monitor Details.
The Last Reponse should be Success – Probe succeeded. Click Close twice.
On the right, under Advanced, click Settings.
Check the box for Client IP and enter X-Forwarded-For as the Header. Then click OK.

Then click Done.

add serviceGroup svcgrp-StoreFront-SSL SSL -maxClient 0 -maxReq 0 -cip ENABLED X-Forwarded-For

bind serviceGroup svcgrp-StoreFront-SSL SF01 443
bind serviceGroup svcgrp-StoreFront-SSL SF02 443
bind serviceGroup svcgrp-StoreFront-SSL -monitorName StoreFront

If the Service Group is http and you don’t have certificates installed on your StoreFront servers (aka SSL Offload), then you’ll need to enable loopback in StoreFront:
1. In StoreFront 3.5, you enable it in the GUI console.
2. In StoreFront 3.0, run the following commands on the StoreFront 3.0 servers as detailed at Citrix Blog Post What’s New in StoreFront 3.0.
```
& "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"

Set-DSLoopback -SiteId 1 -VirtualPath /Citrix/StoreWeb -Loopback OnUsingHttp
```

Load Balancing Virtual Server

Create or install a certificate that will be used by the SSL Offload Virtual Server. This certificate must match the DNS name for the load balanced StoreFront servers. For email discovery in Citrix Receiver, the certificate must either be a wildcard (*.corp.local) or have a subject alternative name for discoverReceiver.domain.com (domain.com = email address suffix)
On the left, under Traffic Management > Load Balancing, click Virtual Servers.
On the right click Add.
Name it lbvip-StoreFront-SSL or similar.
Change the Protocol to SSL.
Specify a new internal VIP.
Enter 443 as the Port.

Click OK.

add lb vserver lbvip-StoreFront-SSL SSL 10.2.2.221 443 -persistenceType SOURCEIP -timeout 60

On the left, in the Services and Service Groups section, click where it says No Load Balancing Virtual Server ServiceGroup Binding.
Click the arrow next to Click to select.
Select your StoreFront Service Group, and click OK.

Click Bind.

bind lb vserver lbvip-StoreFront-SSL svcgrp-StoreFront-SSL

Click OK.
Click where it says No Server Certificate.
Click the arrow next to Click to select.
Select the certificate for this StoreFront Load Balancing Virtual Server, and click OK.

Click Bind.

bind ssl vserver lbvip-StoreFront-SSL -certkeyName WildCorpCom

On the right, in the Advanced column, click Persistence.
On the left, in the Persistence section, select SOURCEIP. Do NOT use COOKIEINSERT persistence or Android devices will not function correctly.
Set the timeout to match the timeout of Receiver for Web.
The IPv4 Netmask should default to 32 bits.
Click OK.
On the right, in the Advanced column, click SSL Parameters.
If the NetScaler communicates with the StoreFront servers using HTTP (aka SSL Offload), at the top right, check the box next to SSL Redirect. Otherwise the Receiver for Web page will never display.

Uncheck the box next to SSLv3.

set ssl vserver lbvip-StoreFront-SSL -sslRedirect ENABLED -ssl3 DISABLED

NetScaler VPX 10.5 build 57 and newer lets you enable TLSv11 and TLSv12. Click OK.

Perform other normal SSL vServer configuration including: disable SSLv3, bind a Modern Cipher Group, and enable Strict Transport Security.

bind ssl vserver lbvip-StoreFront-SSL -certkeyName MyCert

set ssl vserver lbvip-StoreFront-SSL -ssl3 DISABLED -tls11 ENABLED -tls12 ENABLED

unbind ssl vserver lbvip-StoreFront-SSL -cipherName ALL

bind ssl vserver lbvip-StoreFront-SSL -cipherName Modern

bind ssl vserver lbvip-StoreFront-SSL -eccCurveName ALL

bind lb vserver lbvip-StoreFront-SSL -policyName insert_STS_header -priority 100 -gotoPriorityExpression END -type RESPONSE

Then click Done.

SSL Redirect – Down vServer Method

If you created an SSL Offload Virtual Server that only listens on SSL 443, users must enter https:// when navigating to the website. To make it easier for the users, create another load balancing Virtual Server on the same VIP that listens on HTTP 80 and then redirects the user’s browser to reconnect on SSL 443.

This procedure details the Down vServer method of performing an SSL redirect. An alternative is to use the Responder method.

On the left, under Traffic Management > Load Balancing, click Virtual Servers.
On the right, find the SSL Virtual Server you’ve already created, right-click it, and click Add. Doing it this way copies some of the data from the already created Virtual Server.
Change the name to indicate that this new Virtual Server is an SSL Redirect.
Change the Protocol to HTTP on Port 80.
The IP Address should already be filled in. It must match the original SSL Virtual Server.
Click OK.
Don’t select any services. This vServer must intentionally be marked down so the redirect will take effect. Click Continue.
On the right, in the Advanced column, click Protection.
In the Redirect URL field, enter the full URL including https://. For example: https://storefront.company.com/Citrix/StoreWeb. Click OK.

Click Done.

add lb vserver lbvip-storefront-HTTP-SSLRedirect HTTP 10.2.2.201 80 -redirectURL "https://storefront.corp.com"

When you view the SSL redirect Virtual Server in the list, it will have a state of DOWN. That’s OK. The Port 80 Virtual Server must be DOWN for the redirect to work.

StoreFront Base URL

Create a DNS Host record that resolves to the new VIP.
The DNS name for StoreFront load balancing must be different than the DNS name for NetScaler Gateway. Unless you are following the Single FQDN procedure.
In the Citrix StoreFront console, right-click Server Group and click Change Base URL.
Enter the new Base URL in https://storefront.corp.com format. This must match the certificate that is installed on the load balancer. Click OK.

Subscription Replication Load Balancing

If you have multiple StoreFront clusters (separate datacenters), you might want to replicate subscriptions between them. StoreFront subscription replication uses TCP port 808. To provide High Availability for this service, load balance TCP port 808 on the StoreFront servers. See Configure subscription synchronization at Citrix Docs for more information.

On the left, expand Traffic Management, expand Load Balancing, and click Service Groups.
On the right, click Add.
Give the Service Group a descriptive name (e.g. svcgrp-StoreFront-SubRepl).
Change the Protocol to TCP.
Scroll down and click OK.
On the right, under Advanced, click Members.
Click where it says No Service Group Member.
In the IP Address field, enter the IP address of a back-end StoreFront server.
Enter 808 as the port. Then click Create.
To add more members, on the left, in the Service Group Members section, click where it says 1 Service Group Member.
Click Add to add a member. Click Close when done.
On the right, under Advanced, click Monitors.
Click where it says No Service Group to Monitor Binding.
Click the arrow next to Click to select.
Select the tcp monitor, and click OK.

Then click Bind, and click Done.

add serviceGroup svcgrp-StoreFront-FavRepl TCP
bind serviceGroup svcgrp-StoreFront-FavRepl SF01 808
bind serviceGroup svcgrp-StoreFront-FavRepl SF02 808

On the left, under Traffic Management > Load Balancing, click Virtual Servers.
On the right click Add.
Name it lbvip-StoreFront-SubRepl or similar.
Change the Protocol to TCP.
Specify the same VIP that you used for SSL Load Balancing of StoreFront.
Enter 808 as the Port.
Click Continue.
Click where it says No Load Balancing Virtual Server ServiceGroup Binding.
Click the arrow next to Click to select.
Select your StoreFront Subscription Replication Service Group, and click OK.
Click Bind.
Click OK.
On the right, in the Advanced column, click Persistence.
Select SOURCEIP persistence.
Set the timeout to 5 minutes.
The IPv4 Netmask should default to 32 bits.
Click OK.