StoreFront Load Balancing – NetScaler 11.1

Last Modified: Nov 7, 2020 @ 6:35 am

Navigation

Monitor to verify that StoreFront is UP
Server Objects
Service Group
Virtual Server
SSL Redirect
StoreFront Base URL
Subscriptions/Favorites Replication Load Balancing

Monitor

Note: This is a Perl monitor, which uses the NSIP as the source IP. You can use RNAT to override this as described in CTX217712 How to Force scriptable monitor to use SNIP in Netscaler in 10.5.

On the left, expand Traffic Management, expand Load Balancing, and click Monitors.
On the right, click Add.
Name it StoreFront or similar.
Change the Type drop-down to STORERONT.
If you will use SSL to communicate with the StoreFront servers, then scroll down, and check the box next to Secure.
Scroll up, and switch to the Special Parameters tab.
In the Store Name field, enter the name of your store (e.g. MyStore) without spaces.

Click Create.

add lb monitor StoreFront STOREFRONT -scriptName nssf.pl -dispatcherIP 127.0.0.1 -dispatcherPort 3013 -secure YES -storename Store

Servers

On the left, expand Traffic Management, expand Load Balancing, and click Servers.
On the right, click Add.
Enter a descriptive server name, usually it matches the actual server name.
Enter the IP address of the server.
Enter comments to describe the server. Click Create.

Continue adding StoreFront servers.

add server SF01 10.2.2.57
add server SF02 10.2.2.58

Service Group

On the left, expand Traffic Management, expand Load Balancing, and click Service Groups.
On the right, click Add.
Give the Service Group a descriptive name (e.g. svcgrp-StoreFront-SSL).
Change the Protocol to HTTP or SSL. If the protocol is SSL, ensure that the StoreFront Monitor has Secure checked.
Scroll down and click OK.
Click where it says No Service Group Member.
If you did not create server objects then enter the IP address of a StoreFront Server. If you previously created a server object then change the selection to Server Based and select the server objects.
Enter 80 or 443 as the port. Then click Create.
Click OK.
On the right, under Advanced Settings , click Monitors.
Click where it says says No Service Group to Monitor Binding.
Click the arrow next to Click to select.
Select your StoreFront monitor and click Select.
Then click Bind.
To verify that the monitor is working, on the left, in the Service Group Members section, click the Service Group Members line.
Click the ellipsis next to a member and click Monitor Details.
The Last Response should be Success – Probe succeeded. Click Close twice.
On the right, under Advanced Settings, click Settings.
On the left, in the Settings section, check the box for Client IP and enter X-Forwarded-For as the Header. Then click OK.

Then click Done.

add serviceGroup svcgrp-StoreFront-SSL SSL -maxClient 0 -maxReq 0 -cip ENABLED X-Forwarded-For

bind serviceGroup svcgrp-StoreFront-SSL SF01 443
bind serviceGroup svcgrp-StoreFront-SSL SF02 443
bind serviceGroup svcgrp-StoreFront-SSL -monitorName StoreFront

If the Service Group is http and you don’t have certificates installed on your StoreFront servers (aka SSL Offload) then you’ll need to enable loopback in StoreFront.
1. In StoreFront 3.5 and newer, you enable it in the GUI console.
2. In StoreFront 3.0, run the following commands on the StoreFront 3.0 servers as detailed at Citrix Blog Post What’s New in StoreFront 3.0.
```
& "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"

Set-DSLoopback -SiteId 1 -VirtualPath /Citrix/StoreWeb -Loopback OnUsingHttp
```

Load Balancing Virtual Server

Create or install a certificate that will be used by the SSL Offload Virtual Server. This certificate must match the DNS name for the load balanced StoreFront servers. For email discovery in Citrix Receiver, the certificate must either be a wildcard (*.corp.local) or have a subject alternative name for discoverReceiver.domain.com (domain.com = email address suffix)
On the left, under Traffic Management > Load Balancing, click Virtual Servers.
On the right click Add.
Name it lbvip-StoreFront-SSL or similar.
Change the Protocol to SSL.
Specify a new internal VIP.
Enter 443 as the Port.

Click OK.

add lb vserver lbvip-StoreFront-SSL SSL 10.2.2.221 443 -persistenceType SOURCEIP -timeout 60

On the left, in the Services and Service Groups section, click where it says No Load Balancing Virtual Server ServiceGroup Binding.
Click the arrow next to Click to select.
Select your StoreFront Service Group and click Select.

Click Bind.

bind lb vserver lbvip-StoreFront-SSL svcgrp-StoreFront-SSL

Click Continue.
Click where it says No Server Certificate.
Click the arrow next to Click to select.
Select the certificate for this StoreFront Load Balancing Virtual Server and click Select.

Click Bind.

bind ssl vserver lbvip-StoreFront-SSL -certkeyName WildCorpCom

Click Continue.
On the right, in the Advanced Settings column, click Persistence.
On the left, in the Persistence section, select SOURCEIP. Do NOT use COOKIEINSERT persistence or Android devices will not function correctly.
Set the timeout to match the timeout of Receiver for Web.
The IPv4 Netmask should default to 32 bits.
Click OK.
If the NetScaler communicates with the StoreFront servers using HTTP (aka SSL Offload – 443 on client-side, 80 on server-side), and if you have enabled the Default SSL Profile, then you’ll either need to edit the Default SSL Profile to include the SSL Redirect option, or create a new custom SSL Profile with the SSL Redirect option enabled, and then bind the custom SSL Profile to this vServer.
If the default SSL Profile is not enabled, then you’ll need to edit the SSL Parameters section on the vServer, and at the top right, check the box next to SSL Redirect. Otherwise the Receiver for Web page will never display.

set ssl vserver lbvip-StoreFront-SSL -sslRedirect ENABLED -ssl3 DISABLED

If you haven’t enabled the Default SSL Profile, then perform other normal SSL configuration including: disable SSLv3, bind a Modern Cipher Group, and enable Strict Transport Security.

bind ssl vserver lbvip-StoreFront-SSL -certkeyName MyCert

set ssl vserver lbvip-StoreFront-SSL -ssl3 DISABLED -tls11 ENABLED -tls12 ENABLED

unbind ssl vserver lbvip-StoreFront-SSL -cipherName ALL

bind ssl vserver lbvip-StoreFront-SSL -cipherName Modern

bind ssl vserver lbvip-StoreFront-SSL -eccCurveName ALL

bind lb vserver lbvip-StoreFront-SSL -policyName insert_STS_header -priority 100 -gotoPriorityExpression END -type RESPONSE

When connecting to StoreFront through load balancing, if you want to put the server name on the StoreFront webpage so you can identify the server, see Nicolas Ignoto Display server name with Citrix StoreFront 3.
Server name is displayed

SSL Redirect – SSL Load Balancing vServer Method

Users must enter https:// when navigating to the StoreFront website. To make it easier for the users, enable SSL Redirection.

This procedure details the SSL Load Balancing vServer method of performing an SSL redirect. An alternative is to use the Responder method.

On the left, under Traffic Management > Load Balancing, click Virtual Servers.
On the right, find the SSL Virtual Server you’ve already created, click the ellipsis next to it and click Edit.
In the Basic Settings section, click the pencil icon.
Click the More link.
In the Redirect from Port field, enter 80.
In the HTTPS Redirect URL field, enter your StoreFront Load Balancing URL (e.g. https://storefront.corp.com).

Scroll down and click Continue twice.

set lb vserver lbvip-StoreFront-SSL -redirectFromPort 80 -httpsRedirectUrl https://storefront.corp.com

This method does not add any new vServers to the list so it’s not easy to see if this is configured.

StoreFront Base URL

Create a DNS Host record that resolves to the new VIP.
The DNS name for StoreFront load balancing must be different than the DNS name for NetScaler Gateway. Unless you are following the Single FQDN procedure.
In the Citrix StoreFront console, right-click Server Group and click Change Base URL.
Enter the new Base URL in https://storefront.corp.com format. This must match the certificate that is installed on the load balancer. Click OK.

Subscription Replication Load Balancing

If you have multiple StoreFront clusters (separate datacenters), you might want to replicate subscriptions between them. StoreFront subscription replication uses TCP port 808. To provide High Availability for this service, load balance TCP port 808 on the StoreFront servers. See Configure subscription synchronization at Citrix Docs for more information.

On the left, expand Traffic Management, expand Load Balancing, and click Service Groups.
On the right, click Add.
Give the Service Group a descriptive name (e.g. svcgrp-StoreFront-SubRepl).
Change the Protocol to TCP.
Scroll down and click OK.
Click where it says No Service Group Member.
Change the selection to Server Based and select the StoreFront servers.
Enter 808 as the port. Then click Create.
Click OK.
On the right, under Advanced Settings, click Monitors.
On the left, in the Monitors section, click where it says No Service Group to Monitor Binding.
Click the arrow next to Click to select.
Select the tcp monitor and click Select.

Then click Bind and click Done.

add serviceGroup svcgrp-StoreFront-FavRepl TCP
bind serviceGroup svcgrp-StoreFront-FavRepl SF01 808
bind serviceGroup svcgrp-StoreFront-FavRepl SF02 808

On the left, under Traffic Management > Load Balancing, click Virtual Servers.
On the right, click the ellipsis next to the existing StoreFront Load Balancing vServer, and click Add.
Name it lbvip-StoreFront-SubRepl or similar.
Change the Protocol to TCP.
Specify the same VIP that you used for SSL Load Balancing of StoreFront.
Enter 808 as the Port.
Click OK.
Click where it says No Load Balancing Virtual Server ServiceGroup Binding.
Click the arrow next to Click to select.
Select your StoreFront Subscription Replication Service Group and click Select.
Click Bind.
Click Continue.