Had a case earlier today where a customer wanted to configure Netscaler to authenticate with UPN instead of SamAccountName. And using UPN instead of SamAccountName makes sense in many cases, since it easier for users to remember their email-address instead of their username. So in this scenario my samAccoutName is msandbu and my UPN is firstname.lastname@example.org
Now by default Netscaler is setup with samAccoutName under server logon name attribute. This defines what kind of account name you are allowed to logon with using Netscaler.
If you try to logon with UPN when SamAccountName is defined you will get this kind of error message on the StoreFront Server.
So Storefront strips the domain info sent from the Netscaler and tries to validate the credentials to Active Directory.
So how to fix this ?
You have to define the SSO name attribute in the LDAP credential, to samAccountName.
Then the Netscaler firstly validates the UPN, get the SamAccountName of the user and then forwards that to Storefront and logs in.
Important to remember that Storefront always tried to revalidate the info from Netscaler
On the next Netscaler Masteclass in October I will be presenting a session, regarding System Center and Netscaler. To talk about different forms of integration and monitoring.
For those who aren’t familiar with the Masterclass it is a webinar series that is hosted by Citrix, which are hosted once a month.
So sign up here if you want to know more –> http://www.citrix.com/events/netscaler-master-class.html
Now since the release of 10.5 I have been able to test alot of the new features in the latest release. Citrix has also released new versions of Insight and Endpoint clients for Windows & Mac to match the new release.
The upgrades have so far for my part have been non-problematic (in case of a custom GUI you may need to recreate it) from 9.3 and even 10.1 builds. For those that are in a migration plan please refer to the migration document from Citrix http://support.citrix.com/proddocs/topic/ns-faq-map-10-5/ns-faq-migration.html
I have also seen a performance increase in some scenarioes.
There has also been an update on the clustering features, which didn’t caught my eye at first. http://support.citrix.com/proddocs/topic/ns-system-10-map/ns-cluster-feat-supp-ref.html Which allows us to have a Netscaler Gateway vServer running on a local Netscaler node.
Now the new build is 99% pure HTML which is great! there are still some features which still requires JRE, but this is going to be fixed in a future release.
The following features or nodes still require JRE:
- Upgrade Wizard
- User Administration
- Command Policies
- Command Policy RegEx Editor
- Network > Network Visualizer
- Network > TCP/IP connections
- Traffic Management > Load Balancing > Visualizer
- Traffic Management > Content Switching > Visualizer
- Traffic Management > GSLB > Visualizer
- Application Firewall
- Application Firewall wizard
- Add/ Edit/ Import profiles
- Update Version
- Auto Update Settings
- Application Firewall
Citrix has also made easier integrations for their own products such as XenDesktop/XenMobile/Sharefile and so on, which makes it easier for consultants to deploy Netscaler solution to provide availability for other products.
Now all of the new features are listed here –> http://support.citrix.com/proddocs/topic/ns-rn-main-release-10-5-map/netscaler-10-5-rn.html
One thing which I find is the most important featue in the latest build (besides the new GUI) is the front-end optimization feature which allows the Netscaler to reduce load and render times on web pages which are rendered on a client browser, after some intials tests with this feature I was able to save 60% of the load time. Since in most cases a web site is not optimized for speed, and therefore Netscaler might be an important piece there.
But to sum it up so far, I’m really impressed with the latest release and how Citrix has made Netscaler even more powerful with more then 100 more features, and makes it a more key component in most datacenters. Looking forward to the later releases to see what Citrix has up their sleeve!
A couple of days ago I was involved in a case where ICA sessions were suddenly disconnected and the users were unable to reconnect. The setup was a simple ICA-proxy access gateway using the latest build (126) and there were no error messages on the Storefront server.
After involving Citrix support they recommended that we disable AppFlow for the access gateway (since this deployment used Netscaler Insight to monitor ICA sessions) then suddenly things started to work again.
Now I knew that I’ve seen this issue before somewhere on twitter, a quick tweet discovered that someone else has seen the issue as well.
So apparently using Appflow with session reliability is a NO-GO!
If someone has managed to test this with 10.5 please give me some feedback if this has been fixed!
So there has been some fuzz regarding the latest release of Netscaler 10.5 (also codename Tagma) which should been the death of Java GUI within Netscaler. Not quite there yet..
So what has Citrix improved / added in this feature ? Well it is quite a lot. Citrix states that they have added over 100 new features in this release. Beta 1 has just been released to partners, and beta 2 is on its way which is coming mid may.
In the later betaes which are coming there are coming more templates to App and load balancing. But let us focus on the news that’s arrived now.
- HTML5 based GUI
- NITRO SDK for Python
- NITRO for File Operations
- NITRO for ZebOS system
- GSLB Static proximity sync
- SSL configuration Profiles
- CNAME record caching
- Multiple Port CS
- AAA Session Stickiness
- Kerberos Performance
- Jumbo Frames
- Link Redundancy
- TCP BIC and CUBIC
- SPDYv3 Gateway
- SDX Manageability
- Front End Optimization
- Insight Center Enhancements
First of is the GUI which is now mostly pure HTML 5 which makes it quite snappy! I would say that about 80% of the GUI is now HTML 5, some features such as running trace still uses Java (Im guessing this is something that is going to get fixed in a later release.
So what is new under licensing part ? We can see that there are some new features which appear here, such as Integrated Disk caching and RISE (Which is part of the Cisco platform)
There is also two new “features” within Traffic optimization
* Front End Optimization (Which converts data which is being sent back to the user, such as convert image files)
And we have content accelerator (Which is used for integration with Citrix ByteMobile)
Also setting up a new Netscaler Gateway is also alot easier since we don’t need the Java part anymore.
Also support for LLDP is here, which is a information exchange protocol kinda like CDP (from Cisco) So here is a comparison between the old GUI and the new GUI
There is also a list of new monitors which are built-in
Also support for LACP on interfaces which allows you to team NICs.
Citrix has also added some basic wizards which allow for easier setup against XenDesktop / Sharefile and such.
Also SSL profiles and DTLS profiles
We also have support for Jumbo Frames which allows for up to 9000 bytes of payload instead of 1500.
And one thing that is missing is Edgesight monitoring from Netscaler which looks like it has been removed for good. One thing which I didn’t find in the beta but is mentioned in the video is support for Oracle (which most likely coming in a later beta) o this is just my findings in the latest Beta. ill update when the next beta is coming! Looks like we have much to look forward to!
In the many releases of Netscaler VPX (Starting with builds after 9.2) have had some minor issues with additional latency when running on VMware.
This has been a known issue for quite some time, and of course there has been a workaround available as well.
NetScaler VPX Appliance
- Issue ID 0326388: In sparse traffic conditions on a NetScaler VPX virtual appliance installed on VMware ESX, some latency might be observed in releases after 9.3 as compared to release 9.2. If this latency is not acceptable, you can change a setting on the appliance. At the shell prompt, type:
Perform a warm reboot for the above change to take effect. To have the new setting automatically applied every time the virtual appliance starts, add the following command to the /nsconfig/nsbefore.sh file:
But! I am happy to say that this has been fixed in the latest build (126.12) so we no longer require to run the commandline to fix the latency issue
Something I’ve been planning to write for a while but with all the stuff happening lately, its hard to keep track. So this is a question that comes by now and then, how does netscaler handle route entries ?
Now a Netscaler often sits between many differnet networks with a leg in DMZ, one in the internal sone and other sones. Some deployments might be two-armed with more network attached to the Netscaler, and some require it to only be using one vlan because of security requirements.
Now what decides which network the Netscaler uses to communicate with the backend servers? Since Netscaler is a L3 device it uses IP and routing tables to determine where to go.
When you are deploying a Netscaler, one of the requirements is to setup a default gateway and a subnet IP. When you add a default gateway a route entry will be added to it automatically. This route entry looks like this
Which essentially says, all traffic which I have no information about will be sent to my default gateway which is 192.168.88.1.
So if my Netscaler sits on the IP 192.168.88.2 with a prefix of / 24 and the Netscaler needs to get in touch with 192.168.89.2, then the Netscaler will go trough the default gateway.
Now also when you add a subnet-IP another route entry is added automatically where the subnet IP itself is listed as a gateway IP for reaching another subnet. This Netscaler has two SNIPs. one in the 192.168.88.0/24 network and another in the 192.168.31.0/24 network
So all traffic destined to the 192.168.31.0 network is tunneled trough the 192.168.31.127 network. Another thing that is these route entries have a prefix of /24. Meaning that the Netscaler can contact 192.168.31.127 if it needs to get in touch with an IP within that range.
Then this means that the Netscaler might have multiple paths to other subnets ? Since my default-gateway might also have access to 31 and the 88 network. Like other layer 3 devices like Cisco looks at the prefix and then decides which is closest to the target. Netscaler operates only at the cost to get to the remote location. (Thanks to Andrew for that)
Now the default gateway route has a cost of 0
But the SNIP’s have a non-existing cost value
Meaning that they are prefered paths. If I was to have multiple SNIP’s which has access to a back-end service it might also get a conflict, this can be resolved using Net-profiles, this allows you to define which source ip adress should be used to connect to the back-end services.
Attach Net-Profile to a service
But what if you are required to use a one-armed deployment ? and need access to several backend networks for the service/probes to work properly.
Then you need to add a new static route which might look like this. This static route entry says the following. “If you need to access the 192.168.89.0/24 network you need to contact 192.168.88.1)
This new route will be listed as a static route and will have the same cost as the default gateway, but since this gateway sits closer to the targets in the 89. network it will be prefered over the default gateway.
So hopefully this clears up some confusion for people out there!
Microsoft has done a great job adding features to the cloud platform over the last year, one of which is Azure MFA (Multi Factor Authentication) which allows a user to login with his/hers username and password and a second option which might be a pin-code or one time pin or something else.
Now just to show how we can use Azure MFA with non-windows services I decided to give it a try with Citrix Netscaler AAA vServer. So here is a overview of how the service looks like.
The Azure MFA requires a local server component which proxies authentication attempts between the client and the authentication server. In my case I use the MFA component as an RADIUS server and then proxies RADiUS connections to the AD domain and adds the two-factor component on top.
The Netscaler AAA vServer can be used to proxy authentication attempts to backend services, such as Exchange, RDweb and such. This is the type that is also used when logging into a Netscaler Gateway session.
Now for the purpose of this demonstration, I setup a load balanced web-service which consist of two web servers. The webservers themselves have no authentication providers, so therefore I needed to create an AAA vServer on the Netscaler which users will be redirected to in order to authenticate to see the web content.
So a simple load balanced services, and then I added a AAA vServer to the service.
Note that the aaa.test.local is an internal service on the Netscaler (Make sure that DNS is in place and a nameserver is added to the Netscaler) In order to create the AAA vServer go into Security –> AAA –> Virtual Servers and choose create new.
There we need to create a new server, and make sure that the domain name is correct and that a trusted certificate is added
Then under Authentication we need to define a authentication server. Now this can be setup to forward authentication attempts to RADIUS, LDAP, LOCAL, SAML and so on. Since we want to use Azure FMA here we can use RADIUS.
Now in my case I created a authentication policy where I used the expression ns_true which means that all users going trough the Netscaler are going to recieve this policy
My authentication policy looks like this. The Authentication server here is the server which is going to get the Azure MFA service installed (I also predefined a secret key) Also important that the time-out here is put to 60 seconds, this is to grant enough time for the authentication to finish.
Remember certificates here are important! if the clients does not trust the certificate you will get a HTTP 500 error messages.
Now after this is done we can start setting up Azure MFA. First off, make sure that you have some sort of DirSync solution in place so that you can bind a local user to a user in Azure AD. If you do not have this, just google DirSync + Azure you’ll get a ton of blogposts on the subject
In my case I didn’t have DirSync setup so I created a new local UPN which resembled the usernames@domains in Azure so that the MFA service managed to bind a local user to a azure user.
Firstly you need an Azure AD domain
Then choose create new multi-factor auth provider
After you have created the provider, mark it and choose Manage. from there you can download the software.
Now download the software and make sure that you have an server which you can install it on. When installing the server components you are asked to enter a username and password for authentication, this user can be generated from the Azure portal
You are also asked to join a group, this is the same group that you created when setting up the multi-factor authenticaiton provider in Azure.
During the installation wizard you are asked to use the quick setup, here you can configure the wizard against RADIUS automatically.
Then you are also asked to enter the IP address of the RADIUS client, this is the Netscaler NSIP.
After you are done here, finish the wizard and start the MFA application. Firstly make sure that the RADIUS client info is correct
Then go into Target. Since we want the MFA server to proxy connections between the RADIUS client and the AD domain, choose Windows Domain as target
Then go into Directory Integration and choose either Active Directory or choose specific LDAP config if you need to use another AD username and password.
Next go into Users, and choose which Users are enabled for two-factor authentication. In my case I only want one. Here I can define what type of two-factor I want to use for my user.
If I choose phone-call with PIN I get a auto generated phonecall where I can enter my pin code directly.
Now I have also added my phone number so the service can reach me with a OTP. So after all this is setup I can try to login to my service.
Login with my username and password and voila! I get this text message on my phone.
After I reply with the verification code, I am successfully authenticated to the service.
With 2012 R2 and RDS Microsoft has gotten better at devilering remote terminal server sessions. And since the cost of RDS is quite low compared to other platforms such as Vmware or Citrix.
RDS Gateway is a feature which allow us to tunnel RDP traffic inside HTTP packets or HTTPS to be exact and it can be used as an gateway to other servers, which makes it a suitble server to place in the DMZ.
Borrowed from technet: http://i.technet.microsoft.com/dynimg/IC470916.jpg
The problem with is that you do not have any high-availability functions on it, whcih makes it a bit hazzle to setup in a larger deployment. Sure we can use a farm but this is not a fully highly availble solution
With server 2012, Microsoft also added the use of UDP protocol to deliver the graphical while TCP is more used to maintain a session and control actions and such. It is also possible to disable UDP but you get a more sluggish experience.
Connection when UDP is enabled
So basically a RDS Gateway in 2012 R2 is a service which responds to TCP HTTPS (443) and UDP (3391)
Now how could this look like with a Netscaler in front, used to load balace between different RDS gateway servers ?
NOTE: This guide is going to assume that we are going to load balance 443 and 3391.
First we need to go into the Netscaler and add the different back-end servers which run the RDS gateway feature.
Next we need to attach a service to the back-end servers. Now since the RDS Gateway feature uses more then one port (and services in Netscaler is typically 1 Protocol 1 Port binding) we need to use the ANY protocol and we need to enther * in the port field. (We are going to use ACLs later to lock down the system) since this in general means that Netscaler will load balace any protocol and all ports.
Now we can use a https monitor against the backend servers since https:443 is used to establish the connection. The problem is that since we entered * in the port field the built-in https monitor will fail since it does not know which port to prope. Therefore you should create a custom https monitor where you enter the specific port nr 443.
Which then again should be bound to the service. After you have created a service for each backend server (or service group) we need to create a load balanced service which is bound to Protocol ANY and Port ANY
Now the ANY protocol acts like a bridge so you do not need to put any certificates on this vServer but use it as an regular extension on the all-ready in place deployment
After you have created the service remember that you need to put ACLs in place for UDP 3391 and TCP 443 since the Netscaler will now by default load balance any requests to any back-end servers.
Also you should use persistency based upon how long you want the user to be able to use the same session on the gateway.
I was just acccepted into the Netscaler command beta and already took it for a test drive. So for those who are not familier with Commad Center it is a product from Citrix which allows for easy management / monitoring of Netscaler products (including Netscaler VPX/MPX/SDX and Netscaler gateway and cloudbridge products.
The product is not like Insight or Netscaler which runs as an virtual appliance, this is a java based software which needs to run on top of Windows Server (It does not support yet) and it stores data in a mySQL database.
Now im not going to show the setup, but how the admin console looks like (Since the setup is really straight forward)
The admin GUI is available using https://ip:8443 (using the default ports) and username root and password public
After login I am shown an overview pane which shows the status of the devices which I have added to the Command Center
Now before I show how to add a device, there is some cool stuff here which is quite useful and that is configuration part here!
Now i can schedule a software update to automatically stop a ha node and change node and do update, reboot and then change the node. I can do certificate management and have a central repostiory I can also do deployment automation
Now adding a device here is quite simple, choose Citrix Network –> Add Device. Firstly you need to create a device profile which contains user credentials and SNMP info
And for what product you are going to use these credentials against. It will then do a discovery using NITRO API and SNMP against the device/s. After that I can see that the device is showing as operational. If I click on the name here it will automatically connect to the device using the management IP.
So if I now do a change on a device which is added to the Command Center it will show SNMP traps for every change that I do.
I can also setup integration with an SMTP server to allow command center to send out alerts on email if a critical event has happend.
So if you have more then two Netscaler nodes I suggest implementing Command Center since it allows for ease of management and reporting. One issue I still have with it is that it does not support Windows Server 2012 but this is still beta 2 and im guessing it will show up later on.