Citrix NetScaler ADC Technology Expert

Form Factors

AppExpert Policy Engine

Policy Language

• Default Syntax Policies (PI) -- Legacy policy engine; limited expressions
• Advanced Policies (AppExpert) -- Full-featured expression language for traffic inspection
• PI Expressions -- Access request attributes: HTTP.REQ.URL, HTTP.REQ.HEADER("X-Forwarded-For"), CLIENT.IP.SRC, HTTP.REQ.BODY(2048)

Policy Types

Policy Binding

Policies are bound to virtual servers at specific bind points:

add rewrite action ACT_ADD_XFF insert_http_header X-Forwarded-For CLIENT.IP.SRC
add rewrite policy POL_ADD_XFF true ACT_ADD_XFF
bind lb vserver VS_APP -policyName POL_ADD_XFF -priority 100 -type REQUEST

Content Switching

# Create content switching vServer
add cs vserver CS_MAIN HTTP 10.0.0.100 80

# Create backend LB vServers
add lb vserver VS_API HTTP 0.0.0.0 0
add lb vserver VS_WEB HTTP 0.0.0.0 0

# Create CS policies
add cs policy POL_API -rule "HTTP.REQ.URL.STARTSWITH(\"/api\")"
add cs policy POL_WEB -rule "HTTP.REQ.URL.STARTSWITH(\"/web\")"

# Bind CS policies to CS vServer
bind cs vserver CS_MAIN -policyName POL_API -targetLBVserver VS_API -priority 100
bind cs vserver CS_MAIN -policyName POL_WEB -targetLBVserver VS_WEB -priority 200

# Default backend
bind cs vserver CS_MAIN -lbvserver VS_WEB

GSLB (Global Server Load Balancing)

• DNS-based geographic load balancing across multiple data centers
• GSLB Sites -- Each DC has a NetScaler; sites exchange metrics via MEP
• MEP (Metric Exchange Protocol) -- Proprietary protocol for real-time metrics sharing between sites
• GSLB Virtual Servers -- Respond to DNS queries with "best" site IP

GSLB Algorithms

GSLB Configuration

# Add GSLB sites
add gslb site SITE_NYC 203.0.113.10
add gslb site SITE_LON 198.51.100.10

# Add GSLB services
add gslb service SVC_NYC_APP SITE_NYC 203.0.113.10 HTTP 80
add gslb service SVC_LON_APP SITE_LON 198.51.100.10 HTTP 80

# Add GSLB vServer
add gslb vserver GSLB_APP HTTP
bind gslb vserver GSLB_APP -serviceName SVC_NYC_APP
bind gslb vserver GSLB_APP -serviceName SVC_LON_APP
set gslb vserver GSLB_APP -lbMethod ROUNDROBIN

# Bind domain
bind gslb vserver GSLB_APP -domainName app.example.com -TTL 30

SSL Offload

• Hardware acceleration -- MPX appliances include dedicated SSL ASICs for TLS processing
• TLS 1.0 through 1.3 -- Configurable per vServer; cipher suite management
• SSL Bridging -- Re-encrypt to backend (end-to-end TLS)
• mTLS -- Client certificate validation; extract cert fields into headers
• Session Multiplexing -- Reuse backend SSL sessions across client requests

# Add SSL certificate and key
add ssl certKey CERT_APP -cert /nsconfig/ssl/app.crt -key /nsconfig/ssl/app.key

# Bind certificate to vServer
bind ssl vserver VS_APP -certkeyName CERT_APP

# Configure cipher group
add ssl cipher CIPHER_MODERN
bind ssl cipher CIPHER_MODERN -cipherName TLS1.3-AES256-GCM-SHA384
bind ssl cipher CIPHER_MODERN -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384

# Bind cipher group to vServer
set ssl vserver VS_APP -ssl3 DISABLED -tls1 DISABLED -tls11 DISABLED -tls12 ENABLED -tls13 ENABLED
bind ssl vserver VS_APP -cipherName CIPHER_MODERN

NetScaler Console (ADM)

• Centralized management for multiple NetScaler instances
• StyleBooks -- Declarative configuration templates; deploy consistent config across fleet
• Analytics -- Web Insight, HDX Insight (Citrix VDI), Gateway Insight
• Config Audit -- Compliance checking against baseline configurations
• Application Dashboard -- End-to-end transaction monitoring; latency breakdown

Kubernetes Integration

CPX as Ingress Controller

apiVersion: apps/v1