Understand Citrix ADC integration with Azure
Role of Citrix ADC in Azure
This domain tests how Citrix ADC VPX is deployed and integrated in Azure to provide Gateway, load balancing, SSL offload, and web application firewall protection for Citrix workloads. You need to understand Azure networking constraints, high availability options, and which Azure load balancer features are required.
Core rules and concepts
- Citrix ADC VPX runs as an Azure VM. Place it in a dedicated subnet with NSGs that allow client 443, management access from trusted networks, and health probe traffic.
- For high availability, deploy an active-passive pair across availability zones or an availability set. Azure Load Balancer can front the pair with a public or internal frontend IP and health probes that determine the active node.
- Use a Standard SKU Azure Load Balancer for production HA. Basic SKU lacks capabilities needed for many HA designs, including multiple availability zone support and HA ports.
- Citrix ADC provides Gateway proxying to StoreFront or Workspace and VDAs, SSL offload, and WAF policies. It can also load balance StoreFront servers or other internal services.
- Plan subnet sizing, accelerated networking support by VM size, and outbound connectivity for ADC management and licensing.
- Azure LB health probes must match the ADC monitoring endpoint; otherwise both nodes may be marked down or traffic may fail over incorrectly.
Worked example
A company publishes Citrix Gateway externally. Two ADC VPX instances sit in different availability zones in the DMZ subnet. A public Standard Azure Load Balancer has a public IP, a backend pool containing both VPX private IPs, and a TCP 443 health probe. NSGs allow internet 443 to the load balancer and probe traffic from the Azure Load Balancer service tag to the VPX subnet. The active VPX terminates TLS and forwards to internal VDAs. The reasoning is that Azure LB provides the stable public entry point while ADC HA provides node redundancy.
Traps that cost marks
Using a Basic SKU load balancer for a zone-redundant HA pair is a common design error. Blocking Azure Load Balancer probe traffic in the NSG marks healthy nodes as down. Placing the ADC management interface on the public internet is unsafe. Forgetting accelerated networking support can limit throughput. Assuming Azure LB performs SSL offload when the ADC does it confuses the layers.
Key points
- Citrix ADC VPX is an Azure VM placed in a dedicated perimeter subnet.
- Active-passive HA commonly uses Azure Standard Load Balancer with health probes.
- NSGs must allow client, management, and Azure LB probe traffic appropriately.
- ADC provides Gateway, SSL offload, load balancing, and WAF; Azure LB provides the stable frontend IP.
- Verify VM size support for accelerated networking and zone placement.