NetScaler/ADC Traffic Management Fundamentals and Architecture
Where traffic enters and leaves the ADC
Citrix ADC (NetScaler) is usually a full proxy: the client TCP connection terminates on a VIP, and a separate server-side connection is opened from a SNIP. The NSIP is the management and HA address, not the address clients use for published applications. VIPs belong to virtual servers; SNIPs provide the appliance's server-side source address. "Use Source IP" (USIP) on a service preserves the client address to the backend, but then the server's return path must also reach the ADC.
Form factors and processing
MPX is hardware, VPX is virtual, CPX is containerized, SDX is multi-tenant hardware, and BLX is bare metal. nCore uses multiple packet engines; a flow is handled by one packet engine, so stateful features such as persistence and SSL session state are local to that engine. This matters when troubleshooting asymmetric routing. Admin partitions divide objects and can hide VIPs and SNIPs from other partitions.
Address and routing rules
- NSIP: management, HA heartbeat, and some backend monitoring; one per node.
- VIP: client-facing virtual-server address; it can sit in a different subnet from the servers.
- SNIP: source address for ADC-initiated connections to servers; it needs a route to the server subnet.
- MAC-based forwarding (MBF) can send return traffic to a destination MAC rather than following the route table; it is not a substitute for a correct SNIP route.
- An HA pair keeps separate NSIPs; VIPs and SNIPs float to the active node.
Worked example
A client opens https://10.0.0.10 to an SSL vserver. A service points to 192.168.10.20:80, and the ADC SNIP is 192.168.10.5. The client TCP connection ends at 10.0.0.10:443; the ADC decrypts and opens a new TCP connection from 192.168.10.5 to 192.168.10.20:80. The server sees 192.168.10.5, not the client. If the server's default gateway is not the ADC, its SYN-ACK may bypass the ADC and the handshake fails. Fix the server route to point at the SNIP, or enable USIP and route the client subnet back through the ADC. Binding an SSL service to port 80 is not the root issue here; the backend service port and protocol must match what the server actually listens on.
Traps
Do not treat the NSIP as a VIP. Do not assume an SSL vserver requires an SSL service: offloading commonly uses an HTTP service. Do not forget the SNIP route, and do not expect service monitors to trigger HA failover of the whole node.