Citrix CCA-N flashcards
Citrix CCA-N · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- NSIP
- The NetScaler IP address used for management access and HA heartbeat. It is not used for load-balanced traffic unless explicitly configured as a service or VIP address.
- Traffic domain
- A logical partition of the ADC with its own NSIP, SNIPs, VIPs, and routing table. Entities in one domain are invisible to other domains on the same appliance.
- Policy-based routing
- A routing rule that selects a next hop by source IP, destination IP, or protocol rather than the destination subnet alone. PBR is evaluated in priority order.
- Packet engine
- A CPU-bound data-plane process that processes packets. MPX throughput scales with the number of active packet engines, each pinned to a core.
- MAC-based forwarding
- A one-arm deployment mode where the ADC forwards return traffic back to the same interface by MAC address, keeping traffic symmetric when a single NIC is used.
- Active/active HA
- An HA pair where both nodes process traffic. The primary owns the VIPs and the secondary takes over on failover, unlike active/standby where only the primary serves traffic.
- HA heartbeat
- The keepalive between HA nodes, default 3 seconds. Loss of heartbeat, interface failure, or a forced failover triggers a failover to the secondary node.
- Session synchronization
- An HA option that replicates persistent sessions and connection state to the peer. Without it, a failover flushes the connection table and resets active sessions.
- Cluster CLIP
- The cluster IP address used to manage an n-way cluster. Nodes share a striped configuration, and the cluster backplane carries inter-node traffic.
- One-arm deployment
- A deployment where the ADC uses a single interface for both client and server traffic. It requires MAC-based forwarding or PBR to keep return traffic symmetric.
- Load-balancing vServer
- A virtual IP and port bound to a protocol and a set of services or service groups. It distributes client requests across the bound backends using the configured LB method.
- Monitor
- A health check bound to a service. The service is UP only when the monitor succeeds; interval and retry settings determine failover speed and false-positive risk.
- Cookie persistence
- A sticky method that inserts or rewrites an HTTP cookie so subsequent requests from the same client go to the same backend service.
- Content switching vServer
- A vServer that routes requests by policy to target LB vServers. Policies use expressions such as HTTP host or URL and are evaluated in priority order.
- Backup vServer
- A fallback vServer that receives traffic when all services in the primary vServer are DOWN. A redirect URL can instead send clients to a maintenance page.
- Service group
- A container of services bound to one vServer. Members share monitor bindings, and each member's state is managed individually, reducing configuration duplication.
- SSL offload
- Terminating TLS at the ADC on the front end, optionally re-encrypting to the backend. The ADC holds the server certificate and private key for the handshake.
- Certificate-key link
- The operation that associates a certificate with its private key before binding to an SSL vServer. An unlinked key causes the bind to fail.
- Intermediate CA chain
- The intermediate certificates that must be linked and bound so the ADC sends the full chain. Without them, clients see an incomplete chain and may reject the connection.
- SNI
- Server Name Indication lets multiple certificates share one VIP:port. The ADC selects the certificate by the client's SNI hostname, so each hostname needs its own cert-key pair.
- OCSP stapling
- The ADC presents a signed revocation response to clients, avoiding a client-side OCSP lookup. It reduces handshake latency and improves revocation checking reliability.
- SSL profile
- A reusable set of TLS parameters, including protocol versions and cipher order. Binding it to an SSL vServer overrides the vServer's default SSL settings.
- GSLB vServer
- A DNS-based vServer that answers queries for a configured FQDN. It selects a site by metric and returns that site's IP address to the client.
- Static proximity
- A GSLB method that maps the client subnet to the nearest site using a location database. It returns the closest healthy site for the query.
- GSLB site
- A container of local and remote GSLB services. Local services are monitored locally; remote sites are reached via site-to-site RPC on TCP 3009 by default.
- GSLB persistence
- A setting that keeps a client on the same site for a configured TTL. Without it, DNS answers can change between queries and break stateful sessions.
- GSLB RPC
- The protocol that exchanges metrics between GSLB sites on TCP 3009. Firewall rules must allow it between site NSIPs, and the RPC password must match.
- Authentication vServer
- A front-end vServer for the login flow. It binds authentication policies that reference actions such as LDAP, RADIUS, SAML, certificate, or local.
- LDAP authentication action
- A configuration that specifies the LDAP server, base DN, bind DN, and login attribute. The ADC binds to LDAP to validate credentials and can retrieve group membership.
- SAML assertion validation
- The ADC validates the IdP's assertion against the IdP certificate. Expired assertions or clock skew cause login failures even when credentials are correct.
- Responder policy
- A policy that inspects requests and can block, redirect, or rate-limit traffic by URL, header, or geo. It enforces authorization after authentication completes.
- nstrace
- A packet capture on the ADC, filterable by IP, port, or VLAN. The resulting file can be decoded with Wireshark to diagnose handshake and routing issues.