Citrix CCA-N key terms

The unique management and configuration address assigned to a Citrix ADC appliance. It terminates management traffic such as SSH, GUI, and NITRO API calls, and is used for high availability heartbeats between nodes.

An address the appliance uses as the source when it initiates connections to back-end servers or the network. Multiple SNIPs can be added for routing, link redundancy, and large-scale deployments.

A logical entity defined by an IP address, port, and protocol that accepts client traffic and forwards it to bound services. It is the front end of a load balancing configuration and holds policies and settings.

An object representing a specific back-end server IP address and port, with a configured protocol. The appliance monitors its health and load balances client requests across the set of bound services.

A container that holds many services and is bound to a virtual server as a single unit. It simplifies administration when the same set of back-end servers supports multiple vservers or ports.

The algorithm that decides which bound service receives the next request. Common choices include least connection, round robin, least response time, source IP hash, and least bandwidth, each suited to different traffic patterns.

A configuration that keeps a client's successive requests going to the same back-end service for a defined timeout. It may be based on source IP, cookie, SSL session ID, or a custom rule.

Health probes bound to services or service groups that periodically test whether a back end is responding. A failed monitor marks the service DOWN so traffic is not sent to it.

A feature that inspects request attributes such as URL, host header, or HTTP header and directs the request to a chosen target virtual server. It lets one front-end address route traffic to different server farms.

A rule made of an expression that matches traffic and an action that is applied when it matches. Advanced policies use default syntax expressions and are used for content switching, rewriting, responder, and authentication decisions.

A policy that returns a response directly from the appliance, such as a redirect or a maintenance page, without contacting a back-end server. It is often used for URL redirection and blocking requests.

A policy that modifies HTTP request or response content in flight, for example changing URLs, headers, or body text. It requires an action that defines the transformation to apply.

Two appliances configured to work as primary and secondary nodes, sharing a floating IP address and synchronizing configuration. If the primary fails, the secondary takes over the traffic roles.

The process by which an HA pair transfers active roles from the failed primary node to the secondary node. It can be triggered by health checks, forced manually, or caused by a network or power fault.

One appliance within a high availability pair. Each node has a role of primary or secondary and exchanges hello messages and synchronization traffic with its peer over the NSIP.

The automatic replication of configuration changes from the primary node to the secondary node in an HA pair. It keeps both nodes ready so the secondary can take over without manual rebuilding.

A mode where the appliance sends return traffic to the MAC address of the device that sent the request, rather than following its own routing table. It is common in transparent, one-arm, and clustered deployments.

A deployment where the appliance is placed inline without changing client or server IP addressing, often using MAC-based forwarding. Clients are unaware of the appliance and traffic is redirected to it at Layer 2.

A deployment where client and server traffic both enter and leave through the same interface. It is simple to insert into an existing network but can create asymmetric routing that requires MAC-based forwarding.

Decrypting TLS traffic on the appliance so back-end servers receive plain HTTP, which reduces server CPU load and allows inspection. Re-encryption to the back end can be added when end-to-end encryption is required.

A mode where the appliance passes encrypted traffic through without decrypting it, so the back-end server terminates TLS itself. It preserves end-to-end encryption but gives up content inspection and offload benefits.

The linked set of a server certificate, its private key, and optionally a chain certificate that the appliance uses to prove identity during a TLS handshake. It is bound to an SSL virtual server.

A TLS extension where the client states the hostname it wants during the handshake, letting one IP address serve multiple certificates. The appliance selects the matching certificate-key pair based on that name.

A reusable object holding TLS settings such as protocol versions, cipher suites, and session reuse behavior. Binding a profile to a virtual server applies a consistent security posture across many vservers.

A feature that distributes DNS requests across data centers or sites based on health, proximity, and policy. It returns the address of the best available site so users reach a working local deployment.

A logical grouping that represents one data center in a GSLB configuration, containing local virtual servers and the GSLB services that describe them. Sites exchange health and metric information with each other.

The rule that selects which site answers a DNS query, such as static proximity, round trip time, least connections, or failover. Methods can be combined and tuned with explicit priorities.

Pointing the authoritative name servers for a zone at the GSLB deployment so it answers queries for that domain. It may be done with NS records or with a CNAME from the existing DNS provider.

The Citrix ADC feature set that verifies user identity, decides which resources a user may reach, and records access events. It supports local accounts and external servers such as LDAP, RADIUS, and SAML.

A policy that defines which authentication action applies to matching traffic, such as prompting for LDAP or SAML credentials. It is bound to a virtual server and evaluated before access is granted.

An object that controls what happens after successful authentication, including single sign-on to back ends, session timeout, and cookie settings. It is referenced by authentication and traffic policies.

A configuration where one authentication at the appliance lets the user access multiple back-end applications without logging in again. The appliance typically injects credentials or tokens into the back-end requests.

A web application firewall that inspects HTTP and HTTPS traffic for attacks such as SQL injection and cross-site scripting. It applies signatures and learned positive-security rules to protect back-end applications.

An IPFIX-based export format that sends traffic and transaction records from the appliance to collectors such as Citrix ADM. It supports visibility, analytics, and security reporting without inline probes.

The management and analytics platform for Citrix ADC that collects AppFlow and configuration data. It provides dashboards, alerting, configuration templates, and insights used for troubleshooting and optimization.

A REST-based interface for configuring and monitoring the appliance programmatically. It accepts JSON or XML payloads over HTTP or HTTPS and is the basis for automation and many management tools.

A packet capture facility built into the appliance that records traffic on selected interfaces and filters. The resulting capture can be analyzed locally or in tools such as Wireshark for troubleshooting.

A collected archive of configuration, logs, statistics, and system information used by support teams to diagnose problems. Generating it after an issue captures the appliance state needed for root-cause analysis.

A queueing mechanism that holds excess requests when a service reaches its configured capacity, instead of dropping them. It smooths bursts of traffic and helps protect back-end servers from overload.