I85PREP
⌘ K
Citrix CCA-N study materials
Citrix CCA-N study resources

Citrix CCA-N: Networking architecture and Citrix ADC platform fundamentals

Citrix CCA-N · Work through your exam, one topic at a time.

All guide sections

Networking architecture and Citrix ADC platform fundamentals

What this domain tests

The platform fundamentals domain checks whether you can describe Citrix ADC hardware and virtual form factors and explain how a packet reaches a service through the appliance's nCore data plane. Expect questions on IP address roles, deployment modes, licensing, and basic traffic flow rather than deep policy syntax.

Platform and nCore rules

  • MPX is the hardware appliance; VPX is the virtual appliance; CPX is a container-based ADC for Kubernetes/OpenShift sidecars; SDX is a multi-tenant hardware platform hosting VPX instances; BLX runs ADC as a Linux process.
  • nCore uses one software image across platforms. A single ADC instance runs multiple packet engines (PEs), each pinned to CPU resources with its own memory and flow table; traffic is distributed across PEs.
  • Address roles: NSIP is management and control traffic; SNIP is the source address for server-side connections; VIP receives client traffic; MIP is a legacy mapped IP; GSLB site IP handles site-to-site communication.
  • By default, the appliance uses the SNIP for server-side traffic. Enabling Use Source IP (USIP) preserves the client address; Use Subnet IP (USNIP) forces SNIP use.
  • Deployment modes include one-arm (VIP and servers on same network), two-arm (client and server networks separated), and transparent/inline. Licensing is capacity-based, with throughput and Burst options.

Worked example

A VPX is deployed with two packet engines. A client connects to VIP 10.10.10.10, which is bound to a service for 192.168.20.20:80. The server's access logs show 192.168.20.10 (the SNIP), not the client's address. The engineer needs the real client IP for audit. Reasoning: the ADC terminates the client TCP connection and opens a separate server-side connection, so the default source is the SNIP. Turning on USIP in the TCP profile causes the ADC to use the client IP, but the server must have a route back to the client network through the ADC. If routing is asymmetric, USIP will break the return path; USNIP is the safer choice when the server cannot route to clients.

Traps that cost marks

Do not confuse NSIP with a data-plane address; it is not used for load-balanced traffic by default. Do not assume every VPX supports the same throughput or PE count regardless of license. In two-arm mode, the ADC needs a route to both client and server networks. Finally, CPX is not a full replacement for MPX/VPX in every feature area.