Citrix CCE-N key terms

The unique management and internal control address assigned to each Citrix ADC appliance. It is used for administrative access, high availability communication, and system-level traffic rather than for serving client application requests.

An address on the ADC used as the source when the appliance initiates connections to back-end servers or peers. It also handles certain traffic types and must be routable to the relevant networks.

A logical entity on the ADC that listens on a defined IP address and port for client traffic and forwards it according to a configured policy or load-balancing method to bound service members.

A collection of back-end servers and ports that can be bound to one or more virtual servers, allowing shared monitoring and configuration across multiple vservers rather than binding servers individually.

A probe configured on the ADC that periodically tests whether a bound service is responding correctly, marking it UP or DOWN so traffic is directed only to healthy endpoints.

The algorithm that decides which bound service receives a new connection, such as least connection, round robin, or least response time. Choice affects distribution fairness and behavior under failure.

A configuration that keeps a client's subsequent requests going to the same back-end server for a period, typically using a cookie or source IP, so session state is preserved across multiple connections.

A feature that inspects request attributes such as host header, URL path, or HTTP header and routes the request to the appropriate target virtual server based on matching policy rules.

A rule written in the ADC's expression language that evaluates traffic attributes and returns true or false, used by content switching, responder, rewrite, and other policy features.

A policy that acts on a request before load balancing, typically returning a redirect or a fixed response. It can enforce HTTPS redirection or block requests without reaching back-end servers.

A policy that modifies request or response content, such as headers or URLs, without changing the destination of the connection. It is used for header insertion, URL normalization, and similar transformations.

Terminating TLS on the ADC so back-end servers receive decrypted traffic, reducing server CPU load. It requires certificate management on the appliance and careful handling of sensitive data on the internal network.

A mode where the ADC passes encrypted traffic through to the back-end server without decrypting it, preserving end-to-end encryption but preventing content inspection and cookie-based persistence insertion.

The association of a server certificate and its chain with a virtual server so the ADC can present it during TLS negotiation. Missing intermediate certificates cause client trust failures.

A TLS extension where the client states the hostname it wants, letting the ADC select the correct certificate from multiple bindings on one virtual server and serve many sites from a shared address.

The ADC feature set that validates user credentials against external directories, applies authorization policies, and records access events, commonly enabling single sign-on to protected applications.

A federated sign-in flow where the ADC acts as service provider or identity provider, exchanging signed assertions with a trusted party so users authenticate once and reach multiple applications.

A rule bound to a virtual server that triggers an action such as authentication, application firewall inspection, or content transformation when its expression matches the request or response.

The ADC's web application protection module that inspects requests and responses for attacks such as SQL injection and cross-site scripting, using signatures and learned positive security profiles.

A control that caps the number of requests or connections a client or group can make in a time window, mitigating brute-force and flood attempts against protected virtual servers.

Two ADC appliances configured as primary and secondary, sharing a floating virtual MAC and synchronizing configuration so the secondary can take over if the primary fails.

The periodic message exchanged between HA peers over the NSIP or a dedicated path. Loss of heartbeats beyond a threshold triggers failover to the secondary node.

The process where the standby ADC assumes the primary role, taking over virtual IP addresses and traffic after detecting peer failure, a forced switch, or an administrative command.

The automatic or manual replication of configuration from the primary ADC to the secondary so both nodes hold matching settings and the standby can serve traffic immediately after failover.

A mechanism that queues or drops new connections when a virtual server exceeds a configured threshold, preventing back-end servers from being overwhelmed during traffic spikes.

A logical overlay tunnel between SD-WAN sites that carries traffic across one or more WAN links, with per-path quality metrics used to select the best route for each application.

An abstraction in SD-WAN that groups one or more physical WAN links into a single logical interface, enabling policy and routing decisions independent of the underlying provider or medium.

Measurements such as latency, jitter, and packet loss collected continuously per virtual path. Policies use them to decide whether a path is suitable for a given application class.

The SD-WAN feature that classifies traffic into application classes and allocates bandwidth, priority, and drop behavior per class, ensuring business-critical applications keep adequate resources.

Deliberately delaying or pacing outbound packets to smooth bursts and keep rates within configured limits, reducing loss on constrained WAN links while preserving priority for important flows.

The SD-WAN behavior that continuously evaluates available virtual paths against policy thresholds and moves an application's traffic to a better path when quality degrades.

A physical or logical connection from an SD-WAN site to an external network, such as MPLS, broadband, or LTE. Each link has capacity, cost, and quality characteristics used in routing decisions.

An entry in the SD-WAN forwarding table that maps a destination prefix to an egress link or virtual path, learned statically, dynamically, or through the overlay control plane.

A technique that maintains separate routing tables on the same device, letting SD-WAN segment traffic by department, tenant, or security zone without separate physical hardware.

An encrypted connection between SD-WAN sites or to a remote peer that protects overlay traffic in transit, with parameters such as encryption, integrity, and key lifetime agreed by both ends.

The separation of traffic into isolated logical networks with distinct policies and routing, preventing one group or tenant from reaching another while sharing the same physical SD-WAN infrastructure.

A provisioning method where a new SD-WAN appliance contacts a central service, downloads its site-specific configuration, and joins the overlay without manual on-site setup.

The central management and analytics platform that collects telemetry from ADC and SD-WAN instances, provides configuration templates, and surfaces performance and security insights across the estate.

An analytics capability that decodes ICA traffic passing through the ADC to report per-session latency, bandwidth, and user experience metrics for virtual apps and desktops.

The collection and presentation of traffic and quality data from ADC and SD-WAN components in a central console, used to correlate WAN conditions with application experience.