Architecture and Design of Citrix ADC Deployments
This domain tests whether you can select an ADC form factor, place it correctly in the traffic path, and size it against real workload rather than model-number marketing. Expect scenario questions that give a topology, tenant count, or traffic profile and ask for the most defensible design.
Form factors and placement
- MPX is dedicated hardware; VPX is a virtual appliance; CPX is a container; SDX runs multiple VPX instances on one appliance; BLX runs ADC software on bare-metal Linux.
- One-arm mode keeps VIP and servers on the same subnet, so return traffic may hairpin; two-arm mode separates client and server VLANs. Inline/transparent mode is used for bump-in-the-wire inspection.
- A common edge design terminates Gateway/SSL VPN on the ADC; an internal design load-balances StoreFront and Delivery Controllers. Service providers often use SDX with one VPX per tenant.
- Admin partitions separate objects but share CPU, memory, and SSL chips. They are an operational boundary, not a hard security or failure boundary.
Sizing rules
- Throughput in Gbps is not the same metric as SSL transactions per second or concurrent SSL connections; each is a separate constraint.
- SSL offload, AppFW inspection, compression, and rewriting consume CPU. A platform rated for high L7 throughput may deliver much less with full inspection.
- Baseline with Citrix ADM or nstrace, then add 30-50% headroom and consider N+1 for failover capacity.
Addressing
- NSIP is management, SNIP is server-side, VIP is client-facing, and MIP supports USIP. Place SNIP in the server subnet and enable USIP when backends must see the real client IP.
- Avoid asymmetric routing; where it is unavoidable, use MAC-based forwarding or policy-based routes consistently on both ADC and upstream devices.
Worked example
A design has 20,000 peak concurrent users, 30% active simultaneously, and 1.5 Mbps per active ICA session. Throughput = 20,000 x 0.30 x 1.5 Mbps = 9 Gbps. Add 40% headroom = 12.6 Gbps, so two 10G-capable platforms or a larger pair are needed. Login load is 6,000 logins in five minutes = 20 logins/s; even with a 10x SSL handshake allowance, 200 SSL TPS is modest. Reasoning: throughput drives the platform choice, not SSL TPS.
Traps that cost marks
- Treating a model's headline throughput as usable throughput with AppFW and SSL enabled.
- Putting SNIP on the wrong VLAN so return traffic bypasses the ADC.
- Assuming an admin partition protects against a tenant instance crash.
- Forgetting USIP and then troubleshooting "all clients have the same IP."
- Sizing to average, not peak, concurrency.