Citrix ADC High Availability, Optimization, and Troubleshooting
This domain combines HA mechanics, performance tuning, and disciplined diagnosis. Questions often present a failover that did not occur, a synchronization mismatch, or a latency complaint and ask for the next command or setting.
HA mechanics
- A classic HA pair has one primary and one secondary node. Heartbeats and failover interfaces determine whether the peer is reachable; if failover interfaces are not set correctly, a path failure may not trigger takeover.
- HA synchronization copies configuration and certificates. Partial synchronization leaves objects out of sync and is a frequent cause of "it works on one node only."
- INC mode changes how the secondary handles traffic and ARP. Forced failover and HA monitors are operational tools, not design fixes.
Optimization
- TCP profiles tune window scaling, SACK, and buffer behavior; the wrong profile can hurt long-fat-network throughput.
- HTTP compression, caching, front-end optimization, and surge protection reduce bandwidth and origin load but consume CPU.
- Offload SSL and compression only when the platform has headroom for the resulting cipher and inspection load.
Troubleshooting
- Start with show commands: show lb vserver, show service, show servicegroup, show ha node, show arp, show route.
- Use nstrace with capture filters and a defined duration; unfiltered traces on a busy appliance are unreadable.
- nsconmsg and stat commands show counters and drops; ADM provides historical and multi-device views.
Worked example
A primary node loses its uplink but the secondary does not take over. Check show ha node for peer state, verify that the failed interface is included in the failover interface list, and confirm the HA monitor and dead interval. Reasoning: HA heartbeats may still succeed over another path, so the appliance does not know the data path failed; explicitly including the uplink in failover interfaces makes that path part of the health decision.
Traps that cost marks
- Assuming synchronization succeeded because the peer is reachable.
- Forgetting that certificates and licenses can be out of sync even when the config is synchronized.
- Capturing a trace without filters and missing the relevant flow.
- Applying a TCP profile globally when only one vserver needs it.
- Confusing a service down state with a vserver down state.