Citrix CCP-N cheat sheet

Citrix ADC (formerly NetScaler) is an application delivery controller that runs on a proprietary BSD-derived network stack; MPX is hardware, VPX is virtual, SDX is multi-tenant virtualized on an SVM, CPX is a container/lightweight VPX.

Packet flow order: NIC -> Interface -> VLAN -> NSIP/SNIP/MIP -> load balancing vserver -> service -> backend. Policy evaluation and connection handling happen at the vserver, not at the interface.

NSIP is the management IP used for GUI/SSH/SNMP and is not used for backend data traffic; SNIP is the subnet IP used for server-initiated or backend traffic; MIP is a mapped IP used for source NAT in older/inline deployments.

MAC-based forwarding (MBF) is enabled by default: the ADC sends replies to the MAC address it learned from the request, bypassing routing table lookup. Disabling MBF forces route lookups.

Useful CLI facts: show ns ip lists ADC-owned IPs, show route shows the routing table, show arp shows ARP entries, show interface shows link state and speed/duplex.

The ADC uses a single CPU affinity model per connection (unless USIP/connection keepalive changes it) and supports nCore scaling; throughput scales with cores on MPX/VPX.

Feature licensing is per-feature (e.g., SSL offload, GSLB, AppFirewall, AAA) and is checked at configuration time; a missing license prevents enabling the feature.

Default admin ports: HTTP 80, HTTPS 443, SSH 22, SNMP 161, NTP 123. Management access can be restricted via nsacl or the set ns ip -gui options.

A VLAN binds an interface (or channel) to a Layer 3 subnet; a single interface can belong to multiple VLANs only if tagging is enabled. Untagged traffic uses the native VLAN.

VLAN bindings determine which ADC IP (NSIP, SNIP, VIP) is reachable on which interface. A VIP bound to the wrong VLAN will not answer ARP on that segment.

LA/LACP channels aggregate links; use LACP for switch redundancy, and static LA only when the peer does not support LACP. Channel members must match speed/duplex.

Static routes are added with add route <network> <mask> <gateway>; the default route is add route 0.0.0.0 0.0.0.0 <gateway>. Use show route to verify.

Policy-based routing (PBR) overrides the routing table based on source/destination/port, useful for multi-homed ADC with asymmetric paths.

RNAT (reverse NAT) is the modern replacement for MIP: add rnat <net> <mask> then bind to a netprofile or vserver. RNAT preserves return-path symmetry.

USIP (Use Source IP) forces backend connections to use the client's source IP; USNIP allows using a SNIP if the client address is not routable. USIP overrides USNIP.

IPv6 requires a separate NSIP6/SNIP6 and explicit add ip6 configuration; IPv4 and IPv6 can coexist but each needs its own routes.

Vserver types: HTTP, SSL, TCP, UDP, SSL_TCP, SSL_BRIDGE, ANY. Choose HTTP/SSL for L7 features (content switching, rewrite), TCP/SSL_TCP for L4 passthrough with L7 visibility, SSL_BRIDGE for encrypted passthrough.

Service binds a vserver to a backend IP:port with a monitor. Monitors: PING (ICMP), TCP (connect), HTTP (GET/HEAD), HTTPS, TCP_ECV, HTTP_ECV, and custom script monitors.

Monitor interval x retries = time to mark DOWN; downTime controls how long a service stays DOWN before retry. set monitor <name> -interval <sec> -retries <n> -downTime <sec>.

LB methods: Round Robin, Least Connection, Least Response Time, Least Bandwidth, Source IP Hash, Destination IP Hash, Custom Load, Token, and Priority. Default is Round Robin.

Persistence: SOURCEIP, COOKIEINSERT, SSLSESSION, RTSPSID. Persistence timeout defaults to 2 minutes; set lb vserver <name> -persistenceType <type> -timeout <min>.

SSL_BRIDGE vservers do not terminate TLS; they pass encrypted traffic to backend, so no certificate is needed on the vserver. SSL vservers require a certkey binding.

Health checks: show service and show lb vserver show current state. Use stat lb vserver for hits, requests, and current connections.

Redundancy: backup vserver activates when the primary goes DOWN; set lb vserver <name> -backupVserver <backup>. Priority groups order multiple vservers for failover.

Certkey = certificate + private key pair. Import with add ssl certKey <name> -cert <file> -key <file>. Bind to vserver with bind ssl vserver <vserver> -certkeyName <name>.

Intermediate CA chain must be concatenated into the cert file (or bound as a separate certkey with -link). Missing chain causes browser trust errors.

SSL profiles control protocol versions and ciphers: set ssl profile <name> -ssl3 DISABLED -tls1 DISABLED -tls11 DISABLED -tls12 ENABLED -tls13 ENABLED.

SNI (Server Name Indication) allows multiple certs on one VIP: bind ssl vserver <v> -certkeyName <ck> -SNIEnable ENABLED. The default cert is used for unmatched SNI.

OCSP stapling: set ssl vserver <v> -ocspStapling ENABLED and bind an OCSP responder. CRL checking uses -clientAuth ENABLED -clientCert <name>.

SSL offload means the ADC terminates TLS and talks clear HTTP to backend; SSL bridging means the ADC re-encrypts to backend with -sslBridge or a backend SSL service.

HSTS and secure renegotiation are configured at the vserver/profile level. TLS 1.3 requires ADC 12.1+ and a compatible cipher group.

Certificate expiry and cipher strength are visible in show ssl certKey and show ssl vserver. Use show ssl stats for handshake failures.

GSLB requires a GSLB site, GSLB vserver, GSLB service, and ADNS service. ADNS listens on port 53 and answers DNS queries from GSLB-configured zones.

GSLB methods: RTT (round-trip time), Static Proximity, Dynamic RTT, Connection Proxy, and Custom Load. RTT is the default and measures network latency to each site.

Site persistence: NONE, SOURCEIP, SSL, and HTTP Redirect. SOURCEIP keeps a client on the same site for a configured TTL.

GSLB monitors (e.g., gslb monitor) determine site health; a site with all services DOWN is removed from DNS answers.

DNS TTL on GSLB services controls client cache duration; lower TTL = faster failover but more DNS queries. set gslb service <name> -TTL <sec>.

GSLB can be active-active or active-passive via backup vservers and priority. set gslb vserver <name> -backupVserver <name>.

GSLB sync uses RPC on port 3009 between sites; check show gslb site and show gslb runningConfig for sync state.

DNS delegation: the parent zone must delegate the GSLB zone to the ADC's ADNS IP (NS records), otherwise GSLB answers are never queried.

HA pair uses two ADC nodes: primary and secondary. Configure with add ha node <id> <peer-ip> on both nodes; peer IP must be reachable.

HA heartbeat uses UDP port 3003 and sync uses port 3010. Both must be allowed through any intervening firewall.

Failover triggers: heartbeat loss, NIC failure, forced failover (force ha failover), and monitored interface down. Failover time is typically seconds.

HA sync modes: Incremental (default) syncs config changes; Full sync (sync ha files) pushes all config. Use show ha node to verify sync state.

Independent Network Configuration (INC) mode allows different NSIP/subnet per node; default is non-INC where both nodes share the same NSIP.

Failover interface set: set interface <if> -haMonitor ON (default) means link down triggers failover; disable for non-critical links.

HA file sync includes certificates, licenses, and config; verify with show ha file and show ha stats.

Split-brain prevention: the secondary stays passive and only takes over on heartbeat loss; use a dedicated HA link or VLAN to avoid false failovers.

AAA vserver handles authentication: bind an authentication policy (LDAP, RADIUS, SAML, TACACS, Cert, Negotiate) and an authorization policy.

Authentication policy: add authentication ldapAction <name> -serverIP <ip> -ldapBase <dn> -ldapBindDn <dn> -ldapBindDnPassword <pw>.

Session policies control post-auth behavior (SSO, timeout, cookie domain). add tm sessionPolicy <name> -ssoCredential <type>.

Authorization policies use add authorization policy <name> <rule> ALLOW|DENY; bind to AAA vserver or a traffic vserver.

AppFirewall (WAF) profiles: add appfw profile <name> -defaults advanced; bind to vserver with bind lb vserver <v> -policyName <p> -priority <n>.

Security headers and rate limiting: add responder policy or add rewrite policy can add HSTS, X-Frame-Options, and rate limits.

SSL client certificate authentication: bind a CA cert to the vserver and use a Cert authentication policy.

Admin partition and RBAC: add system user <name> <pw> -partition <p> and bind system user <name> -policy <policy> limit scope and commands.

Compression: add compress policy <name> <rule> COMPRESS; bind to vserver. Reduces bandwidth for text/HTML/JSON; not useful for already-compressed content.

Caching: integrated caching stores static objects; add cache policy <name> <rule> CACHE and bind to vserver with -target for content group.

TCP optimization: set ns tcpProfile <name> -flavor BIC -initialCwnd <n> tunes congestion control. Use -nagle DISABLED for latency-sensitive apps.

HTTP/2 and QUIC: enable per-vserver with set lb vserver <v> -httpProfileName <p> where the profile enables HTTP/2.

Content switching: add cs vserver <name> HTTP <ip> <port> then bind cs policies that route by host/path to backend lb vservers.

Rewrite and responder policies modify requests/responses (URL rewrite, header insert, redirect). Priority order matters; lower number = higher priority.

Front-end optimization (FEO) and AppCache are legacy features; modern acceleration relies on compression, caching, HTTP/2, and TCP profiles.

Surge protection and priority queuing: set lb vserver <v> -surgeProtection ON limits connection spikes; add netProfile sets source IP for backend.

show techsupport collects a full diagnostic bundle; use show techsupport -scope <n> to limit size. It includes config, logs, and stats.

stat lb vserver, stat service, stat ssl, stat gslb vserver show live counters. stat resets on reboot; show shows configuration.

nstrace captures packets: start nstrace -size 0 -mode TXB then stop nstrace. Filters: -filter "CONNECTION.IP==x.x.x.x".

Syslog: add audit syslogAction <name> <ip> -logLevel ALL then add audit syslogPolicy and bind globally. Logs go to /var/log/ns.log.

SNMP: add snmp trap <ip> and add snmp community. Use show snmp to verify. SNMPv3 recommended for security.

AppFlow/Insight: add appflow collector <ip> and set appflow param -httpUrl ENABLED for per-request telemetry to Citrix ADM.

Common issues: 503 = no UP service; 401 = auth failure; SSL handshake error = cert/chain/cipher mismatch. Check show lb vserver state and show service state.

nsconmsg reads kernel counters; show ns runningConfig shows active config. Use show ns ns.conf diff to compare against saved config.