Citrix CCP-N flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

NSIP vs SNIP vs MIP

NSIP is the management IP for GUI/SSH/SNMP and never carries backend traffic. SNIP is the subnet IP used for backend and server-initiated traffic. MIP is a legacy mapped IP for source NAT.

MAC-based forwarding

Default ADC behavior where replies are sent to the MAC address learned from the incoming request, bypassing the routing table. Disabling MBF forces a route lookup for every reply.

nCore architecture

Citrix ADC scaling model where each CPU core runs an independent packet engine. Throughput scales with core count, and connections are pinned to a core unless USIP or keepalive changes affinity.

VLAN binding rule

An ADC IP address (VIP, SNIP, NSIP) only answers ARP on interfaces bound to its VLAN. A VIP bound to the wrong VLAN will not respond on the intended segment.

LACP channel

Link aggregation using the LACP protocol for switch redundancy and bandwidth. Use static LA only when the peer lacks LACP. Members must match speed and duplex.

RNAT

Reverse NAT replaces MIP in modern deployments. `add rnat <net> <mask>` then bind to a netprofile or vserver. Preserves return-path symmetry for backend traffic.

USIP vs USNIP

USIP forces backend connections to use the client's source IP. USNIP allows using a SNIP when the client address is not routable. USIP takes precedence over USNIP.

Default route command

`add route 0.0.0.0 0.0.0.0 <gateway>` installs the default route. Verify with `show route`. Without it, the ADC cannot reach off-subnet backends or DNS.

SSL_BRIDGE vserver

A vserver type that passes encrypted traffic straight to the backend without terminating TLS. No certificate is needed on the vserver, but L7 inspection is impossible.

Monitor interval and retries

Time to mark a service DOWN equals interval multiplied by retries. downTime controls how long a DOWN service stays down before retrying. Set with `set monitor <name>`.

Least Response Time method

Load balancing method that picks the service with the lowest response time and fewest active connections. Useful for heterogeneous backends with different performance profiles.

SOURCEIP persistence

Persistence method that maps a client IP to a backend for the persistence timeout, default 2 minutes. Set with `set lb vserver -persistenceType SOURCEIP -timeout <min>`.

Backup vserver

A standby vserver that activates when the primary goes DOWN. Configure with `set lb vserver <name> -backupVserver <backup>`. Priority groups order multiple backups.

Certkey

A certificate plus private key pair imported with `add ssl certKey <name> -cert <file> -key <file>`. Bind to a vserver with `bind ssl vserver -certkeyName`.

SNI on ADC

Server Name Indication lets one VIP host multiple certificates. Bind each certkey with `-SNIEnable ENABLED`. The default cert answers unmatched SNI requests.

SSL profile settings

A profile controls protocol versions and ciphers. Disable SSLv3, TLS 1.0, and TLS 1.1; enable TLS 1.2 and 1.3. Bind with `set ssl vserver -sslProfile <name>`.

SSL offload vs bridge

Offload terminates TLS at the ADC and talks clear HTTP to backend. Bridging re-encrypts to backend using an SSL service or `-sslBridge`.

GSLB ADNS service

A DNS listener on port 53 that answers queries from GSLB-configured zones. The parent zone must delegate the GSLB zone to this ADNS IP via NS records.

GSLB RTT method

Default GSLB method that measures round-trip latency to each site and returns the fastest. Dynamic RTT recalculates continuously; static proximity uses configured geographic distances.

GSLB site persistence

Keeps a client on the same site across DNS queries. Types include NONE, SOURCEIP, SSL, and HTTP Redirect. SOURCEIP uses a configured TTL.

GSLB sync ports

GSLB sites sync over RPC on port 3009. Verify with `show gslb site` and `show gslb runningConfig`. Blocked port 3009 causes stale site data.

HA heartbeat ports

HA heartbeat uses UDP 3003 and config sync uses port 3010. Both must be permitted through any firewall between the primary and secondary nodes.

HA failover triggers

Failover occurs on heartbeat loss, monitored NIC failure, or forced failover with `force ha failover`. Typical failover completes in seconds.

INC mode

Independent Network Configuration allows each HA node to have different NSIP and subnet settings. Default non-INC mode shares the same NSIP across both nodes.

HA interface monitoring

`set interface <if> -haMonitor ON` is the default and triggers failover on link down. Disable for non-critical links to avoid false failovers.

AAA vserver

Handles authentication and authorization. Bind an authentication policy (LDAP, RADIUS, SAML, Cert) and an authorization policy, plus a session policy for SSO.

LDAP action

`add authentication ldapAction` defines the LDAP server, base DN, bind DN, and password. Bind it to an authentication policy, then to the AAA vserver.

AppFirewall profile

WAF configuration created with `add appfw profile <name> -defaults advanced`. Bind to a vserver with `bind lb vserver -policyName <p> -priority <n>`.

Responder policy

Modifies or blocks traffic at the request stage, used for redirects, security headers, and rate limiting. Lower priority number means higher precedence.

Compression policy

`add compress policy <name> <rule> COMPRESS` reduces bandwidth for text, HTML, and JSON. Not effective for already-compressed content like images or video.

Content switching vserver

Routes requests by host or path to backend lb vservers. Create with `add cs vserver`, then bind cs policies with priorities.

nstrace

Packet capture tool started with `start nstrace -size 0 -mode TXB` and stopped with `stop nstrace`. Filter with `-filter "CONNECTION.IP==x.x.x.x"`.

Common 503 cause

HTTP 503 from the ADC usually means no bound service is UP. Check `show lb vserver` and `show service` state, then verify the monitor is reachable.