Networking Architecture and Citrix ADC Platform Fundamentals
This domain covers the Citrix ADC product family and the internal architecture the exam expects you to reason about: how packets enter the appliance, which component owns a connection, and how platform choice changes performance and management. Questions often test the boundary between the data plane and the control plane rather than a single product name.
Control plane and data plane
Citrix ADC separates management and control processes from packet processing. The control plane handles configuration, monitoring, and APIs such as NITRO; the data plane runs in one or more packet engines (PEs). Each PE has its own CPU and memory resources, and a given flow is normally owned by one PE for its lifetime. This matters when you troubleshoot: a connection may appear on only one PE, and adding PEs does not automatically make a single elephant flow faster.
Platform families
- MPX: purpose-built appliance with hardware-assisted packet processing and SSL offload.
- VPX: virtual appliance; throughput and TLS performance depend on the hypervisor, vCPU count, and host.
- SDX: multi-tenant platform that hosts independent VPX instances under an SVM.
- CPX: containerized ADC for Kubernetes and container ingress.
- BLX: Linux-native ADC that runs in the host network stack.
All families share the same configuration model: NSIP for management, SNIP for server-side traffic, VIP for client-facing services, and a default route for off-subnet destinations. Feature availability depends on edition (Standard, Advanced, Platinum), so a design that assumes GSLB or AppFirewall on Standard is invalid.
Worked example
A team needs 25 Gbps of TLS termination in a physical data center, with predictable latency and no hypervisor overhead. They also want a single management IP and the ability to add a second node later. MPX is the fit: hardware SSL and packet processing provide the throughput, while the NSIP and HA pair model remain the same. A VPX could be cheaper, but its TLS rate depends on host cores and cannot be assumed from the license alone; SDX makes sense only if multiple isolated ADC instances are required.
Traps that cost marks
Do not treat the NSIP as a general data-plane address; it is management and HA. Do not assume a VPX license figure equals real TLS throughput. Do not confuse SDX instance management with the SVM management address. Do not forget that a flow pinned to one PE can hide from a check run on another PE.