Lab: Part 16 – StoreFront load balancing with NetScaler (Internal)

Configure StoreFront 3 Load Balancing with Citrix NetScaler.

More from the Lab!

 

In this post, we will review how to use our NetScaler TriScale cluster to load balance Citrix StoreFront. We will not use NetScaler Gateway for internal Load Balancing as our users will connect directly to the Citrix servers on the LAN.

StoreFront Load Balancing

Requirements

• StoreFront website must be up and running in https
  • see Lab: Part 15 – Configure SSL in StoreFront and Lab: Part 14 – Citrix StoreFront 3.x
• Root CA, Storefront Certificates.
• NetScaler TriScale clustering must be configured
  • see Lab: Part 12 – Setup NetScaler 11 Clustering (TriScale)

Lab Configuration

• Two servers with StoreFront installed (SF01/SF02).
• SF02 is the primary StoreFront server (10.0.0.32/8)
• SF01 is the secondary StoreFront (10.0.0.31/8)
• DNS Record: storefront.citrixguru.lab pointing to SF02.
• NetScaler Cluster IP (CLIP): 192.168.1.100
• NetScaler SNIP: 10.0.0.111 and 10.0.0.112.
• Load Balancing/SSL features enabled on the NetScaler cluster.
• IP for the Load Balancing : 10.0.0.30.
• CA Certificate is ready.
• StoreFront certificate is ready.

StoreFront Load Balancing Configuration

Connect to the NetScaler Cluster using the CLIP (http://192.168.0.100) and logon with the nsroot account.

Import Certificates

Navigate to the Traffic Management > SSL. Make sure that the feature is enabled.

Import Root CA certificate

Select SSL and navigate to Tools, select Manage Certificate/ Keys / CSRs.

Select Upload.

Select the Root CA certificate to upload.

 

Go to Certificates and select Install. Browse the appliance the find the Root CA certificate previously updated.

Click on Install.

Import StoreFront certificate

Method 1: not secure

Go to Certificates and select Install. Browse your local computer the find the StoreFront certificate created in the previous post: Lab: Part 15 – Configure SSL in StoreFront.

Note: Take a look at the key file (located in nsconfig/ssl/storefront.fx.ns). The file is not encrypted.

Method 2: secure

To import the StoreFront certificate and keep the private key encrypted, Go to SSL and navigate to Tools, select Import PKCS#12.

• Output file name: /nsconfig/ssl/storefront.cer
• Input file name: storefront.pfx located on your local computer

Select Ok to import the certificate.

Select SSL and navigate to Tools, select Manage Certificate/ Keys / CSRs.

Select StoreFront.cer and View.

 

Add servers

Navigate to Traffic Management > Load Balancing. Make sure that the feature is enabled then go to servers.

Add the two StoreFront servers.

Both servers should be Enabled. If not make sure that you can ping the servers from the NetScalers.

Create new service group

Navigate to Service groups and add a new service group.

• Name: svcgrp-storefront-https
  
• Protocol: HTTPS

The state of the service group is Down but it is normal at this time.

Now click on No Service group Member to add members.

Select Server based and Click to select.

Select both servers previously created.

Specify the port 443.

Select Create to create the service group members.

Monitors

On the right panel, select Monitors.

Select No Service group to monitor binding.

Select Click to select.

Select HTTPS-EVC.

Note: NetScaler has a specific monitor for StoreFront but we cannot use it here as the StoreFront monitor is using the NSIP to communicate with the StoreFront servers. In our lab, this communication is not allowed (the StoreFront monitor does not work over the SNIP).

Select Bind.

The service group should now be UP.

Select Settings and configure as below:

Select Client IP and for the Header, enter : X-Forwarded-For.

Create new virtual server

Navigate to Traffic Management > Load Balancing > Virtual Servers. Select Add to create a new virtual server.

• Name: vslb-storefront
• Protocol: SSL
• IP address: 10.0.0.30
• Port: 443

Click Ok to create the virtual server. Don’t worry about the down state, we first need to bind our new virtual server to something.

Select No Load Balancing Virtual Server ServiceGroup Binding.

Select Click to Select.

Select the previously created serviceGroup.

Select  Bind.

Our new virtual server is now bound to our service group.

The next step is to link the certificates to this vServer.

Select CA certificate.

Select Bind.

Repeat the same for the server certificate.

Both certificates are now linked to the vServer.

You can also configure the persistence. Usually I recommend to use SOURCEIP.

The timeout is 30minutes.

You can also configure the load Balancing method.

LEASTCONNECTION will redirect the requests on the server with the lowest number of sessions.

The vServer is now configured and ready to use.

Testing

You need first to change the DNS record storefront.citrixguru.lab to use the vServer IP address (10.0.0.30) instead of SF02 IP address (10.0.0.32).

Once the DNS is updated, go to https://storefront.citrixguru.lab/Citrix/CitrixGuruStoreWeb.

You can play with the Load Balancing to validate the two StoreFront servers, go Servers and disable SF01 or SF02.

That’s all for StoreFront internal Load Balancing. In the next post, we will discuss how to optimize the load balancing configuration.

More from the Lab!