Lab: Part 17 – Optimize and secure StoreFront load balancing with NetScaler (Internal)

Optimize and secure StoreFront 3 Load Balancing with Citrix NetScaler.

More from the Lab!

 

In the previous lab post, we configured StoreFront load balancing using Citrix NetScaler. Today, I would like to review how to make our internal StoreFront LB more secure and optimized.

Redirect StoreFront HTTP to HTTPS with NetScaler

The goal here is to redirect http://storefront/ to https://storefront.citrixguru.lab/Citrix/CitrixGuruStoreWeb.

There are multiple options to perform this task, you can for example modify the IIS configuration on each server but it is not efficient as NetScaler allows us to do this configuration in a centralized location.

Connect to your Netscaler. In the lab we will use our TriScale NetScaler internal cluster to perform this operation.

Navigate to Traffic Management > Load Balancing > Virtual Servers.

Create a new LB virtual server:

• Name: vslb-storefront-redirect
• Protocol: HTTP
• IP Address: 10.0.0.30
• Port: 80

The new vServer will be down all the time and will not be linked to anything.

Instead we are going to use a feature of the vServer called Protection. This feature will redirect the requests to another URL if the vServer is down which will be the case all the time.

On the panel on the right, select Protection. Enter https://storefront.citrixguru.lab/Citrix/CitrixGuruStoreWeb as Redirect URL.

Select OK to validate.

You can try to connect to StoreFront by typing http://storefront. You will be automatically redirected to https://storefront.citrixguru.lab/Citrix/CitrixGuruStoreWeb.

Create vServer LB and redirection via command line:

Redirect to StoreFront full web Path with NetScaler (default page)

The goal here is to redirect https://storefront.citrixguru.lab/ to https://storefront.citrixguru.lab/Citrix/CitrixGuruStoreWeb.

There is multiple options to perform this task, you can for example modify the IIS configuration on each server but it is not efficient as NetScaler allow us to do this configuration only one time.

Navigate to Traffic Management > Load Balancing and Select the HTTPS vServer associated with StoreFront (vslb-storefront). Then select Edit.

On the right panel select Policies.

Add a new policy.

Select Rewrite and Request.

• Name: rw_storefront_pol 
• Expression: HTTP.REQ.URL.EQ(“/”)

You can either type the expression manually or use the expression editor to create the expression.

Under Action, Select + to create a new rewrite action.

• Name: rw_action_storefront
• Type: REPLACE
• Expression Target: HTTP.REQ.URL
• Expression: “/Citrix/CitrixGuruStoreWeb”

Select Bind.

The policy is bound to vServer.

Now, try to open https://storefront.citrixguru.lab. You will be redirected to https://storefront.citrixguru.lab/Citrix/CitrixGuruStoreWeb.

Go to AppExpert > Rewrite > Policies and take a look at rw_pol_storefront:

The policy has 4 hits, so it is working as expected.

Same configuration is possible via command line:

Create rewrite action

Create rewrite policy

Bind rewrite policy to vServer

Security

Go to Scoring an A+ on SSLLABS.COM with NetScaler 11 VPX and follow the instructions.

More from the Lab!