Lab: Part 18 – Secure LDAP (LDAPS) load balancing with Citrix NetScaler 11

LDAPS Load Balancing with Citrix NetScaler 11.

More from the Lab!

 

In this post, we will see how to load balance LDAP with our external NetScaler 11 HA pair created in Lab: Part 6 – Configure NetScaler 11 High Availability (HA Pair) and how to use NetScaler to offload SSL.

By default LDAP uses port 389 (PLAIN TEXT). We could just create a LB virtual server for the port 389 but Active Directory requires secure LDAP (LDAPS) on the port 636 for password changes.

Requirements

• Certificate Authority must be installed on your controllers to allow LDAPS
• Wildcard certificate generated

Lab configuration

• NetScaler OS 11 62.10nc version
• HA pair configured (192.168.0.201)
• DC (10.0.0.10)
• Communication only allowed to backend servers via the SNIP address

Note: in our lab, we only have 1 DC. 

Create Secure LDAP (LDAP) load balancing

Servers

Go to NetScaler > Traffic Management > Load Balancing, select Servers and Add.

Add all Domains controllers you want to be part of the load balancing.

In the lab, we only have one domain controller but the following procedure is the same.

Service group

Go to NetScaler > Traffic Management > Load Balancing, select Service groups and Add.

• Name: svcgrp-ldap-ssltcp
• Protocol: SSL_TCP

 

Repeat the operation for all servers.

 

Monitor

Citrix offers a Perl script to monitor LDAP service, documented here: CTX114335 and CTX117943.
This advanced monitor performs an LDAP query and check for a valid response over the NSIP address.
However in our lab, the NSIP does NOT communicate with our Domain controllers which is required to use the advanced monitor.

 

Virtual Server

Go to NetScaler > Traffic Management > Load Balancing, select Virtual servers and Add.

• Name: vslb-ldap
• Protocol: SSL_TCP
• Port: 636

 

 

The virtual server is currently DOWN because the Certkey is not found.

We need to import and assign a certificate.

Certificate

Go to NetScaler > Traffic Management > SSL, select Certificates and Install.

 

Go to NetScaler > Traffic Management > Load Balancing, select Virtual servers.

Select vslb-ldap.

 

The virtual server is now UP.

 

Security

Go to Scoring an A+ on SSLLABS.COM with NetScaler 11 VPX and follow the instructions.

In the next post, we will discuss how to configure active directory authentication for NetScaler gateway or for the management website. Stay tuned.

More from the Lab!