Skip to main content

How to Load Balance IBM Domino Webmail Servers with Citrix Netscaler

Citrix have released this cool knowledge article on how to Load Balance the IBM Domino web servers with a Citrix Netscaler appliances. If you have Domino in your production then this is a must to do thing =o) GO Netscaler…. :o)

 

Summary

This article contains information about how to Load Balance the IBM Domino Webmail Servers with a NetScaler appliance.

Background

The configuration demonstrated in this article refers to a Domino configuration where there is one exclusive logon server and individual mailbox servers for each user.

Refer to Achieving High Availability with IBM Lotus iNotes for more information.

Procedure

Because the Domino server must redirect users to their respective mailboxes, a NetScaler appliance must rewrite the URL sent by the Domino server.

This allows the users to only communicate with one given URL such as https://webmail.example.com, instead of multiple URLs such ashttps://mailbox1.example.com or https://mailbox2.example.com.

The following steps describe the network flow when load balancing the IBM Domino Webmail Servers:

  • A user opens the webmail.example.com website by using a Web browser.
  • The Web browser redirects the user to https://webmail.example.com.
  • The user enters the credentials.
  • If the credentials are successful, then the server redirects the user to http://mailbox1.example.com/.
  • A NetScaler appliance modifies the URL to https://webmail.example.com/ before sending the data back to the user.
  • A cookie is set on the client with the value of mailbox1.
  • When the Web browser requests https://webmail.example.com/ with the cookie mailbox1, a NetScaler appliance content switches this request to the mailbox1 server.

The NetScaler appliance must set a cookie for the mailbox server. Therefore, the clients must support cookies.

Features Required

The following features must be enabled on a NetScaler appliance:

  • Load Balancing
  • Content Switching
  • SSL
  • Rewrite

Configuration

To configure a NetScaler appliance to load balance the IBM Domino Webmail Servers, complete the following steps:

  • Run the following command in the command line interface of the appliance to enable the required features:
    enable ns feature LB CS SSL REWRITE
  • Run the following commands to add the mailbox servers:
    add server mailbox1 1.2.3.1
    add server mailbox2 1.2.3.2
    add server mailbox3 1.2.3.3
    add server mailbox4 1.2.3.4
  • Run the following command add the logon server:
    add server login 1.2.3.10
  • Run the following commands to add the content switching policies:
    add cs policy “Mailbox A” -rule “HTTP.REQ.HEADER(\”Cookie\”).SET_TEXT_MODE(IGNORECASE).CONTAINS(\”mailbox1\”)”
    add cs policy “Mailbox B” -rule “HTTP.REQ.HEADER(\”Cookie\”).SET_TEXT_MODE(IGNORECASE).CONTAINS(\”mailbox2\”)”
    add cs policy “Mailbox C” -rule “HTTP.REQ.HEADER(\”Cookie\”).SET_TEXT_MODE(IGNORECASE).CONTAINS(\”mailbox3\”)”
    add cs policy “Mailbox D” -rule “HTTP.REQ.HEADER(\”Cookie\”).SET_TEXT_MODE(IGNORECASE).CONTAINS(\”mailbox4\”)”
  • Run the following commands to add services for the mailbox servers:
    add service mailbox1-http mailbox1 HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp ON -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
    add servicemailbox2-http mailbox2 HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp ON -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
    add service mailbox3-http mailbox3 HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp ON -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
    add service mailbox4-http mailbox4 HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp ON -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
  • Run the following command to add a service for the logon server:
    add service login-http login HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp ON -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
  • Run the following command to add rewrite actions:
    add rewrite action “Webmail – Internal” replace http.REQ.HOSTNAME.SERVER “\”login.example.com\””

    add rewrite action “Webmail – Change Location” replace “http.RES.HEADER(\”Location\”)” “\”https://webmail.example.com\” + http.RES.HEADER(\”Location\”).AFTER_STR(\”example.com\”)”
    Note    : The logon server returns a URL redirect based on its internal name, such as login.example.com.

    add rewrite action “Body Replace” replace “http.RES.BODY(1000).AFTER_STR(\”http://\”).BEFORE_STR(\”/\”)” “\”webmail.example.com\””

    add rewrite action “Insert Cookie” insert_http_header Set-Cookie “http.RES.BODY(1000).AFTER_STR(\”http://\”).BEFORE_STR(\”/\”)”
    Note    : This action sets the mailbox server information cookie on the client.

    add rewrite action “Webmail – Cookie Domain” replace “http.RES.HEADER(\”Set-Cookie\”).AFTER_STR(\”domain=\”).BEFORE_STR(\”;\”)” “\”.example.com\””

  • Run the following command to add rewrite policies:
    add rewrite policy “Webmail – Policy” “http.REQ.HOSTNAME.SERVER.EQ(\”webmail.example.com\”)” “Webmail – Internal”
    Note    : This policy changes the external URL to the internal URL to access the logon server.

    add rewrite policy “Webmail – Host Change” “http.RES.HEADER(\”Location\”).CONTAINS(\”http://webmail.example.com\”)” “Webmail – Change Location”

    add rewrite policy “Webmail-Insert Cookie” “http.REQ.URL.CONTAINS(\”IntRedirMail.nsf\”)” “Insert Cookie”
    Note    : This policy sets the mailbox server information cookie on the client.

    add rewrite policy “Webmail-Replace Body” “http.REQ.URL.CONTAINS(\”IntRedirMail.nsf\”)” “Body Replace”
    Note    : This policy modifies the URL to be an external URL used by users, when the user requests IntReditMail.nsf from the logon server.

    add rewrite policy “Webmail-Replace Cookie Domain” “http.RES.HEADER(\”Set-Cookie\”).CONTAINS(\”example.com\”)” “Webmail – Cookie Domain”
    Note    : This is policy is required, if the internal domain name is different from the external domain name.

  • Run the following commands to add load balancing Virtual Servers:
    add lb vserver mailbox1-lb HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
    add lb vserver mailbox2-lb HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
    add lb vserver mailbox3-lb HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
    add lb vserver mailbox4-lb HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
    add lb vserver login-lb HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
    add lb vserver “webmail redirect” HTTP 10.10.10.1 80 -persistenceType NONE -redirectURL “https://webmail.example.com” -cltTimeout 180
  • Run the following command to add the content switching Virtual Server:
    add cs vserver Webmail SSL 10.10.10.1 443 -cltTimeout 180
  • Run the following commands to bind the load balancing Virtual Server to the services:
    bind lb vserver mailbox1-lb mailbox1-http
    bind lb vserver mailbox2-lb mailbox2-http
    bind lb vserver mailbox3-lb mailbox3-http
    bind lb vserver mailbox4-lb mailbox4-http
    bind lb vserver login-lb login-http
  • Run the following commands to bind the content switching policies to the Virtual Server:
    bind cs vserver Webmail -policyName “Webmail – Policy” -priority 100 -gotoPriorityExpression NEXT -type REQUEST
    bind cs vserver Webmail -policyName “Webmail – Host Change” -priority 1 -gotoPriorityExpression NEXT -type RESPONSE
    bind cs vserver Webmail -policyName “Webmail-Replace Cookie Domain” -priority 10 -gotoPriorityExpression NEXT -type RESPONSE
    bind cs vserver Webmail -policyName “Webmail-Insert Cookie” -priority 20 -gotoPriorityExpression NEXT -type RESPONSE
    bind cs vserver Webmail -policyName “Webmail-Replace Body” -priority 30 -gotoPriorityExpression NEXT -type RESPONSE
    bind cs vserver Webmail login-lb
    bind cs vserver Webmail mailbox1-lb -policyName “Mailbox A” -priority 100
    bind cs vserver Webmail mailbox2-lb -policyName “Mailbox B” -priority 90
    bind cs vserver Webmail mailbox3-lb -policyName “Mailbox C” -priority 80
    bind cs vserver Webmail mailbox4-lb -policyName “Mailbox D” -priority 70
  • Run the following command to bind the SSL certificate to the content switching Virtual Server:
    bind ssl vserver Webmail -certkeyName webmail.example.com

This document applies to:

Unable to Install the Platform License for Unlimited ICA Connections

This article applies for Access Gateway Enterprise 9.2 and Netscaler 9.0

Symptoms

You might experience issues when installing the Platform License for Unlimited ICA connections. The license is not recognized and you will be unable to install it.

Additionally, the output of the show license command displays 0 ICA users. Following is a sample output of the show license command:

After restarting the appliance, the license.log file in the /var/log directory displays the error message, as shown in the following screen shot:

Background

The following increment entries in the license file were verified as explained in Knowledge Center article CTX125567 – How to Configure an Access Gateway Enterprise Edition Appliance with Unlimited ICA Connections

INCREMENT CAG_ICA_CCU CITRIX 2011.0202 permanent 10000
INCREMENT CAG_BASE_SERVER CITRIX 2011.0202 permanent 1

Cause

The Platform License for Unlimited ICA connections file was allocated and downloaded in a single file along with other licenses available on the Citrix Website.

Resolution

Reallocate and download all the licenses as separate files. The Platform License should not be downloaded into the same file, which contains other licenses.

Types of Licensing Available for NetScaler and Access Gateway Enterprise Edition Appliances

Summary

This article contains information about various types of licenses available for NetScaler and Access Gateway Enterprise Edition appliances.

Types of Licenses

Citrix provides the following types of licenses for NetScaler and Access Gateway Enterprise Edition appliances:

  • Retail NetScaler (physical box) License: This is a license for the physical appliance. This license helps you to enable all necessary features of the appliance and 5 Secure Socket layer (SSL) Virtual Private Network (VPN) connections. By default, this license is allocated to Hostname “ANY” in the MyCitrix Web site. You cannot change this allocation.
  • Other NetScaler licenses: These licenses include Internal, Partner USE, DEMO, EVALUATION, or VPX. You need to allocate these licenses to to Host ID of the appliance.
    Refer to the following Knowledge Center articles for more information:
  • Access Gateway Platform License: You must upload this license to increase the Independent Computing Architecture (ICA) connections up to 10000.
  • Access Gateway Universal Licenses: This license increases Full SSL VPN connections.

You need to allocate some of these licenses to the NetScaler Licensing Hostname, which is configured in the /nsconfig/rc.conf file. This hostname is not necessarily the same Hostname that was created by running the set ns hostname, unless you have configured otherwise. By default, the hostname in the /nsconfig/rc.conf file is “ns”, as shown in the following command output:

root@ns# grep hostname /nsconfig/rc.conf
hostname=”ns”

If there is an issue with the hostname allocated for the Access Gateway Platform license, then you can verify the content of the /var/log/license.log file, which should be similar to the following sample content of a /var/log/license.log file:

34 (CITRIX) Wrong hostid on SERVER line for license file:
9:50:34 (CITRIX)       /nsconfig/license/license_20110316121246.lic
9:50:34 (CITRIX) SERVER line says HOSTNAME=My-Netscaler, hostid is HOSTNAME=ns
9:50:34 (CITRIX) Invalid hostid on SERVER line

In the preceding sample, the license is incorrectly assigned to the My-Netscaler hostname considering that to be the Licensing Hostname because the hostname was set as My-Netscaler by running the set ns hostname command. However, the rc.conf file has the hostname set as “ns”.

Secure Deployment Guide for NetScaler MPX and VPX Appliances

Citrix have released this great secure deployment guide for NetScaler MPX and VPX appliance.

I have made a summary in bullets so you can get a quick overview what the guide covers. I recommend that you download the guide to read the entire content.

Overview

NetScaler® Security Best Practices for MPX and VPX

Citrix® NetScaler® MPX appliance is an application delivery controller that accelerates Web sites, provides L4-7 traffic management, offers an integrated application firewall, and offloads servers. Citrix® NetScaler® VPX is a virtual appliance that has all the features of NetScaler MPX appliance, runs on standard servers, and provides higher availability for Web applications including Citrix XenDesktop and XenApp. Utilizing both NetScaler MPX and VPX appliances, an organization can deploy the flex-tenancy solution that further optimizes Web application delivery infrastructure by separating high-volume shared network services from processor-intensive, application-specific services. Furthermore, a NetScaler appliance enables the seamless integration with Citrix OpenCloud Access that can extend a datacenter with the power of the Cloud.

To maintain security through the deployment lifecycle, Citrix recommends the following security considerations:

  • PhysicalSecurity
  • ApplianceSecurity
  • NetworkSecurity
  • AdministrationandManagement

Deployment Guidelines

The following are the organizational security considerations and recommendations for the deployment of a NetScaler appliance:

Physical Security

  • Deploy the Appliance in the Secure Server Room
  • Protect the Front Panel and Console Port from Unauthorized Access
  • Protect Power Supply

Appliance Security

  • Secure the Server operating system that Hosts a NetScaler VPX Appliance
  • PerformRemoteSoftwareUpdates
  • FollowSecureLifecycleManagementPractices

Network Security

  • Consider using an X.509 Certificate from a Reputed Certificate Authority for the Internet Facing Web Application
  • Use Transport Layer Security when Accessing an Administrator Interface
  • Use a Non-routable Management IPAddress
  • Configure a High Availability Setup
  • Configure Network Security Domains
  • Use Stateful Firewall Protection

Administration and Management

  • Create an Alternate Super User Account
  • Change Password for the nsroot Super User Account.
  • Follow Best Practices for the Implementation of a NetScaler Appliance
  • Use Access Control
  • Set up Secure Communication Between Peer Appliances
  • Configure Other Accounts Remotely
  • Configure Logging to External NetScaler Log Host
  • Add SNMP Managers
  • Use SNMP v3 Security Features
  • Configure NTP
  • DisableSSLv2Redirect
  • DropinvalidHTTPrequests
  • DisableSSLRenegotiation
  • Whitelist HTTP headers
  • Disable Layer 3 Mode
  • Consider Using Application Firewall in a NetScaler Platinum Edition Appliance

NetScaler-FIPS Recommendations

  • Change FIPS Crypto Card Passwords
  • Store the HSM Password in a Secure Location

Access Gateway Enterprise Edition Security Recommendations

  • Use Default Deny
  • Use SSLv3/TLS Communication Between Servers
  • Use the Intranet applications feature

Application Firewall Security Recommendations

  • Deploy the Appliance in the Two-arm Mode
  • Use Default Deny

Download the – Secure Deployment Guide for NetScaler MPX and VPX Appliances here

Convert a NetScaler MPX Appliance to NetScaler SDX Appliance

Summary

This document contains information about converting NetScaler MPX appliances to NetScaler SDX appliances.

Requirements

You can use a field conversion kit to migrate a NetScaler MPX appliance to a NetScaler SDX appliance. The following table lists the details of the SDX
Field Replaceable Unit (FRU) Kits:

Description SKU HDD PN# SSD PN#
MPX 17500, 19500, or 21500 to SDX 17500, 19500, or 21500 Migration Kit 3003174-xx 853-00031-01 8530010

Background

With the new NetScaler SDX appliance models 17500, 19500, and 21500, you can deploy multiple virtualized NetScaler instances on a single purpose-built physical appliance with full multi-service and multi-tenant support. The NetScaler SDX appliance uses the service delivery performance and SSL encryption throughput of the NetScaler MPX appliance models 17500, 19500, and 21500.

You can convert a NetScaler MPX appliance to a NetScaler SDX appliance by upgrading the software through a new Solid State Drive (SSD) and a new Hard
Disk Drive (HDD). The conversion process modifies the Basic Input-Output System (BIOS), installs XenServer hypervisor and a Service Virtual Machine image, and copies an image with extension .xva for the NetScaler nCore virtual appliance 9.3 to the hard disk. However, you need to re-license the appliance, and then the appliance can provision the VPX instances as defined by the administrator through the Service VM on the NetScaler SDX appliance.

Read the full knowledge article on HOWTO Convert a NetScaler MPX Appliance to NetScaler SDX Appliance here