Deploy a VPX high-availability pair with private IP address on Google Cloud Platform

You can deploy a VPX high-availability pair on GCP using private IP address. The client IP (VIP) must be configured as alias IP address on the primary node. Upon failover, the Client IP address is moved to the secondary node, for the traffic to resume.

For more information on high availability, see High Availability
.

Before you start

• Read the Limitation, Hardware requirements, Points to note mentioned in Deploy a Citrix ADC VPX instance on Google Cloud Platform
  . This information applies to high availability deployments also.
• Enable Cloud Resource Manager API for your GCP project.

• Allow full access to all Cloud APIs while creating the instances.

• Ensure that your GCP service account has the following IAM permissions:

   REQUIRED_INSTANCE_IAM_PERMS = [ "compute.forwardingRules.list", "compute.forwardingRules.setTarget", "compute.instances.setMetadata", "compute.instances.get", "compute.instances.list", "compute.instances.updateNetworkInterface", "compute.targetInstances.list", "compute.targetInstances.use", "compute.targetInstances.create", "compute.zones.list", "compute.zoneOperations.get", ] <!--NeedCopy-->

• If you have configured external IP addresses on an interface other than the management interface, ensure that your GCP service account has the following additional IAM permissions:

   REQUIRED_INSTANCE_IAM_PERMS = [ "compute.addresses.use" "compute.instances.addAccessConfig", "compute.instances.deleteAccessConfig", "compute.networks.useExternalIp", "compute.subnetworks.useExternalIp", ] <!--NeedCopy-->

• If your VMs do not have internet access, you must enable Private Google Access on the management subnet.

• If you have configured GCP forwarding rules on the primary node, read the limitations and requirements mentioned in Forwarding rules support for VPX high-availability pair on GCP
  to update them to new primary on failover.

How to deploy a VPX high availability pair on Google Cloud Platform

Here is a summary of the high availability deployment steps:

1. Create VPC networks in the same region. For example, Asia-east.
2. Create two VPX instances (primary and secondary nodes) on the same region. They can be in the same zone or different zones. For example Asia east-1a and Asia east-Ib.
3. Configure high availability settings on both instances by using the Citrix ADC GUI or ADC CLI commands.

Step 1. Create VPC networks

Create VPC networks based on your requirements. Citrix recommends you to create three VPC networks for associating with management NIC, client NIC, and server NIC.

To create a VPC network, perform these steps:

1. Log on the Google console > Networking > VPC network > Create VPC Network.
2. Complete the required fields, and click Create.

For more information, see the Create VPC Networks section in Deploy a Citrix ADC VPX instance on Google Cloud Platform
.

Step 2. Create two VPX instances

Create two VPX instances by following the steps given in Scenario: deploy a multi-NIC, multi-IP standalone VPX instance
.

Important:

Assign a client alias IP address to the primary node. Do not use the internal IP address of the VPX instance to configure the VIP.

To create a client alias IP address, perform these steps:

1. Navigate to the VM instance and click Edit.

2. In the Network Interface window, edit the client interface.

3. In the Alias IP range field, enter the client alias IP address.

After the failover, when the old primary becomes the new secondary, the alias IP addresses move from the old primary and is attached to the new primary.

After you have configured the VPX instances, you can configure the Virtual (VIP) and Subnet IP (SNIP) addresses. For more information, see Configuring Citrix ADC-owned IP addresses
.

Step 3. Configure high availability

After you’ve created the instances on Google Cloud Platform, you can configure high availability by using the Citrix ADC GUI or CLI.

Configure high availability by using the GUI

Step 1. Set up high availability in INC Enabled mode on both the nodes.

On the primary node, perform the following steps:

1. Log on to the instance with user name nsroot and instance ID of the node from GCP console as the password.
2. Navigate to Configuration > System > High Availability > Nodes, and click Add.
3. In the Remote Node IP address field, enter the private IP address of the management NIC of the secondary node.
4. Select the Turn on INC (Independent Network Configuration) mode on self node check box.
5. Click Create.

On the secondary node, perform the following steps:

1. Log on to the instance with user name nsroot and instance ID of the node from GCP console as the password.
2. Navigate to Configuration > System > High Availability > Nodes, and click Add.
3. In the Remote Node IP address field, enter the private IP address of the management NIC of the primary node.
4. Select the Turn on INC (Independent Network Configuration) mode on self node check box.
5. Click Create.

Before you proceed further, ensure that the Synchronization state of the secondary node is shown as SUCCESS in the Nodes page.

Note

Now, the secondary node has the same log-on credentials as the primary node.

Step 2. Add Virtual IP address and Subnet IP address on both the nodes.

On the primary node, perform the following steps:

1. Navigate to System > Network > IPs > IPv4s, and click Add.
2. To create a client alias IP (VIP) address:
   1. Enter the Alias IP address and netmask configured for the client subnet in the VM instance.
   2. In the IP Type field, select Virtual IP from the drop-down menu.
   3. Click Create.
3. To create a server IP (SNIP) address:
   1. Enter the internal IP address of the server-facing interface of the primary instance and netmask configured for the server subnet.
   2. In the IP Type field, select Subnet IP from the drop-down menu.
   3. Click Create.

   

On the secondary node, perform the following steps:

1. Navigate to System > Network > IPs > IPv4s, and click Add.
2. To create a client alias IP (VIP) address:
   1. Enter the Alias IP address and netmask configured for the client subnet on the primary VM instance.
   2. In the IP Type field, select Subnet IP from the drop-down menu.
   3. Click Create.
3. To create a server IP (SNIP) address:
   1. Enter the internal IP address of the server-facing interface of the secondary instance and netmask configured for the server subnet.
   2. In the IP Type field, select Subnet IP from the drop-down menu.
   3. Click Create.

   

Step 3. Add a load balancing virtual server on the primary node.

1. Navigate to Configuration > Traffic Management > Load Balancing > Virtual Servers > Add.

2. Add the required values for Name, Protocol, IP Address Type (IP Address), IP Address (primary client alias IP address) and Port, and click OK.

   

Step 4. Add a service or service group on the primary node.

1. Navigate to Configuration > Traffic Management > Load Balancing > Services > Add.
2. Add the required values for Service Name, IP Address, Protocol and Port, and click OK.

Step 5. Bind the service or service group to the load balancing virtual server on the primary node.

1. Navigate to Configuration > Traffic Management > Load Balancing > Virtual Servers.
2. Select the load balancing virtual server configured in Step 3, and click Edit.
3. In the Service and Service Groups tab, click No Load Balancing Virtual Server Service Binding.
4. Select the service configured in the Step 4, and click Bind.

Step 5. Save the configuration.

After a forced failover, the secondary becomes the new primary. The client alias IP (VIP) and the server alias IP (SNIP) from the old primary moves to the new primary.

Configure high availability by using the CLI

Step 1. Set up high availability in INC Enabled mode in both the instances by using the Citrix ADC CLI.

On the primary node, type the following command.

add ha node 1 <sec_ip> -inc ENABLED<!--NeedCopy-->

On the secondary node, type the following command.

add ha node 1 <prim_ip> -inc ENABLED<!--NeedCopy-->

The sec_ip refers to the internal IP address of the management NIC of the secondary node.

The prim_ip refers to the internal IP address of the management NIC of the primary node.

Step 2. Add VIP and SNIP on both nodes.

Type the following commands on the primary node:

add ns ip <primary_client_alias_ip> <subnet> -type VIP<!--NeedCopy-->

Note:

Enter the Alias IP address and netmask configured for the client subnet in the VM instance.

add ns ip <primary_snip> <subnet> -type SNIP<!--NeedCopy-->

The primary_snip refers to the internal IP address of the server-facing interface of the primary instance.

Type the following commands on the secondary node:

add ns ip <primary_client_alias_ip> <subnet> -type VIP<!--NeedCopy-->

Note

Enter the Alias IP address and netmask configured for the client subnet on the primary VM instance.

add ns ip <secondary_snip> <subnet> -type SNIP<!--NeedCopy-->

The secondary_snip refers to the internal IP address of the server-facing interface of the secondary instance.

Note:

Enter the IP address and netmask configured for the server subnet in the VM instance.

Step 3. Add a virtual server on the primary node.

Type the following command:

add <server_type> vserver <vserver_name> <protocol> <primary_client_alias_ip> <port><!--NeedCopy-->

Step 4. Add a service or service group on the primary node.

Type the following command:

add service <service_name> <service_ip_address> <protocol> <port><!--NeedCopy-->

Step 5. Bind the service or service group to the load balancing virtual server on the primary node.

Type the following command:

bind <server_type> vserver <vserver_name> <service_name><!--NeedCopy-->

Note:

To save your configuration, type the command save config. Otherwise, the configurations are lost after you restart the instances.