Use case 10: Load balancing of intrusion detection system servers

To enable the Citrix ADC appliance to support load balancing of intrusion detection system (IDS) servers, the IDS servers and clients must be connected through a switch that has port mirroring enabled. The client sends a request to the server. Because port mirroring is enabled on the switch, the request packets are copied or sent to the Citrix ADC appliance virtual server port. The appliance then uses the configured load balancing method to select an IDS server, as shown in the following diagram.

Figure 1. Topology of Load Balanced IDS Servers

Note: Currently, the appliance supports load balancing of passive IDS devices only.

As illustrated in the preceding diagram, the IDS load balancing setup functions as follows:

1. The client request is sent to the IDS server, and a switch with a mirroring port enabled forwards these packets to the IDS server. The source IP address is the IP address of the client, and the destination IP address is the IP address of the server. The source MAC address is the MAC address of the router, and the destination MAC address is the MAC address of the server.
2. The traffic that flows through the switch is mirrored to the appliance. The appliance uses the layer 3 information (source IP address and destination IP address) to forward the packet to the selected IDS server without changing the source IP address or destination IP address. It modifies the source MAC address and the destination MAC address to the MAC address of the selected IDS server.

Note: When load balancing IDS servers, you can configure the SRCIPHASH, DESTIPHASH, or SRCIPDESTIPHASH load balancing methods. The SRCIPDESTIPHASH method is recommended because packets flowing from the client to a service on the appliance must be sent to a single IDS server.

Suppose Service-ANY-1, Service-ANY-2, and Service-ANY-3 are created and bound to Vserver-LB-1. The virtual server balances the load on the services. The following table lists the names and values of the entities configured on the appliance.

Note: You can use inline mode or one-arm mode for an IDS load balancing setup.

The following diagram shows the load balancing entities and values of the parameters to be configured on the appliance.

Figure 2. Entity Model for Load Balancing IDS Servers

To configure an IDS load balancing setup, you must first enable MAC-based forwarding. Also disable layer 2 and layer 3 modes on the appliance.

To enable MAC-based forwarding by using the command line interface

At the command prompt, type:

enable ns mode <ConfigureMode><!--NeedCopy-->

Example:

enable ns mode MAC<!--NeedCopy-->

To enable MAC-based forwarding by using the configuration utility

Navigate to System > Settings > Configure Modes, and select MAC Based Forwarding.

Next, see “Setting Up Basic Load Balancing
”, to configure a basic load balancing setup.

After you configure the basic load balancing setup, you must customize it for IDS by configuring a supported load balancing method (such as the SRCIPDESTIP Hash method on a sessionless virtual server) and enabling MAC mode. The appliance does not maintain the state of the connection and only forwards the packets to the IDS servers without processing them. The destination IP address and port remains unchanged because the virtual server is in the MAC mode.

To configure a load balancing method and redirection mode for a sessionless virtual server by using the command line interface

At the command prompt, type:

set lb vserver <vServerName> -lbMethod <LBMethodOption> -m <RedirectionMode> -sessionless <Value><!--NeedCopy-->

Example:

set lb vserver Vserver-LB-1 -lbMethod SourceIPDestIPHash -m MAC -sessionless enabled<!--NeedCopy-->

Note

For a service that is bound to a virtual server on which the -m MAC option is enabled, you must bind a non-user monitor.

To configure a load balancing method and redirection mode for a sessionless virtual server by using the configuration utility

1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
2. Open a virtual server and, in Redirection Mode, select MAC Based.
3. In Advanced Settings, click Methods, and select SRCIPDESTIPHASH. Click Traffic Settings, and select Sessionless Load Balancing.

To set a service to use the source IP address by using the command line interface

At the command prompt, type:

set service <ServiceName> -usip <Value><!--NeedCopy-->

Example:

set service Service-ANY-1 -usip yes<!--NeedCopy-->

To set a service to use the source IP address by using the configuration utility

1. Navigate to Traffic Management > Load Balancing > Services.
2. Open a service, and in Settings select Use Source IP Address.

For USIP to function correctly, you must set it globally. For more information about configuring USIP globally, see IP Addressing
.