Table of Contents
Citrix NetScaler is a very powerful and versatile platform for application delivery. Load balancing is one of the key features of Citrix NetScaler. Many organisations are using Microsoft Exchange 2016 to provide email, calendar, tasks and other enterprise collaboration solutionsÃ‚Â to their employees and customers.Ã‚Â Deploying Citrix NetScaler in front of Microsoft Exchange 2016 ensures security, reliability and performance for end-users and IT-engineers. This method is also known as “reverse-proxy” for Microsoft Exchange.
Requirements for the configuration:
- CitrixÃ‚Â NetScaler 11.1Ã‚Â (www.citrix.com)
- Microsoft Exchange 2016
- SSL Certificate
My homelab setup
My homelab setup is not that complex. I am running the Exchange 2016 server and the NetScaler as a Hyper-V virtual machine. For load balancing usually you need more then one back-end resource (Exchange 2016 server), but for testing the load balancing concept it’s fine. Also I am using a self-signed certificate. If you run this similar setup in production, you need a valid certificate singed by a public certificate authority.
So let’s start.
Logon to the NetScaler and go to System-> Basic ConfigurationÃ‚Â and enable the correct featured in theÃ‚Â Basic Features panel according to the screenshot below.
Add ServersÃ‚Â (back-end servers)
Let’s add the servers we will be using to load balance. In my case this is my Exchange 2016 Server. When we add the server here, we can later use it in the Service Group as a resource.
Navigate toÃ‚Â Traffic Management -> Load Balancing -> Servers andÃ‚Â click onÃ‚Â Add.
Enter the required information and click onÃ‚Â Create.
Set up Service Groups
We will need a total of five Service Groups. See the table below. Let’s setup the Service Groups needed to feed the Load Balancing vServer.
|Load Balancing Service Group Name||Exchange feature||Protocol||Port|
|lb_svg_exch2016_owa||Outlook Web Access||SSL||443|
|lb_svg_exch2016_ews||Exchange Web Service||SSL||443|
|lb_svg_exch2016_activesync||ActiveSync Service for mobile mailclients||SSL||443|
|lb_svg_exch2016_rpc||Outlook Anywhere or RPC over HTTPS||SSL||443|
Navigate toÃ‚Â Traffic Management -> Load Balancing -> Service Groups and click on Add.
Enter the required information and click onÃ‚Â OK. Make sure to chooseÃ‚Â SSL as Protocol.
Click then onÃ‚Â OK again.
Now we have to assign Service Group members. These are your Exchange 2016 servers off-course. In my case there is only one as I explained earlier in my post. Click onÃ‚Â No Service Group Member.
Click onÃ‚Â Server Based to select the server you added earlier. In my case that isÃ‚Â exchange01.vikash.nl. Make sure you use portÃ‚Â 443. Click onÃ‚Â Create.
Click onÃ‚Â Done.
You will now be taken to the overview of the Service Groups. Using the steps above create the other needed Service Groups. You can select theÃ‚Â lb_svg_exch2016_owa and then click onÃ‚Â Add.Ã‚Â This is how it should look in the NetScaler interface when you have create all the Service Groups according to the table above.
Set up Load Balancing Virtual Servers
Navigate toÃ‚Â Traffic Management -> Load Balancing -> Virtual Servers and click onÃ‚Â Add.
We will create five Load Balancing Virtual Servers. In the table below I have specified them:
|Load Balancing Virtual Server name||Load Balancing function|
|lb_exch2016_vsrv_owa||Outlook Web Access|
|lb_exch2016_vsrv_ews||Exchange Web Services|
|lb_exch2016_vsrv_activesync||ActiveSync Service for mobile mailclients|
|lb_exch2016_vsrv_rpc||Outlook Anywhere or RPC over HTTPS|
Enter the required information. Make sure you chooseÃ‚Â SSL for protocol and make theÃ‚Â IP Address TypeÃ‚Â Non Addressable. We don’t want the Virtual Server to be directly accessible on the network. Instead we will use the Content Switching feature of the Citrix NetScaler to direct traffic to where we want it. Click onÃ‚Â OK after setting up everything like the screenshot below.
Click onÃ‚Â No Load Balancing Virtual Server ServiceGroup Binding.
Select the a Service Group to bind and click onÃ‚Â Bind.
Click onÃ‚Â No Server Certificate to bind a certificate.
Select the appropriate Server Certificate. In my case this is my self-signed certificate, which is fine for testing purposes. In thisÃ‚Â post I show you how to import a PFX certificate on the NetScaler. After selecting the correct certificate, click onÃ‚Â Bind.
Click onÃ‚Â Continue.
Click onÃ‚Â Done.
Create the other Load Balancing Virtual Servers like I specified in the table above. Just select the Load Balancing Virtual Server we just added, and click onÃ‚Â Add and follow the steps as described above.
After adding all the Load Balancing Virtual Servers, the list should look like the screenshot below.
Set up Persistence
Several of the Load Balancing Virtual Server require a different setting for Persistence. In the table below I have specified the settings:
|Load Balancing Virtual Server Name||Exchange Feature||Persistence Type||Setting per type|
|lb_exch2016_vsrv_owa||Outlook Web Access||NONE||Default|
|lb_exch2016_vsrv_ews||Exchange Web Service||NONE||Default|
|lb_exch2016_vsrv_activesync||ActiveSync Service for mobile mailclients||SRCIPDESTIP||Default|
|lb_exch2016_vsrv_rpc||Outlook Anywhere or RPC over HTTPS||RULE||TimeOut: 240
Navigate toÃ‚Â Traffic Management -> Load Balancing -> Virtual Server and selectÃ‚Â lb_exch2016_vsrv_rpc. Then click onÃ‚Â Edit. You will should see the screen below. Click onÃ‚Â Persistence in the right column of the page.
Select the setting for this specific virtual server in the drop-down menu. Enter the expressionÃ‚Â HTTP.REQ.HEADER(“Authorization”) and click onÃ‚Â OK.
Click onÃ‚Â Done.
Now do the same for the other load balancing virtual servers. Check the table for the specific settings. In the end you should end your Virtual Server should look like the screenshot below.
Set up Content Switching Virtual Servers
The content switching server will redirect the traffic to the appropriate load balancing server. After creating the content switching virtual server we will define the content switching actions and policies, and bind them to the content switching virtual server. Navigate toÃ‚Â Traffic Management -> Content Switching -> Content Switching Virtual Servers and click onÃ‚Â Add.
Enter the information and make sure you use a new IP address and port 443.
Click onÃ‚Â OK.
Now we have to bind the SSL certificate. Click onÃ‚Â Certificate in the right column.
Select the certificate (in my case vikash.nl) and click on Bind.
Click on Continue and then on Done.
We can now see that the virtual server is up.
Create Content Switching Actions
Now we have to create the content switching Actions. These actions will send the traffic to the appropriate backend load balancing virtual server.
Navigate to Traffic Management -> Content Switching -> Content Switching Actions and click on Add.
Fill in the name, select Loadbalancing Virtual Server and select one of the Load Balancing Virtual Servers. In my screenshot I start with the load balancing server for Outlook Web Access. Click then on Create.
Now select the content switch action we just created, and then on Add. This will duplicate the switch action, making it easier to adjust settings for the following switch actions.
In the end you should have all the load balancing virtual servers connected to a specific content switch action, and your screen should look something like the my screenshot below.
Create Content Switching Policies
In the content switching policies we will tell Citrix NetScaler where to redirect the requests to. In the table below I have created an overview of the policies.
Navigate to Traffic Management -> Content Switching -> Content Switching Policies and click on Add.
Give a name and select the appropriate action. Fill in the correct expression (see table above) and click on Create.
Now select the content switch policy we just created, and then on Add. This will duplicate the switch policy, making it easier to adjust settings for the following switch policies.
In the end your list of policies should look like my screenshot below.
Bind Content Switching Policies
Now we have to bind the content switching policies to the content switching virtual server. This is the server where all the traffic comes in, and according to the policies the NetScaler redirect the traffic.
Navigate to Traffic Management -> Content Switching -> Content Switching Virtual Server. Select the content switching virtual server and click on Edit.
Click on No Content Switching Policy Bound to bind the policies.
Select the policy and set the priority. Click then on Bind.
Do the same for all the policies. Your screen should look like my screenshot below.
You should have 5 content switching policies bound to the switching virtual server.
Now you can test! You should be able to connect to the ip address of the content switching server and it should redirect you to the appropriate resource on the backend.
This concludes this tutorial. Feel free to contact me of you have any questions or comments.
You can also follow me on twitter or add the rss feed from the blog and you will be notified when I add new posts.