Load balancing with NetScaler ADC

This article provides guidance on how to deploy a StoreFront server group containing two or more StoreFront servers in all active load balanced configuration. The article provides details of how to configure a NetScaler ADC appliance to load-balance incoming requests from Citrix Workspace app and web browsers between StoreFront servers in the server group.

Create DNS records for the StoreFront server group load balancer

Create a DNS A and PTR record for your chosen shared FQDN. Clients within your network use this FQDN to access the StoreFront server group using the NetScaler ADC appliance load balancer.

Example: storefront.example.com resolves to the load balancing virtual server virtual IP (VIP).

Configure StoreFront Servers

All of the StoreFront servers you wish to load balance between should be configured as part of a StoreFront Server Group which synchronized configuration between servers to ensure they are configured identically. For more details on adding servers to a Server Group see Join an existing server group.

Each server should be configured for HTTPS so that communication between the load balancer and the StoreFront servers is encrypted. See Securing StoreFront with HTTPS. The certificate must contain the load balanced FQDN as a Common Name (CN) or as a Subject Alternative Name (SAN).

Set the Server Group base URL to be the URL of the load balancer. To modify the Base URL, within the Citrix StoreFront management console, in the left hand pane right click Server Group and click Change Base URL. Enter the load balancer virtual server’s URL.

Optionally Configure Citrix Service monitor for HTTPS

A StoreFront installation includes the Citrix Service monitor Windows service. This service has no other service dependencies and monitors the health of critical StoreFront services. This allows the NetScaler ADC and other third-party applications to monitor the relative health of a StoreFront server deployment.

By default the monitor uses HTTP on port 8000. You may optionally change this to use HTTPS on port 443.

1. Open the PowerShell Integrated Scripting Environment (ISE) on the primary StoreFront server and run the following commands to change the default monitor to HTTPS 443:

   $ServiceUrl = "https://localhost:443/StorefrontMonitor"
   Set-STFServiceMonitor -ServiceUrl $ServiceUrl
   Get-STFServiceMonitor
   <!--NeedCopy-->
   

2. Once completed, propagate the changes to all other servers in the StoreFront server group.

3. To perform a quick test on the monitor, enter the following URL into the browser on the StoreFront server or any other machine with network access to the StoreFront server. The browser returns an XML summary of the status of every StoreFront service.

   https://<loadbalancingFQDN>/StoreFrontMonitor/GetSFServicesStatus

   <ArrayOfServiceStatus xmlns="http://schemas.datacontract.org/2004/07/Citrix.DeliveryServices.ServiceMonitor.Contract" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
   <ServiceStatus>
       <name>Citrix Peer Resolution Service</name>
       <status>running</status>
   </ServiceStatus>
   <ServiceStatus>
       <name>CitrixConfigurationReplication</name>
       <status>running</status>
   </ServiceStatus>
   <ServiceStatus>
       <name>CitrixCredentialWallet</name>
       <status>running</status>
   </ServiceStatus>
   <ServiceStatus>
       <name>CitrixDefaultDomainService</name>
       <status>running</status>
   </ServiceStatus>
   <ServiceStatus>
       <name>CitrixSubscriptionsStore</name>
       <status>running</status>
   </ServiceStatus>
   <ServiceStatus>
       <name>NetTcpPortSharing</name>
       <status>running</status>
   </ServiceStatus>
   <ServiceStatus>
       <name>WAS</name>
       <status>running</status>
   </ServiceStatus>
   <ServiceStatus>
       <name>W3SVC</name>
       <status>running</status>
   </ServiceStatus>
   </ArrayOfServiceStatus>
   <!--NeedCopy-->
   

Configure NetScaler Load Balancer

Install Root certificate

If your StoreFront servers use a certificate signed by an internal authority then you must install the root certificate on to the NetScaler. This is required so that NetScaler trusts the StoreFront server’s certificate.

1. Log on to the NetScaler ADC appliance management GUI.
2. Select Traffic Management > SSL > Certificates > CA Certificates.
3. Click Install.
4. On the Install CA Certificate page, enter a Certificate-Key Pair Name, click Choose File and browse for the certificate file.
5. Click Install.

Install the server certificate

To enable HTTPS you need a certificate whose Subject alternate name includes the FQDN of the load balancer. You can sign the certificate with an enterprise or public certificate authority.

You must have separate certificate and key files in PEM format. If you have a certificate containing the private key in PKCS12 format then you can use openssl to convert the file. E.g.:

openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.cer
openssl pkcs12 -in cert.pfx -nocerts -out storefrontlbeu.key
<!--NeedCopy-->

A prompt appears to enter the existing password and a new PEM passphrase.

To install the certificate:

1. Log on to the NetScaler ADC appliance management GUI.
2. Select Traffic Management > SSL > Certificates > CA Certificates.
3. Click Install.
4. On the Install CA Certificate page:
   1. Enter a Certificate-Key Pair Name.
   2. Under Certificate File Name, click Choose File and browse for the certificate file.
   3. Under Key File Name, click Choose File and browse for the key file.
   4. Under Password enter the passphrase.
   5. Click Install.
5. Click Link to link the certificate to the root certificate.

Add individual StoreFront server nodes to the NetScaler ADC appliance load balancer

1. Navigate to Traffic Management > Load Balancing > Servers. Click Add and add each of the StoreFront servers to be load balanced.

   Example = 2 x StoreFront servers named StoreFront-eu-1 and StoreFront-eu-2

2. Use IP-based server configuration and enter the server IP address for each StoreFront node.

Define a StoreFront monitor to check the status of all StoreFront nodes in the server group

1. Log on to the NetScaler ADC management GUI.
2. Select Traffic Management > Load Balancing > Monitors > Add and add a new monitor called StoreFront and accept all default settings.
3. From the Type drop-down menu, select StoreFront.
4. If you have configured your StoreFront monitor for HTTPS, then ensure that the Secure option is selected. Else leave this option unselected and enter a port of 8000.
5. Select the Check Backend Services option. This option enables monitoring of services running on the StoreFront server. StoreFront services are monitored by probing a Windows service that runs on the StoreFront server, which returns the status of the following services:
   • W3SVC (IIS)
   • WAS (Windows Process Activation Service)
   • CitrixCredentialWallet
   • CitrixDefaultDomainService

   

Create a service group containing all of the StoreFront servers

1. Navigate to Traffic Management > Load Balancing > Service Groups. Press Add. To connect to the StoreFront servers over HTTPS, select a protocol of SSL. Leave other settings as default. Press OK.

2. Within your Service Group, under Service Group Members, click No Service Group Member.

   1. Click Service Based.
   2. Select all of the Servers you defined previously.
   3. To use SSL between the load balancer and the StoreFront server enter port 443. Else enter port 80.

   

3. Add the Monitors section and select the StoreFront monitor you created earlier.

   

4. Add the Certificates section.

   1. Bind the client certificate.
   2. Bind the CA certificate used to sign the server certificate that you imported earlier, and any other CAs that might be part of the PKI chain of trust.

   

5. Add the Settings section. Select Insert Client IP Header and enter a header name of X-Forwarded-For. This allows the Client IP Address to be used in Citrix Virtual Apps and Desktops Policies.

Create a load balancing virtual server for user traffic

1. Log on to the NetScaler ADC appliance management GUI.

2. Select Traffic Management > Load Balancing > Virtual Servers > Add to create a new virtual server.

3. Enter a name, choose a protocol of SSL and enter the Port. Click OK to create the Virtual Server.

   

4. Bind the Service Group you created earlier to the load balancing virtual server.

5. Bind the same server and CA certificate you previously bound to the service group.

6. Add the Method section and select the load-balancing method. Common choices for StoreFront load balancing are round robin or least connection.

   

7. Add the Persistance section.

   1. Set the persistence method to be COOKIEINSERT.

   2. Set the time-out to be the same as the Session time out within StoreFront which by default is 20 minutes.

   3. Name the cookie. For example, NSC_SFPersistence, as this makes it easy to identify during debugging.

   4. Set backup persistence to NONE.

   Note:

   If the client is not allowed to store the HTTP cookie, the subsequent requests don’t have the HTTP cookie, and Persistence is not used.

Configure StoreFront Loopback

When the base address is a load balancer, for the internal communication between StoreFront services, it could cause traffic to route to the load balancer and potentially to another server. This results in poor performance and unexpected behaviour. Use the StoreFront setting Enable loopback communication to avoid it. By default this is set to On, meaning it replaces the host part of the service address with the loopback IP address 127.0.0.1, while keeping the schema (HTTP or HTTPS) as-is. This works for a single server deployment and deployments with a non SSL-terminating load balancer.

Where the load balancer is SSL-terminating and communicates with StoreFront over HTTP (not recommended), it’s necessary to configure StoreFront loopback communication to OnUsingHttp, which means that StoreFront will also change the schema from HTTPS to HTTP.

1. Open Citrix StoreFront.
2. For each Store, go to Manage Receiver for Web Sites. For each Web site go to Configure.
3. Go to Advanced Settings
4. Change the Enable loopback communication setting to OnUsingHttp.

Where the load balancer is SSL-terminating and communicates with StoreFront over HTTP (not recommended), it is necessary to configure StoreFront loopback communication to OnUsingHttp, which means that StoreFront will also change the schema from HTTPS to HTTP.

Configure NetScaler ADC load balancer for subscription synchronization between server groups

If you have a multisite deployment consisting of two or more StoreFront server groups, you can replicate subscription data between them using a pull strategy on a repeating schedule. StoreFront subscription replication uses TCP port 808, so using an existing load balancing virtual server on HTTP port 80 or HTTPS 443 fails. To provide high availability for this service, create a second virtual server on each NetScaler ADC appliance in your deployment to load balance TCP port 808 for each of the StoreFront server groups.

Configure a service group for subscription synchronization

1. Log on to the NetScaler ADC appliance management GUI.
2. Select Traffic Management > Load Balancing > Service Groups > Add.
3. Enter a Service Group name, change the protocol to TCP and click OK to save.
4. In the Service Group Members section, add all of the StoreFront server nodes you defined previously in the Servers section and specify Port to 808.
5. Add the Monitors section.
   1. Click where it says No Service Group to monitor Binding.
   2. Click Add. Enter a monitor Name and set its Type to TCP. Click Create.
   3. Click Bind.

Create a load balancing virtual server for subscription synchronization

1. Log on to the NetScaler ADC appliance management GUI.
2. Select Traffic Management> Load Balancing > Virtual Servers > Add and add a new service group.
3. Enter a Name
4. Change the protocol to TCP.
5. Enter an IP Address.

6. Enter a Port of 808.

   

7. Click OK.
8. Click No Load Balancing Virtual Server ServiceGroup Binding, select the Service Group you created earlier and click Bind.
9. Add the Method section and set the Load Balancing Method to ROUNDROBIN
10. Click Done to complete your changes.

Configure StoreFront to pull subscription data via load balancer

See Configure subscription synchronization.

When configuring the replication schedule, specify a server group address that matches the subscription syncing virtual server virtual load balancer IP address.