Citrix ByteMobile T1010, Установка, настройка и администрирование

Страница: 101 / 172

T-Series Traffic Director Installation, Configuration and Administration Guide 3-27
Configuring Security
Creating a Net Profile
A NetScaler net profile (or network profile) contains an IP address or an IP set. It can be
bound to load balancing or content switching virtual servers, services, service groups, or
monitors. During communication with physical servers or peers, the NetScaler appliance
uses the addresses specified in the profile as the source IP address.
For NAT purposes, a network profile may be used to specify the set of 172.16.113.(1-16)
public IP addresses that will be used in place of the private addresses.
> add ns ip 172.16.113.[2-16] 255.255.255.0 -vserver DISABLED -ssh DISABLED -gui
DISABLED
Done
> add ipset egress-vlan251
Done
> bind ipset egress-vlan251 172.16.113.[1-16]
Done
> add netprofile netpf-vlan251 -srcIP egress-vlan251
Done
Binding Net Profile to Existing Egress-Side Service
Once a net profile with the appropriate public IP addresses to use has been created, it should
be associated with the corresponding router object:
> set service server1service -netprofile netpf-vlan251 -usip OFF
Done
This command implicitly enables SNAT for all outgoing OSN traffic towards the internet.
Creating Bypass Ingress-Side Vserver
SNAT is typically required for outgoing traffic regardless of whether it hits the OSN or not.
The latter is a common occurrence in Unison clusters that optimize only HTTP, POP3,
IMAP, and SMTP traffic. However, it can be a rather uncommon occurrence in Unison
clusters that optimize all data traffic, with OSNs being bypassed in case of maintenance
windows and/or mass failure events.
For this reason, SNAT requires the creation of a bypass ingress-side vserver. This vserver is
of a lower priority than the normal ingress side vserver and only facilitates traffic SNAT.
> add lb vserver Ingress_bypass ANY * * -persistenceType SOURCEIP -lbMethod
ROUNDROBIN -timeout 30 -Listenpolicy "CLIENT.VLAN.ID.EQ(151)" -Listenpriority 11
-m MAC -cltTimeout 120 -l2Conn ON
Done
> bind lb vserver Ingress_bypass server1service
Done
Configuring Security
The management IP is accessible from all interfaces. This may expose the T1000
management shell and GUI to 3rd parties beyond the operations and management personnel.