Citrix NetScaler EE, Руководство по установке и настройке

Страница: 755 / 1026

© 1999-2017 Citrix Systems, Inc. All rights reserved. p.755 https://docs.citrix.com
different VLANs.
Management subnet— The virtual machines connect directly to the external management subnet, with different IP
addresses for the management service, NetScaler instance, and XenServer.
Note: You must keep the traffic interfaces isolated from the management interface to prevent ARP flapping and other
problems. This isolation can be achieved physically or by tagging management interface and traffic interface packets with
different VLANs.
Private Internal traffic subnet— The accelerators' accelerated ports are connected to the NetScaler instance internally
in a one-arm mode, using an internal traffic subnet. There is no direct connection between the instances' accelerated ports
and the appliance’s external ports. All accelerated traffic to the accelerators is controlled by the NetScaler instance.
Since this internal subnet is not accessible from outside the appliance, it uses non-routable subnets in the 169.254.0.0/16
range. The NetScaler instance provides NAT for features that require routable access to the accelerator Only the following
two features of the accelerators require IP addresses that can be reached from the outside world:
The signaling IP address, used for secure peering and the SD-WAN (WANOP only) Plugin.
IP addresses, used for communication with the router when the WCCP protocol (WANOP only) is used.
In both cases, the number of externally visible IP addresses is independent of the number of accelerators the appliance has.
Data Flow on the Private Traffic Subnet—The one-arm connection between the NetScaler instance and the accelerators uses the SD-WAN
virtual inline
mode, in which the NetScaler instance routes packets to the accelerators and the accelerators route them back to the
NetScaler instance. Traffic flow over this internal traffic subnet is identical regardless of whether the mode visible to the
outside world (on the external interfaces) is inline or virtual inline.
This traffic requires the SD-WAN "Return to Ethernet Sender" option, and the NetScaler MAC Address Forwarding and Use
Subnet IP options, which are enabled by the Provisioning Wizard.
Note: The WCCP mode is applicable to appliances with WANOP only.
Deployment Mode Summary
The differences between WCCP mode, inline mode, and virtual inline mode can be summarized as follows:
WCCP mode is a one-arm configuration. The accelerators establish WCCP control channels with the router. In WCCP
mode, only one or two accelerators manage the WCCP control channel on behalf of all the accelerators. Data traffic is
load-balanced across all the accelerators. When GRE encapsulation is used, the NetScaler instance performs GRE
encapsulation/decapsulation on the data stream between itself and the router, allowing the data between the
NetScaler and the accelerators to use a decapsulated, Level-2 configuration.
Inline mode operates much the same as WCCP mode internally, but externally the appliance emulates a bridge, and no
WCCP control channel is established. A packet that enters the appliance on one bridge port exits through the other
bridge port. SD-WAN 4000 and 5100 appliances have multiple bridges to support multiple inline links.
In virtual inline mode (used when WCCP and inline modes are not feasible), the appliance is deployed in a one-arm
configuration, much like WCCP, but without the WCCP control channel. Traffic is sent to the appliance from the router,
using policy-based routing (PBR) rules. The appliance processes the traffic and returns it to the router.
Figure 2. Inline cabling