Citrix NetScaler EE, Руководство по установке и настройке

Страница: 809 / 1026

© 1999-2017 Citrix Systems, Inc. All rights reserved. p.809 https://docs.citrix.com
Configuring a Router
Jan 28, 2011
To support virtual inline mode, a router must forward incoming as well as outgoing WAN traffic to the SD-WAN appliance.
After the appliance processes the traffic, the router must forward the incoming traffic from the appliance to the LAN and
the outgoing traffic from the appliance to the WAN. You have to configure policy based rules to avoid routing loops. In
addition, the router must monitor the health of the appliance so that the appliance can be bypassed if it fails .
If the router supports the Reverse Path Forwarding feature, you must disable the feature on the interfaces with policies to
redirect traffic to a SD-WAN appliance, including the interface that is connected to the appliance. Otherwise, the router
intermittently drops traffic. By default, the Reverse Path Forwarding feature is enabled on the router.
Note: If the network has two routers, configure the following procedures for each router using appropriate IP addresses
identified in the worksheet.
In the virtual inline mode, the packet forwarding methods can create routing loops if the routing rules do not distinguish
between a packet that has been forwarded by the appliance and one that has not. You can use any method that makes
that distinction.
A typical method involves dedicating one of the Ethernet ports of the router to the appliance and creating routing rules
based on the Ethernet port on which packets arrive. Packets that arrive on the interface dedicated to the appliance are
never forwarded back to the appliance, but packets arriving on any other interface can be.
Traffic shaping is not effective unless all WAN traffic passes through the appliance. Following is the basic routing algorithm:
Do not forward packets from the appliance back to the appliance.
If the packet arrives from the WAN, forward the packet to the appliance.
If the packet is destined for the WAN, forward the packet to the appliance.
Do not forward LAN-to-LAN traffic to the appliance.
If the appliance fails, data should not be routed to it. By default, Cisco policy based routing does not perform health
monitoring. To enable health monitoring, define a rule to monitor the availability of the appliance, and specify the "verify-
availability" option for the "set ip next-hop" command. With this configuration, if the appliance is not available, the route is
not applied, and the appliance is bypassed.
Note: Citrix recommends virtual inline mode only when used with health monitoring. Many routers that support policy based
routing do not support health checking. The health-monitoring feature is relatively new. It was first available in Cisco IOS
release 12.3(4)T.
Following is an example of a rule for monitoring the availability of the appliance by using Cisco Router model 7600 with IOS
Software version:
!- Use a ping (ICMP echo) to see if appliance is in the connected track
123 rtr 1 reachability
!
rtr 1
type echo protocol IpIcmpecho 17.17.17.2 schedule 1 life forever start-time now
This rule pings the appliance at 17.17.17.2 periodically. You can test against 123 to see if the unit is up.