Citrix NetScaler SDX 11500, Руководство пользователя

Страница: 188 / 253

© 1999-2017 Citrix Systems, Inc. All rights reserved. p.188 https://docs.citrix.com
Consolidation Across Security Zones
Jan 31, 2011
An SDX appliance is often used for consolidation across security zones. The DMZ adds an extra layer of security to an
organization's internal network, because an attacker has access only to the DMZ, not to the internal network of the
organization. In high-compliance environments, a single NetScaler instance with VIP addresses in both the DMZ and an
internal network is generally not acceptable. With SDX, you can provision instances hosting VIP addresses in the DMZ, and
other instances hosting VIP addresses in an internal network.
In some cases, you might need separate management networks for each security zone. In such cases, you have to put the
NSIP addresses of the instances in the DMZ on one network, and put the NSIP addresses of the instances with VIPs in the
internal network on a different management network. Also, in many cases, communication between the Management
Service and the instances might need to be routed through an external device, such as a router. You can configure firewall
policies to control the traffic that is sent to the firewall and to log the traffic.
The SDX appliance has two management interfaces (0/1 and 0/2) and, depending on the model, up to eight 1G data ports
and eight 10G data ports. You can also use the data ports as management ports (for example, when you need to configure
tagged VLANs, because tagging is not allowed on the management interfaces). If you do so, the traffic from the
Management Service must leave the appliance and then return to the appliance. You can route this traffic or, optionally,
specify an NSVLAN on an interface assigned to the instance. If the instances are configured on a management interface
that is common with the Management Service, the traffic between the Management Service and NetScaler instances does
not have to be routed, unless your setup explicitly requires it.
Note: Tagging is supported in XenServer version 6.0.