Jump to content
Welcome to our new Citrix community!

Adc routing traffic without nat


Jeff Riechers

Recommended Posts

32 minutes ago, Johannes Norz said:

ADC, by default, is a L3 router. It will simply rout traffic, if you don't add NAT rules.

 

You may also use "load-balancing" to rout traffic. In case you do this, you also get some application logic. To preserve the user's IP you would need to use source IP mode.

 

Unfortunately they don't want the ADC to own any IPs for back end services, so presenting devices as load balancers is a no go, has to all be done with routes, ACLs and NATs.

 

I have tried PBR, but still can't find a way to present the "back-end" ip to the front-end communication.

Link to comment
Share on other sites

4 minutes ago, Jeff Riechers1709152667 said:

 

Unfortunately they don't want the ADC to own any IPs for back end services, so presenting devices as load balancers is a no go, has to all be done with routes, ACLs and NATs.

 

I have tried PBR, but still can't find a way to present the "back-end" ip to the front-end communication.

 

That's not right. If you use Source-IP mode (SIP mode), the ADC will proxy the connection, but instead of using it's SNIP, it fill "fake" the client IP. So the back-end server will "think", the packet came from the client. See here: https://docs.citrix.com/en-us/citrix-adc/current-release/networking/ip-addressing/enabling-use-source-ip-mode.html

 

Cheers

 

Johannes Norz

Link to comment
Share on other sites

Yea

3 minutes ago, Johannes Norz said:

 

That's not right. If you use Source-IP mode (SIP mode), the ADC will proxy the connection, but instead of using it's SNIP, it fill "fake" the client IP. So the back-end server will "think", the packet came from the client. See here: https://docs.citrix.com/en-us/citrix-adc/current-release/networking/ip-addressing/enabling-use-source-ip-mode.html

 

Cheers

 

Johannes Norz

 

Yeah, saw that too.  But using USIP was breaking their gateway connections so might need to do some more massaging of the config to make it happen.

Link to comment
Share on other sites

22 hours ago, Jeff Riechers1709152667 said:

Yeah, saw that too.  But using USIP was breaking their gateway connections so might need to do some more massaging of the config to make it happen.

Typically if USIP mode is enabled, you have to configure the backend servers with a default gateway of the ADC SNIP, so traffic for the client network returns through the ADC.

Link to comment
Share on other sites

On 12/16/2020 at 7:39 PM, Rhonda Rowland1709152125 said:

Typically if USIP mode is enabled, you have to configure the backend servers with a default gateway of the ADC SNIP, so traffic for the client network returns through the ADC.

 

Sure. But that's what he did, as he is currently using L3 mode. That's why I didn't mention it.

Link to comment
Share on other sites

  • 5 months later...

Hi,


I'm not sure if I can help with my case, but I solved some asymetric routing using PBR in my NetScaler.:

  • add ns pbr PBR_VLAN_XXX ALLOW -srcIP = VIP_IPs  -destIP = VLAN_SNIP  -nextHop DGW  -protocol TCP

I needed to return traffic to the client, that had an IP in the VLAN, where the LB had a SNIP too.

 

Greetings.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...