TFTP Load Balancing with Direct Server Return Does Not Work on NetScaler

TFTP Load Balancing with Direct Server Return Does Not Work on NetScaler

book

Article ID: CTX203051

calendar_today

Updated On:

Description

Unable to upload file to the TFTP server with NetScaler load balancer.

Resolution

Created a loopback adapter on the TFTP server with NetScaler load balancing VIP.

Add MS Loopback adaptor to TFTP servers. From the Windows Start button: 
o Right-click: Computer
o Select: Properties
o Select: Device Manager
o Right-click: <Computer Name>
o Select: Add Legacy Hardware  
o Click: Next
o Select: Install the hardware, manually select from a list
o Click: Next
o Select: Network Adapters
o Click: Next
o Select: Microsoft
o Select: Microsoft Loopback Adapter
o Click: Next twice
o Click: Finish 

Add load balancing VIP IP address to MS Loopback adaptor. From the Windows Start button:
o Select: Control Panel
o Select: Network and Internet
o Select: Network and Sharing Center
o Select: Local Area Connection 3 (The loopback being the last added will be the highest number)
o Select: Properties
o Select: Internet Protocol Version 4
o Select: Properties
o Select: Use the following IP address
o Enter: IP Address: 192.168.1.2 and Subnet mask:255.255.255.0
o Click: Ok and close all other windows  

Configure adapters to send and receive for loopback. This step is necessary in order to allow the server interfaces to send and receive traffic destined for the IP addresses of both the loopback and external interfaces.

From the Windows Command prompt enter:
o netsh
o interface  
o ipv4
o set interface "Local Area Connection" weakhostreceive=enabled  (orignal adapter of machine)
o set interface "Local Area Connection 3" weakhostreceive=enabled  (new adapter we created)
o set interface "Local Area Connection 3" weakhostsend=enabled 

Bind TFTP Service to Loopback. This step is necessary in order to allow the Provisioning Services/TFTP Servers to receive TFTP requests on the loopback interface.
Open Windows Explorer:
o Browse to C:\Program Files\Citrix\Provisioning Services
o Double click tftpcpl.cpl
o Select the TFTP Network TAB
o Select the loopback 192.168.0.90
o Click OK o Click Yes to restart the TFTP service

To verify open a DOS prompt and enter:
o Netstat –na | findstr 192.168.1.2:69
o The output should reflect the loopback listening on UDP port 69 

Now the packet flow will be:
Client 192.168.1.1 will send packet to NetScaler load balancing VIP 192.168.1.2.
NetScaler will send the packet to TFTP server 192.168.1.3.
TFTP server will respond directly to client 192.168.1.1 bypassing the NetScaler but while replying it will use source IP as 192.168.1.2 because of the loopback adapter we created.
Client will receive the packet from 192.168.1.2 and will accept it since it sent the packet to 192.168.1.2 and received it as well from 192.168.1.2 and the communication will be successful

On the NetScaler TFTP.pl monitor will not work, so use tcp/ping monitor on the NetScaler to check the health of TFTP servers.


Problem Cause

The set up was a DSR (Direct Server Return).

What is DSR:
In Direct server return the client, NetScaler load balancing IP and the backend server will be in the same subnet and Use Source IP will be enabled on the NetScaler.
Due to this kind of setup when client sends the packet to load balancing VIP and NetScaler sends it to the backend server then the source IP will still be the client IP address (because we have use source IP enabled). Now when the backend server recieves the packet it sees that the client IP is in the same subnet as it's own and hence will reply directly to the client via arp request and hence the reply packet will never go through NetScaler. This is why it's called Direct server return.

In this scenario - client IP 192.168.1.1, NetScaler LB VIP 192.168.1.2 (USIP enbled), TFTP server 192.168.1.3
Client was sending the packet to load balancing VIP 192.168.1.2 but the client was receiving the packet from 192.168.1.3 due to which client was resetting the packet since it sent the packet to the 192.168.1.2 but got a reply from 192.168.1.3.

Issue/Introduction

Unable to upload file to the TFTP server with NetScaler Load balancer.