Introduction to NetScaler SDX

NetScaler SDX Components

1. XenServer: This is the Hypervisor
2. Service VM (SVM): Provides services like creation/modification/deletion of VPXs. Acts as a management interface for the SDX.
3. NetScaler VPX: Provisioned on the SDX to provide multi-tenant solution.
4. 3rd Party VPXs: Third-party VPXs like TrendMicro, PaloAlto, Websense, etc can also be hosted on SDX.

NetScaler SDX Licensing

When the SVM is started on SDX platform, the license determines the total system performance and the number of VPX instance allowed. Feature licenses are configured when the NetScaler VPX instance is created. The license information is stored in XenStore and is referenced when the VPX is started. On SVM you should have platinum license but on VPX it can be standard/enterprise/platinum license. NetScaler SDX license are stored in /mpsconfig/license directory of the XenServer.

NetScaler SDX Network Traffic Behavior

• Instances can directly communicate with the virtual NIC’s. SDX can support 64 virtual NIC’s which can be allocated to the instances.

• Each VPX instance has dedicated VF (virtual function) and hence the performance is not impacted by other instances.

• VLAN filtering provides segregation of data between instances. VLAN filtering is enabled by default on the NetScaler SDX appliance. For example, if you have configured two NetScaler VPX instances on two different VLANs and you enable VLAN filtering, one instance cannot view the other instance's traffic.

  • If VLAN filtering is disabled, all of the instances can see the tagged or untagged broadcast packets, but the packets are dropped at the software level.
  • If VLAN filtering is enabled, each tagged broadcast packet reaches only the instance that belongs to the corresponding tagged VLAN.
  • If none of the instances belong to the corresponding tagged VLAN, the packet is dropped at the hardware level (NIC).
• A receive packet that successfully passed MAC address filtering is then subjected to VLAN header filtering:
  1. If the packet does not have a VLAN header, it passes to the next filtering stage
  2. If VLAN filtering is disabled, the packet is forwarded to the next filtering stage
  3. If the packet has a VLAN header, and it matches an enabled host VLAN filter, the packet is forwarded to the next filtering stage
  4. Otherwise, the packet is dropped

  • The following examples illustrates how a VLAN ID is verified:

    Case 1	When the VF has a VLAN set from the SVM then below points are true irrespective of VLAN filtering enabled/disabled:   If VM tries to set the same then VLAN silently ignore the request as the VLAN filter is already programmed   If VM tries to set different VLAN, then error is returned
    Case 2	When VF does not have VLAN set from the SVM: If VLAN filtering is Disabled and VM tries to set VLAN on VF, silently ignore the request. If VLAN filtering is Enabled and VM tries to set VLAN on VF, add the VLAN filter if resources available

• If in a deployment the VPX instance needs to communicate with network segment that is in other VLANs than the default VLAN then there is no need to configure the VLAN settings on SVM while provisioning the instance. In this case you mention the VLAN settings on the VPX device wherein we create a VLAN, bind interface to it, and enable tagging on the interface. Refer to CTX138822 - How to Change the NetScaler VLAN on NetScaler SDX for more information.

• If the native VLAN of a VPX instance on SDX is different from the native VLAN of the upstream switch then we need to change the NSVLAN in the VLAN settings of the instance from SVM so that it matches with the upstream device. For example if the upstream switch has VLAN20 as native VLAN then the NSVLAN ID on NetScaler VPX instance should be 20. (This is only for management).

• NSVLAN is the VLAN to which the subnet of NSIP is bound. If SVM and NSIP of instance are in different subnets, then we need to specify the VLAN when provisioning the instance. We specify this in the NSVLAN “Create NetScaler instance” dialog box.

• VLAN tags configured for Individual interfaces are propagated to Link Aggregation [i.e. 1/1 and 1/2 has VLAN tag 2 and we form an LA channel using those interfaces, tagged  configuration is propagated to LA on forming a channel]

• SVM disallows the creation of a channel if there are different tags values across the interfaces:
  •  Allow Physical interfaces to bind if they are part of same VLAN domain
  • Derive LA VLAN ID from slaves, while forming channels
  • During course of operation, VLAN configuration is done on LA only and propagated to LA slaves
  • On unbind, physical interfaces will carry LA VLAN configuration

NetScaler SDX Configuration

1. Initial configuration: https://docs.netscaler.com/en-us/sdx/current-release/getting-started-management-service.html
2. Configuring and Managing NetScaler Instances: https://docs.netscaler.com/en-us/sdx/current-release/configuring-managing-netscaler-instance

Link Aggregation on NetScaler SDX

Management VLAN Settings on NetScaler SDX

CTX200084 - General Information on NetScaler SDX LOM
CTX233122 - How to upgrade SDX appliance from 10.5 to 12.0 Version