Citrix NetScaler Release 10. What's New?

Transcription

1 Citrix NetScaler Release 10 What's New?

2 The #1 Internet Delivery System is now the Most Advanced Cloud Network Platform

3 The World s Most Advanced Cloud Network Platform

4 The #1 Cloud Network Platform

5 The Most Advanced Cloud Network Platform Inject Cloud Scale with Revolutionary TriScale Delivers Apps and Data Services with the Best Performance and Reliability Empower Control with Full App Security & Visibility Infinite Flexibility with Built-in Cloud Connectivity Versatile and Extensible Platform for Service Delivery

6 Delivers Apps and Data Services with the Best Performance and Reliability Integrated solution to optimize, secure and control all enterprise and cloud services Inject Cloud Scale with Revolutionary TriScale Scale performance & capacity on-demand, while reducing appliance sprawl and simplifying the network Empower Control with Full App Security and Visibility Gain end-to-end visibility, ensure compliance and protect valuable corporate assets Infinite Flexibility with Built-in Cloud Connectivity Securely and transparently bring external and internal clouds together Versatile and Extensible Platform for Service Delivery Consolidate adjacent network services with unified policy management and flexible deployment choice

7

8 Today s Cloud Evolution Requires a Scale Revolution

9 Elasticity Scale up Scale in Expandability Scale out

10 Scale Up Simplicity with Many-In-One Elasticity with Pay-As-You-Grow Expandability with Add-and-Go Scale Out

11 Scale Up Buy only what you need End Appliance Sprawl Simplicity with Many-In-One Elasticity with Pay-As-You-Grow Start Small. Grow Forever Scale Out Expandability with Add-and-Go

12 Scale Up Grow capacity upto 5x. No New Hardware. 40:1 footprint reduction. No Compromises. Simplicity with Many-In -One Elasticity with Pay-As-You-Grow Megabits to Terabits. Zero Downtime. Scale Out Expandability with Add-and-Go

13

14 NetScaler Cluster

15 Cluster of NetScaler nodes Can be formed with 2 to 32 nodes Single system image for end user Built on NetScaler ncore architecture No Chassis or new hardware required Dynamic changes permitted

16 Provides linear scalability Higher Throughput Configuration Scalability In-built Fault Tolerance Active-active Support Active-standby Support

17 Cluster Master - CLIP NetScaler Cluster Unified Configuration Unified Monitoring Unified API Aggregates Logs Aggregates Stats Aggregates Trace Config Prop Config Sync

18 Hot Standby NetScaler in power on mode Loaded with same firmware Configuration in sync with cluster Dynamically replaces the faulty one Ready to take traffic at any point NetScaler Cluster

19 High Level Decomposition Flow Processor Node 1 Node 2 Node 3 Node 4 Node 5 Flow Distributor Interface Manager (Rx/Tx) Data: Divide into three subsystems Cluster Interface Manager Flow Distributor Flow Processor Control: Divide into two subsystems Quorum service Cluster Config Manager Collection of NICs of all Nodes

20

21 Striped VIP Scalable Server Server 200 Gbps 200 Gbps Server Large Server Farm Server Server Internet Clients NetScaler Cluster Server

22 Cluster Performance Projections MPX way MPX way MPX L4/L7 Throughput (Gbps) ,350 HTTP requests per second 4.4M 28M 105M Compression (Gbps) SSL TPS (Ktps) 200 2,700 6,400 SSL Bulk (Gbps) TCP Concurrent 55M 480M 1,760M IC RAM Cache (GB)

23

24 Runtime Analytic Engine on NetScaler Cache Top 10 URLs: ANALYTICS.STREAM(\"Top_URL\").IS_TOP(10) Policy: Hit, Action: Send response from NetScaler Cache Analytic Results used within the same System

25 Responder Support for DataStream Rate Limiting Support for DataStream Command = QUERY Configured Response Max Limit for Query RESET MYSQL.REQ.COMMAND.EQ(QUERY) Action: Respondwith or Reset Rate Limit Identifier: -ratethreshold 2 -timeslice trapsintimeslice 30

26 Utilizing well proven Integrated Cache Infrastructure In-memory Caching driving better Response time Command = SELECT Cache Policy: -rule "mssql.req.query.command.contains(\"select\")" -action CACHE -storeingroup cg1 Cached Response Invalidation Policy: -rule "mssql.req.query.text.contains(\"insert\")" -action INVAL -invalobjects cg1

27 Extension to the AppFlow framework IPFIX messages exported for Databases MSSQL MYSQL Template 269 is exported for Database requests DB protocol name Request type Request string Template 270 is exported for Database responses Protocol name Response status Response length Response string

28 XML based standard for exchanging auth information Better security as compared to cookie based approach Treated as authentication protocol for the Cloud Solves the SSO problem at Web browser layer Logical security domain Identity provider (producer of assertions) Service provider (consumer of assertions)

29 Identity Provider Service provider

30 Identity Provider Service provider

31 NTLMv2 is an improvement over NTLMv1 (deprecated) During NTLM negotiation, NS sends NTLM capabilities to the server Server confirms/rejects capabilities sent by NetScaler NS and Server agree upon the highest security parameters, in order of security NTLM2 Signing NTLM2 Session NTLMv2 NTLMv1

32 You can create a Network Profile as individual entity Bind IP address to the Network Profile Bind individual IP address Bind multiple IP addresses using IPSET Bind range of IP addresses using IPSET IP address being bound must be added on NetScaler Bind the Network Profile to NetScaler entities Vserver Service Servicegroup Monitor

33 SIP Expression Support SIP Expressions defined on new policy infrastructure Can be used in Decision making across request/responses Content Switching Responder Policies Rewrite Policies Action Analytics Rate Limiting Configuration add responder policy P1 "SIP.REQ.METHOD.EQ(\"INVITE\") SIP.REQ.METHOD.EQ(\"ACK\") SIP.REQ.METHOD.EQ(\"BYE\")" noop add responder action action-1 respondwith q{"sip/ Responder Action"}

34 Sender side modification of TCP congestion window algorithm Improves the performance of TCP Reno across wired and wireless networks Quite significant improvements over wireless network Results in better throughput across wired and wireless networks Core idea: Monitor the rate of returning ACKs Real time measurement of bandwidth usage on TCP sender Helps with computation of congestion window and slow start threshold

35 5 MB Download: Outstanding data with Westwood OFF What these lines mean? 1. Green Line Weighted average of outstanding data. 2. Red Line Intantaneous outstanding data. Weighted avg for this test comes to be below 25KB On a packet drop(timeout): congestion window comes down a lot and then slowly increases.

36 5 MB Download: Outstanding data with Westwood ON Here weighted average is better ( > 30 KB) After a drop cwnd is set to BWE

37 Man in the Middle Attack Prevented by cryptographically binding renegotiation handshakes to the enclosing TLS cryptographic parameters Transport Layer Security (TLS) Renegotiation Indication Extension 5746

38 Ability to generate customized timeout responses Request Request RESET Timeout DROP add responder action resa1 respondwith '"Request Timeout." set httpprofile prof1 -reqtimeoutaction resa1 set httpprofile prof1 -reqtimeoutaction reset set httpprofile prof1 -reqtimeoutaction DROP

39 Open log management standard improving interoperability Different security and network devices and applications and adopt to common framework Common event log format enables data to be collected and aggregated for analysis CLI: > set appfw settings -CEFLogging (ON OFF) Jan 12 23:06:54 <local0.info> CEF:0 Citrix NetScaler NS10.0 APPFW APPFW_STARTURL 6 src= spt=63819 method=get request= msg=disallow Illegal URL. cn1=15447 cn2=4312 cs1=my_pr cs2=ppe0 cs3=bfrhg6qjsgqdonj4i70l9w2prkka000 cs4=alert cs5=2012 act=blocked

40 Appfw Relaxation rules can now be deployed from the logs The logs must be in CEF log format Convenient option to relax a rule blocking a legitimate request

41 Reducing the memory footprint on overall system With sessionless Field Consistency, no forms stored in memory Adds a hidden form field that is an encrypted digest to the form Helps deployments scale without any impact on memory usage With sessionless URL Closure, AppFw rewrites URLs in the responses Adds a field to the query as encrypted digest of original URL plus session id

42 NITRO supports operations like POST/PUT on multiple (bulk) resources Bulk response is returned with array of base_response objects Exception handling: Exit: When the first error comes, it exits and the commands executed before the error are committed. Default behavior for bulk operation is exit. Rollback: When the first error comes, it exits and the commands already executed are rolled back. Rollback is only supported for add and bind commands. Continue: All the commands in the list are executed in spite of success and failure

43 Different Usages : Using http header X-NITRO-ONERROR: exit/rollback/continue Using request Payload The onerror field can be also be given with in the payload Using SDK To use onerror support through SDK, set the onerror field in the class com.citrix.netscaler.nitro.service.nitro_service set_onerror(nitro_service.onerrorenum val) Sets the onerror status of the netscaler

44 NITRO REST API calls respond the status using HTTP status code Error object returned for failure cases only, in the response body includes severity, errorcode and errormessage. 2XX Codes: Successful operation OK or 201 Created (when entity is created in NetScaler) For combination of success and failures Multi Status (Bulk Operation) For Warning status code. 5XX Codes: If the service is not available, then 503 Service Unavailable is returned. If the error code is very specific to NetScaler, 599 status code is returned.

45 4XX Codes Incorrect Request Bad Request Invalid or No credentials given unauthorized Unauthorized Access forbidden Accessing an unavailable resource in the NetScaler Not Found Accessing methods not supported by nitro Method Not Allowed Values supplied in Accept header could not be satisfied Not Acceptable Trying to create a resource already existing in NetScaler Conflict

46 NITRO_AUTH_TOKEN - created during login and deleted on logout Access given to the base path /nitro/v1 Sample: Request: Content-Type:application/vnd.com.citrix.netscaler.login+json { "login": { "username":"nsroot", "password": "nsroot" } } Response: HTTP/ Created. Set-Cookie: NITRO_AUTH_TOKEN=%23%238D64258DD2FD995049BC ED4E5F06AA02A8F C12D484; path=/nitro/v1

47 Custom headers X-NITRO-USER and X-NITRO-PASS to be passed for each API request Sample: Request Http Method URL Headers X-NITRO-USER: username X-NITRO-PASS: password POST Content-Type: application/vnd.com.citrix.netscaler.lbvserver+json Payload { "lbvserver": { "name":"lbv1", "servicetype": "HTTP" } } Response HTTP/ Created\r\n

48 NetScaler 10 - A Landmark Release with 100s of New Features - NetScaler 10: What's New in AppFirewall - NetScaler 10: What's New in Networking - NetScaler 10: What's New in AppFlow - NetScaler 10: What's New in Load Balancing and Web Acceleration - NetScaler 10: What's New in Security - NetScaler 10: What's New in Command Center (ongoing) NetScaler 10: What's New in DataStream - NetScaler 10: What's New in TCP Optimization (TCP Westwood) - NetScaler ActionAnalytics - Turning Your Network Footprint into a Big Data Engine - NetScaler TriScale - The Full Scale Cloud Revolution is Here NetScaler TriScale Clustering -

49 Allgemeine Informationen

50 Besuchen Sie die Partner in der Ausstellung

51 Nutzen Sie unsere Zusatzangebote! Citrix Expert Desks: Unsere Produkt-Spezialisten beantworten Ihre individuellen Fragen und geben Ihnen Einblick in aktuelle Projekte Citrix Tech Lounge: Lernen Sie die wichtigsten Funktionen von Citrix XenClient live kennen - bei einem Hands-On-Test in unserer Tech Lounge Meet the Architects: Buchen Sie an der Info einen Kurz-Workshops mit Citrix- Consulting und erarbeiten Sie eine Zielarchitektur für Ihr Unternehmen Citrix Datentankstelle: Lassen Sie sich auf Ihren mobilen Endgeräten einen Citrix Receiver mit Demozugang einrichten Citrix Education Desk: Informieren Sie sich über die aktuellen Trainingsangebote Citrix Test Center: Die Plätze sind ausgebucht. Es besteht die Möglichkeit über die Warteliste noch kurzfristig einen Platz zu bekommen

52 Feedback und Präsentationen Ihre Meinung ist uns wichtig! Bitte nehmen Sie sich einige Minuten Zeit, unseren Online Feedbackbogen auszufüllen. Den Link dazu erhalten Sie einige Tage nach der Veranstaltung Im Anschluss an den Fragebogen haben Sie Zugriff auf die Downloadseite der Präsentationen

53 Bitte vormerken: Citrix Synergy 2012 The premier event on cloud computing, virtualization and networking Oktober 2012 im International Convention Centre Barcelona Weitere Infos:

54 Work better. Live better.