Flex Tenancy :48:27 UTC Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement

Transcription

1 Flex Tenancy :48:27 UTC 2015 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement

2 Contents Flex Tenancy... 3 Flex Tenancy... 4 Understanding the Flex Tenancy Architecture... 6 Building a Flex Tenancy Solution... 8 Enterprise IT as an Internal Service Provider... 9 Hosting provider solution

3 Flex Tenancy Flex Tenancy is a Citrix NetScaler methodology that allows you to tune a group of NetScaler VPX instances to the unique characteristics and needs of individual applications in a complex Web 2.0 setup. As the Web becomes the de-facto way of delivering application services, the number of web applications that enterprises and service providers must support has been growing at a very fast pace. Not only are the technical requirements of each web application different, but also in most large environments, the applications are owned and controlled by different constituencies/organizations. This leads to the need to offer the Application Delivery Controller (ADC) functionality as a shared service to multiple tenants. 3

4 Understanding the Flex Tenancy Architecture In a typical Flex Tenancy set-up, NetScaler physical and virtual appliances can be used together in a two-tier architecture with each tier dedicated to managing specific actions. This: provides flexibility for how application delivery services are deployed and managed makes it much easier to shuffle applications and their associated application delivery resources on-demand without risking the stability of the entire network reduces costs The Flex Tenancy architecture segments web application delivery services into two tiers: shared-network-service flex tier application-specific tenant tier Figure 1. Flex Tenancy Architecture 4

5 Flex Tenancy The Flex Tier The flex tier runs at the edge of the data center or an enterprise network. The flex tier generally performs application delivery services and associated policies that are common and applied to all applications. Examples of such services could include: SSL offload SSL VPN DoS mitigation GSLB Certain types of redirects Content Switching Since the policies are common and shared, there is no reason to try and partition them across multiple NetScaler instances dedicated per specific application. Indeed, partitioning at the flex tier is counterproductive as it leads to duplication of effort and the associated possibility of configuration errors during change management. Therefore, the flex tier should be physically centralized on as few NetScaler instances as possible. In all but the smallest environments this will generally lead to NetScaler MPX physical appliances being used at the flex tier. The Tenant Tier The tenant tier runs logically close to the applications, with each tenant (whether a tenant is an application, a line of business, or a customer) getting its own NetScaler instance. The tenant tier isolates the application delivery needs that vary by application - like server load balancing, caching, compression and application firewall protection - per application. Since the policies - and thus the NetScaler configurations - differ by application, there is no inherent configuration benefit to centralizing multiple applications onto a single NetScaler. In fact, there are significant configuration isolation, separation of duties and capacity planning benefits of dedicating appliances on an app-by-app basis. Centralized Management One potential downside to dedicating NetScaler instances to specific applications is "appliance sprawl". In Flex Tenancy architectures, the vast majority of most instances will be NetScaler VPX virtual appliances. Therefore, the physical challenges (e.g., racking, cabling) associated with appliance sprawl don't exist. Citrix Command Center is used to provide centralized FCAPS (fault, configuration, accounting, performance, security) management of both the flex and the tenant tiers. 5

6 Understanding the Flex Tenancy Architecture In a typical Flex Tenancy set-up, NetScaler physical and virtual appliances can be used together in a two-tier architecture with each tier dedicated to managing specific actions. This: provides flexibility for how application delivery services are deployed and managed makes it much easier to shuffle applications and their associated application delivery resources on-demand without risking the stability of the entire network reduces costs The Flex Tenancy architecture segments web application delivery services into two tiers: shared-network-service flex tier application-specific tenant tier Figure 1. Flex Tenancy Architecture 6

7 Understanding the Flex Tenancy Architecture The Flex Tier The flex tier runs at the edge of the data center or an enterprise network. The flex tier generally performs application delivery services and associated policies that are common and applied to all applications. Examples of such services could include: SSL offload SSL VPN DoS mitigation GSLB Certain types of redirects Content Switching Since the policies are common and shared, there is no reason to try and partition them across multiple NetScaler instances dedicated per specific application. Indeed, partitioning at the flex tier is counterproductive as it leads to duplication of effort and the associated possibility of configuration errors during change management. Therefore, the flex tier should be physically centralized on as few NetScaler instances as possible. In all but the smallest environments this will generally lead to NetScaler MPX physical appliances being used at the flex tier. The Tenant Tier The tenant tier runs logically close to the applications, with each tenant (whether a tenant is an application, a line of business, or a customer) getting its own NetScaler instance. The tenant tier isolates the application delivery needs that vary by application - like server load balancing, caching, compression and application firewall protection - per application. Since the policies - and thus the NetScaler configurations - differ by application, there is no inherent configuration benefit to centralizing multiple applications onto a single NetScaler. In fact, there are significant configuration isolation, separation of duties and capacity planning benefits of dedicating appliances on an app-by-app basis. Centralized Management One potential downside to dedicating NetScaler instances to specific applications is "appliance sprawl". In Flex Tenancy architectures, the vast majority of most instances will be NetScaler VPX virtual appliances. Therefore, the physical challenges (e.g., racking, cabling) associated with appliance sprawl don't exist. Citrix Command Center is used to provide centralized FCAPS (fault, configuration, accounting, performance, security) management of both the flex and the tenant tiers. 7

8 Building a Flex Tenancy Solution The Flex Tenancy architecture is applicable to any high volume environment where: multiple tenants share a common infrastructure there is a core set of shared application delivery services that are common to all tenants each tenant also has its own specific web application delivery needs and requirements The two most prevalent examples of this kind of environment are: hosting/managed services providers that want to offer dedicated load balancing/application delivery services to their customers an enterprise IT organization that models itself as an internal service provider to support multiple lines-of-business and business applications. In each case, the core architecture is similar. However, the deployment architecture and the management of the overall system will likely vary based upon the very different business needs of each case. 8

9 Enterprise IT as an Internal Service Provider Many enterprise IT organizations model themselves as internal service providers supporting the different needs of the different lines-of-business. Building "private clouds" to support enterprise apps is this the latest phase of this trend. An enterprise typically hosts a variety of applications that may be independent of each other. These applications: require their own application server pools typically need customized ADC policies and tuning have their own distinct change management requirements and windows The challenge facing the groups managing the web application delivery infrastructure is to support different and increasingly complex applications and at the same time scale so that they can support an ever increasing number of applications. Achieving application performance in this environment depends upon coordination between network teams and the various application teams. Application tuning requires knowledge of the application and in many cases should be responsibility of the application team. Maintaining network performance and availability requires knowledge of various networking protocols and hardware management and therefore becomes the responsibility of the network team. Sharing the same device between both teams creates manageability challenges for an organization. For example, consider an application administrator wanting to upgrade to upgrade the ADC take advantage of new functionality. If the ADC is shared by other applications, the administrator will must coordinate with all these teams to initiate change control for his change. Moreover, any changes to the ADC will need to be tested with every other application. As the number of applications grows, this model becomes exponentially complex. The Flex Tenancy architecture addresses these issues. Since no other applications run on the tenant instance: it can be upgraded based solely on the needs of its hosted app there is no need to qualify the version upgrade against other applications there is no concern that using the new functionality will impact other app performance Figure 1. Architecture of an enterprise service solution 9

10 Enterprise IT as an Internal Service Provider There are three possible administrative approaches using Flex Tenancy: 1. The central IT organization can retain full administrative control over both the flex and tenant tiers. 2. The central IT organization can retain full control over the flex tier, but delegate management rights of the tenant instances to individual app teams. 3. The central IT team can retain full control over the flex tier, retain control over certain elements of the tenant tier (e.g., certain IP addressing, ensuring it can retain root access ) but delegate control of other functionality to app teams. The ability to tune the application delivery fabric to individual applications enables IT organizations to maximize the performance of their applications and to scale the number of applications they provide to their stakeholders without significant increase in costs. 10

11 Hosting provider solution A hosting provider provides space on a server they own and Internet connectivity for the applications hosted on that server. These servers are typically hosted in a data center. Load balancing is a frequently requested "add-on" services customers ask for. Additionally, advanced L7 services such as compression, application firewall and caching provide additional revenue opportunities for the hosting provider.figure 1. Architecture of a hosting provider solution The biggest challenge in this environment is managing and delivering application delivery services for a wide variety of customers, each with varying requirements. Trying to manage these services on a shared device can lead to performance bottlenecks, change management conflicts and ultimately a loss of business. Also, many customers will want admin rights to control the load balancing services used for their hosted back-end servers. Flex Tenancy solution can be very useful in this scenario. A hosting provider can use the flex tier to run services common to the entire data center. These include global server load balancing (GSLB) which would provide data center redundancy, denial of service protection (DoS), and segregate traffic to the tenant tier using content switching policies. At the tenant tier each tenant is provisioned, and can manage its own, dedicated NetScaler instances. One of the primary services of this tier is to load balance requests to the backend servers. In addition, this tier may also perform SSL offload. This is usually a flex tier service, but in a hosting environment it may be offloaded to the tenant tier if the hosting business model 11

12 Hosting provider solution supports customers owning and managing their own certificates. Tenant tier is also used to apply a variety of complex application policies to tune application performance. For example, a customer can define caching policies to cache objects of a certain application only for ten seconds while other application objects could be cached for a longer duration. Customers can also define rewrite policies, application firewall policies, compression policies and application level monitoring policies. In this environment, flex tier can comprise of one or more MPX devices while the tenant tier could comprise of a combination of VPX and MPX devices. Citrix provides Command Center to manage these devices. Since VPX is a virtual appliance, network administrators can easily create a workflow, using commercial or in-house data center automation tools, to bring up additional NetScaler VPX instances and servers online to support the increased load. NetScaler also provides extensive API that can be used to integrate into the work flow automation tools used in hosting/managed services infrastructures. Network administrators can also use the Citrix Command Center in conjunction to propagate the relevant NetScaler configurations to these newly started NetScaler VPX instances. The division of services amongst the tiers and the ability to manage them through Command Center and NetScaler APIs enables a hosting provider to scale performance of his application delivery fabric and to streamline his operations. 12