NetScaler: Configure NSVLAN

Configuring NSVLAN

NSVLAN is a VLAN to which the NetScaler management IP (NSIP) address' subnet is bound. The NSIP subnet is available only on interfaces that are associated with NSVLAN. By default, NSVLAN is VLAN1, but you can designate a different VLAN as NSVLAN. If you do so, you must reboot the NetScaler appliance for the change to take effect. After the reboot, NSIP subnet traffic is restricted to the new NSVLAN.

The traffic from the NetScaler IP subnet can be tagged (802.1q) with the VLAN ID specified for NSVLAN. You must configure the attached switch interface to tag and allow this same VLAN ID on the connected interface.

If you remove your NSVLAN configuration, the NSIP subnet is automatically bound to VLAN1, restoring the default NSVLAN.

To configure NSVLAN by using the command line interface

At the command prompt, type:

• set ns config -nsvlan <positive_integer> -ifnum <interface_name> ... [-tagged (YES|NO)] 
• show ns config 

Note: The configuration takes effect after the NetScaler appliance is rebooted.

Example

> set ns config -nsvlan 300 -ifnum 1/1 1/2 1/3 -tagged NO
Done

> save config
Done

To restore the default NSVLAN configuration by using the command line interface

At the command prompt, type:

• unset ns config -nsvlan 
• show ns config 

Example

> unset ns config -nsvlan

 Done

To configure NSVLAN by using the configuration utility

1. Navigate to System > Settings.
2. In the details pane, under Settings, click Change NSVLAN Settings.
3. In the Configure NSVLAN Settings dialog box, set the parameters. For a description of a parameter, hover the mouse cursor over the corresponding field.
4. Under Interfaces, select interfaces from the Available Interfaces list and click Add to move them to the Configured Interfaces list.
5. Click OK. In the Warning dialog box, click OK. The configuration takes effect after the NetScaler appliance is restarted.

NetScaler: Working with VLANs

Creating or Modifying a VLAN

To configure a VLAN, you create a VLAN entity, and then bind network interfaces and IP addresses to the VLAN. If you remove a VLAN, its member interfaces are added to the default VLAN.

To create a VLAN by using the command line interface

At the command prompt, type:

add vlan <id> [-aliasName <string>] [-ipv6DynamicRouting (ENABLED|DISABLED)]

Example

> add vlan 2 –aliasName “Network A”
Done

To bind an interface to a VLAN by using the command line interface

At the command prompt, type:

bind vlan <id> -ifnum <slot/port>

Example

> bind vlan 2 -ifnum 1/8

Done

To bind an IP address to a VLAN by using the command line interface

At the command prompt, type:

bind vlan <id> -IPAddress <IPAddress> <netMask>

Example

> bind vlan 2 -IPAddress 10.102.29.54 255.255.255.0
 Done

To remove a VLAN by using the command line interface

At the command prompt, type:

rm vlan <id>

To configure a VLAN by using the configuration utility

1. Navigate to Network > VLANs.
2. In the details pane, do one of the following:
   • To create a new VLAN, click Add.
   • To modify an existing VLAN, click Open.
3. In the Add VLAN or Configure/Modify VLAN dialog box, set the parameters. For a description of a parameter, hover the mouse cursor over the corresponding field.
4. To bind an IP address to a VLAN, under IPs, select the Active check box corresponding to the IP address that you want to bind to the VLAN (for example,10.102.29.54). The Type column displays the IP address type (such as mapped IP, virtual IP, or subnet IP) for each IP address in the IP Addresses column.
5. To bind a network interface to a VLAN, under Interfaces, select the Active check box corresponding to the interface that you want to bind to the VLAN (for example, 1/8).
6. Click Create or OK, and then click Close.

How to Troubleshoot Citrix NetScaler Access Gateway Authentication with aaad.debug

To troubleshoot authentication with Aaad.debug, complete the following procedure:

Connect to the Access Gateway Enterprise Edition command line interface with a Secure Shell (SSH) client such as PuTTY.



Run the following command to switch to the shell prompt:
shell



Run the following command to change to the /tmp directory:
cd /tmp



Run the following command to start the debugging process:
cat aaad.debug | grep username

Use | grep username to filter out a particular user



Perform the authentication process that requires troubleshooting, such as a user logon attempt.



Monitor the output of the cat aaad.debug command to interpret and troubleshoot the authentication process.



Stop the debugging process by pressing Ctrl+Z.



Run the following command to record the output of aaad.debug to a log file:
cat aaad.debug | tee /var/tmp/<debuglogname.log>

Where /var/tmp is the required directory path and <debuglogname.log> is the required log name

Citrix support...you have disappointed me today

I had a weird problem with the NetScaler gateways where my VPN connection would occasionally not allow me to connect to any hosts on one of the internal networks. It would allow me to get to the the same network where the NetScaler cluster was located but not any other. This was very intermittent and very annoying.

I finally called Citrix support on the issue and spoke with a tech and based on his name and accent he was definitely located off-shore...I am guessing somewhere in the land of the sacred cow. I can't complain too much about this chap as he was relatively knowledgeable. After the initial troubleshooting he recommended that I upgrade my NetScaler cluster to the most recent stable version of the software. He said that the upgrade process was fairly straight forward and that I only needed to make sure I upgraded one device at a time and that HA cluster/replication was disabled for the duration of the upgrade.

One of my concerns was that I may lose all of the customization I had done to the login pages within the NetScaler infrastructure. He assured me that my customization would remain intact.

Well, imagine my surprise when upon logging on to Citrix I noticed that my customization was GONE! Yup, the little bastard lied to me. Luckily I had backed up all the pertinent files prior to the upgrade so I was able to get things up and running in a short amount of time.

Well Citrix support, you have disappointed me today.