https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
r
firewall rules only have the primary NSIP allow gui?
c
Firewall rules on the SDX?
r
network firewall
assuming you have a DMZ and a managements network, etc etc.. Making bold assumptions here
c
No. This is all internal, and we aren't blocking ports from my Admin box (which is in the same datacenter) as the Netscalers.
These are just internal Netscalers for load balancing.
r
you may have to console into the secondary and check the management access with cli commands
c
I can't find anything. I do have access to the secondary. I just have to fail it over to be the primary and I can access it, but then the original primary is now unavailable. Everything just times out. GUI and SSH.
r
can you console into the secondary?
c
Yeah through the SDX
r
set ns ip x.x.x.x ssh ENABLED
or, show ns ip x.x.x.x
management access: Enabled telnet: Disabled ftp: Enabled ssh: Enabled gui: SecureOnly snmp: Enabled
make sure all of this is on the secondary
and you're saying you're on the same subnet as the NSIP Address, and when it fails over you still can't SSH to it?
c
I am on the same network but a different subnet. The wacky thing is. I can't GUI or SSH into it, but then I fail it over to be the primary and I can. I am at a loss.
r
do you route to it through a firewall ?
yeah, that's some pretty odd behavior...
you doing MAC based forwarding?
I wonder if that's causing it...
not sure if that's required on SDX though, i'm kind of out of my element on SDX based deployments. I never would use MBF on a VPX deployment
c
I will try toggling, but I think there was an issue with routing. Thanks Ryan.
👍 1
h
MBF is a bazooka for routing issues if flipping it on works and without it doesn’t you indeed have routing issues. Take a look at PBR and do an inventory on all your routable paths and what the NetScaler services. Is all resolvable and no asymmetric routing in place
c
My networking knowledge is pretty weak. We also have some PBRs for the NSIP.
But I turned off the MBR and things did not work.
j
Do you use a SNIP as a GW for your NSIP? It could explain why it doesn't work when secondary as the SNIP is not active. Check your routing table.
c
From the sh route I see the 0.0.0.0 network 0.0.0.0 Netmask having a gateway of 10.25.213.1
Which on the arp shows it using interface LA/1 on the primary, it isn't present on the secondary. Which makes sense to me if it using it and the secondary shouldn't. That shouldn't impact the management IP tho, right?
j
You should have 1 interface / LACP for data and 1 for management. My NSIP is going through an internal FW and external through external FW. What you could try is start a trace on primary and then failover, you will capture the failure, it may help to figure out what is happening. It sounds like routing to me. Can you ping the secondary NS IP from the FW interface ?
Because the FW the network team had to do some NATing to sort out the NS IP in some scenario.
j
What is in your PBR?
👀 1
c
I think it was something to do with routing or caching. It hasn't presented the same issue in the last 24 hours.
Open in Slack
PreviousNext
Powered by