World of EUC

image.png

Not when the source is the NS kernel, like AAA.

If you load balance LDAP on the NS it will use the snip instead of the nsip as source IP :)

I believe there's a config setting to influence this behavior now, but in the past you'd use something like PBRs or a local LB VIP to essentially get that behavior.

that's exactly what I want to do. :slightly_smiling_face:

as soon I allow TCP 636 on the firewall from the NS MGMT IP -> DC it turns green

Right, that test is just a script called by the ns kernel. If you already setup a LB vip and the backend services aren't coming up then you've got a plumbing problem to sort out first.

Create a LB VIP for the ADDS services and also specify a network profile for backend probing with the correct SNIP for steering

For reference: <https://support.citrix.com/article/CTX207661/faq-netscaler-ldap-uses-which-ip-address-as-source|https://support.citrix.com/article/CTX207661/faq-netscaler-ldap-uses-which-ip-address-as-source> and <https://support.citrix.com/article/CTX208019/scriptable-monitors-are-using-nsip-instead-of-snip|https://support.citrix.com/article/CTX208019/scriptable-monitors-are-using-nsip-instead-of-snip>