This message was deleted.
# citrix-netscalers
Slackbot
10/13/2020, 10:37 AMThis message was deleted.
l
Leee Jeffries
10/14/2020, 6:23 AMYou'd create your load balancer as a bridge rather than any sort of offload. It will then just pass the traffic but still load balance.
j
jvitech
10/14/2020, 9:24 AMThanks @Leee Jeffries but I am looking to do this for TCP port 8000 for example, not SSL. I can't see a bridge option for TCP.
jvitech
10/14/2020, 9:39 AMI can actually set the SSL Bridge against a different port even if not SSL, I need to do a bit more tests but I suppose it means SSL_Bridge can bridge anything.
l
Leee Jeffries
10/14/2020, 9:40 AMPretty much, the whole point is not to offload the SSL processing.
Leee Jeffries
10/14/2020, 9:40 AM@Mads Petersen is your man when it comes to NetScaler though.
j
jvitech
10/14/2020, 10:06 AMCool, thanks Leee, I'll do some tests and maybe Mads can confirm if I am taking the right approach?
l
Leee Jeffries
10/14/2020, 10:28 AMSpot on dude. Nice one.
m
Mads Petersen
10/14/2020, 10:31 AMHi,
If you want the backend server to see the real client IP, you would need to use souceIP, but you really need to consider if that is the correct approach, as there are requirements if you want to do that.
j
jvitech
10/14/2020, 12:10 PMHi Mads, not really, I want to avoid chaining proxy as I believe and some research paper shows there is a performance impact. Maybe I am just wrong and the perf impact is negligeable?
m
Mads Petersen
10/14/2020, 1:13 PMHi @jvitech
In my experience i almost never seen issues with chaing proxy, it's somethin we're doing a lot today, with Tier1 (With your typical ADC hardware/VPX appliance) handling the North/South traffic and Tier2 (Your CPX, kubernetes, just internal traffic) handling the east/west traffic.
You have to size your proxy correct of course, but i wouldn't worry about that.
A lot of the stuff i'm doing now is controlling traffic from different zones, with ADC's to receive traffic in all zones, so no other device communicates directly with eachother, without the traffic being proxied by different proxy server (In my case it's always ADCs)
j
jvitech
10/14/2020, 1:21 PMThanks @Mads Petersen Indeed that's my case too. I found this research (2015) - https://www.researchgate.net/publication/283497223_TCP_Proxies_Chaining_Performance_Implications/ and heard also about the perf degradation a few times. Also, I had live issue whereas going through chained proxies with small size files was clearly slowing down the process. Still I agree that it is one of the best option to secure, handle the traffic. Anyway just to confirm, if I really wanted to do it in some cases, not proxying it, how would you do it? SSL_Bridge or it is not really an option with NetScaler? thanks a mill!
m
Mads Petersen
10/14/2020, 1:31 PMIf it's just a TCP Service, i just would use a TCP protocol. If it's really a web service running on a different port, i would use a SSL_Bridge if you don't want to handle the TLS on the ADC (Again something i would personally want a discussion about), but there are some very clear advantages for doing SSL Offload, and i almost never do SSL_Bridge (Even if you SSL -> SSL) on the ADC.
I will read that research, it's always nice to learn new stuff, but my real world experience tells me it's not an issue in those assignments that i've been a part of it.
j
jvitech
10/14/2020, 3:57 PMOK thanks but using TCP protocol would proxy the connection or do I miss something? Agree for SSL, I prefer to terminate on ADC too, I like my A+ ;)