let's discuss about Enterprise data center so this is very important to understand before you deploy your let's killer Okay so if you see this in any data center you will have three types of you know segregation one you have internet on which all your client may be resides and then we have something called DMZ Network sorry yeah something called DMZ Network so and then we have a internal Lan Network so let me tell you what is internal Land network internal Land network it is nothing but a place where you are going to keep your all the critical servers such as your domain controllers storage etc etc which is which should not have any visibility to the outside world when I say outside world it is to the internet okay we should not have any direct exposure to Internet that is the uh Appliance all those Appliance will comes under internal Land network okay so here you can see you have servers you have storage you have routers switches and client also client are nothing but your internal users which is sitting inside your network then we have a DMZ Network what is DMZ Network this is also called all also we are calling it as demilitarized zone networks why we call it as beam literacy Zone Network because here we are going to place a device which is having a direct exposure to internet okay so for example let's say you have a public facing website okay so that you need to deploy on the DMZ Network itself you should not deploy that on the internal land side so DMS is a place where we are going to expose your servers or websites or application to the internet okay so all those things comes under DMZ then internet which already mentioned this is the users which is sitting on the public internet okay so all the traffic first should come to the DMC if it is coming from the internet and it should cross your you know DMZ internet DMZ firewall or router whatever then it will reach your servers which is hosted here okay so your internet should not have direct visibility to Network so this is not at all recommend you know it's not a recommendation it's it's how that it is because your DMZ only should be exposed and internal should not expose to anything outside okay this is the Enterprise data center architecture this is how your most of the data center really looks like and some data center may have some complicated architecture but in general this is architecture you will find in any data centers so now the question is coming that's killer placement so where to place do you know where to keep the net scalar either I should keep the netscaler in DMZ or I should keep the net Skiller in Lan Network so this is the scenario most of the people may come across so let me brief you about this so for example let's say you have an application which is hosted in the DMZ for example you wanted you wanted to expose your uh websites to the internet okay and those websites are sorry those servers which is responsible for the websites are in your DMZ Network then you need to deploy your net scale in the DMZ and then you can expose this to the Internet so this is how you're going to decide you need to ask the customer where is the application hosted customer you will tell my application are hosted in DMZ then you need to deploy your next calendar the DMZ itself okay so this is one scenario and the second scenario is netskiller in Lan or internal Network Okay so this is the scenario where your servers are in the internal Zone itself for example your storefront server the storefront server is not you're going to know you're not going to give that storage server over the internet right so your storefront server is only for the internal users so that time you need to deploy your net scale around the internal Lan Network you you should not deploy on the DMZ and you can do the configuration it has to be on the uh internal itself so always keep it in a mind you need to deploy your netskiller where your server exists either in the DMZ or on the internal Lan so you cannot Deploy on the DMZ and you can configure the servers on the back end so I'll come to that point such configuration also exist but as a best practice you also always you have to segregate if it is an internal you have to deploy it in the internal if your service is in the DMZ you need to deploy it on the DMC Network okay and the third one is netscaler in DMZ as well as internal Network so many some customers they have application which is also available in the DMZ and also available in the internal so if he is having a budget constraint or budget issues to buy multiple net scaler then you can use the same net scalar to do the load balancing of your DMZ as well as your internal but it is highly highly highly not recommended why because for example let's say if your DMZ Network got compromised then use uh the attacker might get access to your netscaler and through netscaler he can jump into your internal servers Etc so that is why I always recommending to do the segregation so even though customer is telling that you know I wanted to use the same netscaler you should highlight this risk okay so if your DMZ Network or compromise because chances are compromising DMZ Network are more because users having a direct access to your DFC Network right or the internet so that is why so you need to deploy your net scalar accordingly but although you can also use the same netskiller to do the load balancing of your DMZ as well as internal Network however there is a risk which I highlighted so this is the three water method you can use to deploy your netskiller so either DMZ or internal or both so netscaler Apple Appliance connectivity this is very important so most of the people who are working on netscaler maybe VPX or if they are not worked on MPX they may have a question how I can I can connect my netscaler to the uh switch okay so for for those people I'm going to explain this is how we are going to connect your netscaler so let's okay so once you decide you are placing in internal Lan or DMZ then the second part comes the connectivity okay so how you are going to connect your Appliance so see guys you have a switch right so you have a network switch so to this network switch you may have a back-end connectivity to the servers or your computer Etc so now you placed your netscaler in the rack okay so this is rack mounted and uh now you need to do the cabling okay so what you have to do you need to connect one end of the cable to the switch and another end to one particular switch Port okay so this is switch number one and this is switch number two always make sure that you have two switches to connect your net scaler for the redundancy I will tell you why so first cable you need to connect to the first interface second cable you need to connect to the second interface okay different switches first interface to the first switch second interface to the second switch similarly you have another Appliance this is for the h a you may have a high availability so you will have another Appliance so here also first it should go to the first switch over here and the second we should go over here so this is how you need to connect why because let's say if this switch goes down due to some reason power failure whatever it is so you'll have a redundancy of the switch okay so this is the switch level redundancy we are talking about now coming into the interface level redundancy for example let's say you connected to this port right if this port is having any issue let's say this port is gone due to some issue then still you have you know another report connected to this to your net scaler so you'll have a redundancy on the interface level also okay so for example if you do not connect like that then if this interface goes down means your internet scalar may go down so now if you are connected two cables one for the one interface another for the another interface then you have redundancy over the interface level as well okay this is so we have seen switch level we have seen interface level redundancy now coming into the net scalar level so now we deployed two net scalar right so even though if this net scalar goes down also then still you have this net scalar so this is how you need to plan and you need to configure or you need to connect your cables to the switch so always connect two cables from each netscaler to different switches so that you will have a complete redundancy over the failures okay so hope this this is clear for you guys so as you may see uh just to avoid confusion I took only one net Skiller here so I connected one cable to this and another cable to the this one similarly you need to connect the other net scaler also to here and to here okay so now going to the next topic which is 1R mode to on mode 3r mode so some of somebody asked how I can consider which mode to go so as the statement says one hour mode you can connect Citrix Appliance to the network through a single VLAN the appliance receives the request from the client on a single VLAN and it sends the request to the server on the same VLAN so if you see here let's say you have a network which is configured as single level and it means your servers are sitting in this range which is 192. 168 10. 5 10.
6 10. 7 okay this is the same VLAN similarly on the net scalar also you configure the same which is 192 16 10. 3 10.
4 10. 5 so in this case everything is on a single Network or single VLAN Okay so in this case we are confirm we are referring this as a one hour mode where all your you know servers and your netskiller are you are going to deploy it on a single VLAN so you are not introducing complexity so it is very simple configuration so this is referring it as a one hour mode where everything is on a single VLAN so you need to ask your customer when you are going to deploy what is my server range what is the server VLAN and what is the netscaler you wanted to configure okay so if the customer says that no I don't want complexity I want everything in a same VLAN then it is referring it and then we are referring it as a one hour mode sorry so now coming into the second part which is 2R mode so in two or more setup you connect the Citrix ADC Appliance to the network through two vlans the appliance receives the request from the client on a one VLAN and send it send the request to the server on the another VLAN so if you see this diagram here so here you see 192 168 10. 5 10.
6 10. 7 so these are all in same VLAN okay so then you have something called something in red right whip virtual IP I'll tell you what is virtual IP later but this is a customer facing IP okay this is the IP user will access so now this IP is different as you can see 10. 163.
1. 5 so it means this is in a different VLAN and this is you know different back end is in a different VLAN now two vlans are involved in this configuration so now this is called as 2R mode where you re you are getting the request in one VLAN and you are sending that request to the backend on another VLAN okay so this is called 2R mode okay so here two vlans are involved one for the request from the client and another for the backend communication with your servers and the last one is multi-air mode multi-air mode is nothing but here you have multiple vlans uh you know involved for example let's say your server first first server it is in a 10 163 1. 5 second is 172.
29. 1. 5 third one is 192.
168. 1. 5 so all these are in a different range and it is in a different VLAN so similarly in ADC if you see nsip is in 10.
183 VP is 10. 145 Snip is a different 100.
