JasonSamuel.com

The GUI on a Citrix Netscaler is nice but it takes 7 seconds to update and sometimes you need live stats and a 7 second delay is not going to work for you. You can do A LOT through command line you can’t through the GUI (isn’t that the case with pretty much anything though? ). I am writing this article to show you how to get stats on each of your VIPS and servers quickly and also monitor live connections and traffic into your appliance.

 

 

GETTING DETAILS
First, you might want to get some details on your Load Balanced VIP. I am calling my Load Balanced VIP “lb_vsvr_name” in this example. Here is how you do that:

1. SSH into the Netscaler using Putty
2. Type:

sh lb vserver lb_vsvr_name

You will immediately see a lot of stats on how this VIP is configured like it’s IP, it’s status, connection method, persistency, bound service groups, etc. Pay attention to the bound service groups. So to get details on one of those, type this where “svcgrp_name” is the name of your service group:

3. Now type:

sh servicegroup svcgrp_name

This will show you details on the service group such as the status and the individual back end servers. Let’s say you have two servers called “svr_name1″ and “svr_name2″. To get the details on those backend servers:

4. Type:

sh server svr_name1

and

sh server svr_name2

This will pull up stats on each of your backend servers.

 

GETTING REALTIME GENERAL PERFORMANCE STATS
1. Make sure you are still SSHed into the Netscaler using Putty
2. Type “shell” to enter the FreeBSD shell
3. Capitalization matters below or you will get an error. Type:

nsconmsg -s ConLB=2 -d oldconmsg

What this does is pull up realtime general stats on all your VIPs and services and continues to update it every 7 seconds until your press Ctrl+C to stop it. I know the display has a ton of info in it but Citrix actually has some very good documentation on how to read it all here: http://support.citrix.com/article/CTX113341

 

GETTING REALTIME TRAFFIC & CONNECTION STATS
Now that you have verified the VIP is up and have it’s IP and bound service groups. Here is how you can SSH into the Netscaler and get live traffic and connection stats for the VIP itself:

1. Make sure you are still SSHed into the Netscaler using Putty
2. Make sure you are not in the shell. Type “exit” if you are still in it from doing the previous section.
3. Now type:

shconnectiontable

This will give you every connection coming into the Netscaler. The columns displayed are in this order:

SRCIP = source IP address
SRCPORT = source port
DSTIP = destination IP address
DSTPORT = destination port
SVCTYPE = service type like HTTP, SSL, etc.
IDLTIME = idle time of that connection in milliseconds
STATE = current state of the connection, you will usually see it either waiting or established

Pretty hard to look at if the device you are looking at is in production and has a ton of traffic on it. So we need to filter this display. Let’s just look at how many connections we have to just one of the backend servers above. Type:

sh connectiontable | grep xxx.xxx.xxx.xx

or

sh connectionable "ip == xxx.xxx.xxx.xx"

where xxx.xxx.xxx.xxx is the IP address of one of the backend servers above. This will give you stats on all the connections to that backend server.

1. Anything that says “MONITOR” is the Netscaler itself testing for uptime so ignore those.
2. If you see “MONITORS”, ignore those too, they are just SSL based monitors.
3. If you see “HTTP” or “SSL”, that’s the real traffic you are after. Note if they say “TIME_WAIT” or “ESTABLISHED”. If it’s live traffic, the state should be an established connection.

Let’s get into some more advanced filtering. Let’s say you want to filter all monitors to that IP and only display SSL, HTTP, etc:

sh connectiontable "ip == xxx.xxx.xxx.xxx && svctype != MONITOR"

Let’s say you want to see all traffic to that IP but only established connections. Here is the syntax for that:

sh connectiontable "ip == xxx.xxx.xxx.xxx && state == established"

Let’s say I want all the traffic to that IP, established connections only, and only display SSL connections:

sh connectiontable "ip == xxx.xxx.xxx.xxx && state == established && svctype == SSL"

 

One thing to note, typically you can filter additional service types like this:

sh connectiontable "ip == xxx.xxx.xxx.xxx && svctype != MONITOR && svctype != SSL"

but I found that if you have “MONITORS” and you wanted to filter them, it does not work and gives you an error saying it’s an invalid command. I actually have an open ticket with Citrix about this bug so it should be fixed in a future release. In the meantime, just use a combination of a filter expression and grep to filter it out. Here’s an example:

sh connectiontable "ip == xxx.xxx.xxx.xxx && svctype != MONITOR" | grep -v MONITORS

 

FURTHER READING
If you need further info on commands and syntax available on the Netscaler, I have hosted the Citrix Netscaler Command Reference Guide for 9.1 here:

NS-CommandReference-Guide.pdf

Yes it’s 1742 pages but take the time to flip through it. It’s extremely powerful. The connectiontable related syntax begins on page 883 (873 in the guide).

This is my follow-up to my original article on setting a Netscaler back to factory defaults (http://www.jasonsamuel.com/2010/06/22/how-to-reset-a-citrix-netscaler-back-to-factory-defaults/). The instructions I provided wiped the config but what about if your actual Netscaler system is corrupted and you need to bring it back to factory new conditions? Well here is the procedure which is also outlined here on CTX116742 (http://support.citrix.com/article/CTX116742). ZebOS by the way if you are interested is what does the routing on the Netscaler (http://www.ipinfusion.com/products/products_home.html). This is a commercial version of GNU Zebra (http://www.zebra.org). Development on Zebra stopped back in 2005 and Quagga became the successor (http://www.quagga.net). A lot of network appliances out there are based on these two.

1. After completing the following steps, the NetScaler will have no configuration left and will be ready for the next installation or environment. Connect to the device using the serial console or with a Secure Shell client (SSH). Delete the system, routing, and SSL configuration:

> shell
# cd /etc
# for file in *; do
# rm /nsconfig/$file 2> /dev/null
# done
(Ignore warnings about files or directories missing. Not all files in /nsconfig are present in /etc)
# cd /nsconfig
# rm ns.conf* ZebOS.conf rc.conf
(Ignore warnings about files or directories missing)
# cd ssl
# GLOBIGNORE=”ns-*”
# rm *
# exit
> reboot

2. Perform an initial system configuration. Connect to the device using the serial console:

> set ns config –ipaddresss nsip -netmask netmask
> save config
> reboot

I recently troubleshot an issue where cookie persistency was not working properly when failing over from the active node to the passive node in a Citrix Netscaler HA cluster (high availability cluster). I found the issue was that if the date and time on your appliances are not the same, the cookie will be invalid causing persistency to fail when failing over to the passive node. That’s a big issue because all your users will lose their sessions during a failover.

To quickly check your appliances:

1. SSH using Putty into your NSIPs of your Netscalers.

2. Type “shell” to enter the FreeBSD shell

3. Type “date” to see the current date, time, and time zone. Both your Netscalers should be identical.

4. If they are not identical, set the time by typing the current date and time in the following format:

date yymmddhhmm.ss

For example, to set the date to June 28, 2010 12:13 PM with 15 seconds left in the minute:

date 1006281213.45

You will get this result if you are successful:

Mon Jun 28 12:13:45 CST 2010

5. Now if your timezone says GMT or something instead of your correct time zone, then you need to navigate to timezone file directories by typing:

cd /usr/share/zoneinfo

6. Type this to list all the different zone folders:

ls -l

7. To set the timezone, copy your timezone file to the localtime folder. Below, I am setting the timezone to CST (Central Standard Time):

cp /usr/share/zoneinfo/America/Chicago /etc/localtime

8. Now just type “date” again and it should be the correct time, date, and timezone. That’s it, you’re done! Let me know if you run into any trouble.

On older Netscaler appliances, the command to clear your Netscaler configuration and reset it to factory defaults used to be:

clear config –c y

But on newer devices, the command is:

clear ns config level

where level is one of the following:

1. basic – which clears everything except NSIP, MIPs, SNIPs, network settings, HA, features, and the nsroot account

2. extended – which clears everything except NSIP, MIPs, SNIPs, network settings, & HA

3. full – which clears everything except teh NSIP and default gateway

So typically, I type this to do a full wipe:

clear ns config full

You can also do this through the GUI by going to System > Diagnostics > Maintenance > Clear Configuration. Use the drop down box to select basic, extended, or full then click the Run button.

With that said, I have run across newer devices (even running NS 9.1 and newer) that just don’t clear all their config info. For those, I have just done the following to reset:

1. SSH using Putty into the Netscaler and login
2. Type “shell” to enter shell
3. cd /nsconfig
4. Rename the configuration by typing “mv ns.conf ns.conf.bak”
5. Type reboot

This should reset the device to the IP of 192.168.100.1 with the nsroot/nsroot account credentials. Your licenses and SSL certs will remain though since these are files and not part of the Netscaler config. You will have to delete them manually via WinSCP.

UPDATE 6/29/10: To completely reset your Netscaler to “factory new” conditions, it’s a little bit more work but I have outlined the procedure here:

http://www.jasonsamuel.com/2010/06/29/how-to-really-set-a-netscaler-back-to-factory-defaults-factory-new-condition/

I’m doing some firmware updates on Citrix Netscaler appliances today and thought I would give you guys a quick guide on how to do this. This applies to all legacy appliances, MPX appliances, and VPX appliances. You use the same procedure for both Classic and nCore firmware packages. It is very easy to do.

1. Login to MyCitrix at http://citrix.com/English/mycitrix/index.asp and download the firmware .tgz package. Make sure to check compatability with your appliance before downloading.

2. Use WinSCP to transfer the package to the /var/nsinstall directory on your appliance.

3. SSH into your appliance using Putty and type “shell” to enter the shell

4. Type cd /var/nsinstall

5. Type ls to list the contents of the directory and verify your newly uploaded firmware package is there

6. Now type “tar -zxvf build-xxxxxxxx.tgz” to unzip the package

7. Then type “installns” to begin the install. Should take about 30 seconds to copy to flash and install.

8. Reboot the appliance once prompted for it (just type Y).

9. Login via the web GUI and verify the firmware version in the top right corner is the same as the package you were trying to apply.

Often times you might have to add an SSL cert to a Cisco or Citrix appliance (like a Netscaler) but it only accepts the SSL cert and private key in a certain format.  Your CA (certificate authority) will issue the SSL cert to you as a .crt.  From there, you need to package the cert with the private key and in the format your appliance requires.  There are different ways to do this and one easy way I like is using IIS and OpenSSL which is a free open source tool and can be downloaded here:  http://www.openssl.org

1. Create a temporary site in IIS and generate a CSR.  Make sure the CN (common name) you enter matches whatever appliance you are trying to generate it for exmp:  wireless.mycompany.com

2.  Submit the CSR to your CA such as Verisign, GoDaddy, Network Solutions, etc. and wait for them to validate and issue your cert.

3. Get the .crt from the CA once they issue it and convert it to .cer.  Just open the .crt by double clicking on it and and save it as .cer using the export wizard.  This is necessary since IIS does not accept .crt.

   

 

4. Install the .cer in IIS using the Web Server Certificate Wizard where you originally generated the CSR.  Just process the pending request to install it.

5. View the cert in IIS and export it with the private key in pkcs12 (.pfx) format.  Just set the password as “password” since you will be deleting it after conversion is complete later.

6. Go to the directory where OpenSSL.exe is and type in the following to convert the .pfx to a .pem

openssl pkcs12 -in nameofcert.pfx -out nameofcert.pem

7. Type the “password” when prompted for the pass phrase.

8. Install the .pem on the appliance and it should work

IMPORTANT NOTE:

If you are doing it for some appliances like a Cisco IronPort, you need to add the nodes switch when creating the .pem:

openssl pkcs12 -in nameofcert.pfx -out nameofcert.pem –nodes

The –nodes switch ensures that the key inside the .pem is left unencrypted.  If you attempt to install a .pem created without the -nodes switch, the appliance will take the cert but will not accept the private key since it cannot read it in an encrypted state.