In this series, i would explain and show how to configure Citrix NetScaler for hosted Microsoft Exchange 2010. It breaks into four parts as following:

1. Part 1: The basics of load balancing.
2. Part 2: Features required for NetScaler and Certificate import.
3. Part 3: Load Balancing CAS
4. Part 4: Load Balancing HUB

Email me for any comments.

Image 1 shows the services required to run HUB. we would like one service with protocol TCP and port 25, while the second will be protocol HTTP and port 80.

Image 1

Once that is done, creating the virtual servers is logical step. We would create one HUB-VIP server that uses protocol TCP and port 25, and second HUB-VIP-Return-HTTP with protocol HTTP and port 80. lastly, we would create HUP-VIP-Return with protocol SSL and port 443. Since the last server using SSL, we would need to do SSL offloading. This will require to use the certificate that was imported. We have used one certificate for all ports, so we will use the same certificate used in previous blog entry. Please note that we don’t any persistence method, while we used Least Connection throughout.

Image 2

Image 3

Image 4

Image 5

Once that is done. The required configurations are done. Image 6 is showing how your virtual servers tap should look like.

Image 6

With that, we have finalized the series of how to configure Citrix NetScaler for Hosted Microsoft Exchange 2010.

As for the Load Balancing Method, Microsoft has its own recommendation, I would suggest to go with “Least Connection”, “Round Robin” is really not a good way, since one server can be loaded unequally by longer connection session. Persistence for OWP is Cookieinsert,  while AS, OA is Source IP. Since our CAS is handling all the three applications, we used cookieInsert for all. Some users, mentioned issues with cookieinsert, and used Source IP. We would like to do our own testing before deciding with Persistence method to choose.

We start by creating virtual Server for OWA. Before adding anything, first we need to add the real servers. This will ease the process when we want to associate the service (ports) with the real servers.  In the image below, click on add. Then just follow the procedure shown.

Figure 1: Servers Menu

Figure 2 : Adding Real Server

Once we have added the servers, it is best to add all the required servers running the various applications. It can be seen from above that we have added 3 CAS, 3 HUB servers. Since Citrix NetScaler is being used to load balance CAS and HUB only.

Now, Adding the service is next step. as seen in First Entry, we would like to create the services of the real server. Since we are creating OWA, HTTP with port 80 is the real service. click on Add as shown in the services Menu.

Figure 3 : Service Menu

Figure 4 : Adding Service

to Add the service, Write the name of your choice. Pick the real Server, Protocol, and Port number. Please note that you would need to do this for all the OWA application servers. In our case we have done 3 of them. Figure 3 shows that we created services for OWA, POP3, IMAP4 and RPC. Since, the RPC uses random port numbers. Use the following settings, Service name (add the name), Server (add real server), Protocol pick TCP, and port pick *.

Now, lets create the Virtual Server. Since we are going to offload SSL from real servers. The Virtual Server will run on port 443, with SSL certificate added and persistence enabled. Please click on Add at the Virtual Servers menu as shown below.

Figure 5 : Virtual Servers Menu

Figure 6 : Adding Virtual Server

In figure 6, we are adding the virtual server by Naming it, Giving it Virtual IP address, Selecting Protocol SSL, and port number 443. We have selected the Services that we want to associate this Virtual IP with. Figure 7 shows that we have picked the Method of load balancing as Least Connection, while Persistence mode is cookiesinsert.

Figure 7 : Configuring Method for Virtual Server

Figure 8 : Adding SSL Certificate to Virtual Server

Figure 8 shows that we have added the certificate we created earlier here. With this, configuration of the Load Balancer is done. Although there is one small detail that should be looked at. Since NetScaler will Send traffic from SSL to HTTP (from 443 to 80). The CAS server will reply with port 80 (HTTP). We would like to configure NetScaler to Intercept this traffic. So we create a virtual server for protocol HTTP, port 80, and we don’t associate any service with it. Figure 9 shows the configuration for the Return-OWA traffic.

Figure 9 : Virtual Server to Intercept Return Traffic

Figure 5 shows all the virtual servers that we have created for various applications running in the hosted Microsoft Exchange Server 2010. With this, we have finalized the configuration of NetScaler for the CAS. In our next Entry, i would Configure the Load Balancer for HUB.

Before starting the configuration on Citrix NetScaler, please make sure that all the features required are enabled. Features are: SSL offloading, compression, write, load balance. The figure shows where and how to enable it.

as mentioned earlier, we would be SSL offloading from the server, this means that Security Certificate should be installed on the Load Balancer. The certificate has to be mapped to all the names, and ports that we will be load balancing. In our case, we have mapped ports 80,443, pop3, IMAP4, and SMTP with a single certificate.

To import the certificate please do the following: First, we need to import the PKCS#12 into the load balancer.

Next step is installing the imported certificate. Go to the SSL>Certificates>add. as shown below.

Create a name for the Certificate-Key Pair name that you can refer using them certificate with load balancing. The Certificate file Name will be the same file name created in the above step when importing the certificate.

Once installation is done. the next step is to create the re-write policies. This is required because Load Balancer will be re-writing the actual traffic and sending the new traffic to the CAS. Go to Rewrite and create the action first as shown in the images below.

This will create the action, next create the policy that this action will be used in. follow the images shown below.

Our initial /prerequisite setup is done. What would follow is the actual Load Balance configuration in the next Entry.

The image above shows a logical diagram of what the servers look like. Yes, i did put a Cisco icon since i didn’t have Citrix NetScaler isometric Vision Stencils. When Retrieving emails The end user will access the CAS. CAS then retrieve the emails from the Mail Box Database. When sending emails, the end user access the CAS, CAS then forwards the email to Mail Box Database (sent items) and to HUB to be routed. When E-mails are coming from outside the organization (public domains) they would go throw the Anti-Spam, then HUB and lastly to Mail Box Database.

Before we Begin Configuring the load balancer, it is necessary to understand which traffic to expect. CAS will usually be expecting the following application traffic,  Outlook Web App (OWA), Active Sync, POP3, IMAP4, RPC Client Acces, Outlook Anywhere (OA). The load balancer will offload the ssl traffic from CAS, thus enabling CAS to provide its resources for serving the costumer.

VIP Port     Server Port    Protocol

OWA:    443           80                HTTPS

AC:       443           80                HTTPS

POP3:    995          110               TCP

IMAP4:  993          143               TCP

RPC:      Any          Any               TCP

OA:       443          80                 HTTPS

While the required ports for HUB operation is mentioned below.

VIP Port     Server Port    Protocol

SMTP:      25           80                   TCP

Return:     443        80                   TCP

Retrun-http: 80     80                    TCP

In the next entry, i would discuss some issues that need to be taken care of before configuring the NetScaler to load balance both CAS and HUB Traffic.