« previous next »
Pages: [1]   Go Down

Author Topic: HOWTO: Create a forward proxy vserver (and why you want to)  (Read 1220 times)

Offline TheOracle

  • Hero Member
  • *****
  • Posts: 152
  • Karma: 16
HOWTO: Create a forward proxy vserver (and why you want to)
« on: February 20, 2008, 08:52:57 AM »
One of the most frustrating things in dealing with a NetScaler configuration can be testing the behavior of a new set of policies, and how it will behave under various conditions.  One trick you can do to help test is to create a forward proxy vserver, which allows you to point your browser at it, then browse to any location, and apply policies such as rewrite and responder to them, to verify that the policies behave as you expect.  In order to do this, do the following:

enable ns feat cr
add cr vserver proxy HTTP <ip> <port> -cacheType FORWARD -redirect ORIGIN -dnsVserverName dns_vsvr

Now, if you set your browser to the IP:port, you should be able to browse the web via your NS, with IC, CR, rewrite, responder, etc all kicking in.

Some hints:  You must have a DNS_vsvr configured, and it must be an IP addressed vserver, not a non-addressible vserver, or you will get 503 errors.  You can't bind most policy types directly to a CR vserver as you can CS and LB vservers, so you will need to craft policies that are bound as global policies, so craft them wisely if the Netscaler is in production.  Finally, make sure you use the newest versions of code.  Early versions of 8.0 had issues with the forward proxy vservers, but they have been fixed.  7.0 may still have such issues.  I tested this on release 8.0, build 51.4.

The Oracle
Logged

Offline TheOracle

  • Hero Member
  • *****
  • Posts: 152
  • Karma: 16
Re: HOWTO: Create a forward proxy vserver (and why you want to)
« Reply #1 on: March 01, 2008, 01:34:03 AM »
One of the oddities that I've found with the forward proxy vserver as it is now is the point that any request rewrite processing isn't done unless the final target of the traffic is defined on the NS.  For example if you want a request rewrite policy to occur for a given domain, define the name of the domain as a dns address, then define a service with a server of the same address you defined in the A record.  Then, rewrite actions that should occur to that location normally.  The problem seems to be in the policy evaluation logic when the target doesn't exist on the NS, but the NS needs to do request processing anyway.  Response processing seems to work properly.

The Oracle
Logged
Pages: [1]   Go Up
« previous next »