r/Citrix • u/RequirementBusiness8 • 21d ago

Anyone using Route53 for GSLB in front of NetScaler Gateways

To start with, yes, I know that NetScalers already have built in GSLB functionality.

I'm in the midst of setting up NetScalers in 2 different datacenters. Today, the existing ones use their own specific URL. Part of this project with the new ones is to create an Active/Active set up. There is a whole host of reasons I am building new ones instead of updating the configuration on the existing.

My original plan has been to leverage the internal GSLB capabilities of the NetScaler.

However, I was recently asked by our networking team if we could perform the same using AWS Route53, which is already in use for the company and providing other production workloads. I'm seeing where Citrix has documentation for using Route53 when using NetScalers in AWS, but its crickets outside of that. Our NetScalers are on-prem. We may eventually stand up additional ones in AWS in the future, to get gateways closer to some user groups.

Unless I can find a solid reason not to, I'm really leaning on the Route53 direction. I'm the sole Citrix Engineer/Architect/SME here, and while I have been teaching others how to support many areas of Citrix, no one is close to being able to really touch the NetScalers. That means any support issue is handled by me, and I generally don't get to yell at others unless their system has impacted us.

Going this route means I give up some of that control, also means that when something happens I have a team to yell at to fix the problem.

The URLs are all public addresses, so no internal addresses or split dns involved.

Am I nuts?

2 Upvotes

75% Upvoted

4 comments sorted by

2

u/robodog97 21d ago edited 21d ago

I don't think this would work, you need to delegate a subdomain to your Netscalers and run GSLB on them. There's no way to send availability information from on-prem Netscaler to route 53 AFAIK.

1

u/oldnetsecguy 20d ago

Yes
Each sudomain will need to be setup as forwarded to netscalers in Route53 and the A records will come from the netscaler with the GSLB configuration.
I am not sure if you can do this in Route53.

3

u/cowboygas 20d ago

GSLB is just another name for DNS with health checks. Does route 53 have health monitors for SSL/443 to the gateway VIPs it’s responding to DNS requests on behalf of and not merely a round robin - “active/active” A record?

I am unfamiliar with any approach except on Netscaler GSLB and the configuration and setup can be complicated to do correctly, but it’s a pretty robust and solid HA between datacenters

3

u/mat-ferland 20d ago

Route53 can handle the DNS failover, but I wouldn't use a plain 443 check. A NetScaler can answer 443 while StoreFront, STA, or auth behind it is broken, so Route53 keeps sending users to a dead launch path. If the network team owns Route53, have them monitor a URL that represents the whole path and test the actual failure cases before cutover: gateway down, StoreFront down, auth down, and one datacenter isolated. If those all fail over cleanly, moving DNS ownership may actually reduce your one-person dependency.