Integrated Cache on Netscaler

Integrated Cache Training – Netscaler Webinar

Mark Hillick

•  Goals of Caching

q Why & What

•  Cache Policies •  How long to cache

•  Memory for Cache •  IC configuration

example

•  Cache Statistics

•  Troubleshooting IC

Agenda of Cash, sorry Cache

Please be aware that this a technical presentation with lots of detail and it is intended that it can be used as a reference guide at a later date (e.g. when you're on-site). Sadly, it’s not like my usual Zen presentation with lots of funny pictures and jokes, sorry L

Presentation Goal

•  Caching would be useless if it did not significantly improve performance.

•  Goal => to eliminate the need to send requests in many cases.

q Reduces the number of network round-trips required for many operations - we use an "expiration" mechanism for this purpose

•  Goal => remove the need to send full responses in many other cases.

q  The latter reduces network bandwidth requirements - we use

a "validation" mechanism for this purpose

Caching Goals

•  Local cache in your browser

•  Cache in the office (Forward Proxy or Transparent)

•  Cache at the ISP (Transparent)

•  Cache at the origin (Reverse Proxy or Transparent)

•  Cache integrated inside a traffic manager – much better J

Caching is Used Everywhere

Caching Benefits.

1.  Saves Bandwidth

2.  Reduces traffic to back-end server & so saves processing resources

3.  Protects back-end servers from flash crowds

4.  Improves the response time & Increases site capacity

P.S. Even more benefits when integrated within a LB J

IC in Packet-Processing TCP Processing

SSL Decrypt

HTTP Parsing

AAA Processing

Cache Redirection

Content Switching

Application Firewall

Responder Action?

Cache Hit?

HTTP Cache Req Policies

Rewrite Policy Eval

Load Balancing

Content Filtering

GET /foo/index.html HTTP/1.1 Host: www.example.com

HTTP/1.1 200 OK Last-Modified: Thu, ... Content-Length: 3688

Content-Type: text/html

Non-Caching Proxy

Proxy Cache (Saves copy)

Caching Proxy: Miss

Proxy Cache (Fresh copy!)

Caching Proxy: Hit

HTTP Response after a hit •  wget -S --header="If-None-Match:23834-b1-4951a45768b8d" -U

Mozilla http://10.90.196.68/index.html

•  HTTP/1.1 200 OK

………

•  Via: NS-CACHE-9.2: 65

•  ETag: "23834-b1-4951a45768b8d"

•  Server: Apache/2.2.14 (Ubuntu)

......... OR .........

•  ETag: "23834-b1-4951a45768b8d"

•  2011-04-26 18:22:56 ERROR 304: Not Modified.

………

HTTP Response after a miss

•  $ wget -S --header="If-None-Match:23834-b1-4951a45768b8d" -U Mozilla http://10.90.196.68/index.html

……….

•  HTTP/1.1 200 OK

•  Date: Wed, 27 Apr 2011 09:30:59 GMT

•  Server: Apache/2.2.14 (Ubuntu)

•  Last-Modified: Mon, 15 Nov 2010 16:52:53 GMT

………..

•  Saving to: `index.html.41

What Not to Cache

•  Cache-Control: no-store =>applies to entire message (req/resp)

•  Cache-Control: no-cache =>server cannot respond with cached response

•  Cache-Control: Private => not by shared cache

q More info see - http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html

•  POST request.

•  Don’t cache if set-cookie exists

•  Don’t cache all 5xx response codes, example 503 (Gateway time out)

•  By default, NS ignores cache-control headers in requests -> CG Settings

•  Describes how long the associated representation is fresh for.

q No need to send a request to server if object has not expired

q Saves time

•  Expires: Fri, 30 Oct 1998 14:19:41 GMT

•  Cache-Control: max-age=3600

Freshness

•  Validation – once expired, validator can be used to check with the server if the object is still valid.

q  Send conditional request and get a short “304 Not Modified”

response q  Saves bandwidth

•  If-Modified-Since <Date>

•  If-None-Match <Etag>

Validation

HTTP/1.1 304 Not Modified Date: Fri, ...

If-Modified-Since: Thu, ... Proxy

Proxy Cache (Saves copy)

Caching Proxy: Validation

Cacheability Policies •  Specifies if response is cacheable.

q Request or Response-based policy

•  CG is DEFAULT by default J but can be changed.

•  Action types q CACHE: Transaction is cacheable. Store the object q NOCACHE: Transaction is non-cacheable. q MAY_NOCACHE o  For request based policies only o  The response may be cacheable. The default if no response

cacheability policy matches is to not cache the response. q MAY_CACHE o  For request based policies only o  The response may be cacheable. The default if no response

cacheability policy matches is to cache the response. q INVAL o  Mark the object as invalid

Cache Decision Time

•  Cache, Nocache, Inval

q Cache decision @ request time & unless something that prevents decision like CL mistmatch, no policy eval @ response time

•  MAY_CACHE, MAY_NOCACHE

q Cache decision @ response time

Invalidate versus Expire

•  Invalidate

q Invalidate will invalidate the object/"all objects in contentgroup".

q But the way it is done is it is optimized such a way that we don't look at each object and remove it but when you run expire command or when new request comes for the invalid object, it is then removed.

q We serve a full response (200) to client regardless of cache hit.

•  Expire

q Only mark the object as expired

q Request comes in & instead of getting full response (i.e what we do for invalid object) we will send if-modified-since/if-none-match conditional request to back-end server. i.e can receive a 304.

Content Group •  Every cached object => member of CG

q No CG, object => Default

q minhit – no. of hits before store

•  Properties of objects can be controlled per contentgroup

•  Dynamic versus Static - parametised

•  Configurations per content-group are q Expiry settings q Portions of object considered for caching as well as Invalidation

[Parameterized Caching] q Pre-fetch objects before it gets expired (event-driven) q Inserting headers (e.g. Via header) q Memory related configuration for the objects and for this whole groups

Flash Cache (FC) •  FC

q Improves performance –> 1 req to back-end server

q Concurrent requests queued on NS & single response served

q set/add cache contentgroup <group_name> -flashCache YES

q POWERFUL

q Cannot enable with PET (ensures IC polls origin before serving)

Some Other CG settings •  Expiry settings (blank by default)

q Relexpiry – relative -> overrides server response settings

q heurexpiryParam - %

q Expire after complete response received

•  If no expiry settings & none in response => cache miss but can do validation (non-fc)

•  Cache controls

q No cache depending on size or hits

q Mem limit usage per group

•  Works with FC J but probably not wise on significant groupsExpire after complete response received

Cache Policies

•  Built-In (begin with “__” & “ctx_”)

q Greatly enhanced in 9.3 – should be sufficient for most

•  Bound globally or per vServer

q Easy-To-Administer & View within Global Policy Manager

•  PI-based expression engine like other NS features

•  Built-In (begin with “__” )

q Greatly enhanced in 9.3 – should be sufficient for most

•  Bound globally or per vServer

q Easy-To-Administer & View within Global Policy Manager

•  PI-based expression engine like other NS features

Verification

•  Three Verification Options (again sh cache pa)

q Hostname (Sufficient for Most Companies)

q Hostname & IP (Default)

q DNS (Most Secure)

Flushing the Cache •  Flush Cache

q Remove stale content manually

q Troubleshooting (preferred flush, disable, enable)

q CLI – either CG or Object

o  flush cache contentGroup content_group_html

o  flush cache contentGroup ALL

o  flush cache object –locator <0x….>

q GUI – IC > Cache Objects

•  Automatic CG flush once CG configuration is modified

Cache Memory Management (1)

•  BSD & PPE First

•  7500 with 8gb RAM & 3 PE

q 2gb for kernel, 3gb for PE & max 3gb for IC

q Each PE has minimum of 1gb

•  17500 – 48gb mem & 11 PE

q 2gb for kernel, 23gb to PE & IC can take up to 23gb

q Each PE cannot exceed 3.2gb address space

•  IC takes up what’s left (!>0.5)

Cache Memory Management (2)

•  > set cache pa –memLimit 254

•  > sh cache pa | grep -i mem

Memory usage limit: 10000 MBytes

Memory usage limit (active value): 10000 Mbytes => reboot

Maximum value for Memory usage limit: 15662 MBytes

•  > sh cache contentgroup

•  Memory Allocation Issues

q cli> stat cache –detail | grep alloc

Memory allocation failures 5741 => cache misses

Cache Selectors •  Best practice to configure selectors (preferred over parameters)

•  Named filter – locates particular objects in CG, not exact match

•  Associate selector based on the request, not with responses

•  Sample selectors

•  http.req.url; http.req.method; client.ip.dst etc

•  Use cases

q One file only cached once regardless of hostname

q Two copies of same file – compressed & uncompressed

q Same file, same hostname but different VIPs & CGs

“Not Cache” Best Practice •  Not Cache policies first

q Once IC is turned on, it will begin to cache as per the default policies.

o  This may cause confidential content to be cached by accidentThen cache known, good content

q Start with images – jpegs, gifs

q Check statistics for

o  Memory allocation errors

o  Hits

o  Misses

o  Expiries

Cache HTTP Callout

•  Callouts to external servers

q Cache saves multiple requests

•  add cache policy pol_callout -rule "CLIENT.IP.SRC.EQ(127.128.129.130 )" -action CACHE –storeInGroup

•  bind cache global pol_callout –priority 100 –gotoPriorityExpression END –type REQ_DEFAULT

•  sh cache object –locator <0x…> HTTP callout cell: YES

HTTP callout name: callout1 HTTP callout type: TEXT HTTP callout response: NO

Soft-Cache Expiry

•  When a back-end server does not respond quickly to requests, an upstream NetScaler can serve responses from the cache.

q Liberal interpretation of RFC

q Protects back-end server further (e.g. lash-type event)

q Serves stale data for a minimal amount of time

•  Applies to 9.2.52.3 & above

Configuration through Wizard (1) •  Easy-to-use J

Configuration through Wizard (2)

Configuration through Wizard (3)

Example Configuration •  enable feature IC

•  set cache parameter –memlimit 512

•  add cache contentgroup cg_image –relExpiry 600 –memLimit 100 –maxResSize 512

•  add cache policy cp1 –rule http.req.url.contains(“jpeg”) –action cache –storeingroup cg_image

•  bind cache global cp1 –priority 1 –type REQ_DEFAULT

cli> sh cache object 0x000000078b4200000004 cg_image //10.102.30.16:80/abc.jpeg

Statistics via the CLI (1) •  cli> sh cache object 0x000000078b4200000004 cg_image //10.102.30.16:80/abc.jpeg •  cli> sh cache object –locator 0x000000078b4200000004

q Address in Memory

•  nscachemgr –a/-g <contentgroup> q Shell Equivalent

•  Use grep – POWERFUL for parsing output for hits, misses etc.

Statistics via the CLI (2)

Statistics via the GUI (1)

Troubleshooting Tools1

•  Browser -> inconsistencies & can be very frustrating L

q FF (HTTP Fox & Tamper Data Extensions but FF4 issues)

q IE (7, 8, 9) -> Fiddler

q Opera & Chrome -> as standard, no extensions

•  Tracing & PCAP ->

q Nstrace & Wireshark as usual J

Troubleshooting Tools2

•  Paros (as a proxy in the middle) -> I now use Zap (Owasp project fork of Paros)

•  CLI -> no user-cache to worry about J

q wget

•  wget –S –header=“If-None-Match:etag_value” http://test.com/file.jpg

q curl

o curl –header “If-None-Match: etag_value” test.com/index.html

Troubleshooting

•  Cache turned on but no cache objects q  sh cache pa != Memory usage limit: 0 bytes q Zero memory = cache misses

o  Warning msg in 9.2 when ‘sh cache object’ q Check expiry settings? NS? Server?

•  Blank entries in nscachemgr output? q  //10.90.196.76/ q  //10.90.196.76/citrix_logo.jpg q Default caching properties of “GET / HTTP/1.1”

CTX Articles (just a snapshot)

•  http://support.citrix.com/article/CTX124553 - how to IC •  http://support.citrix.com/article/CTX123753 - compressed

content to unadvertised clients •  http://support.citrix.com/article/CTX126557 - caching

uncompressed & compressed content of same file •  http://support.citrix.com/article/CTX128801 - same

hostname/object but different vip twice •  http://support.citrix.com/article/CTX129118 - has my HTTP

callout been cached •  http://support.citrix.com/article/CTX124718 - cache callout

response •  http://support.citrix.com/article/CTX129734 - Soft Cache

Expiry

Extra Reading

•  You can use perl, curl, wget, browser add-ons but I like wget – q http://www.cyberciti.biz/tips/linux-wget-your-ultimate-

command-line-downloader.html q http://www.computerhope.com/unix/wget.htm q Google “wget site:www.linuxquestions.org” q Easy to write a basic shell script around it & doesn’t need

to be too complicated

•  RFC 2616 (HTTP) VERY IMPORTANT q Section 13 (Caching) q Section 14 (Headers)

So with IC you can, take over….

Sláinte

Integrated Cache on Netscaler

Technology

Web cache architecture and cache design

Hvað er netscaler

Bedienungsanleitung roI classic über Citrix · Citrix Netscaler Gateway Software nicht installiert Um sich erfolgreich einzuwählen, muss auf dem System die Software für das Netscaler

Breizhcamp 2014 : Une partie de Cache-Cache

Citrix NetScaler - Drogą wstępu do ADC

FormationCitrix Netscaler pour App et Desktop - Alphormstatic.alphorm.com/fichesformations/Alphorm-Fiche-Formation-Citrix-Netscaler-pour-App...Avoir des connaissances sur Windows Server

PROGRAM STUDI S1 SISTEM KOMPUTER - CORE · 2013-07-12 · • Second-level cache a cache on memory ... (virtual memory) 15 Cache Design ° Bagaimana organisasi cache? (ingat: cache

NetScaler ADC TDM Presentation

Netscaler Rate limit

CMOSCMOS INTEGRATED INTEGRATED CIRCUIT DESIGN …

ロードバランサー NetScaler VPX VRRP設定ガイド … ECL2.0 ロードバランサーNetScaler VPX 10.5 VRRP設定 Author NTTCom Created Date 9/1/2016 10:29:12 AM

Citrix NetScaler SDX - SVM接続手順書 · アセンテック（株） Citrix NetScaler SDX Citrix NetScaler SDX ---- SVMSSVVMMSVM接続手順書接続手順書接続手順書

Arquitectura de Computadores I Memoria Cache. Memoria PrincipalMemoria Cache

Netscaler WAF XSS

NetScaler CPX 11 - Citrix Docs · NetScaler CPXについて Dec 15, 2016 Citrix NetScaler CPXは、コンテナーベースのアプリケーションデリバリーコントローラーで、Dockerホストでプロビジョニ

Interrop ctrix netscaler on Softlayer 2015

Brochure géotouristique CACHE-CACHE AVEC LA GLACE

Citrix NetScaler 시작 · Citrix NetScaler 시작 Aug 30, 2016 이 라이브러리 섹션은 복잡한 네트워킹 장비를 설치하고 구성하는 시스템 및 네트워크

Citrix NetScaler 시작 · Citrix NetScaler 제품은 일종의 응용 프로그램 스위치로서 응용 프로그램별 트래픽 분석을 수행하여 웹 응용 프로그램을

Citrix NetScaler SSL 证书部署指南 - wosign.com NetScaler SSL证书部署... · Citrix NetScaler 系统一套 SSL 证书一张（备注：本指南使用s.wosign.com 域名OV