CTX205668
2016-01-20
1970-01-01
When customer will hit the VIP on Netscaler the INAT rule should kick in based on the Dest IP and change the DEST IP when sending to backend. ...

Symptoms or Error

When customer will hit the VIP on Netscaler the INAT rule should kick in based on the Dest IP and change the DEST IP when sending to backend. But in this case INAT is failing and when we take nstrace we see that we receive the SYN packet which has the Dest IP same as the INAT rule configured but Netscaler does not do INAT in the next packet. In below packet trace we see the SYN request comes to netscaler. But netscaler does not do INAT and client does retransmission of same packet.

User-added image

So this cases the page to not load on client side.

Solution


From the logs and nstrace it seems there is no connectivity between Netscaler on which INAT is done and the backend server 192.168.0.20 or 192.168.0.25:
We are not learning the ARP for 192.168.0.25 but we are learning the ARP for 192.168.0.20. Below we see from logs the same as mentioned here:
??
show arp
?????????????? IP???????????????????????????? MAC?????????????????????????????? Iface VLAN?? Origin???????? TTL???????? Traffic Domain
?????????????? --???????????????????????????? ---?????????????????????????????? ----- ----?? ------???????? ---???????? --------------
1)?????????? 127.0.0.1?????????????? 82:53:75:6c:01:96?? LO/1?? 1???????? PERMANENT?? N/A?????? 0
2)?????????? 10.20.30.61?????????? 00:17:c5:b3:68:84?? 10/1?? 1???????? DYNAMIC?????? 1054???? 0
3)?????????? 10.20.30.1???????????? 02:17:c5:b3:69:c4?? 10/1?? 1???????? DYNAMIC?????? 798?????? 0
4)?????????? 192.168.0.34???????? d6:07:45:99:de:aa?? 1/1???? 1???????? DYNAMIC?????? 958?????? 0
5)?????????? 192.168.0.35???????? 82:53:75:6c:01:96?? LO/1?? 1???????? PERMANENT?? N/A?????? 0
6)?????????? 192.168.0.39???????? 1a:31:c0:a6:34:35?? 1/1???? 1???????? DYNAMIC?????? 1199???? 0
7)?????????? 192.168.0.37???????? 52:bf:cc:0f:a5:e6?? 1/2???? 1???????? DYNAMIC?????? 1199???? 0
8)?????????? 192.168.0.20???????? 0a:13:33:e3:bc:04?? 0/1???? 1???????? DYNAMIC?????? 959?????? 0 ?? ---.> Here we see that we are learning the ARP for backend 192.168.0.20
9)???????? 192.168.0.25 ?? ??incomplete ?? ---> Here we see that we are not learning the ARP for 192.168.0.25
??
From nstrace if we filter with (ip.addr==6.6.6.6 or arp) ??we clearly see that ARP broadcast is sent by netscaler for 192.168.0.25 after we receive initial SYN packet but no ARP reply is coming:
??
User-added image
??
So this further confirms that there is some network issue between Netscaler and backend server 192.168.0.25

When we try to ping server IP from Netscaler and vice versa we are not able to reach each other.

Once we solve the network connectivity between Netscaler and backend server the issue is resolved and now the INAT is working fine.

Problem Cause

Network connectvity issue between Netscaler on which INAT is done and backend sevrer for which we are doing INAT

Applicable Products


 

Join the conversation

Citrix Discussions

Open a case

Citrix Support

特别说明


本文来源为Citrix.com所有,翻译后版权归翻译者所有.如需转载请注明出处.

文档版本


.

广告招租


最新留言


.

广告招租


.