Citrix NetScaler Access Gateway VPX user scalability numbers explainedThe Citrix NetScaler Access Gateway VPX
and MPX are great platforms for secure remote access to your company network.When working with Access Gateway there are two methods of setting up your connection.An integrated connection to Citrix XenApp and XenDesktop, which we call ICA proxy.A full
connection for access to company servers, which we call SSL-VPN. Both Access methods can be used combined or separate on a Access Gateway node. Both have their own use cases and based on the customer needs you will use either one of them. NetScaler Access Gateway is available as a virtual platform (VPX) and as a hardware platform (MPX).Figure 1. NetScaler Access Gateway MPXFigure 2. NetScaler Access Gateway VPX&A very important question to ask when choosing between a VPX and MPX model is the amount of users you need to facilitate on the Access Gateway solution. The amount of users is divided between the amount of ICA Proxy users and the amount of SSL-VPN users. A single SSL-VPN user load consumes a lot more resources then a single ICA Proxy user and the resource load of a single SSL-VPN session is impossible to predict because it changes all the time.So what does Citrix have to say about this?The official Citrix statement is:&Figure 3. NetScaler spec sheet (click on picture for full spec sheet)Although we now know the maximum amount of concurrent SSL-VPN sessions on a VPX this says nothing about ICA Proxy. When speaking to Citrix representatives I hear different numbers, maximum ICA Proxy is 500 sessions and maximum SSL-VPN is 200 sessions. Their explanation is that the earlier figures are based on 1k
certificates instead of 2k certificates. Because a VPX does not have the physical SSL offload chips a VPX is using CPU resources. This would mean that if we go for 4k certificates we would be screwed even further because the SSL transaction load does not grow linear with the certificate bits size. This is not something to under estimate, the difference in resource consumption between 1 and 2k is 5x, between 2k and 4k this could be as much as 20 times!Now that we know these numbers we have some guidelines but what about guys like Julien Stanojevic who are reporting an enormous amount of ICA Proxy users as described in his article on . He reports 1900 concurrent ICA Proxy sessions with a huge amount of space to grow even further, Julien is not telling fairy tales. I know that there are a lot of customers with user amounts just like this even on Windows based Citrix Secure Gateway instances, even Citrix reports over 1.000 concurrent sessions on a P4 system .To prove my statements about the amount of concurrent ICA Proxy sessions on a single Access Gateway VPX appliance I started a quest for the magic number. Ok, not really but I did start a small research on how many ICA users would fit on a virtual Citrix NetScaler Access Gateway. You can find the research article .The results of the survey are just like I would expect them to be and I will give you a short summary of the results. Please do keep reading after you have seen the results because these are only numbers and they are misleading!Question 1 What kind of certificate are you using on your CAG VPXThe outcome is exactly what you’d expect, some of you are still doing 1k certificates and most of you are using 2k certificates while no one is using 4k certificates yet. If we would ask you this next year no one should be doing 1k, most of you are doing 2k and some of you are already doing 4k. This is going to be important so remember this!What is the maximum amount of users on your CAG/NS VPX on one VPX applianceAs Citrix recommends using a VPX up to 500 ICA proxy users it’s expected that most of you are using it in situations up to 500 concurrent users. This is exactly what is shown in the results of the survey. What the survey clearly shows is that there are more then a handful of customers with well over the maximum amount of users that Citrix states it can handle. Remember the Julien Stanojevic article I mentioned?So what can we conclude from this? The clear and positive conclusion is, Yes we can do a lot more concurrent ICA-Proxy sessions on a Citrix NetScaler Access Gateway VPX appliance. The negative side to this conclusion is, sorry, unfortunately this will not assure any of us that YOU actually will!Citrix NetScaler Access Gateway VPX What’s the real deal?The honest and simple answer to the question how many concurrent ICA-Proxy sessions can we facilitate on a single VPX appliance is that no one is able to tell you, not even Citrix!Let me explain this statement because it might be that time where you start thinking that we as the so called “experts” and even Citrix don’t know what we are talking about, right? I will try to explain this a bit further.The problem with a virtual appliance is that we have zero control over the platform we will be hosting the virtual appliance on. This could be any of three big hypervisors on any of the supported hardware platforms by these hypervisors. Even if we would know this and everything works well simple changes like updating network firmware or drivers can cause issues. Just read
article by Trond Eirik Haavarstein, you will be amazed what can happen when a simple driver is not playing well combined with the running firmware.Another problem is that the performance of a virtual appliance is highly dependent on CPU performance because of SSL transaction and virtual networking. If your hypervisor is over committed this may influence overall performance a lot. I will dig deeper on the why and how in my article “”.So although there are situations in which you can facilitate more then the amount of users Citrix specifies I’ll bet you that there are just as many situations where even those numbers are way to positive. The problem with this is that Citrix needs to say something and who’s blaming them for choosing a fairly safe amount of users. Doing so we should be assured that when we follow the numbers Citrix gives us we should be safe, although a highly over committed platform will surely show you performance issues!The final advice is “pilot pilot pilot and check scalability and performance counters!”.If you still have questions please let me know in a comment and I will try to get them answered.This article wouldn’t be possible without the help of the community. Special thanks to , ,
and two Citrix employees for their useful insights and reviews of this article!Share this:Like this:Like Loading...About Barry Schiffer Barry is an IT Architect with 15 years of IT experience. He has gained both a broad and deep knowledge in the sphere of IT. Throughout the years, Barry has developed into a specialist in the field of Microsoft Windows, Server Based Computing, desktop and server virtualisation.Barry is co-founder and member of the Board of the Dutch Citrix User Group.Barry is awarded with the Citrix Technology Professional award in 2015 and received the RES Software Valued Professional award in 2012.
Tagged , , , . Bookmark the .
Proud member ofPowered byBlogrollRecent Posts
Subscribe to Blog via EmailEnter your email address to subscribe to this blog and receive notifications of new posts by email.Join 55 other subscribers
Email Address
Send to Email Address
Your Name Your Email Address
Post was not sent - check your email addresses! Email check failed, please try again Sorry, your blog cannot share posts by email.%d bloggers like this:Advertisement
Forefront Unified Access Gateway 2010 (UAG) delivers comprehensive, secure remote access to corporate resources for employees, partners, and vendors on both managed and unmanaged PCs and mobile devices. Utilizing a combination of connectivity options, ranging from SSL VPN to Direct Access, as well as built in configurations and policies, Forefront UAG provides centralized and easy management of your organization's complete anywhere access...
Price:&USD&$0.00;
License:&Freeware
File Size: 58265 KB;
Windows XP,
Windows Vista
, Windows Vista x64,Windows 7,Windows 7 x64
High quality and Value for the 1Y0-308 Exam.Testpassport Practice Exams for Citrix Access Gateway 4.5 Advanced Edition: Administration 1Y0-308 are written to the highest standards of technical accuracy, using only certified subject matter experts and published authors for development.100% Guarantee to Pass Your Citrix Other Certification exam and get your Citrix Other Certification Certification.We guarantee your success in the first attempt....
Price:&USD&$0.00;
License:&Freeware
File Size: 240 KB;
Windows Me,
Windows NT,
Windows 2000,
Windows XP,
Windows Vista,
Windows CE,
Earlyon CafeCentra is the leading time-tested Internet and Cyber Cafe Billing and Management software solution offering cyber and internet cafeoperators the security, reliability and performance necessary to operate a successful Cyber Cafe business. Key software features include: *100% Hacker Proof Client Security *Automated Cyber Cafe Income Reports Mailing *Superior Print Job Monitoring and Management *Websites and Web Downloads Restriction...
Price:&USD&$150.00;
License:&Shareware&(Free&to&Try)
File Size: 5796 KB;
Platform: Not,Applicable
Gateway Access Point is an easy-to-use software that turns your Gateway laptop into a Wi-Fi wireless access point. Anyone nearby can surf the Internet through your sharing. This is also an ideal solution for setting up a temporary AP in a hotel room, meeting room, at home or the like. Different from Virtual Access Point software which is hardware-independent, Gateway Access Point is designed for Gateway hardware only. Other laptops are not...
Price:&USD&$29.95;
License:&Shareware&(Free&to&Try)
File Size: 870 KB;
Windows 2000,
Windows XP
Gateway Mediation Server (GMS) is a free program that runs locally on your premises and provides remote access mediation service. GMS works with Remote Utilities remote desktop software. The program consists of GMS service and Administrator's console. The service is run on the gateway PC while the Administrator's console is used to connect to server and administer it.
GMS allows remote support companies and helpdesk providers to have fully...
Price:&USD&$0.00;
License:&Freeware
File Size: 2448 KB;
Windows 2000,
Windows 2003,
Windows Vista,
Windows XP
, Windows 7 x32, Windows 7 x64, Windows Server, Windows Vista, Windows Vista x64
With the Citrix ICA Client for Macintosh, local and remote users can access any Windows-based application running on the server. All the user needs is a low-bandwidth connection (21kilobytes) and the ICA client, which is downloadable free from the Citrix web site. The IT Manager must have Citrix WinFrame or MetaFrame products installed at the server. Citrix Systems & My Citrix & Error.
Price:&USD&$49.99;
License:&Shareware&(Free&to&Try)
File Size: 4915 KB;
Platform: Intel based Mac
Stop memorising logins, passwords, Citrix servers and ma store all your Citrix connections on one USB flash drive, smart card, enjoy automated access - simply insert the USB drive and pass convenient identification. Add the strength of multi-factor authentication for login to Citrix MetaFrame Presentation Server sessions, and eliminate the risks of passwords being lost, forgotten or stolen.
Users simply insert...
Price:&USD&$39.00,&EUR&39;
License:&Shareware&(Free&to&Try)
File Size: 1486 KB;
Windows 98,
Windows Me,
Windows NT,
Windows 2000,
Windows XP
AXIGEN Gateway is a secure mail relay server capable of integrating with most virus / anti-spam applications and using firewall-like connection rules.
By separating security functions from real mail server usage, you improve both server effectiveness and communication security. Download the full-featured evaluation version and benefit from free technical support during the evaluation period and first year of use. If you choose to switch to...
Price:&USD&$95.00,&EUR&80;
License:&Shareware&(Free&to&Try)
File Size: 10800 KB;
Teleon Skype Gateway for voice modem is a VoIP gateway driver for common voice modem card. Calls can be forwarded from PSTN to Skype remote user and vice versa, in fix transfer mode or free dial mode. Its freeware version has a duration limitation for each call.
1) Automatic installation/uninstallation program helps you to install, uninstall and remove driver.
2) Call from Skype to PSTN and PBX: open a chat window in...
Price:&USD&$0.00;
License:&Freeware
File Size: 946 KB;
Windows 2000,
Windows XP
Ideco Gateway provides the users of corporate networks with controlled and secure access to the Internet and delivers on the following tasks:
* Maintain the database of users of the corporate network
* Guard the enterprise's servers and workstations against attacks from the Internet
* Filter traffic, block unwanted advertising
* Connect remote departments and employees
* Analyze network traffic and set...
Price:&USD&$599.00;
License:&Shareware&(Free&to&Try)
File Size: 116608 KB;
Windows 2000,
Windows 2003,
Windows 95,
Windows 98,
Windows Me,
Windows NT,
Windows Vista,
Windows XP
TrustPort Internet Gateway can be mounted on dedicated Windows server or within current mail server depending on particular network topology. Separate parts of TrustPort Internet Gateway can be split between several servers. With complete antiviral and antispam check utilization TrustPort Internet Gateway achieves high-speed rate of message processing. Its performance can be customized and is fully adequate for big mail servers and ISP...
Price:&USD&$30.00;
License:&Shareware&(Free&to&Try)
File Size: 38966 KB;
Windows NT,
Windows 2000,
Windows XP
Summary: Gateway notebook WiFi Router is a software-based WiFi routing utility that turns your Gateway notebook into a wireless router. Designed specially for Gateway brand notebooks for sharing the Gateway notebook's Internet with other WiFi-enabled devices.
Detailed: Gateway Notebook WiFi Router is a handy and easy to use software router for Gateway notebooks. After downloading and installing the lightweight application, Gateway...
Price:&USD&$29.95;
License:&Shareware&(Free&to&Try)
File Size: 3122 KB;
Windows Vista,
Windows XP
eMachines Access Point is an easy-to-use software that turns your eMachines laptop into a Wi-Fi wireless access point. Anyone nearby can surf the Internet through your sharing. This is also an ideal solution for setting up a temporary AP in a hotel room, meeting room, at home or the like. Different from Virtual Access Point software which is hardware-independent, eMachines Access Point is designed for eMachines hardware only. Other laptops are...
Price:&USD&$29.95;
License:&Shareware&(Free&to&Try)
File Size: 870 KB;
Windows 2000,
Windows XP
, WinVista,Win7 x32
BenQ Access Point is an easy-to-use software that turns your BenQ laptop into a Wi-Fi wireless access point. Anyone nearby can surf the Internet through your sharing. This is also an ideal solution for setting up a temporary AP in a hotel room, meeting room, at home or the like. Different from Virtual Access Point software which is hardware-independent, BenQ Access Point is designed for BenQ hardware only. Other laptops are not supported...
Price:&USD&$29.95;
License:&Shareware&(Free&to&Try)
File Size: 870 KB;
Windows 2000,
Windows XP
, Windows Vista, Windows 7
Averatec Access Point is an easy-to-use software that turns your Averatec laptop into a Wi-Fi wireless access point. Anyone nearby can surf the Internet through your sharing. This is also an ideal solution for setting up a temporary AP in a hotel room, meeting room, at home or the like. Different from Virtual Access Point software which is hardware-independent, Averatec Access Point is designed for Averatec hardware only. Other laptops are not...
Price:&USD&$29.95;
License:&Shareware&(Free&to&Try)
File Size: 870 KB;
Windows 2000,
Windows XP}