TFTP Load Balancing on NetScaler using Direct Server Return

3/28/14 - A new post with updated information can be found here.

To be able to provide Provisioning Server (PVS) High Availability (HA), there are a few options.  One option stands out, direct server return (DSR).  With DSR, NetScaler provides the initial load balancing to an appropriate TFTP server, and then the TFTP and the client talk directly freeing up bandwidth on the NetScaler.  The process of the request is as follows:

1. A DHCP request is sent by a client, at which the DHCP server responds with an IP address and 2 DHCP options, 66 and 67.  Option 66 holds the TFTP server IP, and option 67 holds the boot file name.
2. The preboot execution environment (PXE) on the client then makes a request to the TFTP IP.
3. NetScaler now makes a load balancing decision.  NetScaler uses the MAC address and forwards the request while not changing the destination IP.  The frame arrives at the TFTP server with the same destination IP as the VIP configured on NetScaler.  The TFTP is able to process this frame because of a loopback adapter with the same IP assigned.
4. After the TFTP server receives the request, it forwards the request to the loopback adapter.  It then sends to the client the initial segment of its boot file.

The advantages of DSR for TFTP load balancing is that it provides robust scalability and availability.  The disadvantages of using DSR is that it requires a bit more effort in configuration and also requires a loopback interface on the TFTP servers.

Now on to the fun stuff.  Below you will find instructions on how to configure TFTP load balancing using NetScaler DSR.  In this scenario there are 2 PVSs with the TFTP service installed on each.  The PVSs have initially 2 network adapters.  The first network adapter is used to connect to the server VLAN.  The second adapter is to connect to the PVS VLAN for streaming images.  We are using 1 NetScaler (or you could use 2 in a HA pair) using subnet IP (SNIP) instead of mapped IP (MIP).  There are 3 VLANS connected to the NetScaler.  First, the management interface which is where the NetScaler IP (NSIP) is allocated.  Second, the server VLAN.  Finally, the PVS VLAN  So it logically looks like:

Now for the configuration:

1. Open the NetScaler GUI and login.
2. Navigate to "System" | "Settings"
3. Click on "Configure modes".
4. Select "Use Source IP".
5. Select "MAC Based Forwarding".
6. Create the SNIP for the PVS VLAN if not already created.
7. Create load balancing servers in NetScaler:
1. Navigate to "Load Balancing" | "Servers" and click "Add".
2. Enter a name and IP address, the click "Create".
3. Repeat this for each TFTP server.
8. Create a new service group:
1. Navigate to "Load Balancing" | "Service Groups" and click "Add".
2. Select "ANY" for Protocol.
3. Select "Server based".
4. Select the TFTP servers created earlier.
5. Enter * for the port.
6. Add a ping monitor, or create your own TFTP monitor.
7. Navigate to the "Advanced" tab.
8. Select "Use Source IP".
9. Select "Client Keep-Alive".
10. Select "TCP Buffering".
11. De-select "Surge Protection".
12. Click "Create".
9. Create a new virtual server:
1. Navigate to "Load Balancing" | "Virtual Servers".
2. Type in a name and IP.  This is the IP that needs to be used in DHCP option 66.  This is also the IP address to be used for the loopback adapters.
3. Set the protocol to "Any".
4. Set the port to *.
5. Navigate to the "Services Group" tab.
6. Select the service group created earlier.
7. Navigate to the "Method and Persistence" tab.
8. Select "SOURCEIP" for persistence.
9. Navigate to the "Advanced" tab.
10. Set redirection mode to "MAC Based".
10. Add the loopback adapter to the TFTP servers:
1. Navigate to the device manager.
2. Right-click the TFTP server name in the middle pane and choose "Add legacy hardware".
3. Click "Next".
4. Select "Install the hardware that I manually select from a list (Advanced)".
5. Click "Next".
6. Select "Network adapters".
7. Click "Next".
8. Select "Microsoft" for the manufacturer.
9. Select "Microsoft Loopback Adapter" for the network adapter.
10. Click "Next".
11. Click "Finish".
12. Navigate to the properties of the new loopback adapter and uncheck IPv6.
13. Go to the properties of IPv4 and type in the IP address and subnet mask.  This is the same IP address when you created the virtual server earlier.  Do not enter a gateway or DNS servers.
14. Disable DNS registration on this adapter.
15. Disable NetBIOS on this adapter.
16. Open a command prompt as an administrator.
17. Enter the following commans for the loopback adapter and PVS VLAN adapter:
1. netsh interface ipv4 set interface "[name of adapter]" weakhostreceive=enabled
18. Enter the following command for just the loopback adapter:
1. netsh interface ipv4 set interface "[name of adapter]" weakhostsend=enabled
11. Set the TFTP service to listen on the new loopback adapter:
1. Navigate to C:\Program Files\Citrix\Provisioning Services.
2. Open tftpcpl.cpl as an administrator.
3. Click on the "TFTP Network" tab.
4. Select the loopback adapter created earlier and de-select any other adapters.
5. Restart the Citrix TFTP service.
12. Test TFTP load balancing with NetScaler DSR:
1. Install the TFTP client feature on a server that is on the PVS VLAN but is not a TFTP server.
2. Open a command prompt and enter the following:
1. tftp [IP of TFTP virtual server created earlier] GET ardbp32.bin ardbp32.bin

Let me know if you have any comments, questions, or suggestions.