NetScaler has multiple deployment solutions in AWS – standalone, HA (failover) within zone or across zones, Auto scale etc. In this article, we will be focusing on HA across zone within a AWS VPC which is active passive deployment and very popular among NetScaler users in AWS. Following is the high-level topology that we will be deploying in AWS:



Above HA pair of NetScaler's can take care of failover for both publicly available external apps and internal private apps. NetScaler support AWS CloudFormation Templates for various deployments. In this tutorial, we will be using ha-3nic-across-az-pipeip.yaml template.
 

Initial Setup
Prior to using the above template, the following needs to be configured in your AWS infrastructure.

1. Create a VPC
2. 6 subnets – 3 subnets in each Availability Zone (AZ)
   1. Primary NetScaler subnets
      1. Management side subnet
      2. Client-side subnet
      3. Server-side subnet
   2. Secondary NetScaler subnets
      1. Management side subnets
      2. Client-side subnet
      3. Server-side subnet
3. 3 unallocated Elastic IPs
   1. 1 each for NetScaler (Primary and Secondary) management access
   2. 1 for VIP
4. EC2 keypair
5. Subscribe for any of the NetScaler product offering from AWS Marketplace that you would like to deploy:
   1. AWS Marketplace : NetScaler VPX – Customer Licensed
   2. Free VPX Express edition
   3. Paid Marketplace Subscription

1. Click here to go Citrix’s GitHub repository
2. Scroll down for Quick Launch Links section and click on the Launch Stack corresponding to the AWS region where the VPC infrastructure is present.
3. Fill in the values to AWS Infrastructure and NetScaler configurations in Parameters section. Some guidance on few parameters is here:
   1. Source address range to access NetScaler management interfaces via SSH, HTTP, HTTPS ports
      1. This is a CIDR range in the format x.x.x.x/x.
      2. If you wish to restrict login to NetScaler management interface only from your computer, give your PublicIP address. eg., If your Public IP address is 1.2.3.4, then provide 1.2.3.4/32 in the input parameter.
   2. Do you have any custom NetScaler AMI to be deployed?
      1. The CFT by default deploys “NetScaler Customer Licensed BYOL” image.
      2. However, if you wish to deploy other NetScaler images, you can give the AMI ID of the product here.
      3. You can find all the AMIs for a particular NetScaler product here.
   3. NetScaler instance type - m5.xlarge is the recommended one. Refer our NetScaler AWS  instance support guide for further info.
   4. PublicIP (EIP) be assigned to management interfaces?
      1. If you wish to login NetScaler via public IP, select “Yes”
      2. Note: If you select “No”, then you need to have a bastion-host in the VPC to access the NetScaler management interface.
      3. For this demo, we recommend having this as “Yes”
4. Click Next on the Configure stack options page
5. On the Review page, scroll down and acknowledge that CFT creates IAM role.
   1. 
6. Create Stack
   It takes only 3 minutes to deploy the CloudFormation stack
    

1. Two NetScaler EC2 instances
   1. One for Primary NetScaler in one AZ
   2. One for Secondary NetScaler in another AZ. If Primary NetScaler goes down for any reason, Secondary NetScaler becomes active and handles client’s traffic for your apps.
   3. Two LB V Servers are pre-configured for you as part of CFT deployment for trying out HA:
      1. Internal_lb lbvserver – You can expose your internal apps via this lbvserver
      2. External_lb lbvserver – You can expose your external public facing apps via this lbvserver
2. IAM Role with the below policy – This is required to handle failover scenarios

3. Six Elastic Network Interfaces (ENIs)
   1. Two ENIs – for Primary and Secondary NetScaler management traffic
   2. Two ENIs – for Primary and Secondary NetScaler client traffic
   3. Two ENIs – for Primary and Secondary NetScaler backend-server traffic
4. Three Security Groups
   1. For each of the above three kinds of network interfaces
   2. Primary and Secondary management traffic share same security group.
   3. Primary and secondary client traffic share same security group.
   4. Primary and secondary backend-server traffic share same security group.
5. Three Elastic IP (Public IP)

   1. One for Primary NetScaler management access

   2. One for Secondary NetScaler management access

   3. One for Client traffic. You will expose your external apps via this Public IPs.