Feeds

Citrix pushes the pedal on NetScaler appliance metal

2,048-bit SSL coprocessor nitro

Internet Security Threat Report 2014

Citrix Systems made a lot of noise by acquiring XenSource a few years back for a half billion bucks, but it still makes a lot of money from its NetScaler line of web application acceleration appliances. These include physical implementations (MPX), virtual ones (VPX) running inside of virtual machines, and the high-end ones for service providers (SDX).

The NetScaler appliances are based on two-socket Xeon 5600 servers in a 2U chassis with SSL encryption/decryption coprocessors plugged into their peripheral slots. The MPX versions just run one image of the NetScaler software on a single appliance: the Standard, Enterprise, or Platinum editions, to be precise. The SDX versions, which first debuted in May, are aimed at service providers and they use the company's XenServer hypervisor to carve up a single server into multiple, isolated virtual application acceleration and access control instances. The MPX and SDX appliances come with all of their hardware installed and Citrix dials up a certain level of bandwidth and SSL encryption/decryption capacity to create different models. Once you have one model, you can do a software upgrade on-the-fly to boost a NetScaler appliance's performance. The VPX virtual appliances can run on any server sporting a Citrix XenServer, Microsoft Hyper-V, or VMware ESXi hypervisor.

With companies freaking out about security on the Wild Wide Web, Citrix has beefed up the performance of the NetScaler MPX and SDX appliances so they can process 2,048-bit SSL encryption and decryption at an acceptable performance level. It's not that the existing NetScaler appliances can't do the 2,048-bit encryption, explains Greg Smith, senior director of product marketing for the Cloud Networking Group at Citrix, but the company had to add come more coprocessing oomph to do so at speed. At the top-end of the NetScaler line, the new MPX 21550/SDX 21550 can handle 90,000 transactions per second with those 2Kb key certificates, which is twice the oomph of the prior MPX 21500/SDX 21500 appliances and more than twice that of the nearest rivals, according to Smith.

Citrix NetScaler

Citrix NetScaler acceleration/access appliances

Smith says that on an existing NetScaler appliance without the extra coprocessors, switching from 1,024-bit to 2,048-bit SSL drops the transaction throughput on the appliance by 80 percent. Doing that extra math takes a lot more time.

The other big change with the latest NetScalers is that the virtual appliance count on the SDX appliance has been boosted from 16 virtual NetScaler instances with the SDX appliances announced in May. With the NetScaler SDX 17550, 19550, 20550 and 21550 appliances that were just announced, service providers can add up to 40 virtual NetScaler instances to the machines. Citrix is still using the XenServer 5.6 hypervisor inside of the SDX appliances, by the way, not the new XenServer 6.0 hypervisor announced a little more than a week ago. The SDX appliances can run different editions and release levels of the NetScaler software at the same time and can have specific amounts of memory, CPU, and SSL encryption/decryption throughput tied to each SDX image.

"We guarantee that no NetScaler instance will starve out any other and that is very important for multitenant service providers," says Smith. The only other way to guarantee performance would be to buy a separate hardware appliance for each customer, and that's not going to work in the cloudy era.

The base MPX 17550 appliance has 20Gb/sec of throughput and can process 44,000 transactions per second using 2,048-bit SSL encryption. It costs $145,000. The SDX 17550 has the same feeds and speeds hardware wise and has five instances of the NetScaler Standard Edition loaded up with the hypervisors. The other three appliances offer 35Gb/sec, 42Gb/sec, and 50Gb/sec raw throughput. The ability to upgrade through those speeds is called "pay-as-you-grow" by Citrix. ®

Internet Security Threat Report 2014

More from The Register

next story
Docker's app containers are coming to Windows Server, says Microsoft
MS chases app deployment speeds already enjoyed by Linux devs
IBM storage revenues sink: 'We are disappointed,' says CEO
Time to put the storage biz up for sale?
'Hmm, why CAN'T I run a water pipe through that rack of media servers?'
Leaving Las Vegas for Armenia kludging and Dubai dune bashing
'Urika': Cray unveils new 1,500-core big data crunching monster
6TB of DRAM, 38TB of SSD flash and 120TB of disk storage
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
SDI wars: WTF is software defined infrastructure?
This time we play for ALL the marbles
Windows 10: Forget Cloudobile, put Security and Privacy First
But - dammit - It would be insane to say 'don't collect, because NSA'
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.