Citrix pushes the pedal on NetScaler appliance metal
2,048-bit SSL coprocessor nitro
Citrix Systems made a lot of noise by acquiring XenSource a few years back for a half billion bucks, but it still makes a lot of money from its NetScaler line of web application acceleration appliances. These include physical implementations (MPX), virtual ones (VPX) running inside of virtual machines, and the high-end ones for service providers (SDX).
The NetScaler appliances are based on two-socket Xeon 5600 servers in a 2U chassis with SSL encryption/decryption coprocessors plugged into their peripheral slots. The MPX versions just run one image of the NetScaler software on a single appliance: the Standard, Enterprise, or Platinum editions, to be precise. The SDX versions, which first debuted in May, are aimed at service providers and they use the company's XenServer hypervisor to carve up a single server into multiple, isolated virtual application acceleration and access control instances. The MPX and SDX appliances come with all of their hardware installed and Citrix dials up a certain level of bandwidth and SSL encryption/decryption capacity to create different models. Once you have one model, you can do a software upgrade on-the-fly to boost a NetScaler appliance's performance. The VPX virtual appliances can run on any server sporting a Citrix XenServer, Microsoft Hyper-V, or VMware ESXi hypervisor.
With companies freaking out about security on the Wild Wide Web, Citrix has beefed up the performance of the NetScaler MPX and SDX appliances so they can process 2,048-bit SSL encryption and decryption at an acceptable performance level. It's not that the existing NetScaler appliances can't do the 2,048-bit encryption, explains Greg Smith, senior director of product marketing for the Cloud Networking Group at Citrix, but the company had to add come more coprocessing oomph to do so at speed. At the top-end of the NetScaler line, the new MPX 21550/SDX 21550 can handle 90,000 transactions per second with those 2Kb key certificates, which is twice the oomph of the prior MPX 21500/SDX 21500 appliances and more than twice that of the nearest rivals, according to Smith.
Citrix NetScaler acceleration/access appliances
Smith says that on an existing NetScaler appliance without the extra coprocessors, switching from 1,024-bit to 2,048-bit SSL drops the transaction throughput on the appliance by 80 percent. Doing that extra math takes a lot more time.
The other big change with the latest NetScalers is that the virtual appliance count on the SDX appliance has been boosted from 16 virtual NetScaler instances with the SDX appliances announced in May. With the NetScaler SDX 17550, 19550, 20550 and 21550 appliances that were just announced, service providers can add up to 40 virtual NetScaler instances to the machines. Citrix is still using the XenServer 5.6 hypervisor inside of the SDX appliances, by the way, not the new XenServer 6.0 hypervisor announced a little more than a week ago. The SDX appliances can run different editions and release levels of the NetScaler software at the same time and can have specific amounts of memory, CPU, and SSL encryption/decryption throughput tied to each SDX image.
"We guarantee that no NetScaler instance will starve out any other and that is very important for multitenant service providers," says Smith. The only other way to guarantee performance would be to buy a separate hardware appliance for each customer, and that's not going to work in the cloudy era.
The base MPX 17550 appliance has 20Gb/sec of throughput and can process 44,000 transactions per second using 2,048-bit SSL encryption. It costs $145,000. The SDX 17550 has the same feeds and speeds hardware wise and has five instances of the NetScaler Standard Edition loaded up with the hypervisors. The other three appliances offer 35Gb/sec, 42Gb/sec, and 50Gb/sec raw throughput. The ability to upgrade through those speeds is called "pay-as-you-grow" by Citrix. ®
Sponsored: Becoming a Pragmatic Security Leader