Deploy NetScaler VPX (formerly Citrix ADC) on Microsoft Azure

Platforms

Microsoft Azure

Products

NetScalerMicrosoft Azure

Result

Two NetScaler VPX nodes (ns-vpx0 and ns-vpx1) running as an HA pair in two availability zones

Overview

Deploy a NetScaler VPX high-availability pair across Azure availability zones from Azure Marketplace, then reach it over SSH and keep the GUI behind Azure Bastion.

Microsoft Azure is a set of cloud services to build, manage and deploy applications on Microsoft's global network.

NetScaler (formerly Citrix ADC) is an enterprise Application Delivery Controller. It distributes, optimizes and secures application traffic (layer 4 to 7) for web applications.

NetScaler comes in several form factors (VPX, MPX, SDX, BLX, CPX). The virtual appliance NetScaler VPX, covered in this post, runs on hypervisors on-premises and in public clouds such as AWS, Google Cloud and Microsoft Azure.

In 2020 there were two common ways to deploy NetScaler VPX on Azure: the image in Azure Marketplace, or the Azure Resource Manager (ARM) templates on GitHub (standalone, HA pair and express). In this post I deploy an HA pair from Azure Marketplace.

Prerequisites

Before you start, check that you have the following.

Note: Marketplace subscription (pay-as-you-go) licensing, with models such as VPX10, VPX200, VPX1000 and VPX3000, is no longer supported for NetScaler VPX on Azure. Licenses are now activated with the License Activation Service, and Citrix ADM is now NetScaler Console (see NetScaler licensing).

Configuration

The Marketplace template creates the whole HA pair in four wizard steps.

Sign in to the Azure portal (portal.azure.com), select Create a resource to open Azure Marketplace, search for Citrix ADC 13.0 (High Availability) (in 2020) and select the template:

The offer shows an Overview and the software plans. In 2020 there were three:

• HA with backend autoscale: keeps the right number of VPX instances for the traffic.
• HA using Availability Zones: availability zones are separate locations within an Azure region, with their own power, cooling and networking.
• HA using Availability Set: spreads the VMs over several hosts and racks in the same datacenter.

I deployed the HA pair with Availability Zones in West Europe. Only some regions support zones (see regions with availability zones); Poland Central, announced at Ignite 2020, now has three zones.

Update (October 2026): the Marketplace offer is now called NetScaler VPX. Its HA plans are BYOL only: NetScaler VPX HA (Availability Zone) BYOL and HA (Availability Set) BYOL, plus newer via Secondary IP plans that move floating IPs between the VMs without an Azure Load Balancer (see Configure a high-availability setup with multiple IP addresses and NICs). Autoscale is a separate topic in the NetScaler documentation.

After you choose a plan, select Create. The wizard has four steps: Basics, General Settings, Network Settings and Review + create.

Step 1: Basics

• Subscription: any valid subscription, for example Pay-As-You-Go.
• Resource group: create a new one, for example Citrix_ADC_HA_pair_RG.
• Region: the closest region with availability zones, for example West Europe.

Don't select Review + create yet. Select Next: General Settings:

Step 2: General Settings

• User name: must not be a reserved word such as admin.
• Password: 12 to 72 characters, with a lowercase letter, an uppercase letter and a special character other than \ or -.
• sku: for example BYOL, if you upload your own license.
• Virtual machine size: the default in 2020 was 2x Standard DS3 v2 (4 vCPUs, 14 GB memory).

Update (October 2026): NetScaler now recommends v5 sizes, for example D4s_v5, with accelerated networking above 1 Gbps (see Deploy a NetScaler VPX instance on Microsoft Azure). The Dsv2 series, which includes DS3 v2, is scheduled to retire on May 1, 2028 (see Azure VM retirements).

Then select Next: Network Settings:

Step 3: Network Settings

Configure the virtual network and its three subnets, or accept the defaults:

• Virtual network: (new) vnet
• Interface 0/1 subnet: (new) snet-01 (10.0.0.0/24), for management traffic
• Interface 1/1 subnet: (new) snet-11 (10.0.1.0/24), for front-end (client) traffic
• Interface 1/2 subnet: (new) snet-12 (10.0.2.0/24), for back-end (server) traffic

Select Next: Review + create:

Step 4: Review and create

Azure validates the settings and shows a summary with Validation Passed:

Note: at the bottom of the page you can download the template for automation.

Select Create to start the deployment. It shows Deployment is in progress, and within minutes Your deployment is complete:

Result

Check the HA pair in the Azure portal, then connect to it.

When the deployment is complete, check your new NetScaler VPX HA pair under Virtual machines:

Note: you should see two new virtual machines, ns-vpx0 and ns-vpx1, in the Running state.

The virtual machines belong to a resource group, a logical group of resources such as VMs, NICs and storage accounts. Select the resource group name, or open Resource groups in the Azure menu:

The resource group holds all the NetScaler resources created by the template:

• Azure Load Balancer (ALB) with a public IP
• 6 network security groups
• 6 network interfaces (3 per VM)
• 2 virtual machines (ns-vpx0 and ns-vpx1)
• Virtual network (VNet) and a storage account

Select the virtual machine ns-vpx0 (the primary HA node). Copy its public IP address and connect to it over SSH (for example with PuTTY):

You can't reach the NetScaler GUI from the internet, because the network security group has no inbound rule for port 443.

It isn't recommended, but you can add port 443 to the management NIC (0/1) to reach the GUI:

The NetScaler GUI:

A better and more secure way to reach the GUI is Azure Bastion, which gives you browser-based access to the VMs without opening management ports to the internet.