Curious if anyone has deployed a virtual Citrix load balancer container with Netlab

[jbemmel]

See https://docs.netscaler.com/en-us/cpx/current-release/deploy-using-docker-image-file.html

I can pull the image and launch it, but have difficulty reaching the web interface. Would appreciate a quick how-to

[sdargoeuves]

I have attempted, but unsuccessfully and unfortunately gave up a little while ago, but it was with a KVM image... I can't find any useful notes of what I did. I've since spent a few hours (way too many) fighting a Check Point FW to get the vagrant box up and running. It's possible I missed some steps when creating the vagrant box for the Citrix LB.

Now, if there is a docker image, maybe I should reconsider... I will attempt to play with it, and share if I get somewhere!

[sdargoeuves]

I had some issues with the version 14, couldn't get to the webportal either, AI and I didn't understand what the problem was, something to do with Apache configuration maybe... Anyway, I tried with an older version of Netscaler, and I got there!

Get the image:

docker pull quay.io/netscaler/netscaler-cpx:13.1-59.22

Run the container:

docker run -dt -P --privileged=true -e EULA=yes --ulimit core=-1 --name cpx quay.io/netscaler/netscaler-cpx:13.1-59.22

Users

Get the password for nsroot user

This gives you the random default password for the root or nsroot user, to later access the UI. You don't need it if you create the clab user

docker exec cpx cat /var/deviceinfo/random_id

Create a clab superuser

I created a simple clab/clab user, with full access:

docker exec cpx useradd -m clab
docker exec cpx bash -c 'echo "clab:clab" | chpasswd'
docker exec cpx cli_script.sh "add system user clab clab -promptString '%u@%h'"
docker exec cpx cli_script.sh "bind system user clab superuser 0"
docker exec cpx cli_script.sh "show ns ip" ":clab:clab"

Fix permissions for the web UI:

docker exec cpx mkdir -p /var/nstmp
docker exec cpx chmod 777 /var/nstmp
docker exec cpx cli_script.sh "save ns config"

Get the IP Address:

docker exec cpx bash cli_script.sh "show ns ip"

This will give you the IP of your container (172.17.0.4) for me

Use the API

You can access the NITRO API at https://172.17.0.4:9443/nitro/v1/config with basic auth using nsroot and the random password. For example: curl -k -u nsroot:PASSWORD https://172.17.0.4:9443/nitro/v1/config/ns

Web portal

For me to use the portal, I need to SSH forward: ssh -fNL 40443:172.17.0.4:9443 user@netlab-server
Then you should have access the GUI at https://localhost:40443 with username nsroot and the random password you obtained earlier.

[sdargoeuves]

sorry for the constant editing of the message above, I'm playing with the docker container/image, to spin it in netlab

[sdargoeuves]

After the test above, I've now tested to create a new docker image from the container, and I can spin up the netscaler in the lab with a topology like this.

First create a new docker image after doing the configuration:

docker commit cpx noodleops/netscaler:13.1

Now you should be able to run netlab up with a topology like this:

---
message: "Citrix lab!"
defaults.devices.eos.clab.image: "ceos:4.29.9.1M"
defaults.devices.linux.clab.image: "ubuntu/nginx"
provider: clab

groups:
  switches:
    _auto_create: true
    device: eos
    module: [ ospf, vlan ]
    members: [ sw1, sw2 ]

  allhosts:
    _auto_create: true
    device: linux
    role: host
    members: [ h11, h12, h21, h22 ]
    config: [ config-snippets/linux.j2 ]

  unprovisioned:
    members: [ lb ]

nodes:
  lb:
    device: linux
    clab:
      kind: linux
      image: noodleops/netscaler:13.1 # replace with your local image
      env.USERNAME: clab
      env.PASSWORD: clab

  sw1:
    vlans:
      user_1:
        ipv4: 1
      server_1:
        ipv4: 1
  sw2:
    vlans:
      user_2:
        ipv4: 1
      server_2:
        ipv4: 1

vlans:
  user_1:
    id: 11
    ospf.passive: true
  server_1:
    id: 12
    ospf.passive: true
  user_2:
    id: 21
    ospf.passive: true
  server_2:
    id: 22
    ospf.passive: true

links:
  - lb:
    sw1:
      ospf: false
  - lb:
    sw2:
      ospf: false

[jbemmel]

Thanks a lot! I think it would be worthwhile adding this as a recipe to Netlab, similar to the Vagrant box builds

[sdargoeuves]

Is this the page your are referring to? In this page, all the vagrant boxes are from vendor supported by netlab. If we were to add a similar page for docker/containerlab, should we add some basic level of support for Citrix Netscaler, at least the networking part? Is there an appetite for it, is it worth it?

Or is it a blog post material, on how to bring any container image, link it to your netlab environment, but configure it outside of netlab, like we've done here.

[jbemmel]

Yes, similar to those Valgrind boxes with install scripts https://github.com/ipspace/netlab/tree/dev/netsim/install/libvirt

I personally have a need for Netscaler and a specific recipe to make it work with Netlab, it may help others. Figuring out those little steps to make things work takes a lot of time, we can save people the trouble

[ipspace]

I personally have a need for Netscaler and a specific recipe to make it work with Netlab, it may help others.

If you just want to save the knowledge, create the recipe in docs/labs/netscaler.md and add a link it to docs/labs/clab.md under "Using unsupported devices" or some such. Obviously, you can also add a new device 😎

[sdargoeuves]

I'm working on a Dockerfile recipe, which could be a nicer approach than the few docker exec xxxx that I've got above.

And also, I've spent some way too much time to find a way for the user to be able to connect directly into the standard nscli mode, directly logged in. This way you can just ssh to the netscaler, and you will be able to directly enter your show commands. It will look like this:

╰─❯ ssh clab@10.194.59.201
clab@10.194.59.201's password:
Welcome to nsoslx 1.0 (GNU/Linux 5.4.0-216-generic x86_64)

 * Documentation:  https://www.citrix.com/

The programs included with the nsoslx system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

nsoslx comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
 Done
clab@lb> show version
	NetScaler NS13.1: Build 59.22.nc, Date: Aug 20 2025, 15:43:41   (64-bit)
 Done
clab@lb>

[sdargoeuves]

create the recipe in docs/labs/netscaler.md and add a link it to docs/labs/clab.md under "Using unsupported devices" or some such.
I'm throwing my notes in here, before adding it as suggested

Here is the dockerfile I am now using:

FROM quay.io/netscaler/netscaler-cpx:13.1-59.22

ENV EULA=yes

# Build arguments for clab user credentials
ARG CLAB_USER=clab
ARG CLAB_PASSWORD=clab@123
ENV CLAB_USER=${CLAB_USER}
ENV CLAB_PASSWORD=${CLAB_PASSWORD}

# Create clab user (for SSH)
RUN useradd -m ${CLAB_USER} && echo "${CLAB_USER}:${CLAB_PASSWORD}" | chpasswd

# Create required directories
RUN mkdir -p /var/nstmp && \
    chmod 777 /var/nstmp

# Provision script - create a user with superuser privileges
RUN (echo '#!/bin/bash'; \
     echo "cli_script.sh \"add system user ${CLAB_USER} ${CLAB_PASSWORD} -promptString '%u@%h'\""; \
     echo "cli_script.sh \"bind system user ${CLAB_USER} superuser 0\""; \
     echo 'cli_script.sh "save ns config"') > /provision.sh && \
    chmod +x /provision.sh

# nscli wrapper - allows user to enter nscli, already logged in
RUN (echo '#!/bin/bash'; \
     echo "exec nscli -U 127.0.0.1:${CLAB_USER}:${CLAB_PASSWORD}") > /usr/local/bin/nscli-wrapper && \
    chmod +x /usr/local/bin/nscli-wrapper

# Set nscli wrapper as default shell for user
RUN usermod -s /usr/local/bin/nscli-wrapper ${CLAB_USER}

# Entrypoint - runs startup and also provisioning if container is not already initialized
RUN (echo '#!/bin/bash'; \
     echo 'if [ ! -f /initialized ]; then'; \
     echo '  /var/netscaler/bins/docker_startup.sh &'; \
     echo '  sleep 120'; \
     echo '  /provision.sh'; \
     echo '  touch /initialized'; \
     echo 'else'; \
     echo '  /var/netscaler/bins/docker_startup.sh'; \
     echo 'fi'; \
     echo 'wait') > /entrypoint.sh && \
    chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]
EXPOSE 22 9080 9443

To create your image you can either keep the default clab user as defined in the Dockerfile, or define your own:

docker buildx build -t noodleops/netscaler:13.1-default .

docker buildx build --build-arg CLAB_USER=cliuser --build-arg CLAB_PASSWORD=sEcrEtP4ssword -t noodleops/netscaler:13.1-custom .

You can ignore the warning

 2 warnings found (use docker --debug to expand):
 - SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "CLAB_PASSWORD") (line 7)
 - SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CLAB_PASSWORD") (line 9)

[sdargoeuves]

I've started this PR (hopefully I've done this part correctly... I'm a newbie in the art of contributing in github)

[sdargoeuves]

@jbemmel when you mention this:

Perhaps a small YAML file under devices/netscaler.yml could define clab.image and the username/password to login, such that netlab connect lb1 would work too?

you would want netlab to use the same user/password as the one set up as clab/clab@123 in the current Dockerfile, instead of using the root user?

Because this commands works for me, but then I am logged in as root, not as the CLI user. I have to do the following to be able to enter my show commands:

╰─❯ netlab connect lb1
Connecting to container clab-ml_4-lb1, starting bash
# nscli
> login
Enter userName: clab
Enter password:
 Done
clab@lb1> 

Or

╰─❯ netlab connect lb1
Connecting to container clab-ml_4-lb1, starting bash
# bash
root@lb1:/# cli_script.sh "show ns ip"
exec: show ns ip
  	Ipaddress        Traffic Domain  Type             Mode     Arp      Icmp     Vserver  State
  	---------        --------------  ----             ----     ---      ----     -------  ------
1)	10.194.59.201    0               NetScaler IP     Active   Enabled  Enabled  NA       Enabled
2)	192.0.0.1        0               SNIP             Active   Enabled  Enabled  NA       Enabled
Done
root@lb1:/#

Because if I understand correctly, the netlab connect xx is using the docker exec -it xx bash which will not use any username/password.

[jbemmel]

You're right, it's not strictly needed for netlab connect. It would integrate things more cleanly into Netlab though. I'm a fan of defining things once, in clearly defined locations; such hardcoded usernames/passwords are candidates for cleanup

We can leave it FFS

[jbemmel]

To illustrate:

netlab/netsim/devices/frr.yml

Line 24 in 0763487

netlab_show_command: [ vtysh, -c, 'show $@' ]

[sdargoeuves]

I'm happy to investigate the creation of a netscaler.yml file, using the frr as an example.
I wanted to learn how to add a vendor to netlab, I was not thinking of citrix as the one I would pick, but it could still be interesting to add a limited/minimal support for it (similar to fortios maybe), if you think that makes sense.

[ipspace]

I'm happy to investigate the creation of a netscaler.yml file, using the frr as an example.

@sdargoeuves I could merge #2742 right now (adding documentation on how to use it as a Linux node), or I could wait for you to add "netscaler" device, which would then automatically trigger the "you have to build the container first" warning.

How do you want to proceed?

[sdargoeuves]

I would say we could merge this, so I can take the necessary time to go through the How to add a device
Once I have something worth sharing, I will create a new PR.