A week or so ago we had a driver update take place on ALL machines at once and flooded the router/firewall with 800 MB of traffic. When this happened, voip over Citrix started dropping packets causing call issues for order takers. Citrix connections are via HTTPS, encapsulating the VOIP for the softphones on the Citrix desktops, so SIP priority did not work.
What I am looking at now is to prioritize any and all HTTPS going to the load balancer that head ends the Citrix Farm. I think I have the correct configuration, but would like some feedback before I apply it to prevent causing an outage when applied and since I would need to see similar traffic like what we saw, to fully test it, which at this time of year, is what we want to avoid.
access-list Citrix-Priority extended permit tcp any host 192.168.160.138 eq 443
class-map Citrix-Priority
match access-list Citrix-Priority
policy-map Citrix
class Citrix-Priority
priority
service-policy Citrix interface outside
service-policy Citrix interface idmz
From what I remember, granted, YEARS ago when I did this all the time, the inbound packets coming in from outside that match the ACL would hit the priority bucket and be processed ahead of everything else, which "should" put all the citrix traffic through to the internal dmz interface the LB resides at. Will the second service policy interface even be needed since its the inside and outside that were getting slammed? It was the outside interface dropping random packets causing this.
Is there a better method to do this? I used to work for an ISP and worked firewalls all day, every day, but has been 8 years since I had the need to do traffic work on an ASA as I no longer work for an ISP.
