Understanding default traffic plane behavior and override mechanisms

Last published : Sep 24, 2026
The Secure Management feature in NetScaler® keeps your network more secure by separating traffic across two different routing planes: the Management plane (TD 4094) handling admin tasks and the Data plane (TD 0) handling regular user traffic. Normally, each NetScaler feature automatically gets assigned to one of these planes. But sometimes your network setup needs to work differently than the default settings. NetScaler provides powerful mechanisms to redirect feature traffic from its default plane to the other.
To override the default traffic plane for a feature, the configuration entity you use must belong to the target plane where you want the traffic to flow. In other words, the override mechanism must be part of the routing area (plane) you intend the traffic to use. The following sections describe the available override methods:
  • Net profile-based override
    A Net profile is a configuration object that forces a service or action to use a specific source IP address for outbound connections. When you assign a source IP (SNIP) from the target plane, NetScaler uses that plane's routing and network configuration, such as TD 0 for the Data plane or TD 4094 for the Management plane. This directs Net profile traffic through the selected plane. This method is commonly used to redirect traffic for services like Syslog, RADIUS, and LDAP.
  • Virtual server-based override
    Certain features or services are bound directly to a virtual server, such as a Load Balancing virtual server. Configure or bind services to a virtual server in your desired plane to direct feature traffic toward the target plane.
  • Policy-based routing (PBR) override
    Policy-based routing (PBR) provides a flexible way to redirect traffic using rules that filter traffic attributes such as source and destination IP, port, and protocol. PBR lets you intercept specific traffic flows and route them explicitly to a different Traffic Domain (TD) from their default assignment, with an optional next-hop gateway specification. This ensures precise control over traffic routing across planes.

Default traffic plane assignment and override methods for NetScaler features

This table summarizes the default traffic plane classification for various NetScaler features and outlines the available methods to override these defaults, directing traffic to a different plane when needed.
Feature Default Traffic Plane Override Methods Override Implementation
AAA Data plane Virtual server-based override Creates a backend authentication and authorization server service explicitly in the Management plane (TD 4094), allowing a Data plane LB virtual server to proxy to it.
Policy Based Routings (PBR) override Uses PBR to explicitly force authentication and authorization traffic to the Management Traffic Domain (TD 4094).
Policy-based routing (PBR) override For VPX on Linux platforms, user-defined authentication and authorization servers on non-standard ports require a PBR override rule to route authentication and authorization traffic through the appropriate plane.
User-defined monitors (VPX on Linux) Data plane Policy-based routings (PBR) override For VPX on Linux platforms, user-defined monitors require a PBR override rule to route monitor traffic through the appropriate plane.
Application Firewall Data plane Virtual server-based override Uses a Data plane LB virtual server to proxy APPFW import and update queries to backend APPFW servers in the Management plane.
PBR override Intercepts APPFW traffic destined for a server and forces it into the Management Traffic Domain (TD 4094).
DNS Data plane Net profile-based override Forces DNS queries to originate from the Management IP (NSIP), routing them through the Management plane.
Virtual server-based override Uses a Data plane DNS load balancing virtual server to proxy queries to Management plane DNS resolvers, bridging the planes.
PBR override Intercepts DNS traffic and forces it into the Management Traffic Domain (TD 4094).
IP Reputation Data plane Virtual server-based override Uses a Data plane LB virtual server to proxy IP Reputation queries to backend proxy servers located in the Management plane.
PBR override (for proxy server traffic when not direct internet access) Intercepts IP Reputation proxy traffic and forces it into the Management Traffic Domain (TD 4094).
SSL-CRLRefresh Data plane PBR override Uses PBR to intercept CRL refresh traffic destined for a pre-resolved IP and forces it into the Management Traffic Domain (TD 4094).
SSL-HSM Data plane PBR override Uses PBR to intercept HSM client traffic on a specific port and force it into the Management Traffic Domain (TD 4094).
AppFlow Management plane Virtual server-based override Uses a Management plane LB virtual server to proxy AppFlow traffic to a Data plane service, bridging the planes.
Netprofile-Based override (Recommended) Forces AppFlow traffic to originate from a Data plane SNIP, routing it through the Data plane.
Note: When Secure Management is Enabled, Analytics Logstream traffic over NSIP does not function as expected. Logstream traffic must be configured to flow through the Data plane for proper operation.
SNMP Management plane PBR override Intercepts SNMP traps traffic destined for a Data plane manager and redirects it using a Data plane gateway, routing it through the Data plane.
SYSLOG Management plane Net profile-based override Forces SYSLOG traffic to originate from a Data plane SNIP, routing it through the Data plane.
Virtual server-based override Uses a Management plane LB virtual server to proxy SYSLOG traffic to a Data plane service, bridging the planes.

Configuration examples for overriding the default traffic plane

The following examples show how to apply each override method to move traffic from its default plane to the other plane. The first set moves a Management plane feature (Syslog) to the Data plane, and the second set moves a Data plane feature (DNS) to the Management plane.
Note:
In a policy-based routing (PBR) rule, -td specifies the source plane Traffic Domain and -targetTD specifies the destination plane Traffic Domain. You cannot use -targetTD and -nextHop in the same PBR rule. The -targetTD parameter routes the packet to the target plane, and the routing table of that plane then forwards the packet to the appropriate next hop.

Redirect Management plane traffic to the Data plane

By default, Syslog traffic uses the Management plane. The following examples send Syslog UDP traffic to a server in the Data plane.
Virtual server-based override (LB method):
add ns ip 10.106.221.55 255.255.255.128 -vServer DISABLED -td 4094
add lb vserver mgmt-syslog-udp-lb SYSLOGUDP -persistenceType NONE -lbMethod ROUNDROBIN -cltTimeout 120
add audit syslogAction mgmt-syslog-action -lbVserverName mgmt-syslog-udp-lb -logLevel ALL
The following example uses a Management plane load balancing virtual server to proxy AppFlow traffic to a Data plane service:
add lb vserver mgmt-appflow TCP 10.106.231.56 4739 -persistenceType NONE -cltTimeout 9000 -td 4094
add service appflow-server-Dataplane 5.5.5.5 TCP 4739
bind lb vserver mgmt-appflow appflow-server-Dataplane
Policy-based routing (PBR) override:
add pbr mgmt-syslog-override ALLOW -destIP 7.6.5.5 -td 4094 -targetTD 0
Net profile-based override:
add netProfile dataplane-netprofile -srcIP 10.106.231.51 -MBF DISABLED
add audit syslogAction mgmt-syslog2-action 3.3.3.3 -logLevel ALL -mgmtlogLevel NONE -netProfile dataplane-netprofile

Redirect Data plane traffic to the Management plane

By default, DNS traffic uses the Data plane. The following examples send DNS UDP traffic to a server in the Management plane (TD 4094).
Virtual server-based override (LB method):
add service dns-mgmtplane-server TD_4094_10.106.221.66 DNS 53 -td 4094
add lb vserver DNS-Dataplane DNS 10.106.231.57 53 -persistenceType NONE -cltTimeout 120
bind lb vserver DNS-Dataplane dns-mgmtplane-server
Policy-based routing (PBR) override:
add ns pbr dns-override-dataplane ALLOW -destIP 6.6.6.7 -targetTD 4094 -td 0 -priority 30
Net profile-based override (DNS monitor):
add netProfile "mgmt netprofile" -td 4094 -srcIP 10.106.221.55 -MBF DISABLED
add lb monitor DNS-Mgmt-monitor DNS -query . -queryType Address -LRTM DISABLED -netProfile "mgmt netprofile"

Use case: Management and Data plane exceptions

This example illustrates how to use exceptions for authentication for NSIP login (LDAP or RADIUS authentication) when the Secure Management feature is enabled on NetScaler.
Scenario:
A customer wants to use LDAP or RADIUS to authenticate users logging in to the NetScaler management IP (NSIP), including the secondary NSIP. However, with 'Secure management' enabled, AAA (authentication and authorization) traffic is considered a Data plane and uses SNIP, so authentication to the secondary NSIP does not work by default.
Solution:
Use a load balancing-based plane override. The front-end virtual IP (VIP) address is placed in the Management plane, while the backend LDAP/RADIUS servers are in the Data plane.
Configuration:
  1. Create a load balancing virtual server in the Management plane.
  2. Bind LDAP/RADIUS servers (in the Data plane) as backend services.
  3. Configure the NSIP to use the load balancing VIP for authentication.
This setup allows authentication requests from the Management plane to reach backend authentication servers in the Data plane, bypassing the default restriction.
This is a virtual server-based override applied in the Management-to-Data plane direction. For the equivalent CLI commands and the other override methods, see Configuration examples for overriding the default traffic plane.