High availability across different AWS availability zones

Last published : Oct 01, 2026
You can configure two NetScaler VPX instances on two different subnets or two different AWS availability zones, as a high availability active-passive pair in Independent Network Configuration (INC) mode. If for any reason, the primary node is unable to accept connections, the secondary node takes over.
For more information about high availability, see High availability. For more information about INC, see Configuring high availability nodes in different subnets.
Related information
NetScaler VPX on AWS

Points to note

  • Read the following documents before you start your deployment:
  • The VPX high availability pair can either reside in the same availability zone in a different subnet or in two different AWS availability zones.
  • Citrix® recommends that you use different subnets for management (NSIP), client traffic (VIP), and back-end server (SNIP).
  • High availability must be set in Independent Network Configuration (INC) mode for a failover to work.
  • The two instances must have port 3003 open for UDP traffic as that is used for heartbeats.
  • The management subnets of both the nodes must have access to internet or to AWS API server through internal NAT so that the rest APIs are functional.
  • IAM role must have E2 permission for the public IP or elastic IP (EIP) migration and EC2 Route Table permissions for the private IP migration.
You can deploy high availability across AWS availability zones in the following ways:

Additional References

For more information on NetScaler Application Delivery Management (ADM) for AWS, see Install the NetScaler ADM agent on AWS.