Best Practices for Transitioning to IPv6

Register for this live webinar, featuring Forrester Research and hear expert advice on the benefits and best practices of migrating to iPv6.

In this webinar you will learn:

• The reasons and hurdles why enterprises haven't shifted over to IPv6 already
• Business and IT benefits of transitioning to IPv6
• How other companies have made the transition.
• Who should be the most concerned and put the transition on the fast track
• What actions can be taken to minimize the cost and disruption to your infrastructure.

Details:

Webinar: Best Practices for Transitioning to IPv6
When: Tuesday, June 7, 2011
Where: Register at https://www1.gotomeeting.com/register/283262625

The Citrix Community is powerful!

Using Powershell & Amazon CloudFormation

I first started building proof of concepts in the Amazon cloud over two years ago. You can read about all of them here. We've come a long way with the recent developments we have been working on with Amazon. Since then, Amazon has released some new tools that make a datacenter in the cloud very apetizing. Recent tools now allow us to build a CloudFormation template, and when used with a Powershell script, give us the ability to automatically create a complete, scalable, Medium sized XenApp Farm in Amazon VPC. Different XenApp Farm sizes and architecture descriptions can be found here.

Amazon VPC has had some recent updates as well, that provide the ability to connect to your farm without having to have a site-to-site VPN installed into your datacenter. A major change is the ability to create security groups that act like firewalls to segment your network infrastructure, and keep the servers safe, the same way you would architect your on premise datacenter using firewalls. Now we can have a secure, scalable XenApp farm in the cloud.

What is exciting is the use of Powershell and Cloudformation to automatically launch all fo the XenApp AMI's necessary to create a Medium sized XenApp farm in the cloud. The video below describes the steps required to perform this automation yourself. There are essentially three ways to create a XenApp farm in Amazon, the last of which is using automation scripts.

Build the XenApp servers from scratch

• To build a single XenApp server follow these instructions
• To build a XenApp farm follow these instructions

Launch pre-built XenApp AMI's

• Download the latest listing of Citrix AMIs from here
• Follow the deployment guide
• Login to your Amazon account
• Navigate to EC2 -> AMI's
• Search for the Citrix Public AMIs and launch them

Use automation

• Download and install Amazon EC2 API tools
• Download and install Amazon CloudFormation Tools
• Download, install and run the Citrix Powershell script & CloudFormation Template

See CloudFormation in action

The Citrix Community is powerful!

Using Powershell & Amazon Cloud Formation

I first started building proof of concepts in the Amazon cloud over two years ago. You can read about all of them here. We've come a long way with the recent developments we have been working on with Amazon. Since then, Amazon has released some new tools that make a datacenter in the cloud very apetizing. Recent tools now allow us to build a Cloud Formation template, and when used with a Powershell script, give us the ability to automatically create a complete, scalable, Medium sized XenApp Farm in Amazon VPC. Different XenApp Farm sizes and architecture descriptions can be found here.

Amazon VPC has had some recent updates as well, that provide the ability to connect to your farm without having to have a site-to-site VPN installed into your datacenter. A major change is the ability to create security groups that act like firewalls to segment your network infrastructure, and keep the servers safe, the same way you would architect your on premise datacenter using firewalls. Now we can have a secure, scalable XenApp farm in the cloud.

What is exciting is the use of Powershell and Cloudformation to automatically launch all fo the XenApp AMI's necessary to create a Medium sized XenApp farm in the cloud. The video below describes the steps required to perform this automation yourself. There are essentially three ways to create a XenApp farm in Amazon, the last of which is using automation scripts.

Build the XenApp servers from scratch

• To build a single XenApp server follow these instructions
• To build a XenApp farm follow these instructions

Launch pre-built XenApp AMI's

• Download the latest listing of Citrix AMIs from here
• Follow the deployment guide
• Login to your Amazon account
• Navigate to EC2 -> AMI's
• Search for the Citrix Public AMIs and launch them

Use automation

• Download and install Amazon EC2 API tools
• Download and install Amazon Cloud Formation Tools
• Download, install and run the Citrix Powershell script & Cloud Formation Template

See Cloud Formation in action

The Citrix Community is powerful!

into/out of farms/domains, & changing the password

I previously posted how to launch some pre-built XenApp AMIs in the Amazon cloud. If you launch these, you will eventually want to change the password, and/or move the servers out of and into a different domain. You may even want to join the XenApp server to a different XenApp farm. As you can imagine there is a correct way to do these tasks. Here they are:

Changing the administrator password

If you change the administrator password on the XenApp server, it will break the connection to the SQL Datastore. It can easily be fixed to work again by doing the following:

• Stop the Citrix IMA service (if it is running)
• From a command prompt run the following:

  dsmaint config /user:<computer or domain>\administrator /pwd:<password> /dsn:<path to mf20.dsn file>

• Start the Citrix IMA service

Removing the server from a domain/joining a domain

If you remove the server from the domain, or join a domain, you should recreate the local host cache

• Stop the Citrix IMA service (if it is running)
• From a command prompt run the following:

  dsmaint recreate lhc

• Start the Citrix IMA service

Joining a different farm

• Run the XenApp Role manager: Start -> All Programs -> Citrix -> XenApp Server Role Manager -> XenApp Server Role Manager.
• Edit configuration.
• Leave the current farm.
• Repeat and Join the farm you want to move to.

More information on this topic can be found here.

XenApp Administration & the DSMAINT command can be found here.

It's powerful!

For Citrix XenApp 6.0 and other Citrix products

I previously posted the steps to prepare your own XenApp server in the Cloud. Then I listed the XenApp AMI's that are available for free. Having just gone through the exercise of rebuilding them using XenApp 6.0 on Windows Server 2008 R2, I thought it only made sense to publish the complete list of Citrix AMI's in Amazon EC2 that are available for your free use. Whether you are located in the Americas, Europe or Asia Pacific, Amazon has a platform for you, and Citrix has a XenApp Application Delivery Cloud waiting your use.

These AMI's are used in the Citrix Open Cloud blueprints, which are designed to give cloud providers a complete set of service delivery infrastructure building blocks for hosting, managing and delivering cloud-based computing services using XenApp. The C3 blueprints include reference architectures that combine the individual capabilities of several Citrix product lines to offer a powerful, dynamic, secure and highly available service-based infrastructure ideally suited to large-scale, on-demand delivery of both IT infrastructure and application services.

Click on the image to see the complete list

Citrix AMI Reference Architectures can be found here.

The Citrix Community is powerful!

XenApp Servers Explained

Proper farm design is the most important aspect to having a well performing, scalable farm. This post examines the architecture and design of the Citrix XenApp solution as the number of users/servers requiring applications or desktop access scales.

XenApp Server Roles

XenApp farms have two types of servers: infrastructure servers and worker servers. Worker servers are dedicated to the role of hosting published applications and desktop. Infrastructure servers perform specific functions and do not typically host published applications, except in small farms. Infrastructure servers host functionality that supports the farm, such as the data store, data collector, XML Service, license server, and other services.

• Farm infrastructure services. Data Store, Data Collector, XML Service and Web Interface
• Access infrastructure services. Access Gateway (optional)
• Additional services. Streaming File Server, Provisioning Services (optional), Configuration Logging database (optional), EdgeSight database (optional), and SmartAuditor (optional).

XenApp Farm Roles

• Access Gateway: Provides secure access to Citrix XenApp applications and desktops.
• Web Interface Server: A Web server running Microsoft's (IIS) Web server and Citrix's Web Interface which hosts the Web pages users connect to in order to enumerate and launch published applications.
• Data Collector: Maintains dynamic farm-wide data, including the list of online and offline servers, as well as the load level of each server.
• XML Service: Used by the Web Interface to enumerate published applications from the XenApp farm.
• Database Server (Data Store): Could be another XenApp server (SQL Express) or a server running an enterprise database like Microsoft SQL or Oracle.
• XenApp Worker Server: Servers that host the applications and desktops.

It is common practice to group one or more of these infrastructure services in small farms. In large deployments, each service runs on one or more dedicated servers for scalability and redundancy. The table below categorizes the XenApp deployment model into groups based on the number of users and servers hosting the applications and desktops.

Farm Size Categories

While farm size (small, medium, large, etc...) as determined by the number of servers, can indicate the general category your farm is in, another important factor to consider is the number of user connections. Because applications can scale differently from server to server (some servers might support 100 user connections, others might support only ten), both categories are used to determine the size of the farm.

Small Farm (< 100 Users / < 5 XenApp "Worker" Servers)

For small environments all roles can be placed on a single server. As the number of users increase, it is important to know where the bottlenecks are occurring. Once a bottleneck is identified, move the affected services to their own server.

Medium Farm (< 1000 Users / 5 - 50 XenApp "Worker" Servers)

For medium sized environments dedicating servers for application and desktop hosting presents the best use of computing resources and avoids contention of resources between the users and the infrastructure. As memory or CPU become scarce, more servers supporting applications and desktops can be added easily. At this stage, the resource usage of the infrastructure services, for a farm of this size, is within the bounds of an appropriately sized server.

Large Farm (< 5000 Users / < 50 - 250 XenApp "Worker" Servers)

As the user count increases, the combined overhead of server resolutions and application enumerations (Data Collector), SQL Database resource usage (Data Store) and HTTP requests (Web Interface) will require infrastructure services to be placed on dedicated servers. Administrators should group infrastructure servers and services together when they have similar functions. For example, the XML Server should be grouped with the data collector.

Another benefit of this design is, if the data collector goes down, then the servers hosting published applications would not take on that role, leading to contention. A backup Data Collector is recommended to keep the operations segregated in the event of a DC failure.

Enterprise Farm (> 5000 Users / 250 - 1000 XenApp "Worker" Servers)

In enterprise class deployments, disaster recovery and failover capabilities become critically important, each infrastructure service will be dedicated to one or more servers.

Service Provider Farm (< 100 Users / < 5 XenApp "Worker" Servers)

The CSP XenApp solution provides a scalable and high availability infrastructure designed around multi-tenancy, tenant security and automation. In this module, applications and desktops are virtualized, and subscriber partitions and Active Directory boundaries are defined, which are centrally governed by XenApp systems.

For more information regarding the CSP Reference Architecture see http://www.citrix.com/skb/articles/RDY2524.

For more information on designing and building a scalable XenApp solution for the cloud please reference the following whitepaper. http://www.citrix.com/skb/articles/RDY3028

It's powerful!

Using Wavemaker

I previously posted about the Citrix and Wavemaker partnership. The NetScaler Nitro APIs are available now in NetScaler v9.3. Cloud Providers are deploying NetScaler within their cloud offerings. Cloud Providers can now provide a web-based user interface to their Subscribers, allowing the Subscribers to manage and monitor their NetScaler instances. WaveMaker has built a web application to manage and monitor NetScaler instances when deployed within a cloud environment.

Each Cloud Provider can tailor the application to suit their particular operating requirements and to deliver Provider-specific benefits to their Subscribers. Therefore, we have provided the WaveMaker project (i.e. source code) as a download so you can customize the management application to deliver a customized solution to your Subscribers. The application is customizable using WaveMaker Studio, a visual environment for developing enterprise cloud applications. Wavemaker Studio uses the NetScaler Nitro APIs in the NetScaler Cloud Management Application to retrieve information from NetScaler instances and configure NetScaler instances.

The solution has the following components

• Citrix NetScalers running in the cloud
• Wavemaker Studio
  • MySQL
  • Tomcat or other Java Server
  • NetScaler Cloud Management Application project
    

Benefits

• An easy to use and deploy development/test environment
• Provides end-users a customizable configuration, management and monitoring UI
• View, Create and terminate virtual instances in the cloud
• Manage multiple Virtual NetScalers

How it works

1. Import the NetScaler Cloud Management Application project into Wavemaker Studio
2. The NetScaler Nitro API is used to retrieve monitoring information and send down configuration information
3. Use Wavemaker Studio to customize NetScaler Cloud Management Application
4. Use Wavemaker Studio to generate a WAR file
5. Use Wavemaker Studio to deploy to Tomcat server
   

Watch it in action

Download the latest release of Wavemaker Studio here

Download the Citrix Cloud Management Application for Wavemaker Studio here

Download the Citrix NetScaler Cloud Management Documentation here

Wavemaker is Citrix Ready Certified!

Citrix NetScaler

It's powerful!

Citrix and Sourcefire together

I previously posted about the Citrix and Sourcefire partnership. Sourcefire and Citrix have partnered together to provide a unique approach to securing and protecting this critical infrastructure. Through this collaboration, Sourcefire can enhance Citrix NetScaler security policies on the fly in near-realtime in response to network security events.

The Sourcefire Intrusion Prevention integration with Citrix NetScaler provides Intrusion Prevention and Detection capabilities for NetScaler where there may be compliance requirements for IDS/IPS. So far, we know that PCI, FISMA and SOX all require Intrusion Detection Systems.

The solution has the following components

• Citrix NetScaler front-ending web applications and web sites
• Sourcefire 3D Sensor
• Sourcefire Defense Center

Benefits

• Take immediate action to manage and minimize web application security risk with automated policy Changes
• Extend your investment in your current solution and enhance your network security with greater levels of protection
• Lower your TCO with flexible deployment options and the ability to tune protection to minimize damage and the time and effort required for response

How it works

1. Sourcefire 3D Sensor detects an attack
2. Sourcefire Defense Center creates a policy and sends it to Citrix NetScaler through the API
3. Citrix NetScaler applys the policy and blocks the attack

Watch it in action

Sourefire is Citrix Ready Certified!

Citrix NetScaler

It's powerful!

Simplifying complex certificate and key management

If you are at all concerned about data security, you are familiar with certificates. You know, those cryptographic puzzles you have to deal with to get HTTPS running on your web sites. The complexity of certificates might not change anytime soon, but the way to manage them has been simplified. This should be of concern now that websites are required to migrate from 1024-bit keys to 2048-bit keys. Citrix and Venafi have partnered to create a turnkey certificate and key management solution that eliminates enterprise risks associated with Key and Certificate management while also enhancing network and application performance. The result is improved security, compliance and operational efficiency.

Venafi works intricately with the SSL offloading, Citrix Access Gateway Enterprise Edition (SSL VPN) and Application Firewall features integrated in Citrix NetScaler. NetScaler has been tightly integrated with Venafi for automated key generation and certificate distribution.

Administrators can set up NetScaler hardware and virtual appliances to work closely with Venafi in the generation of keys, configuration of certificates, provisioning and installation of these on NetScaler. With Venafi and NetScaler, organizations can scale encryption deployments and management functionality across the enterprise. Venafi support and manages hundreds of thousands of keys and certificates at many of the world's most prestigious Global 2000 organizations while NetScaler powers over 10 gigabits of SSL traffic per appliance with 2048 bit keys.

The solution has the following components

• Citrix NetScaler front-ending web applications and web sites
• Venafi Director Certificate Manager
  
  

Benefits

• Enhanced security
• Reduced operational complexity
• Reduced regulatory and compliance risks
• Increased network and operational performance

How it works

1. Venafi discover's certificates in your network
2. Venafi validates inventory daily
3. Venafi monitors for & reports on inventory expirations, policy violations
4. Venafi acts as the intermediary to manage the enrollments, approvals and issuances of certificates
5. Venafi automatically issues, uploads and binds new certificates in the Citrix NetScaler
6. Venafi regularly rotates certificates, providing increased security agility

Watch it in action

Venafi is Citrix Ready Certified!

Citrix NetScaler

It's powerful!

Analyze Risk and Adapt

Citrix and RSA have partnered to integrate RSA's Adaptive Authentication methods with NetScaler's AAA and Access Gateway Enterprise Edition (SSLVPN) systems to protect portals, applications, and networks. This also works with Citrix applications and technologies like XenDesktop and XenApp providing secure, remote access to user enterprise applications.

Solution

A common deployment topology is shown with the NetScaler appliance in the DMZ providing access to the RSA Adaptive authentication service components in the trusted zone. Other deployment topologies are possible depending on whether the RSA Adaptive Authentication components are located on-premise or hosted.

The solution has the following components:

• Citrix NetScaler - Version 9.2 or later running on either MPX hardware appliances or VPX virtual appliances. This provides the primary authentication service against the Identity provider for the enterprise and integrates with RSA AA to provide the enhanced authentication services. NetScaler also load balances RSA AA components using RADIUS load balancing for the RADIUS adapter and HTTP load-balancing schemes for the Adaptive Authentication adapter and the Data Protection Server components.
• Identity Provider: Provides primary authentication services for the user. This is usually Active Directory or equivalent LDAP based system though NetScaler supports multiple Identity providers.
• RSA Adaptive Authentication Server (Hosted or On-Premise): Provides the secondary authentication of users based on behavioral and other inputs.

Benefits

Integrating the advanced Authentication features in RSA's Adaptive Authentication services with Citrix NetScaler substantially enhances the security of the enterprise and cloud applications delivered through the NetScaler while providing a seamless end-user experience.

How it works

1. User attemtpts to access a system protected by Adaptive Authentication
2. User's activity is analyzed by the RSA Risk Engine and is assigned a Risk Score
3. RSA Policy Manager determines Risk using Behavioral Analysis
4. User is directed to "Step-Up Authentication"
   

Watch it in action

RSA Adaptive Authentication is Citrix Ready Certified!

NetScaler Web Application Firewall

It's powerful!

Turn-key Web Application Security Solution

Anti-virus, network firewalls and malware protection alone do not protect web applications or websites from hackers. Whether it's politically motivated attacks from rogue states, or financially motivated attacks, there is a continuous stream of new security threats. With approximately 75% of all Internet attacks targeting web applications, it's critical for companies to be prepared to defend their information assets diligently. This is becoming even more important, and more challenging, as these applications are developed and deployed within cloud environments.

Solution

I have been waiting for this type of solution for a long time. I always thought the best solution would be able to discover the weaknesses of a web application by scanning, and then use the results of that scan to block hackers from exploiting the vulnerabilities. It's finally here. The Cenzic / Citrix integration does just that by protecting websites against hacker attacks by detecting and then protecting them against a broad range of threats. Cenzic's web testing (vulnerability scanning) solutions combined with the Citrix's web application firewall is a powerful combination that prevents breaches and secures websites for both on-premise and cloud based application deployments. The integration provides a "1-2 punch" against website hackers, as Cenzic identifies the website weaknesses and Citrix blocks against them.

Benefits

• Turnkey Web Application Security Solution
  • Reduces risk by identifying and blocking vulnerabilities in websites and web applications that hackers exploit
  • Integrated solution allows faster set-up of NetScaler WAF and easier on-going web application security
  • Does not require deep security expertise
• Compliance
  • Citrix and Cenzic provide compliance testing and reports to meet GLBA, PCI, HIPAA, SOX & other regulations
• Solutions for companies that need to protect their data
  • On-premise or SaaS solutions from Cenzic and Citrix
  • Entry-level to enterprise—all industries
  • Protects customer information, meets government regulations and secures web commerce from hackers

How it works

1. Websites are tested for security flaws using Cenzic
2. Results are imported into the Citrix Web Application Firewall (WAF)
3. The Citrix WAF blocks attacks directed at those security flaws
4. Users routinely run website security tests to stay ahead of the hacker curve
   

Watch it in action

Cenzic is Citrix Ready Certified!

NetScaler Web Application Firewall

It's powerful!

The Citrix Blogs feeds have changed. Please update your feed readers to use the new feeds at http://blogs.citrix.com.

This feed will no longer be updated. We apologize for the inconvenience.

Eliminates response time issues

The NetScaler provides the ability to ensure the response from an application in spite of server capacity or processing speed, called SureConnect. SureConnect eliminates the gap between the client expectations and their browsing experience and improves the real and perceived availability of a Web site.

You can use the SureConnect feature of the Citrix® NetScaler® appliance to service all incoming connections with either the requested content or a custom Web page that displays information about a delay in the request being serviced.

When servers are overloaded with the requests, the servers might either respond slowly or not at all. The SureConnect feature enables the NetScaler appliance to detect and compensate such conditions by ensuring that every client request gets serviced in some way, such as either a custom Web page or actual content is sent to the client.

SureConnect is activated when the response time or maximum server connections to a client request exceeds a limit that you have set. The SureConnect browser window displays one of the following:

• A progress bar with the amount of time remaining until the requested content will be available.
• Alternate Web content of your choice (alternate page).
• Both a progress bar and alternate page.
• Complete custom content of your choice.

When the load balanced servers become responsive again, the original request for content is served.

SureConnect is advantageous in the following situations:

• Full server queue: The server can respond fast, but there are too many users. This results in the server's queue being full and unable to process additional client requests. In this situation, the SureConnect window is displayed, showing the time left until the content will be available. The alternate page is displayed under the progress bar, if an alternate page has been configured.
• Large response delay: The server response is slow. If a Web server does not respond to a client request quickly, the user will leave the site. When the predicted delay reaches a configured time threshold, the SureConnect window displays the progress bar and the optional alternate page in the client browser.
• Client time-out: When the client requests content from a very slow Web site, a time-out message displays in the client browser, and the content is not delivered. The user may leave the site. The appliance stores the request until the server is no longer busy and delivers the requested content to the client.
• Server experiencing a traffic surge: The server typically responds quickly, but the current load of open connections is greater than the server capacity to serve them. Therefore, the server response is delayed. A SureConnect window is displayed in the client browser, showing the time left. The alternate page from the server is also displayed if it has been configured.

To set SureConnect on a virtual server by using the NetScaler command line

set lb vserver <vServerName> -sc <Value>
Example

set lb vserver Vserver-LB-1 -sc yes

To set SureConnect on a virtual server by using the configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane appears, select the virtual server for which you want to configure SureConnect (for example, Vserver-LB-1), and then click Open.
3. In the Configure Virtual Server (Load Balancing) dialog box, click the Advanced tab.
4. Select the SC check box, and then click OK.

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download the Citrix Load Balancer

It's powerful!

Directing Requests Based on Priority

The NetScaler provides the priority queuing option for prioritizing client requests to serve important requests first. The NetScaler places the requests in a queue based on the configured priority, thereby providing an uninterrupted flow of transactions through dynamic traffic flows.

The priority queuing feature also lets you filter incoming HTTP traffic on the basis of categories that you create and define, and prioritize those HTTP requests accordingly. Priority queuing directs high-priority requests to the server ahead of low-priority requests, so that users who need resources for important business uses receive expedited access to your protected Web servers.

To set priority queueing on a virtual server using the NetScaler Load Balancer command line

set lb vserver <vServerName> -pq <Value>
Example

set lb vserver Vserver-LB-1 -pq yes

To set priority queueing on a virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure priority queuing (for example, Vserver-LB-1), and then click Open.
3. In the Configure Virtual Server (Load Balancing) dialog box, click the Advanced tab.
4. Select the PQ check box, and then click OK.

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download the Citrix Load Balancer

The Citrix Community is powerful!

Redefining traditional Application Delivery Controllers (ADCs)

Citrix Systems today announced NetScaler® SDX, a groundbreaking new virtualized networking platform designed from the ground up to serve as the "front door" for virtual datacenters and clouds. With the new NetScaler SDX platform, customers can now run numerous virtualized NetScaler instances on a single purpose-built physical appliance with full multi-service, multi-tenant support. This innovative new architecture helps customers move from traditional application delivery to far richer "service delivery" required by the adoption of cloud computing, and growing user demand for new services delivered to a wide range of consumer devices.

Creating a service delivery fabric requires understanding and redefining traditional application delivery controllers (ADCs), such as Citrix® NetScaler®, in a services context. For example, application availability becomes service availability, while application optimization becomes service optimization.

More than just a name change, the transition to a service delivery fabric needs infrastructure and user-centric delivery capabilities that enable the delivery of services as well as applications. Since this fabric will become the foundation of enterprise IT and an essential element of an organization's competitive differentiation, it needs enterprise-class power, flexibility and manageability too.

In some instances developers will be able to meet the new requirements by transforming an existing capability, typically by extending its scope of coverage. In other cases, though—such as with the need for broader and deeper visibility—developers are likely to have to create entirely new capabilities.

Highlights

• NetScaler SDX is a groundbreaking new platform that uses advanced hardware and software virtualization to run multiple "virtual NetScaler instances" on a single hardware appliance - each optimized for different apps, services, sites and customers.
• Each virtual instance is a complete NetScaler environment, incorporating all the functions needed to deliver apps and services with the best performance, security and reliability, including load balancing, caching, compression, SSL VPN, SSL offload, federated identity and app firewall.
• NetScaler SDX provides full network, CPU, memory and SSL acceleration isolation for each virtual NetScaler instance, as well as per-instance (rather than per-appliance) high availability, version control and lifecycle management.
• NetScaler SDX incorporates SR-IOV (single root I/O virtualization) capabilities from Intel to provide fast, multi-tenant, multi-service appliance capable of running at native wire speeds.
• The next-generation NetScaler SDX architecture provides the foundation for further consolidation of adjacent service delivery capabilities such as WAN optimization, network security and virtual desktop delivery.
• A single control plane within the NetScaler SDX platform provides unified provisioning, monitoring and management of all virtual NetScaler instances, while also enabling administrative privileges to be delegated per instance.
• The NetScaler SDX 17500, 19500 and 21500 models share a common hardware platform with the existing NetScaler MPX 17500, 19500 and 21500 models, enabling MPX appliances to be easily upgraded in the field to all the new NetScaler SDX functionality.

Availability

NetScaler SDX platforms include the SDX-17500, SDX-19500 and SDX-21500, offering performance up to 50Gbps, and will be available in April 2011.

Overview

Architecture

Read the NetScaler for Multi-Tenancy whitepaper here

Read the NetScaler Service Delivery Whitepaper here

The Citrix Community is powerful!

Identity Validation

If you need to augment your security with Two-Factor authentication, the AuthenWare™ solution that will amaze you. It is fun to watch, and fun to use. AuthenWare is a leading cybersecurity software vendor based in Miami, Florida. Their innovative technology enables organizations to deliver the highest levels of security to enterprise applications, website, as well as any other form of transaction that engages a user.

AuthenWare for Citrix ensures simple and secure remote access to XenApp-delivered corporate applications while providing strong security and authentication. AuthenWare is a second-factor authentication technology which is very accurate and completely transparent to end-users. The product uniquely identifies the rightful owner of username and password credentials by combining keystroke dynamics with a series of behavioral and environmental heuristics to make user authentication and validation easy, cost-effective and reliable.

How it works

AuthenWare™ for Citrix incorporates a breakthrough, multi-dimensional approach to validating identity. Using a series of security algorithms that record and measure a person's unique keyboard typing patterns, as well as other behavioral and environmental heuristics, the product creates a personal security pattern - the AuthenWare Singularity Pattern™ - that is as unique as the person's DNA.

Based on a series of statistical singularities (aspects that distinguish one person from others), the pattern can even adapt to nuances in behavior such as those caused by medication, injury or fatigue. Remote users attempting to access published applications in the Citrix XenApp Server are authenticated using the AuthenWare Singularity Pattern through a secured AuthenWare login page. Upon successful authentication, the user is seamlessly passed to Citrix and allowed to proceed. AuthenWare for Citrix is certified "Citrix Ready" and supports any 32-bit or 64-bit XenApp-managed client application.

With AuthenWare for Citrix, XenApp customers can be sure that:

• Only authorized users are granted access to applications or data
• Invalid access attempts are detected and prevented
• Stolen credentials are rendered useless
• Authentication is totally transparent to the user
• XenApp integration is "out-of-the-box"
• The software is proven, and is certified by both International Biometric Group (IBG) and Common Criteria

Read more about the Citrix / Authenware partnership here.
Read about the Citrix Ready certification here.
Vote for them in the Security Challenge.
Read more about Authenware here.

It's powerful!

With Unlimited ICA Connections

I previously posted how to get 1-Year Licenses for NetScaler and followed up with a post on how to get Licenses for other Citrix Products through the Citrix Ready program. Starting with NetScaler release 9.2, all MPX's and VPX's include a platform license for unlimited AGEE access to XenApp and XenDesktop. However, some customers have trouble finding the unlimited access license for the ICA Proxy in their MPX or VPX. Even the SE-issued license doesn't show the unlimited access for ICA.

Background

The reason this license exists is because the AGEE functionality counts ICA proxy only connections against the CCUs. The traditional Secure-Gateway (on IIS Server) never had a concept of CCUs to count against and the legacy Net6 - Access-Gateway Standard and Advanced also did not count the ICA proxy only connections against any CCU count. The resolution for the NetScaler version of Access-Gateway (AGEE) was to create this license to make the ICA proxy only connection's "free" in the sense that you do not have to pay for the CCUs with any kind of access license (it's a compatibility thing to match the other products). This is why the license is separate from the platform license and the feature license. For the record, the NetScaler still does count these connections, the limit is just set to 10,000, assuming I guess that an individual NetScaler will not exceed that count (nor be needed), although I suspect it might be possible on larger platforms to better than 10,000 in which case the NS will throttle connections until it falls below 10,000.

There are four licenses that the customer may have

1. NetScaler Platform: Proper retail NetScaler (physical box) license (which is responsible for enabling all necessary features + 5 SSL VPN connections) is allocated by default to Hostname "ANY" in MyCitrix website and you cannot change this allocation. This is different from internal licenses (see 2).
2. NetScaler Features: The remainder of NetScaler licenses (Internal/Partner USE/DEMO/EVALUATION or VPX) need to be allocated to Host ID (MAC) of the appliance (articles CTX121062 page 11 and 16 and article CTX122426 page 9 and 22). The function (AGEE) is licensed/enabled by the MAC or HostID of the NetScaler. Two licenses are required for HA.
3. Access Gateway CCU license: To increase SSL VPN concurrent usage, CCUs, you must upload an AG Universal License. This license floats across HA pairs. This license needs to be allocated to the NetScaler Licensing Hostname, which is configured in /nsconfig/rc.conf file. This is NOT necessarily the same hostname as the created by 'set ns hostname' unless specifically made so by the customer. By default the hostname in /nsconfig/rc.conf is "ns".
4. Access Gateway ICA license: To increase connections for ICA Connections you must upload an AG Platform License (to increase ICA connections up to 10000). This license floats across HA. This license needs to be allocated to the NetScaler Licensing Hostname, which is configured in /nsconfig/rc.conf file. This is NOT necessarily the same hostname as the created by 'set ns hostname' unless specifically made so by the customer. By default the hostname in /nsconfig/rc.conf is "ns". Please reference article http://support.citrix.com/article/CTX125567.

   If you have an issue with hostname allocated for AG Platform License, you will see something like 34 (CITRIX) Wrong hostid on SERVER line for license file: In /var/log/license.log.

Frequently asked questions

Q: Is it possible to know whether the unlimited access has already been included in the NETSCALER Platform license (like license of VPX-3000, MPX-7500, etc...)? Or, we (or our partners/customers) need to do

anything to retrieve that license?"
A: Unlimited remote ICA access is an entitlement of all Access Gateway or NetScaler appliance purchases (MPX or VPX). It is not included in the NetScaler Platform license. You need to retrieve the Access Gateway Platform license separately which enables the entitlement. This is in addition to the NetScaler Platform license. Both need to be present on the appliance.

Q: Do I need to install the AGEE platform license into a NetScaler?
A: Yes, you need to install the Access Gateway Platform license on NetScaler .

Q: If I set up the AGEE Vserver in BASIC MODE, there is no need for any AGEE license (platform or CCU) installed in that NetScaler?
A: If you create an AGEE vServer in Basic Mode without the Access Gateway Platform license, it will consume Access Gateway Universal Licenses. (Note: NS Standard and Enterprise come with 5 AGEE Universal CCUs per appliance and NS Platinum comes with 100 AGEE Universal CCUs per appliance.)

Q: Can I ignore the "show license" information, stating that "Maximum ICA User=0"?
A: You cannot ignore the 'Show License' information if it shows 'Maximum ICA User=0'. If that is the case you have not applied an Access Gateway Platform license or the Access Gateway Platform license was not recognized by the system and any Access Gateway vServers will use AG Universal CCUs.

Q: If AGEE platform license is needed specifically in the NetScaler, is it the "CNS_AGEE_Server_Retail.lic"?
A: The confusion here may be because prior to AGEE / NS 8.1, there was an Access Gateway Platform license that enabled the base Access Gateway functionality on NetScaler. However, this older 'Platform' license is no longer required because all editions of NetScaler now ship with the base AG functionality already enabled. However, you need to apply the new Access Gateway Platform license if you plan to use 'Basic' (ICA Proxy / SG Mode-only) vServers. If you plan to use 'SmartAccess' (SSL VPN, SmartAccess, Clientless VPN, etc) vServers you need to apply an Access Gateway Universal CCU license.

Read more in this article, CTX129117

It's powerful!

Scalable XenApp in the Cloud

I previously posted how to create a XenApp 5.0 server and a XenApp 6.0 server
in Amazon EC2. A one-off server is good for starters, but you might
eventually want to build a "scalable" XenApp farm in the cloud. Having a XenApp farm that scales requires that the components of XenApp be broken out and install on their own servers. Those components being the License Server, Database Server, XenApp Server, XML Server and Web Interface Server. You will also need a Windows Domain Controller. A complete set of XenApp farm AMI's have been created for your use, in our Citrix C3 Blueprints section of the Citrix Community site.

The following are the instructions to install the components of a scalable XenApp farm in Amazon EC2. The instructions are for the Amazon EC2 Cloud, although they could be adapted for use with any cloud provider. Note: These instructions are for the Amazon EC2 cloud; however, you may want to install these AMI's inside of the Amazon VPC for tighter security.

Domain Controller (dc.xa6.com)

• Launch Amazon AMI for W2K8R2
• Right-Click to get administrator password using your key
• RDP to the instance
  • From your local computer command prompt, mstsc /console
• Change the password:
  • Administratrive tools -> Computer Management -> Users -> Administrator -> right click -> Set Password
• Set Ec2Config Service settings:
  • Program Files -> Amazon -> Ec2ConfigSetup -> Ec2ConfigServiceSettings.exe
  • Uncheck (disable) set computer name
  • Uncheck (disable) set password
• Set Computer Name
  • My Computer --> right click --> Properties --> Computer Name --> Change --> dc
• Use dcpromo to turn it into a Domain Controller
• Create a new forest xa6.com
• Get the internal IP Address - this will be used by all the other XenApp AMI's as the DNS address

License Server (lic.xa6.com)

• Launch Amazon AMI for W2K8R2
• Right-Click to get administrator password using your key
• RDP to the instance
  • From your local computer command prompt, mstsc /console
• Change the password:
  • Administratrive tools -> Computer Management -> Users -> Administrator -> right click -> Set Password
• Set Ec2Config Service settings:
  • Program Files -> Amazon -> Ec2ConfigSetup -> Ec2ConfigServiceSettings.exe
  • Uncheck (disable) set computer name
  • Uncheck (disable) set password
• Set Computer Name
  • My Computer --> right click --> Properties --> Computer Name --> Change --> lic
• Set DNS address in Network Settings to point to the dc.xa6.com internal IP Address
• Join the xa6.com domain
• Download the XenApp 6.0 .iso and mount with Virtual Clone Drive
• Install XenApp Licensing
• Apply License file
• Create an Amazon Volume, and assign drive letter D:
• Copy the XenApp 6.0 .iso and Virtual Clone Drive to drive D:
• Create an Amazon Snapshot for drive D:
  • Name it Citrix XenApp 6.0

Database Server (db.xa6.com)

• Launch Amazon AMI for W2K8R2
• Right-Click to get administrator password using your key
• RDP to the instance
  • From your local computer command prompt, mstsc /console
• Change the password:
  • Administratrive tools -> Computer Management -> Users -> Administrator -> right click -> Set Password
• Set Ec2Config Service settings:
  • Program Files -> Amazon -> Ec2ConfigSetup -> Ec2ConfigServiceSettings.exe
  • Uncheck (disable) set computer name
  • Uncheck (disable) set password
• Set Computer Name
  • My Computer --> right click --> Properties --> Computer Name --> Change --> lic
• Set DNS address in Network Settings to point to the dc.xa6.com internal IP Address
• Join the xa6.com domain
• Do not install XenApp on this server
• Start Services: SQL Server, SQL Server Agent, SQL Server Browser (Set to automatic)
• Launch Microsoft SQL Server Management Console
  • Database -> right click -> new -> xenappdb

XenApp Server (xa1.xa6.com)

• Launch Amazon AMI for W2K8R2
• Right-Click to get administrator password using your key
• RDP to the instance
  • From your local computer command prompt, mstsc /console
• Change the password:
  • Administratrive tools -> Computer Management -> Users -> Administrator -> right click -> Set Password
• Set Ec2Config Service settings:
  • Program Files -> Amazon -> Ec2ConfigSetup -> Ec2ConfigServiceSettings.exe
  • Uncheck (disable) set computer name
  • Uncheck (disable) set password
• Set Computer Name
  • My Computer --> right click --> Properties --> Computer Name --> Change --> xa1
• Set DNS address in Network Settings to point to the dc.xa6.com internal IP Address
• Join the xa6.com domain
• Creat a volume from the snapshot created previously
• Attach and mount the volume to drive letter d:
• Install XenApp
  • Do not install XML Integration
  • Join Database -> db.xa6.com, xenappdb
• Create a farm (xa6farm)
• Publish applications
• Configure Policy
  • Launch Desktop Delivery Controller
  • DDC -> Policies
  • License server hostname -> lic
  • License server port -> 27000
  • Trust XML requests
  • XenApp product edition (should match license)
  • XML Server and port
  • Update policy
    • Launch command prompt as administrator
    • gpupdate /force

XML Server (xml.xa6.com)

• Launch Amazon AMI for W2K8R2
• Right-Click to get administrator password using your key
• RDP to the instance
  • From your local computer command prompt, mstsc /console
• Change the password:
  • Administratrive tools -> Computer Management -> Users -> Administrator -> right click -> Set Password
• Set Ec2Config Service settings:
  • Program Files -> Amazon -> Ec2ConfigSetup -> Ec2ConfigServiceSettings.exe
  • Uncheck (disable) set computer name
  • Uncheck (disable) set password
• Set Computer Name
  • My Computer --> right click --> Properties --> Computer Name --> Change --> xml
• Set DNS address in Network Settings to point to the dc.xa6.com internal IP Address
• Join the xa6.com domain
• Creat a volume from the snapshot created previously
• Attach and mount the volume to drive letter d:
• Install XenApp
  • Select XML Integration
• Register XML on port 8080
  • Run command prompt as administrator
  • ctxxmlss /u
  • ctxxmlss /r8081
  • restart XML service
• Configure and join the xa6farm & database on xa1.xa6.com
  Note: re-run discovery on the DDC to make sure it shows up in the farm
• To specify the data-collector
  • DDC -> XenApp -> Farm -> zones -> Default zone -> "Most Preferred" is the data collector

Web Interface (wi.xa6.com)

• Launch Amazon AMI for W2K8R2
• Right-Click to get administrator password using your key
• RDP to the instance
  • From your local computer command prompt, mstsc /console
• Change the password:
  • Administratrive tools -> Computer Management -> Users -> Administrator -> right click -> Set Password
• Set Ec2Config Service settings:
  • Program Files -> Amazon -> Ec2ConfigSetup -> Ec2ConfigServiceSettings.exe
  • Uncheck (disable) set computer name
  • Uncheck (disable) set password
• Set Computer Name
  • My Computer --> right click --> Properties --> Computer Name --> Change --> xml
• Set DNS address in Network Settings to point to the dc.xa6.com internal IP Address
• Join the xa6.com domain
• Creat a volume from the snapshot created previously
• Attach and mount the volume to drive letter d:
• Install Web Interface
• Launch Web Interface Management:
  • Create site -> point server farm to xml.xa6.com port 8080
• Install Secure Gateway according to these instructions
• Change Secure Access to Gateway Direct
• Grab an Elastic IP Address from Amazon and assign it to this server

Additional XenApp Server (xa2, xa3, xa4, etc).

• Install XenApp Server
• Join farm at xa1.xa6.com

It's powerful!

XenApp Secure Gateway in the cloud

I previously posted how to create a XenApp 5.0 server and a XenApp 6.0 server
in Amazon EC2. In order to secure communications with that server, you will need to install Secure Gateway. A secure gateway XenApp 6.0 AMI already exists for your use, in our Citrix C3 Blueprints section of the Citrix Community site.

The following are the instructions to install Secure Gateway on the XenApp server. The instructions are for the Amazon EC2 Cloud, although they could be adapted for use with any cloud provider. Secure Gateway doesn't use the default certificate generated by IIS, so you will first create a Certificate Authority (CA) server to generate come certs. Specifically a CA Cert and a Server cert. Then you can install Secure Gateway on the XenApp server.

Certificate Authority

• Create a Server running WIndows Server 2008R2
• Name the computer xa6
• Install Certificate Services
• Download the CA cert from http://localhost/Certsrv
• Create a Certificate Request using IIS Manager. (Must be a FQDN, xa6.com)
• Submit request using http://localhost/Certsrv, Request -> Advanced -> Submit using base64 -> paste -> Submit
• Issue request using Certification Authority Manager
• Download Server Certificate from http://localhost/Certsrv -> View Request -> base64
• Import Server Certificate into Certificates MMC snap-in -> Computer -> Local -> Personal
• Export CA and Server certificates from MMC Certificates snap-in, as .pfx files, with exportable key

XenApp Server

• Launch the MMC Certificates snap-in:
  • Import (.pfx) CA cert into Certificates mmc snap-in -> Computer -> Local -> Trusted CAs
  • Import (.pfx) Server Cert into Certificates mmc snap-in -> Computer -> Local -> Personal
• Create a Web Interface site in XenApp Web Interface Management
• Use IIS as the default
• Reconfigure XenApp to use port 8081 for XML
  • Run command prompt as administrator
  • ctxxmlss /u
  • ctxxmlss /r8081
  • iisreset
• Open IIS Management
  • Sites -> Bindings -> Add -> SSL port 444.
  • Use the xa6.com Server cert. (You may have to install IIS Management service)
  • iisreset from a command prompt
• Make an entry in the local hosts file
  • <internal Amazon IP Address> xa6.com xa6
  • Save the file
  • Test the connection locally: https://xa6.com:444
• XenApp Web Interface - Gatewway Direct
  • Launch XenApp Web Interface Management
  • Web Interface -> Secure Client Access -> Gateway Direct
  • FQDN = xa6.com
  • Next -> STA=http://localhost:8081/scripts/ctxsta.dll

Install Secure Gateway

• Download the XenApp .iso and mount using Virtual Clone Drive
• Install Secure Gateway from the XenApp media
  • Use the xa6.com Server Certificate
  • Use Port 443
• STA Details
  • localhost
  • Path -> /scripts/ctxsta.dll
  • ID -> (automatically determined)
  • Uncheck "Secure Traffic between STA and SG"
  • Don't use default port, use port 8081
• Access Options details
  • Indirect.
  • Uncheck "Intalled on this computer"
  • FQDN -> xa6.com
  • TCP Port: 444.
  • Check "Secure traffic between the WI and SG"
• Disable setaltaddress service (if installed)
• Open the windows firewall for port 443

Test from client machine

• Make an entry in local client machine's hosts file
• Generally located in c:\Windows\System32\drivers\etc
• <external Amazon ip address> xa6.com xa6
• save the hosts file
• Open a browser, and enter https://xa6.com

It's powerful!

Build Your Own XenApp 6.0 in the Cloud

I previously posted how to create a XenApp 5.0 server in Amazon EC2. Now that XenApp 6.0 is released, some folks might want to build XA 6.0 in the cloud. We have already built "ready to use" XenApp servers in Amazon EC2. Just search for Citrix in the AMI section and launch them. You can also find the list of AMI's here, which are built for use with the Citrix C3 Blueprints.

The following are the instructions to create a XenApp 6.0 server in the cloud. The instructions are for the Amazon EC2 Cloud, although they could be adapted for use with any cloud provider.

Creating a XenApp 6.0 Server in the cloud (Amazon EC2 for example):

Windows Prep

• Sign in to the Amazon Web Services Console
• Select the Amazon EC2 Tab
• Select Images --> AMIs
• View Amazon Images
• Search for WIndows Platforms --> 2008R2
  • XenApp 6.0 runs on Windows 2008R2
• Launch the AMI
  • Make sure you launch it in the same Availability Zone as your other AMI's and volumes
• Right-Click to Get Administrator Password
• RDP to the instance (command prompt, mstsc /console)
• Change password (Administrative Tools --> Computer Management --> Users --> <user> right click --> Set Password.
• Set Ec2Config Service Settings. Program Files --> Amazon --> Ec2ConfigSetup --> Ec2ConfigServiceSettings.exe.
  • Uncheck (disable) Set Computer Name.
  • Uncheck (disable) Initialize Drives
  • Uncheck (disable) Set Password, both random and feature after sysprep.
• Set Computer Name. My Computer --> right click --> Properties --> Computer Name --> Change --> <new computer name>.
  • You will use this hostname to apply for a XenApp license, so make note of it.
• Restart.

XenApp 6.0 Install

• Download the XenApp 6.0 ISO Image from the Citrix download site
  • XenApp 6.0 for W2K8R2 can be downloaded from here
• Mount the XenApp 6.0 ISO Image using Virtual Clone Drive
• Install XenApp 6.0 from the ISO image
• Install hotfix CTX126123 (XA600W2K8R2X64002.MSP).
• Install hotfix CTX125388 (XA600W2K8R2X64001.MSP).

Launch XenApp Delivery Services Console

• Publish Notepad, IE and Desktop
• Auto populate the Domain
  • AMC -> Citrix Resources -> Configuration Tools -> Web Interface -> XenApp -> Configure Authenticaiton methods -> Explicit -> Properties -> Authentication Type -> Settings -> Display Domain Box - Prepopulated.
  • Hide Domain Box.

Launch XenApp Web Interface Console

• Create Web Interface (Set as default for IIS)
• Create XenApp Service
• Set Client Secure Access mode to "Alternate" for EC2 Images only (not VPC images)
• Upload SetAltAddressService.exe to c:\drive
• Install SetAltAddressService.exe
  • From command prompt: c:\windows\Microsoft.NET\Framework\v2.0.*\installutil.exe c:\setAltAddressService.exe
• Username/password: <domain>\Administrator, <password>
• Set the service to start Automatically.

Clone the Server

• From the Amazon Web Services Console select Instances under navigation
• Highlight the server you just created
• Right-Click "Create Image (EBS AMI)"

Make it public

• When the building of the AMI (cloning) is finished, set permissions to public so others can launch it (unless you want to keep it a secret)

Note: To change the name of the server to eliminate duplicate hostnames & licensing

• If this is a single server farm you can just rename the server and get a new license file. Removing the server from the farm would have no affect as it's the only host in the farm.

It's powerful!

Citrix NetScaler for Lync Server 2010

Microsoft® Lync™ ushers in a new connected user experience transforming every communication into an interaction that is more collaborative, engaging, and accessible from anywhere. Citrix® NetScaler® improves the Lync server performance and end user experience through its advanced Application Delivery Controller techniques such as Load Balancing, SSL Bridging & Offload, Advanced Health Monitoring, TCP & SSL Multiplexing, GSLB and High Availability. Deployed in front of the Lync Edge Servers in the DMZ and between the Lync Edge and Front End servers on the internal network, Citrix NetScaler enables a new level of scalability, performance, security, availability and ease of use for Microsoft Lync. At the same time, NetScaler reduces time to deployment, simplifies management and reduces the cost of operations.

Load Balancing

Citrix NetScaler's advanced Multiplexing software distributes traffic across multiple Lync servers to improve performance and ensure availability. When a Lync server goes down, Citrix NetScaler routes traffic around it to other servers that are up and running. Citrix NetScaler Load Balancing defaults to the Least Connections algorithm, but can also be setup to use Round Robin, Least Response Time, Hash Method, Least Bandwidth, Custom Load and Token based algorithms among others.

SSL Bridging & SSL Offloading

SSL bridging enables the NetScaler to bridge all secure traffic directly to the Lync server, without having to import Certificates. When using SSL Briding, NetScaler does not offload the Certificate processing from the Lync servers, enabling a new level of ease-of-deployment and ease-of-use.

A Citrix® NetScaler® appliance configured for SSL Offloacing accelerates SSL transactions by offloading SSL processing from the Lync servers. Configuring SSL offloading requires an SSL certificate and key pair. Other related SSL capabilities include managing certificates, CRLs, client authentication and SSL Policies.

Advanced Health Monitoring

The Citrix NetScaler tracks the state of each Load Balanced Lync server in real-time, so that it can divert traffic from an unresponsive Lync server to a server that is responding. Lync servers are removed from the list of available servers, until they become responsive again. Citrix NetScaler allows for the creation of custom monitors specific tor Lync servers.

GSLB

The Citrix NetScaler provides Global Server Load Balancing for disaster recovery and ensures continuous availability of applications by protecting against points of failure in a Wide Area Network (WAN). GSLB performs Load Balancing across geographically disparate data centers, by directing traffic to the closest or best performing data center.

High Availability

Citrix NetScaler High Availability (HA) provides uninterrupted operation for Lync server traffic, by designating a Primary NetScaler and a Secondary NetScaler. The Secondary NetScaler monitors the Primary, and if the Primary goes down, the Secondary takes over.

Microsoft Lync 2010 Details

To see the ports and protocols used in a Microsoft Lync Server 2010 environment, go here. A poster of the Lync Server 2010 workloads, describing the relationships and traffic flow can be found here. To download and use the Lync Server 2010
Topology Builder tool, go here

NetScaler for Lync Server 2010 Deployment Guide

We recently spent some time in Redmond, WA with Microsoft's Lync 2010 team to certify the Citrix NetScaler for deployment with Lync 2010. The deployment guide walks the user through simple steps of configuring the Citrix NetScaler for Lync 2010. Additionally, the user can download the pre-built configuration for Lync Server 2010 used in the deployment guide and upload it to Citrix NetScaler to serve as an example.

Download the Citrix NetScaler for Lync Server 2010 here.

Download the Citrix NetScaler configuration here.

The Citrix Community is powerful!

Scaling the Data Tier with Citrix NetScaler DataStream Technology

Native support and intelligence of SQL transactions is the key to extending the scalability, availability, and security benefits that the ADC brings to the web tier to the data tier, as noted in Sunil Potti's blog. Similar to the benefits of HTTP load balancing, a data tier load balancer should provide these key benefits:

• A native SQL proxy like solution to perform SQL connection management and offload for database scale up scenarios to increase SQL connection limit.
• A TDS protocol and SQL transaction intelligent load balancer that can accurately monitor backend server status including slave replication backlog to optimally distribute load in database scale out setups.
• High Availability that can address both Master/Master and Master/Slave replication deployments to complete the database scaling solution. Both scaling approaches also need advanced, clustering-like automated IP failover for lower cost high availability with commodity hardware.
• Database security encompassing transaction activity logging tied to user logins for compliance purposes to be generated from a central location to simplify record management.

NetScaler DataStream Technology

Leveraging its expertise in web applications, NetScaler with DataStream technology is the first ADC that justifiably addresses data tier challenges. With DataStream technology, NetScaler introduces the industry's first "true" load balancer for data that offers native SQL protocol, data format and transaction support for scaling database infrastructures. Structured Query Language (SQL) which is the de-facto data format, TDS (Tabular Data Stream) and Oracle MySQL, protocols that are widely deployed, are natively parsed and interpreted in NetScaler's high speed processing engine, providing all of the advance policy framework available to act on data connections and transactions. Applying all of the same HTTP acceleration technologies to SQL, NetScaler is able to provide the same benefits to the data tier, such as SQL Connection Multiplexing, SQL Load Balancing, SQL Content Switching, SQL Health Monitoring, Automated Failover and Security.

Features

• SQL connection multiplexing: NetScaler's SQL transaction intelligence enables NetScaler to act as a SQL proxy and terminate SQL connections from both client and server. Client to server connection multiplexing ratios of 50:1 or more is achievable depending on the application, number of unique database user logins and character sets in use.
• SQL Load balancing: Armed with SQL transaction awareness, NetScaler can switch one client's many SQL transactions in a single TCP connection to several different servers. This delivers more optimal load balancing of SQL traffic since the load distribution is more granular when compared to a TCP load balancer.
• SQL Content switching (read/write split): NetScaler can interpret SQL transactions and decipher between "select", "drop", "insert", "update" and other SQL statements and perform a split between read and write transactions. Splitting the reads and writes simplifies application server deployments by offloading the decision making and policy enforcement to NetScaler.
• SQL Health monitoring: NetScaler intelligently load balances SQL requests, by selecting the database server that will return up-to-date data the fastest at the time of the request and sending the read request to only that server.
• Automated IP failover: NetScaler's Virtual IP address solution is based on automated IP failover implementation where the virtual IP is assigned to the master node is switched over to the secondary node upon detection of heartbeat/monitor failure.
• Security: NetScaler can apply granular user access policies to each database user. It also provides a consolidated log of all SQL transactions and user accesses for complete visibility, without taxing the database server. SQL protocol validation is also available with advanced Policy Infrastructure (PI) regular expressions.

As the industry's first SQL aware load balancing solution, NetScaler addresses the scaling and availability needs of the data tier, leveraging its HTTP ADC technology for the web tier. NetScaler's SQL connection multiplexing scales connection limits for database scale up, native SQL load balancing optimizes database scale-out, SQL transaction logs simplifies database security and replication aware monitors with Virtual IP based failover enables cost-effective high-availability.

For more details about the new NetScaler DataStream technology, see the latest blog posts by Sunil Potti and Roger Klorese.

The Citrix Community is powerful!

Citrix Master Class

This is your opportunity to learn the key skills you need to troubleshoot a Citrix XenServer environment. Join Lee Bushen and Steve Benton live, for another exciting Master Class experience.

Topics Include:

• XenServer architecture
• Advanced troubleshooting techniques
• Understanding the key log files and commands
• Troubleshooting tools and demos
• Where to find the tools and resources you need

Details:

Webinar: XenServer Master Class - Troubleshooting XenServer
When: Wednesday, March 23, 2011 2:00 Eastern/11:00am Pacific
Where: Register at http://bit.ly/XenServerMasterClass

The Citrix Community is powerful!

Including VPX's with Commvault

Operational spending on IT, primarily Data Protection, continues to be highly correlated around staff and infrastructure. Whether your data storage is local or in the cloud, driving down costs suggests that any approach must be highly automated and work toward containing those costs.

Data Growth remains an uphill battle as the amount of data is growing at rates far faster than the operational budget can support. That disparity means you are in a constant struggle to work smarter and more efficiently squeezing more utilization out of the resources you already own.

Cutting costs and managing growth are two leading drivers in the mass migration IT is undergoing in the move to virtualized infrastructures. This ongoing shift is now making your data dynamic by nature. Workloads, applications and data now float over servers and locations which pose problems for those older legacy backup tools which expected to find the same data in the same scripted location each night.

That problem is exacerbated by the viral nature of Virtual Machines which magically pop up on the network overnight without any advanced notice - we refer to this condition as dynamic sprawl. Combine this with the dynamic nature of Virtual Disks, shared or dedicated, and unquestionably any modernized data management system must have a way to overcome this sprawl by automatically discovering and adjusting to changes in the applications and systems. This ensures you are capturing and indexing everything you need, so you can immediately turn around and drive a successful recovery of that system, machine, application or a lost document.

Time is also critical and it is the one resource that is continuing to shrink - redcuing your backup window - and dictate how long you need to preserve those copies of data to meet compliance or governance requirements.

Shrinking backup windows, rentention, recovery, SLA's, cost management and data growth are colliding with the drive to virtualization. Traditional backup approaches are clearly not up to the challenge & a new way forward is needed.

This is where CommVault comes in to play. Simpana 9 software from CommVault delivers a centrally managed, scalable and automated data protection solution that Bridges data protection and data management capabilities for both physical and virtual server environments in a single console.

This unified solution for managing and protecting data is emerging as a key requirement in the drive to a modern data management solution. However, it is important for that data protection solution to be more than just a single pane of glass for management. This requirement implies that customers demand (and rightfully so) a solution that meets the same business and service level requirements for virtual server environments - like Citrix Xen - that they get today in their physical environment.

This is the value of the Simpana 9 Virtual Server Protection capabilities for CommVault. Not only does Simpana 9 deliver a singular management solution that bridges both physical and virtual environments. It delivers industry leading data protection and data management capabilities that meet the most demanding business and service level requirements.

We did a proof of concept in the Citrix Santa Clara lab, to show that CommVault easily backs up the Citrix Virtual environment - consisting of XenServer, XenApp, XenDesktop, NetScaler VPX, Branch Repeater VPX, and Access Gateway VPX.

Integrated protection for Citrix Xen Server environments

• Full VM-level backups:
• For all supported OSes including Windows vdisks, NetScaler VPX, Access Gateway VPX, Branch Repeater VPX, XenApp VM's, XenDesktop VM's
• VM or file-level recovery
• Autodiscovery of VMs:

How it works

• A VSA deployed on a proxy VM (guest) inside each physical Xen server
• Backup queisces VM, snaps VM and attached to the proxy VM.
• Proxy VM mounts the snapshot as a volume and transfers to backup media
  

The Citrix Community is powerful!

Citrix Tech Talk

In this TechTalk, you will learn about proven methods for delivering 100% availability to any XenApp or XenDesktop Infrastructure, while simultaneously providing the foundation for rapid growth. XenApp and XenDesktop are ground breaking technologies. They are even more amazing when front-ended by a NetScaler to provide Enterprise scalability and performance. If Virtual Desktops and Apps are on your roadmap, you need to tune in to this webinar.

Topics Include:

• How Citrix NetScaler brings unparalleled robustness for critical XenApp and XenDesktop components, including Web Interface, XML Broker, and Desktop Delivery Controller.
• Proven strategies for scaling XenApp & XenDesktop environments
• The benefits of global load balancing for disaster recovery, and how to leverage multiple XenApp & XenDesktop farms

Details:

TechTalk: Guarantee Availability for XenApp and XenDesktop Deployments
When: Wednesday, March 16th, 2011 2:00pm Eastern/11:00am Pacific
Where: Register at https://www1.gotomeeting.com/register/734221352
Speaker: Florin Lazurca, Architect

Get the Citrix Load Balancer here

The Citrix Community is powerful!

Visit Citrix at RSA Conference USA 2011

Cybercrime. Malware incidents. Data breaches. Compliance legislation. Today's changing security landscape means you can't leave anything to chance. You need a balanced perspective. You need to separate speculation from fact. One event brings all the security issues, answers and thought leaders together. RSA Conference 2011 will feature over 350 leading information security companies and Citrix will be there.

Booth 1843: Venafi and Citrix have partnered to create a turnkey certificate management solution. Venafi works intricately with the SSL offloading, Citrix Access Gateway Enterprise Edition (SSL VPN) and Application Firewall features integrated in Citrix NetScaler. NetScaler has been tightly woven with Venafi Director for automated key generation and distribution. Administrators can set up NetScaler hardware and virtual appliances to work closely with Venafi Director in the generation of keys, configuration of certificates, provisioning and installation of these on NetScaler. With Venafi and NetScaler, organizations can scale encryption deployments and management functionality across the enterprise. Venafi supports hundreds of thousands of keys and certificates worldwide while NetScaler powers over 10 gigabits of SSL traffic per appliance with 2048 bit keys.

Booth 332: Using Cenzic solutions with NetScaler deployments is a fully validated and straightforward process. Initially the Hailstorm or ClickToSecure solution performs an automatic security scan to identify any weaknesses within the tested web applications. The administrator then receives a detailed vulnerability report to initiate remedial action. The detected vulnerabilities are exported from the Cenzic product to the NetScaler Application Firewall module via an XML file. After receiving the rules, NetScaler automatically generates policy settings to protect the application and bind the Application Firewall profile within minutes. No additional configuration or learning is needed.

Booth 1725: RSA and Citrix have collaborated to integrate RSA's Adaptive Authentication with NetScaler AAA system for Citrix Access Gateway (SSL VPN) and web applications. The Adaptive Authentication Integration Adapter from RSA is a Java web application that gathers device forensics and fingerprint information from client browsers and forwards it to the Adaptive Authentication Web Server. The Adapter lets administrators incorporate additional invisible and visible authentication methods as a secondary authentication to complement the primary authentication of NetScaler against standard user identity systems such as Active Directory or LDAP. The Adapter collects data from users for situations in which additional authentication is required, further protecting portals, applications and networks behind a firewall. The Adapter has been fully tested and validated to work with NetScaler (version 9.2) on all editions including Citrix Access Gateway Enterprise Edition and NetScaler Application Firewall.

Booth 2552: The NetScaler web application firewall works on the application layer, seeking and blocking attacks against specific web-based applications. Sourcefire 3D® Sensors serve as a second line of defense, identifying threats and changes to protocols, operating systems, and database servers and passing critical information from the Sourcefire Defense Center® management console to Citrix NetScaler to reconfigure security policies for increased protection. For example, Defense Center can trigger a configuration change on the Citrix NetScaler appliance to block a machine or machines that Sourcefire identifies as malicious. On Sourece 3D systems, a Citrix NetScaler Remediation module would perform an ACL command based in the information provided by the Sourcefire 3D system. Remediations execute when the rules included in a compliance policy and associated with that remediation trigger, violating the compliance policy. When the compliance policy is violated, the Remediation subsystem launches an instance of the associated remediation.

See you there!

The Citrix Community is powerful!

Citrix XenClient

Virtualization is pervasive, and the abstraction that results is amazing. I've been using XenServer for a few years now to spin up datacenter and lab VM's. Adding XenApp for applications and XenDesktop for virtual desktops (VDI) is another layer of amazing. Can it get any better? It can, add XenClient.

Citrix XenClient is a high-performance, bare-metal hypervisor that runs directly on the client device hardware, dividing up the resources of the machine and enabling multiple operating systems to run side by side in complete isolation. Now I can have virtual machines in the cloud, and virtual machines in hand. Now I can use multiple simultaneous desktops on my laptop - one for graphics work, another for work & email, and linux for other stuff. XenClient is based on XenServer technology, and now I have two Windows VM's and Ubuntu 10 on my laptop. There is a hack for MAC OS X, however I'm told the performance is not that great just yet. To install an OS that isn't in the list, just select the Win7 profile, and insert your bootable CD/DVD - this is how I installed Ubuntu.

How I did it - I went to the Citrix XenClient Hardware Compatibility list to check the requirements, and found a machine that suits my needs. Then I followed the user guide because you need to enable the virtualization options in the BIOS before installing XenClient.

Performing a XenClient install will wipe your data

I ordered a Lenovo T510, and here is the config:

• 45M4819 SBB INCR I7-620M 2.66GHZ,4MBL3
• 45M3090 VBB GENUWIN7PROFES.64
• 45M4918 SBB G.WIN.7PROF64US ENGLISH
• 45M4595 SBB 15.6HD+ANTI-GLW/LEDBKLIGH
• 0A21165 SBB INTELHDGRAPHUSB,TAA
• 45M4574 VBB 8GBPC3-10600DDR3 1333SODMM
• 45M4839 SBB KEYBOARDUS ENGLISH
• 75Y0171 VBB ULNAVTRPOITOUPADFINGREADER
• 45M4631 SBB CAMERA(2.0 MP)
• 45M4618 SBB 500GB HDISK DRIVE7200RPM
• 45M4608 SBB MULT.RECORD.OPTDRIVE12.7MM
• 75Y0174 VBB EXPCARSL+5IN1CARREAD
• 45M4816 SBB 9CELLLI-ION BATTERY
• 41W1787 SBB CPK NORTH AMERICA
• 45M3043 SBB BLUETOOTH W/ANTENNA
• 45M4805 SBB IN.CENTADV.-N+WIMAX 6250
• 44C9189 SBB NO WWAN SUPPORT
• 45M4676 SBB LANGUAGEPACK US ENGLISH
• 45K5970 3YR Onsite

All for about $1700.00. Once It arrived, I had some networking problems, and was told that my wireless adapter (6250) wasn't compatible, but after re-installing XenClient and my Windows 7 VM's it seems to be working fine. If it happens again, I can order a compatible Intel wireless adapter from any of the online stores.

How to install XenClient

• Purchase supported client hardware
• Download XenClient, burn to a CD using ImgBurn
• Set BIOS settings
• Boot to CD and install

  install the SSH option if you want to open a SSH terminal window within XenClient (useful for troubleshooting)

How to install VM's

• Burn .iso image of your OS to bootable CD/DVD using ImgBurn
• Add VM from XenClient
• Insert CD/DVD into drive

XenClient Tips and Trix

• ctrl+0, ctrl+1, ctrl+2, etc: switch to xenclient, vm1, vm2, etc...
• ctrl+shift+t: launches a terminal window - necessary for troubleshooting ip address and network
• alt-tab: rotate between xenclient and terminal windows
• status-tool: run this command from the terminal window to gather stats - including screenshots - stored in /storage/status-report
• ifconfig brbridged: run this command to show the ip address for dom0 - physical adapter
• ifconfig wlan0: run this command to show the ip address for dom0 - wireless adapter
• xentop: run this command from the terminal window to view performance data
• vhd-util: run this command from the terminal window to change/check vhd
• xec: run this command from the terminal window to control vm's
• touch /config/ssh_enabled: run this command to enable SSH on the XC Management Console - if not already installed
• ctrl+q: refresh hypervisor
• dmesg: show debug messages
• disktovhd: use this on old pc to make a vhd of your pc or laptop. Create new VM, replace .vhd in /storage/disks. Install XenTools.
• copy .iso to /storage/iso: mount the .iso in the virtual drive that normally mounts XenTools. Or use Virtual Clone Drive.

Download XenClient

XenClient Documentation

The Citrix Community is powerful!

for all Citrix Products

I previously showed how to get a 1-Year License for the Citrix NetScaler VPX Express. Our partners don't only use the NetScaler VPX, and may need 1-Year Licenses for other Citrix products as well. These can be obtained by joining the Citrix Ready program. To join Citrix Ready and obtain 1-Year Licenses for your Citrix products, follow the procedure below.

Citrix Ready Process

1. Sign up for a new Citrix user account http://mycitrix.com
2. Sign up for Citrix Ready at http://citrix.com/joincitrixready
3. Questions? Send email to citrixready@citrix.com
4. Wait for Citrix Ready approval (about 72 hours)
5. Receive approval email from Citrix Ready
6. Login to MyCitrix at http://mycitrix.com
7. Select Choose a Toolbox -> Partner Demo Licenses -> Get Software
8. Select Citrix Product to license -> Retrieve Serial Numbers
9. Select and copy Serial Number to clipboard
10. Select Choose a Toolbox -> Activate System/Manage Assets -> Activate/Allocate
11. Paste in Serial Number -> Continue
12. Allocate, Download and Install License
    
    

See how easy it is

Citrix Ready NFR License Matrix

The benefits of Citrix Ready can be found here. The following shows the Citrix Ready NFR License allocations.

The complete Citrix Ready process can be viewed here

Frequently Asked Questions can be answered here

The Citrix Community is powerful!

Citrix and Aptimize introduce NS-WAX

Aptimize is a Citrix Ready partner with software products that provide extra website acceleration on top of NetScaler. We have just completed benchmarking of NetScaler with Aptimize Website Accelerator for NetScaler (NS-WAX) and will link to the benchmark results soon. In the meantime, here is some background on NS-WAX and steps for getting started.

Background

NS-WAX is an on-server software product - installed on the web front end servers, and accelerates websites using content optimization (WCO), applying the following techniques dynamically in real-time:

• Reduces HTTP requests by merging JavaScript files and StyleSheets into fewer files, creating image sprites for HTML images, inlining CSS background images and removing duplicate resource files
• Reduces data traffic by shrinking (minifying) JavaScript and StyleSheets, resampling images, and removing redundant image metadata
• Speeds up repeat views by turning on far-future-expires headers on non-HTML resource files - causing the browser to cache the files long-term. NS-WAX uses auto-URL versioning to refresh the cached files if they change on the server
• Dynamic layout effects - techniques that display the page quicker, such as repositioning stylesheets to the top of the HTML, asynchronous JavaScript loading, and on-demand image loading - where only images within the browser's current viewport are loaded initially.

These optimizations are all done on-the-fly, without any changes to the website.

See how fast SharePoint is with NetScaler and NS-WAX

Integration with NetScaler

Aptimize has added features to integrate with NetScaler. Server health reporting means server health statistics are published to NetScaler and can be used for dynamic load balancing - based on the current load of the server. In addition, Aptimize has special pricing for co-deployment with NetScaler.

Initial availability is for the Microsoft platform versions of Aptimize's software - in particular SharePoint and ASP.NET. Aptimize's software is widely adopted to accelerate SharePoint, with implementations including Microsoft who use Aptimize to accelerate sharepoint.microsoft.com and lync.microsoft.com.

Get Started

Aptimize NS-WAX is available by contacting Aptimize. You can learn more on the Aptimize for Citrix section of their website, or download a technical whitepaper for configuring NetScaler with NS-WAX here.

The Citrix Community is powerful!

NetScaler VPX Express supports SSL Offload; however, NetScaler VPX does all SSL processing in software, so NetScaler VPX will not offer the same SSL performance as NetScaler appliances. NetScaler VPX can easily support up to 500 new SSL transactions per second, and the same encryption ciphers that the NetScaler appliances use are supported. The main difference between the NetScaler VPX and NetScaler MPX appliances is performance and L2 networking on the VPX is done in the Hypervisor. NetScaler VPX Express throughput is limited to 1 Mbps (Full Duplex). If you need more throughput, just download a 90-day eval license for NetScaler VPX-1000 Platinum, here.

Packaging

Capacity

View the NetScaler VPX Express FAQ

Download NetScaler VPX Express & License

The Citrix Community is powerful!

The Citrix NetScaler VPX provides the complete NetScaler all-in-one feature set in a simple, easy-to-install virtual appliance. IT organizations of any size can deploy NetScaler VPX on demand, anywhere in the datacenter, using industry standard servers. The simplicity and flexibility of NetScaler VPX make it easy and cost effective to fully optimize every web application and more effectively integrate networking services with application delivery.

Download Citrix NetScaler VPX

Download Citrix XenServer

The Citrix Community is powerful!

Redirecting HTTP Requests to a Cache

When the NetScaler performs load balancing, The NetScaler provides a cache redirection option for redirecting HTTP requests to a cache. A cache stores frequently requested HTTP content. When you configure cache redirection on a virtual server, the NetScaler sends cacheable HTTP requests to the caches and non-cacheable HTTP requests to the origin Web servers.

To set cache redirection on a virtual server using the NetScaler Load Balancer command line

set lb vserver <vServerName> -cacheable <Value>
Example

set lb vserver Vserver-LB-1 -cacheable yes

To set cache redirection on a virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual
   Servers.
2. In the details pane, select the virtual server for which you want to configure
   cache redirection (for example, Vserver-LB-1), and click Open.
3. In the Configure Virtual Server (Load Balancing) dialog box, click the
   Advanced tab.
4. Select the Cache Redirection check box, and then click OK.

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download the Citrix Load Balancer

The Citrix Community is powerful!

Xen Apps from the Cloud

Whether you decide on Amazon EC2 or Amazon VPC, or XenApp is easily deployed in the cloud. There has been alot of talk about cloud computing. There are believers and naysayers, but this is to be expected with any forefront technology. Whatever the talk is on the internet highway, one thing is clear. Cloud Computing makes sense, and we are now seeing companies take interest in XenApp in the cloud. Proof of Concepts are taking place. Questions are being answered. And from what I can see, there isn't a problem we haven't been able to solve. In fact, a couple of weeks ago we helped a customer get started on a XenApp POC for a large use base. For them, we also installed Secure Gateway so that https could be used into the Web Interface.

XenApp from your datacenter and XenApp from the cloud are really not that different. Building a XenApp farm in the cloud is just the same as building a XenApp farm in your datacenter, with a few tweaks. The steps for building a XenApp server in Amazon EC2 are outlined here.

I have personally built many POC's and written them up for reference, they can be found here. Citrix is a leader in Cloud Computing, and we have blueprints to show for it. There are some blueprints here, and most of these have pre-built XenApp AMI's that you can launch and apply your Citrix License to. The Microsoft Terminal Server license expires after 120 days, so let me know if any of these don't launch.

Probably the first question to answer is does the customer want to build a XenApp farm in the public cloud (Amazon EC2) or the private cloud (Amazon VPC)? The public cloud XenApp servers can run Secure Gateway to protect the Web Interface with HTTPS. The VPC is protected by a VPN tunnel, which requires the use of a VPN appliance tunneling SSL connections back to your datacenter. Vyatta offers both IPSec and SSL VPN Tunneling to the cloud. OpenVPN has a solution that works with Vyatta.

The Citrix Community is powerful!

For Virtualized Apps

As you can see from Chris Fleck's post from CES, virtualized everything is here, delivered to any device, anywhere, anytime, using Citrix Receiver. A key component of that infrastructure, is the Citrix Receiver and Citrix Merchandising Server. Citrix Receiver for Windows, Receiver for Mac, and Merchandising Server are components of the Citrix Delivery Center solution. While Citrix Delivery Center provides the application delivery infrastructure to the IT administrator, Citrix Merchandising Server and Citrix Receiver for Windows work together to streamline the installation and management of application delivery to the user desktops. Merchandising Server provides the administrative interface for configuring, delivering, and upgrading plug-ins for your users' computers.

The system consists of the Receiver application that is installed on your users' computers, the Merchandising Server that is installed on a virtual machine in your data center, and the Citrix Update Service that is hosted on Citrix.com. The Merchandising Server Administrator Console is the interface on the Merchandising Server that you use to configure plug-ins and schedule their delivery to your users. The Merchandising Server delivers the plug-ins and their installation instructions to your users on the scheduled date.

It guys often ask, how do I protect the Merchandising Server? The answer to that is by using the Citrix NetScaler to frontend the Receiver connections to the Merchandising Server. The Citrix NetScaler contains security policies to protect the Merchandising Server. We have created an NetScaler AppExpert Template for Merchandising Server. Just upload the AppExpert Template to your NetScaler VPX, tweak the policy for your domain/ip address scheme, and your are ready to start delivery apps out to your user base.

Download the NetScaler AppExpert Template for Merchandising Server here.

Download Citrx Receiver here.

The Citrix Community is powerful!

Try XenApp for free from the Application Delivery Cloud

I previously posted the steps to prepare your own XenApp server in the Cloud. Having gone through the process of creating additional servers in the cloud for my lab, I figured I would create some and make them publicly available for you to try. If there is an application you want streamed from the cloud to your device, comment, and I will do my best to get it loaded onto the server. Whether you are located in the Americas, Europe or Asia Pacific, Amazon has a platform for you, and Citrix has a XenApp Application Delivery Cloud waiting your use.

The Citrix Cloud Center (C3) is an integrated portfolio of Citrix delivery infrastructure products packaged and marketed to the cloud service provider market. C3 integrates cloud proven virtualization and networking products that power many of today's largest Internet and Web service providers.

Citrix C3 is designed to give cloud providers a complete set of service delivery infrastructure building blocks for hosting, managing and delivering cloud-based computing services. C3 includes a reference architecture that combines the individual capabilities of several Citrix product lines to offer a powerful, dynamic, secure and highly available service-based infrastructure ideally suited to large-scale, on-demand delivery of both IT infrastructure and application services.

More Citrix AMI's can be found here.

The Citrix Community is powerful!

Try XenApp for free from the Application Delivery Cloud

I previously posted the steps to prepare your own XenApp server in the Cloud. Having gone through the process of creating additional servers in the cloud for my lab, I figured I would create some and make them publicly available for you to try. If there is an application you want streamed from the cloud to your device, comment, and I will do my best to get it loaded onto the server. Whether you are located in the Americas, Europe or Asia Pacific, Amazon has a platform for you, and Citrix has a XenApp Application Delivery Cloud waiting you.

Americas	Europe	Asia

The Citrix Community is powerful!

and the ADC State of the Art

Load Balancing in its infancy emerged to improve the availability and reliability of websites and to offload SSL computation from the web servers. Innovation has advanced these machines to provide an assortment of benefits in addition to Load Balancing, and are thus classed into Application Delivery Controllers. The Citrix Load Balancer has advanced the state of the art by combining the benefits of basic Application Acceleration through the use of TCP Multiplexing, SSL Offload, Caching, Compression, Content Switching. The Load Balancer evolved to provide these benefits for Enterprise Applications in addition to websites, such as SAP, Oracle, Microsoft Sharepoint and OCS (Lync).

The Citrix ADC was the first to advance the state of the art in the virtualization realm, by coming to market with the first virtual appliance for load balancing, the NetScaler VPX. While the innovation of this continues to develop, the Virtual ADC (vADC) has broken down barriers to entry into sales engagements and partner relationships, thus increasing the overall bottom line.

The Virtual ADC incorporates rule-based extensibility through the use of NetScaler Expressions, and simplifies the rule-based language through the use of AppExpert Templates - prebuilt configurations and rules for all types of Enterprise Applications and Websites. Just import the AppExpert Template, and the application will be automatically accelerated. Applicaiton acceleration can achieve between 5% - 90% improvement depending on the measurement. When you spend money on bandwidth and users depend on low latency - this translates directly to the bottom line.

The NetScaler division at Citrix Systems has been successful at maintaining a rigid stance in the Load Balancing, Application Delivery Controller market, and continues to invest in the product by advancing the state of the art through innovation. State of the Art is integration of the Application Firewall, XML Firewall, AppExpert Templates, SOA and the Virtual ADC.

Download the Citrix Load Balancer

The Citrix Community is powerful!

Configuring Sessionless Load Balancing Virtual Servers

When the NetScaler performs load balancing, it creates and maintains a number of sessions between the client and servers. In scenarios such as DSR setup or intrusion detection system (IDS) load balancing, the NetScaler can perform load balancing without creating sessions. To prevent creation of sessions, you must configure a sessionless virtual server in the NetScaler. The sessionless virtual server does not allocate any resources on the NetScaler, thereby saving the memory that the specific deployment consumes.

When you enable the sessionless option, the NetScaler performs load balancing on a per-packet basis. When a sessionless virtual server is configured, the sessionless virtual server forwards the packets to a server selected using load balancing methods. While forwarding the packet, the NetScaler changes the destination MAC address to the server MAC address.

For sessionless load balancing

• Enable MBF mode
• Enable MAC-Based mode on the sessionless load balancing virtual server
• Enable USIP mode on services (because the IP address of the source is not changed)

To set a sessionless virtual server by using the NetScaler command line

set lb vserver <vServerName> -m <RedirectionMode> -sessionless <Value>
Example

set lb vserver Vserver-LB-1 -m MAC -sessionless enabled

To set a sessionless virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the Load Balancing Virtual Servers page, select the virtual server for which you want to configure sessionless load balancing (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, under Redirection Mode, click MAC Based.
4. Select the Sessionless check box, and click OK.

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download the Citrix Load Balancer

The Citrix Community is powerful!

A Load Balancer such as the Citrix NetScaler has monitors built in, to automatically redirect Client requests to the back-end servers that are up and running. But, what happens if the front-end is down? Load Balancing can fail when a Virtual Server or Vserver fails, or when the VIP is unable to handle excessive traffic. Protecting the LB setup against failure helps ensure the availablility of the websites and applications.

Configuring Connection-Based Spillover

You can use connection-based spillover to configure a maximum threshold for the number of active client connections on a virtual server. When the client connections exceed the configured threshold limit, new client connections are diverted to the backup virtual server.

To configure connection-based spillover, follow the steps described in the section Diverting Excess Traffic to a Backup Load Balancing Virtual Server. In the Method list, select Connection.

Global Server Load Balancing (GSLB) virtual servers do not support connection-based spillover.

Configuring Dynamic Spillover

Dynamic spillover depends on the maximum client setting configured on the services. If the number of client connections at the virtual server exceeds the sum of the maximum client values, the new connections are diverted to the services of the backup virtual server. To configure dynamic spillover, you must enable it on a virtual server. You must configure the services with appropriate maximum client values. If the value for maximum client is set to 0, the spillover limit is treated as infinity, and spillover never occurs. To configure dynamic spillover, follow the steps described in the section Diverting Excess Traffic to a Backup Load Balancing Virtual Server. In the Method list, select Dynamic connection.

Configuring Bandwidth-Based Spillover

Bandwidth-based spillover allows you to configure a bandwidth threshold value. When the bandwidth on the primary virtual server exceeds the bandwidth threshold value, the NetScaler diverts new connections to a backup virtual server. For example, if you create a primary virtual server, a backup virtual server, and two services, and bind the services to the virtual servers, you can configure bandwidth spillover on the primary virtual server. You can also configure the backup virtual server with a threshold value. When the threshold for the backup virtual server is reached, the NetScaler diverts new client connections to the next backup virtual server. To configure bandwidth-based spillover, follow the steps described in the section Diverting Excess Traffic to a Backup Load Balancing Virtual Server. In the Method list, select Bandwidth.

Configuring Stateful Connection Failover

The NetScaler enables TCP or UDP connections to survive a failover event in high availability (HA) mode. This functionality is called connection failover. After adding a secondary node and configuring HA, you can choose to configure either stateless or stateful connection failover. You can configure connection failover on any LB virtual server.

To configure a stateful connection failover by using the NetScaler command line

At the NetScaler command prompt, type:

• set lb vserver <vServerName> -connFailover <Value>

Example

set lb vserver Vserver-LB-1 -connFailover stateful

To configure a stateful connection failover by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the Load Balancing Virtual Servers page, select the virtual server for which you want to configure connection failover (for example, Vserver-LB-1), and click Open.
3. On the Advanced tab, in the Connection Failover drop-down list, select Stateful.
4. Click OK.
   
   Detailed instructions can be found in the NetScaler Traffic Management Guide
   
   NetScaler Documentation can be found here
   
   Download the Citrix Load Balancer
   
   The Citrix Community is powerful!
   
   
   

A Load Balancer such as the Citrix NetScaler has monitors built in, to automatically redirect Client requests to the back-end servers that are up and running. But, what happens if the front-end is down? Load Balancing can fail when a Virtual Server or Vserver fails, or when the VIP is unable to handle excessive traffic. Protecting the LB setup against failure helps ensure the availablility of the websites and applications.

Diverting Excess Traffic to a Backup Load Balancing Virtual Server

The spillover option diverts new connections to a backup virtual server when the number of connections to the primary virtual server exceeds the configured threshold value. The threshold value is dynamically calculated, or you can set the value. The number of established connections (in case of TCP) on the virtual server is compared with the threshold value. When the number of connections reaches the threshold, new connections are diverted to the backup virtual server.

You can configure persistence with spillover. In this configuration, connections are diverted to the backup virtual server based on the persistence settings configured on the backup virtual server. These connections are not moved back to the primary virtual server after the number of connections drops below the threshold. Instead, the primary virtual server accepts new client connections.

If the backup virtual servers reach the configured threshold and are unable to take additional load, the primary virtual server diverts all requests to the redirect URL. If a redirect URL is not configured on the primary virtual server, subsequent requests are dropped.

With RTSP virtual servers, the NetScaler uses only data connections for spillover. If the backup RTSP virtual server is not available, the requests are redirected to an RTSP URL and an RTSP redirect message is sent to the client.

To set a primary virtual server to divert new connections to a backup virtual server by using the NetScaler command line

At the NetScaler command prompt, type:

• set lb vserver <vServerName> -soMethod <spillOverType> -soThreshold <positiveInteger> -soPersistence ENABLED -soPersistenceTimeout <positiveInteger>

Example

set lb vserver Vserver-LB-1 -soMethod Connection -soThreshold 1000 -soPersistence 
enabled -soPersistenceTimeout 2

To set a primary virtual server to divert new connections to a backup virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure the spillover (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, in the Method list, select the type of spillover, and in Threshold text box, type the threshold value (for example, Connection and 1000).
4. Under Spillover, select the Persistence check box, and in Persistence Time-out (min) text box type the time-out (for example, 2).
5. Click OK.
   
   Detailed instructions can be found in the NetScaler Traffic Management Guide
   
   NetScaler Documentation can be found here
   
   Download the Citrix Load Balancer
   
   The Citrix Community is powerful!
   
   
   

A Load Balancer such as the Citrix NetScaler has monitors built in, to automatically redirect Client requests to the back-end servers that are up and running. But, what happens if the front-end is down? Load Balancing can fail when a Virtual Server or Vserver fails, or when the VIP is unable to handle excessive traffic. Protecting the LB setup against failure helps ensure the availablility of the websites and applications.

Configuring a Backup Load Balancing Virtual Server

If the primary virtual server is marked down or disabled, the NetScaler directs the connections or client requests to a backup virtual server that forwards the client traffic to the services. It can also send a notification message to the client regarding the site outage or maintenance. The backup virtual server is a proxy and is transparent to the client. If a load balancing virtual server is configured with both a backup virtual server and a redirect URL, the backup virtual server takes precedence over the redirect URL. A redirect is used when the primary and backup virtual servers are down. You can configure a backup virtual server when you create a virtual server, or when you change the optional parameters of an existing virtual server. You can also configure a backup virtual server for an existing backup virtual server, thus creating cascaded backup virtual servers. The maximum depth of cascading backup virtual servers is 10.

If you have multiple virtual servers that connect to two servers, you have a choice of which virtual server takes over if the primary virtual server goes down and then comes back up. The default behavior is for the primary virtual server to resume its role as the primary. However, you may want to designate the backup virtual server to remain in control in the event that it takes over. For example, you may want to sync updates to the backup server to the primary server and then manually force the original primary server to resume its role. In this case, you can designate the backup virtual server to remain in control in the event that the primary virtual server goes down.

If the backup virtual server does not exist, an error message appears. You can use redirect URL on the primary when the primary and the backup virtual servers are down or have reached their threshold for handling requests. When a service bound to the virtual server is in an out of service state, use the redirect URL on the virtual server.

To set a backup virtual server by using the NetScaler command line

At the NetScaler command prompt, type:

• set lb vserver <vServerName> -backupVserver <BackupVServerName> [-disablePrimaryOnDown]

  If you enable the Disable Primary When Down option, the backup virtual server maintains control after the primary virtual server comes up. To enable the primary virtual server to retake control, you must manually re-enable it.

Example

set lb vserver Vserver-LB-1 -backupVserver Vserver-LB-2 -disablePrimaryOnDown

To set a backup virtual server by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure the backup virtual server (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, in the Backup Virtual Server list, select the backup virtual server (for example, Vserver-LB-2).
4. If the primary server goes down and then comes back up, and you want the backup virtual server to function as the primary server until you explicitly reestablish the primary virtual server, select the Disable Primary When Down check box.
5. Click OK.
   
   Detailed instructions can be found in the NetScaler Traffic Management Guide
   
   NetScaler Documentation can be found here
   
   Download the Citrix Load Balancer
   
   The Citrix Community is powerful!
   
   
   

Today's complex networking environment often requires coordinating a high-volume, high-capacity load balancing configuration with robust authentication and authorization. Application users may connect to a VPN through mobile access points such as consumer-grade DSL or Cable connections, WiFi or even dial-up nodes. Those connections usually use dynamic IPs, which can change during the connection. If you configure RADIUS load balancing on the NetScaler appliance to support persistent client connections to RADIUS authentication servers, the appliance uses the user logon or the specified RADIUS attribute instead of the client IP as the session ID, directing all connections and records associated with that user session to the same RADIUS server. Users are therefore able to log on to your VPN from mobile access locations without experiencing disconnections when the client IP or WiFi access point changes.

To configure RADIUS load balancing with persistence, you must first configure RADIUS authentication for your VPN. For information and instructions, see the Citrix NetScaler Application Security Guide, Authentication Authorization Auditing (AAA) chapter. You must also choose either the Load Balancing or Content Switching feature as the basis for your configuration, and make sure that the feature you chose is enabled. The configuration process with either feature is almost the same.

Then, you configure either two load balancing, or two content switching, virtual servers, one to handle RADIUS authentication traffic and the other to handle RADIUS accounting traffic. Next, you configure two services, one for each load balancing virtual server, and bind each load balancing virtual server to its service. Finally, you create a load balancing persistency group, and set the persistency type to RULE.

The steps that follow assume familiarity with NetScaler load balancing or content switching configuration. If you are not familiar with configuring the NetScaler appliance, you should review the appropriate chapter of the Citrix NetScaler Traffic Management Guide before attempting to configure RADIUS load balancing with persistence.

Configuring RADIUS Load Balancing with Persistence

• Enable the Load Balancing or Content Switching Feature
• Configure Virtual Servers
• Configure Services
• Bind Virtual Servers to Services
• Configure Load Balancing Persistency Groups
  
  

Detailed instructions can be found in the NetScaler Traffic Management Guide

NetScaler Documentation can be found here

Download Citrix NetScaler Load Balancer

The Citrix Community is powerful!

A Load Balancer such as the Citrix NetScaler has monitors built in, to automatically redirect Client requests to the back-end servers that are up and running. But, what happens if the front-end is down? Load Balancing can fail when a Virtual Server or Vserver fails, or when the VIP is unable to handle excessive traffic. Protecting the LB setup against failure helps ensure the availablility of the websites and applications.

Redirecting Client Requests to an Alternate URL

You can configure a redirect URL to communicate the status of the NetScaler in the event that a virtual server (only of type HTTP or HTTPS) is down or disabled. This URL can be a local or remote link. The NetScaler uses HTTP 302 redirect. Redirects can be absolute URLs or relative URLs. If the configured redirect URL contains an absolute URL, the HTTP redirect is sent to the configured location, regardless of the URL specified in the incoming HTTP request. If the configured redirect URL contains only the domain name (relative URL), the HTTP redirect is sent to a location after appending the incoming URL to the domain configured in the redirect URL.

If a load balancing virtual server is configured with both a backup virtual server and a redirect URL, the backup virtual server takes precedence over the redirect URL. A redirect is used when the primary and backup virtual servers are down.

To configure a virtual server to redirect the client request to a URL by using the NetScaler command line

At the NetScaler command prompt, type:

• set lb vserver <vServerName> -redirectURL <URLValue>

Example

set lb vserver Vserver-LB-1 -redirectURL http://www.newdomain.com/mysite/maintenance

To configure a virtual server to redirect the client request to a URL by using the GUI configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure redirect URL (for example, Vserver-LB-1), and then click Open.
3. On the Advanced tab, in the Redirect URL text box, type the URL (for example, http://www.newdomain.com/mysite/maintenance).
4. Click OK.
   
   Detailed instructions can be found in the NetScaler Traffic Management Guide
   
   NetScaler Documentation can be found here
   
   Download the Citrix Load Balancer
   
   The Citrix Community is powerful!
   
   
   

PHD Virtual Backup that is

In August, 2010, PHD Virtual announced support for PHD Virtual Backup for Citrix XenServer. The backup and recovery solution is built specifically for XenServer environments. They are a Citrix Ready partner, meaning the solution has been verified to work with Citrix XenServer in our labs. PHD Virtual provides the ability to back up and restore business critical information quickly and efficiently, directly within the XenCenter management console, providing a single pane of glass to manage virtual machine backups. With support for XenServer, XenDesktop and XenApp, customers can leverage the same solution across their entire virtual environment.

Releasing this month

Is PHD Virtual Backup 5.1 for XenServer. It is built on the next generation of PHD Virtual's award winning VBA architecture and extends their XenServer backup and recovery solution with new capabilities providing:

• The fastest and most cost effective virtualization backup to meet RPO, RTO and SLA requirements
• Dramatically reduced storage requirements and efficient network backup with TrueDedupe™ Technology
• The most reliable solution for backup data integrity with TrueRestore™ Technology
• Seamless, integrated management of backup and restore directly from Citrix XenCenter
• Backup and recovery of XenApp and XenDesktop deployments on XenServer
• Completely virtualized solution footprint leveraging the PHD VBA (Virtual Backup Appliance)
  
  

PHD VBA Architecture

Provides a purpose-built virtualization backup solution giving you the ability to simultaneously backup and restore multiple VMs concurrently. The PHD VBA deploys as a small virtual appliance on XenServer that autonomously conducts hot backups of all your virtual machines.

• Purpose built for virtual environments and integrated with XenCenter
• Backs up and restores any VM running on XenServer
• Does not compromise hypervisor performance or impact Dom0
• Does not require dedicated proxy servers, additional hardware or software agents
  
  

New in version 5.1:

• Flexible Backup Storage Options
• Set it and Forget it Job Scheduling
• File Level Restore (FLR) Any OS, Any File System
• Application Object Recovery Enabling Existing Tools to Restore Application Objects from Backups
• Support for Tape Backup Solutions via Backup Data Connector
• Backup Retention and Archiving - Meet DR Objectives and Retention Policies
  
  

Read more about PHD Virtual here

PHD Virtual is Citrix Ready

Download Citrix XenServer here

Download Citrix XenDesktop here

Download Citrix XenApp here

Download Citrix Virtual Load Balancer & SSL VPN here

The Citrix Community is powerful!

Configuring a backup persistence method

The NetScaler Load Balancer uses the backup persistence option when the primary persistence fails. For example, the primary persistence type is set to Cookie Insert, and backup persistence is set to Source IP. When the client browsers do not support cookies, Source IP persistence is used. To set the backup persistence option to Source IP, you must set the primary persistence to Cookie Insert.

If the traffic comes from behind a Network Address Translation (NAT) device or proxy, the traffic appears to come from a single source IP address and cannot be distributed evenly.

Backup persistence has a time-out value that you can set when the primary persistence type is set to COOKIEINSERT or RTSP session ID persistence, and the backup persistence type is set to SOURCEIP.

The NetScaler uses the backup persistence if the cookie or RTSP session ID is missing in the header.

To set backup persistence for a virtual server by using the NetScaler command line

At the NetScaler command prompt, type:
set lb vserver <vserverName> -persistenceType <PersistenceType> -persistenceBackup <BackupPersistenceType>
Example
set lb vserver Vserver-LB-1 -persistenceType CookieInsert -persistenceBackup SourceIP

To set backup persistence for a virtual server by using the configuration utility

1. In the navigation pane, expand Load Balancing, and then click Virtual Servers.
2. In the details pane, select the virtual server for which you want to configure backup persistence (for example, Vserver-LB-1), and then click Open.
3. The Configure Virtual Server (Load Balancing) dialog box, click the Method and Persistence tab.
4. In the Persistence list, select COOKIEINSERT and in the Time-out text box, type the time-out value (for example, 20).
5. In the Backup Persistence list, select the backup persistence that you want to configure (for example, SOURCEIP).
6. In the Backup Time-out and Netmask text boxes type the backup time-out value and netmask (for example, 20 and 255.255.255.255).
7. Click OK.

Download the Citrix Load Balancer here

The Citrix Community is powerful!

hacking tool for Wordpress

Since the rollout of social media and blogging, I have wondered "why aren't these sites using SSL". When I told my wife my facebook account got hacked, she didn't believe me. Then her's got hacked. Session Hijacking has been around for a while now, so it's nothing new, but the hacking tool Firesheep, an extension to Firefox, is a new illustration of that vulnerability. It has built in strings to capture session keys from all of the favorite web sites, including twitter, facebook and wordpress among others. This is not just about social sites, it is about Enterprise apps also, being exposed. Companies are using Twitter, Facebook and Wordpress as business tools. So it is now an Enterprise security issue, a real risk to applications that run the business. And with many of our execs going mobile, they are using these tools from places with open WiFi such as airports, coffee shops and hotels. Fixing the threat is easy, by putting a NetScaler VPX in front of these site(s) and automatically redirecting HTTP to HTTPS. Here are the steps necessary to implement the fix, along with a video that shows how easy it is to hack using session hijacking, and how easy it is to fix this problem.

Steps for securing Wordpress with SSL - Wordpress hosted at a service provider:

1. Download and install XenServer
2. Download and install NetScaler VPX for XenServer
3. Install SSL Certificate on the NetScaler
4. Create a Load Balancing VIP with new publicly routable IP Address
5. Edit DNS entry for your wordpress site to point to the NetScaler Load Balancing VIP
6. Set Service to the IP Address of your wordpress site at the service provider
7. Set Load Balancing VIP port 80 to automatically redirect to port 443

Connect to http://<yourwordpresssite.com> and it should automatically redirect to https://<yourwordpresssite.com>.

Steps for securing Wordpress with SSL - Wordpress hosted in your own DMZ:

1. Download and install XenServer
2. Download and install NetScaler VPX for XenServer
3. Install SSL Certificate on the NetScaler
4. Create a Load Balancing VIP with a new publicly routable IP Address
5. Edit DNS entry for your wordpress site to point to the NetScaler Load Balancing VIP
6. Set the Service to point to the IP Address of your locally hosted wordpress site
7. Set Load Balancing VIP port 80 to automatically redirect to port 443

Connect to http://<yourwordpresssite.com> and it should automatically redirect to https://<yourwordpresssite.com>.

Its easy

Download XenServer here

Donwload NetScaler VPX here

The Citrix Community is powerful!

for Video over WAN

The Citrix Branch Repeater plays a critical role in optimizing an existing WAN connection and improving the overall virtual desktop user experience in the branch office. The following key findings from a recent report emphasize the strategic cost savings and performance improvement a Branch Repeater solution can provide for any branch office XenDesktop deployment.

• Citrix Branch Repeater can reduce the overall average bandwidth consumed per session by up to 89%.
• Citrix Branch Repeater can reduce the amount of time it takes for a XenDesktop session to launch on a congested WAN connection by up to 40%.
• Citrix Branch Repeater can double the number of users able to execute similar virtual desktop activities on the same congested WAN connection.
• Citrix Branch Repeater can reduce the amount of time it takes for the print request to spool from the virtual desktop to the branch office print server by up to 60%.

Optimized Video Delivery

Citrix Branch Repeater is a branch optimization solution that accelerates and simplifies branch infrastructure. Branch Repeater solutions reduce IT costs and increase user productivity by simplifying branch startup and management, and providing users the best access experience. The Branch Repeater products achieve WAN optimization by combining a variety of technologies:

• TCP Optimization: Branch Repeater is a symmetric solution, where a Branch Repeater is located at each end of the WAN connection (in the datacenter and in the branch office) recognize each other's presence and employ RFC compliant TCP optimization techniques that ensure optimal utilization of the network bandwidth.
• Traffic Prioritization (QoS): Administrators can classify network bandwidth based on TCP port numbers and IP ranges to prioritize the delivery of TCP segments based on the classification. Furthermore, Branch Repeater recognizes the priorities of the various ICA virtual channels and can ensure preferential treatment of real-time critical data such as audio.
• Compression: Branch Repeater can detect repeating patterns in the transmitted data and utilize very small tokens across the WAN to identify such repeating data patterns and serve the data to the user out of the appliance memory; therefore, restricting the amount of data required to traverse the WAN and improving user experience.
• Protocol Optimization: Branch Repeater can optimize a variety of common application protocols. Citrix XenDesktop leverages the ICA protocol, which employs a variety of optimization and security features natively. In order to apply compression, a WAN optimizer must be able to decrypt the ICA workload, identify repeating patterns within the ICA virtual channels, apply the optimization, and re-encrypt the data stream. This is why Citrix Branch Repeater is the only WAN optimization product capable of directly optimizing the ICA payloads on the protocol level.

Citrix High Definition (HDX)

Citrix is committed to providing the best high definition user experience through the introduction of HDX technology. Citrix HDX technology builds on existing Citrix user experience innovations from the datacenter to the device, adding enhancements for multimedia, voice, video and 3D graphics. Citrix HDX is comprised the following categories:

• HDX Broadcast - Ensures high-performance of virtual desktops and applications over any network, including high-latency and low-bandwidth environments.
• HDX WAN Optimization - Optimizes performance by utilizing Citix Branch Repeater to cache bandwidth intensive data and graphics and deliver them from the most efficient location.
• HDX MediaStream - Accelerates multimedia performance through compression or, when possible, redirection and client-side rendering.
• HDX RealTime - Enhances real-time voice and video using advanced encoding and streaming to ensure a no compromise end-user experience.
• HDX 3D - Optimizes the performance of everything from graphics-intensive 2D environments to advanced 3D geospatial applications using software and hardware based rendering in the datacenter and on the device.
• HDX Plug-n-Play - Enables simple connectivity for all local devices in a virtualized environment, including USB, multi-monitor, printers and peripherals.

Read the performance report here

Download the free Branch Repeater VPX Express virtual appliance

Read about HDX here

Get the optimized video delivery technology here

The Citrix Community is powerful!

Recommended by NIST for January 2011

Beginning January 1st, 2011, the NIST (National Institute of Standards & Technology) recommends all SSL certificates be upgraded to 2048-bit strength To protect data confidentiality. This transition can have a significant impact on performance and capacity of your SSL infrastructure.

Join us Wednesday, November 10th, 2:00pm Eastern/11:00am Pacific and discover how to efficiently manage this change and what actions you need to take now that will ease the transition to 2048-bit, and still maintain the highest performance and security standards.

In this TechTalk, learn about:

• Why SSL/TLS is moving to 2048-bit certificates and the impact on your organization
• How a major web hosting provider, GoDaddy.com is managing the transition to 2K certificates
• Recommendations and examples of Citrix NetScaler SSL/TLS features

Details:

TechTalk: 2048 bit SSL Certificates - Are you ready?
When: Wednesday, November 10, 2010 2:00 PM - 3:00 PM EST
Where: Register at http://www.citrix.com/sslcertwebinar
Speaker: Kurt Roemer, Chief Security Strategist, Citrix Systems

Get the most powerful SSL Performance here.

The Citrix Community is powerful!

Sprint, HTC, RIM, Samsung, Motorola

If you've been paying attention, you know that Citrix Receiver runs anyapplication, on anydevice, anywhere. If you are in Silicon Valley, you can see it in action by attending the session to be delivered by Chris Fleck of Citrix, at the Sprint Developer Conference. Mobile devices continue to proliferate across the enterprise creating new business challenges for users, IT and developers. Users want their devices to empower them to do more than just read e-mail and browse the web. They want simple and fast access to documents and the ability to run their business applications. IT needs a secure and scalable infrastructure for delivering business apps to mobile devices, anytime and anywhere. Developers want a common platform to create applications without duplication and little additional resources.

With Citrix Receiver™, accessing applications hosted on Citrix XenApp provides a common platform that both IT and developers can utilize to minimize development, run applications centrally and securely deliver apps to any device. The Citrix Receiver connects securely to the XenApp server using Citrix NetScaler SSL VPN technology.

In this session you will learn

• How to use existing development tools and resources like Visual Studio, Flash and Java to create business applications for any device
• How to use alternative, non-development tools to create compelling business applications and dashboards
• How Citrix Receiver enables tablets, smartphones, and other devices to quickly and securely enter the workplace
• How to optimize existing applications for Android, BlackBerry and even iPhone
  Session Demos: Citrix Receiver on Android and Blackberry devices: www.citrix.com/receiver

Session: Citrix: Build Once, Run Centrally and Deliver Business Applications Anywhere with Citrix Receiver
When: Tuesday, October 26, 2010 | 4:15 - 5:15 p.m.
Where: Santa Clara Convention Center, Room K
Who: Chris Fleck - VP Community & Solutions Development, Citrix Systems

Samsung Devices (Epic 4G Handsets, Transform Sprint ID Handset, Galaxy Tab)

Stop by the Samsung booth in the exhibit hall or attend the Samsung session Wed Oct 27, 10:00-11:00, and provide your contact information via business card to be eligible to win one of multiple Samsung Epic 4G handsets or Samsung Galaxy Tab Android Tablets via a business card drawing in the Samsung Booth and Samsung breakout session.

In addition, Samsung Epic and Transform handsets will be raffled off to attendees of the Android Coding Session, Thur 2:30-5:30.

A limited number of Samsung Galaxy Tab (Sprint's first Android powered tablet) will be raffled off to Android Coding session attendees who have downloaded the Samsung Galaxy Tab SDK/Emulator http://innovator.samsungmobile.com/galaxyTab.do. Sprint employees will validate the emulator configuration on android coding session attendee laptops as attendees enter the android coding session.

HTC EVO 4G

Stop by the HTC booth in the exhibit hall or attend the HTC session Wed Oct 27, 11:15-12:15, and provide your contact information via business card to be eligible to win one of multiple HTC EVO 4G handsets via a business card drawing.

HTC will also be raffling off a limited number of HTC EVO 4G handsets following their presentation in the Android Coding Camp, Thur 2:30-5:30.

Motorola I1 (the first iDEN Android PTT capable handset.)

Forty attendees of the Motorola Motodev Session on Wed, Oct 27, 4:00-5:00 will be eligible to receive a Motorola I1 device. Specific information about how the devices will be awarded will be shared in the session itself. Must be present at the breakout session to be eligible for the device giveaway.

RIM Style (first Sprint RIM Blackberry 6.0 OS device, not yet available to the public)

This information is COMING SOON.

Get Citrix Receiver here

Get Citrix XenApp here

Get the most powerful Citrix Receiver Proxy here.

The Citrix Community is powerful!

Integrated with NetScaler HTTP Callout

Ever wonder, with all of this networking security, who is protecting the information at the endpoint, before it enters the VPN stack? Ever heard of Keyloggers and Framegrabbers? API's that can read your passwords? (Even when connected to an SSL VPN or to a web application using HTTPS). You're not out of the woods yet until you secure your internet browser, on your local machine. Internet Explorer, Chrome, Safari and Firefox don't have this protection natively, so you will want to read this.

Quaresso Protect On Q enables web sites to mitigate information compromise risks introduced by web browsers, and by extension end users. Browsers have become the target or vector of many styles of attacks. While SSL protected packets (i.e., HTTP/S) and data center security solutions (e.g., web application firewalls) can significantly increase protections against compromise, the end point has become the relative weak link in this three link chain. Why? Some of the reasons:

• Breadth and depth of attacks - the monetization of malware have increased the number and sophistication level of attacks. Vulnerabilities, both in the code of browsers as well as plug-ins along with new methods of social engineering have increased year over year.
• Decreased efficacy of traditional anti-virus solutions - many recent studies have shown that the growth in the number of in-the-wild attacks have increased the vulnerability window for users.
• Increase in data at risk - more and more organizations are making heretofore sensitive content available across the Internet, whether customer-focused content like banking transactions, health care information or equity trades or enterprise content such as product design documents, customer account databases, internal communications like email. This creates a financial motivation for attackers.
• Lack of visibility - Although browser vendors have done a credible job of adding security features to their products in an attempt to mitigate the browsers' vulnerabilities, high assurance web sites have very few tools to ensure users have enabled such features or have configured them correctly.

Protect On Q takes a fundamentally different approach to solve the problem of browser insecurity. Instead of relying on end users or the security state of users' PCs, web sites with Protect On Q can take control of the client side risk by quickly delivering an ephemeral (i.e., temporary) security layer around the browsers that connect to their site. This layer - implemented as a protected browser - is controlled by the web sites via a site specific policy. It requires no extraordinary requirements of the end user or local system and does not require permanent software installation, minimizing operational overhead and desktop support complexity.

POQ provides the following security features:

• Keylogger/Framegrabber Defense
• Browser Privacy
• Browser Process Integrity
• SSL Certificate White Listing
• SSL User Orverride
• Network Destination Controls
• Hostname Resolution Bypass
• Information Leakage and Auditing
• Session Time Limits
• Blocking COM Snooping

The diagram below depicts the Protect On Q (POQ) architecture in a typical POQ usage scenario

• The NetScaler automatically redirects HTTP (cleartext) requests to HTTPS (encrypted). This protects the information in transit to the website.
• Request is made to https://citrix.demo.quaresso.com.
• The NetScaler intercepts the request, and determines if the browser is armored already. If not,...
• A page appears that explains to the user that they need the POQ armored browser before they access that application/website.
• The armored browser is started.
• The users session is then sent to the original request https://citrix.demo.quaresso.com using the armored browser.
• All requests to that website are sent to the HTTP Callout, including HTML, images, css, Javascript, etc.
• The NetScaler checks for a POQ-Verified value.
• The value is extracted from the "QuaressoPOQSessionID" and an HTTP Callout request is sent to the REST API, to verify that the POQ server did in fact sign that user agent value, and then allows or denies further access.

During the armored browser session:

• User must use an armored browser for the website/application https://citrix.demo.quaresso.com.
• User cannot navigate to other sites while using the armored browser.
• User cannot navigate to invalid certificate sites (certificate whitelisting).
• Information controls prevent saving, printing, pasting or copying information from the application/website through the armored browser.
• Malware detection is enabled preventing screen captures and keyloggers (however, we made a whitelist exception to record the video).

Watch it in action

Citrix NetScaler Process Flow

Citrix NetScaler Configuration

# HTTP Callout Policies
add policy httpCallout QuaressoCallout
add policy httpCallout poq_valid_session_id
set policy httpCallout QuaressoCallout -IPAddress 63.110.51.85 -port 8080 -returnType TEXT -hostExpr "\"63.110.51.85\"" -urlStemExpr "\"/poqserver/rest/\" + HTTP.REQ.HEADER(\"QuaressoPOQSessionID\") + \"/isValid\"" -resultExpr "HTTP.RES.BODY(5)"
set policy httpCallout poq_valid_session_id -IPAddress 63.110.51.85 -port 8080 -returnType TEXT -hostExpr "\"QuaressoCallout.ns.com\"" -urlStemExpr "\"/poqserver/rest/session/\" + HTTP.REQ.HEADER(\"QuaressoPOQSessionID\") + \"/isValid\"" -resultExpr "HTTP.RES.BODY(5)"
# Server Setup
add server 63.110.51.85 63.110.51.85
add server 63.110.51.87 63.110.51.87
add service HTTPS 63.110.51.87 SSL 443 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
add service POQServer 63.110.51.85 HTTP 8080 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
add service badstore 63.110.51.87 HTTP 80 -gslb NONE -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -sp OFF -cltTimeout 180 -svrTimeout 360 -CKA NO -TCPB NO -CMP YES
set rewrite param -undefAction NOREWRITE
# Load Balancing Virtual Servers
add lb vserver QuaressoVIP HTTP 63.110.51.92 80 -persistenceType NONE -redirectURL "https://citrix.demo.quaresso.com/" -cltTimeout 180
add lb vserver QuaressoVIP-HTTPS SSL 63.110.51.92 443 -persistenceType NONE -cltTimeout 180
add lb vserver QuaressoVIP-POQServer SSL 63.110.51.92 8443 -persistenceType NONE -cltTimeout 180
# Responder Policies
add responder action invalidPOQKey_action respondwith "\"HTTP/1.1 200 OK\r\\r\\nContent-length: 116\\r\\n\\r\\n<HTML><HEAD><TITLE>Invalid POQ Session key </TITLE></HEAD><BODY><h1>Invalid POQ Session key found</h1></BODY></HTML>\""
add responder action noPOQKey_action redirect "\"https://citrix.demo.quaresso.com:8443/poqserver/client/citrixtest/poqRequired.html\""
add responder policy noPOQKey_policy "HTTP.REQ.HEADER(\"QuaressoPOQSessionID\").EXISTS.NOT && HTTP.REQ.HOSTNAME.EQ(\"QuaressoCallout.ns.com\").NOT" noPOQKey_action
add responder policy invalidPOQKey_policy "HTTP.REQ.HOSTNAME.EQ(\"QuaressoCallout.ns.com\").NOT && SYS.HTTP_CALLOUT(poq_valid_session_id).EQ(\"true\").NOT" invalidPOQKey_action
set responder param -undefAction NOOP
# Bind Policies to VServers
bind lb vserver QuaressoVIP-HTTPS HTTPS
bind lb vserver QuaressoVIP-POQServer POQServer
bind lb vserver QuaressoVIP-HTTPS -policyName noPOQKey_policy -priority 101 -gotoPriorityExpression END
bind lb vserver QuaressoVIP-HTTPS -policyName invalidPOQKey_policy -priority 102 -gotoPriorityExpression END
# SSL Certs
add ssl certKey ns-server-certificate -cert ns-server.cert -key ns-server.key
add ssl certKey quaresso-self-signed-cert -cert quaresso.cert -key quaresso.key
add ssl certKey quaresso-demo-cert -cert demo_quaresso_com.crt -key demo_quaresso_com.key
set ssl service HTTPS -eRSA DISABLED
# Bind SSL Certs to VServer
bind ssl service HTTPS -certkeyName quaresso-demo-cert
bind ssl vserver QuaressoVIP-HTTPS -certkeyName quaresso-demo-cert
bind ssl vserver QuaressoVIP-POQServer -certkeyName quaresso-demo-cert

To see how these threat protections work and read about additional security protections, scalability, and performance, go to www.quaresso.com or contact them at info@quaresso.com.

Get the most powerful HTTP Callout controller here.

Quaresso is Citrix Ready!