Monthly Archives: August 2015

HDX Broadcast now with Framehawk

The following content is a brief and unofficial prerequisites guide to setup, configure and test HDX Broadcast now with Framehawk with XAD 7.6 FP2 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names

What is Framehawk?
It forms part of HDX Broadcast technologies within the High Definition eXperience (HDX) stack providing an enhanced X1 UX over broadband wireless, cellular connections where users experience the effects of packet loss, congestion, latency and jitter. The technology came from the Framehawk acquisition made by Citrix in 2014 ref – Framehawk is defined as light weight frame buffer protocol (UDP based) and adds a new virtual channel to the ICA protocol. The initial release is targeted at users connected to XAD 7.6 FP2 via TRU networks however as of 14/08/2015 ref * Framehawk is now also available for users running the latest up to date iOS Receiver – utilising NetScaler Gateway 11.0 build 62.10 ref the following CTX blog which also includes details surrounding the initial Framehawk release within XAD 7.6 FP2 at – *

New Use Cases for Framehawk
The following official Citrix blog articles provides insight into some of the use cases for Framehawk –

HDX Framehawk Performance in XenApp and XenDesktop 7.6 FP3

Demonstration of Citrix (HDX Broadcast now with Framehawk) vs. VMware

Pre-requisites & System Requirements for Deploying HDX Broadcast now with Framehawk (Draft + The Basic’s Only)
0: The HDX Broadcast now with Framehawk admin guide is available at – which I would strongly suggest that you read through before undertaking any type of PoC or internal testing of Framehawk’s capabilities within your own home lab, organisation demo environment.
1: You need to download the XAD 7.6 FP2 components from Also download and the firmware update for NetScaler Unified Gateway 11.0 build 62.10** to upgrade your NUG V/A.Note: The current supported Citrix Receivers (update 22/08/2015) are the Windows Receiver 4.3 or iOS Receiver 6.0.
2: Download the DisplayStateGUI.exe * tool from its a good read by way so be sure to read through that official CTX blog articles aswell prior to deploying Framehawk in your Home/Test lab or for a customer PoC.
3: In your Citrix test or home lab environments snapshot all the relevant XAD 7.6 infrastructure components that requires which an update which is most rior to proceeding. This is typically a common leading best practise so that you revert back in the unlikely event of a failure or corruption of any components during the infrastructure update.
4: Once the updates have been completed successfully installed and you’ve rebooted your compoments seperately in an agreed maintenance window the launch Citrix Studio upon a successful reboot and create a new policy selecting the Framehawk policies and adding them to your test user(s) or group(s). It is not recommended to apply this HDX policy to all users within your Site but only those whom are experiencing high packet loss ref page 12 of the Framehawk Admin Guide. Also be sure to carefully review and understand the provided technical overview of each policy setting by reading the policy description.TIP: Type in frame in the search window to find the Framehawk policies in Studio quicker.
5: Also make sure that your install and update the server, desktop VDA’s within your template images or create a new set of template(s) for your desktop and server OSes. It’s your choice :-).
6: I’d suggest that you utilise a Windows end-point for your initial tests of Framehawk, so navigate to which should auto detect your Windows endpoint and recommend that you download and install Citrix Receiver 4.3 for your Windows OS.
7: Once the Windows Citrix Receiver 4.3 has successfully installed and configure Receiver to point to your Citrix test or home lab environment and begin testing :-). TIP: Why not setup a DNS SRV record for e-mail based discovery check out –
8: Once your have configured Receiver a lunch a destkop and run DisplayStateGUI.exe * and also login into the new and update Director to check that your launch ICA/HDX session is in fact utilising using Framehawk and not DRC or the SuperCodec.
9: Once your happy proceed to snapshotting your NUG V/A and begin the firmware upgrade from your exsiting NUG build to the current supported firmware version which is 11.0 build 62.10**.
10: Once your have upgrade your NUG V/A and it is functioning as expected then proceed with the following to enable delivery of HDX Broadcast now with Framehawk via your NetScaler (Unfied) Gateway.
11: Enable DTLS in the settings of the VPN virtual server, enable and open 443 on TCP/UDP and unbind and rebind the SSL cert-key pair this second part is mandatory for more detail ref 16 of the Framehawk admin guide.
12: Deploy XAD 7.6 FP2 as your typically would utilising either the built-in wizards, manually using AppExpert e.t.c
13: Once its is successfully configured navigate to your external gateway FQDN and login to ensure that you can successfully authenticate and access your RfW powered by StoreFront 3.0 with the unified experience enabled ref – Now logout and return to the NUG Admin WebUI.
14: Now complete the following steps within the NUG Web AdminUI to enable and allow Framehawk ICA/HDX sessions through your NetScaler Unified Gateway V/A:

– Click configuration tab -> NS Gateway -> Virtual Servers now click “Edit” then click “More”
– Select to enable DTLS then click “Ok”
– Now within the VPN Server screen click e.g “1 Server Certificate”
– Write down the name of the certificate
– Select your server cert and the click on Unbind above from the list of menu options and then save/close
– You be returned to the VPN Server screen and there will be NO certs that is normal. Now click on “No Server Certificate” to reopen it
– Click on the + sign
– Find your certificate within the list and click “Select” then when prompted click “Bind”.
– Ignore and click OK on the warning error message entitled “No usable ciphers configured on the SSL vserver/serivce

15: Begin testing using Windows Receiver 4.3 from any supported Windows end-point.
16: If you wanted to enable and allow Framehawk access from iOS devices running Receiver 6.0 then please complete the following:

– On your SFS access App_Data dir of your Store in C:\inetpub\wwwroot\Citrix\Store\App_Data\
– Open the file entitled default.ica
– Under the [WFClient] section within the file add the following line of code Framehawk=On which should be under ProxyUseFQDN=Off
– Click “Save”

17: Begin testing using Citrix Receiver iOS 6 on an iOS device.
18: If you have downloaded the initial Framehawk Admin Guide is doesn’t including the remote access setup and configuration so please re-download the admin guide at – It well worth a re-read in my view to better understand Framehawk.

SYN230: HDX update: What’s new
If you want to learn what’s new and all the updates to Citrix HDX i’d suggest that you watch the following Citrix Synergy 2015 session entitled “SYN230: HDX update: What’s new”.

Supported Citrix Receivers
1: The current supported Citrix Receivers for Framehawk are the Windows Receiver 4.3+ and the iOS Receiver.
2: You can download either Receiver by visiting your OSes app store of by navigating to –
3: The current up to date Citrix Receiver feature matrix is available at –

Upgrading a NetScaler 10.5.x.n Virtual Appliance to NetScaler Unified Gateway 11.x.n

The following content is a brief and unofficial prerequisites guide to upgrade from NetScaler Gateway 10.5.x.n to NetScaler Unified Gateway 11.x.n prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names

Deployment Preparation Overview (DRAFT & MAY CONTAIN ERROR(S))
The following is an upgrade process that I utilise within my own home lab. Please ref to for an accurate and official upgrade process.

1: Download the firmware of your choice if more than one is available at – Please note that your will require either a valid Citrix account to download the firmware.
2: Upload the *.tgz file you downloaded to the following location on your NS V/A “/var/install“. Once you have confirmed its successfully uploaded disconnect and close your (s)FTP application. I use WinSCP myself which can be downloaded at – as my (s)FTP client.
3: Open a Secure Shell (SSH) connection to the NS V/A and enter in the username and password access details where prompted. Once your have successfully logged in type “shell” then type “cd /var/nsinstall” to change to the nsinstall directory and then type “ls” to confirm the uploaded file is there.
4: Now to unpack the tarball package by typing in “tar –xvzf build_X_XX.tgz”, where build_X_XX.tgz (TIP: Enter in B and press TAB to complete typing the name of the file) is the name of the NS firmware build that we will be upgrading to. Once the tarball is successfully unpacked type in “ls” verifying that you can see the extracted files from the tarball.
5: Now type in “./installns” to begin the upgrade process and where prompted type in “Y” to reboot the NS V/A
6: Move to your hypervisors mgmt. console and watch the NS CLI reboot and once you can see the NS login prompt within the CLI navigate to the NS mgmt. IP addr and login using your NS access details and verify that the NS V/A has been successfully upgrade to your firmware of choice by looking at the firmware version in the top right-hand corner of the WebUI.

Fronting XenMobile 10.x.n with NetScaler 10.5.x.n – 11.x.n

The following content is a brief and unofficial prerequisites guide to setup, configure and test a NetScaler Gateway 10.5.x.n or NetScaler Unified Gateway 11.x.n fronting a XenMobile 10.x.n XMS virtual appliance prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views expressed here are my own and do not necessarily reflect the views of Citrix.

Shortened Names

Deployment Preparation Overview (DRAFT & MAY CONTAIN ERROR(S))
0. The section also contain the pre-requite, system requirements for each virtual appliance (V/A) for NetScaler and the XenMobile Server (XMS).
1. Review the XenMobile comparability matrix at – to choose the correct NS build vs. XMS build.
2. Download the V/A’s for each at signing in with your Citrix partner access details.
3. You need an SSL certificate a wildcard is recommend for simplicity and this should be using at min a 2048-bit key for your CSR that you submit to your CA. If you are experiencing the following issue enrolment issue Profile Installation Failed “The server certificate for ‘https://’ is invalid“ the please review to help resolve this issue.
4. Generate an APNS certificate following this process at and sign your APNS certificate with Citrix at –
5. You need to be aware that the port communication between the different components has changed and also the placement of the XMS V/A in XenMobile 10. A network diagram can be viewed at – I would recommended that you please refer to the figure 4. MDM and MAM modes and also figure 5. Cluster deployments.
6. XenMobile 10 today as of writing this blog post requires the following FQDN and IP ADDR reservations to be made available when fronting a XMS V/A with NS appliance either virtual or physical 10.5.x.n and 11.x.n. Please note that for simplicity I will refer to a NetScaler Virtual Appliance V/A from here on in.

a – 1x Public routable FQDN for MDM e.g
b – 1x Public routable static IP addr that resolves to the MDM FQDN
c – 1x Public routable FQDN for MAM e.g as Secure/Worx’s apps utilise a mVPN via WorxHome now SecureHub
d – 1x Public routable static IP addr that resolves to the public FQDN MAM
e – 1x DMZ private static IP addr for Gateway for your mVPN traffic
f – 1x DMZ private static IP addr for Load-balancing the MAM traffic
g – 1x DMZ private static IP addr for MDM traffic e.g enrolling and on-going device mgmt.
h – 1x DMZ private static IP addr for the actual XMS V/A

Sample PoC Diagram
* refers to the “” ending the FQDN.

MDM (b) Firewall MDM (a/g) NetScaler Installation FQDN (h) XMS
MAM (d) MAM (c/e/f)

7. NetScaler today as of writing this blog article requires the following IP ADDR reservations for NetScaler to allow you to front Citrix e.g “XenMobile”, ShareFile e.t.c and none-Citrix workloads e.g web services, exchange servers, application servers and much more.

– 1x DMZ private static NetScaler IP addr
– 1x DMZ private static NetScaler Mgmt IP addr for mgmt. of your NS virtual or physical appliance
– 1x DMZ private static Subnet IP addr for the NetScaler to access resources within your TRU network

8. Once you have successfully deployed your XMS use the built-in 30 day licenses for the initial configuration then allocate some eval licenses against the XMS hostname. You can allocate XM 10 licenses by choosing the “MDM/Enterprise 99 User” from – Once you have licensed the XMS V/A then proceed to successfully deploy the NS V/A and login into the NS V/A mgmt. interface which will be the NS’s mgmt IP addr find the HostID or utilise the following CTX article entitled “How to Allocate NetScaler VPX Licenses” – which will be required to license your NS V/A. Once you have the HostID visiting the Citrix Evaluation Store at – and allocate as an eXaMpLe a 3000 VPX at platinum for 90 days at – and also allocate a “Universal 99 Concurrent User Connection” from – once again for 90 days.
9. Reboot both the NS, XMS V/A and validate that they are back up and running and functioning as expected using the CLI and or the Admin WebUI’s of each V/A.

Let’s Deploy XMS fronted by a NS (DRAFT & MAY CONTAIN ERROR(S))
1. Login into NS Admin WebUI and navigate to the licensing tab and validate that you have all green ticks and ensure that you have 99-104 Universal licenses if not please read step 8 above before proceeding.
2. In the bottom left-hand corner click on “XenMobile” and select “XenMobile 10” from the dropdown list on the XenMobile initial wizard welcome page.
3. Under the NetScaler for XenMobile section to the left-hand side select the following “Access through NetScaler Gateway” (MAM e.g Worx’s Apps) and “Load Balance XenMobile Servers” (MDM) and then click on Continue.
4. Enter in the IP addr e and leave the port as 443 and provide a Virtual Server Name then click Continue.
5. Select and existing wildcard card certificate or upload a new wildcard certificate then click Continue.
6. Select and existing LDAP binding or create a new LDAP binding and then click Continue. Example of a Base DN for the domain with domain users residing with the default Users folder within AD would e.f “Cn=Users,dc=axenc,dc=co,dc=za“.
7. Under Load-Balancing FQDN for MAM enter in a for the FQDN and for the IP addr beneath is enter in IP addr f and then click Continue. Please leave the defaults as is for now BUT please be aware that we will are not be performing any SSL Offloading, split tunnelling.
8. Select the same SSL cert as per step 5 above unless its NOT a wild card certificate in-which case then please upload the SSL cert for the MDM FQDN before proceeding. Click Continue.
9. Click “Add Server” under the XenMobile Servers section and enter in IP addr h and the click Continue. Note: Port for communication is 8443!
10. Click “Load Balance Device Manager/XenMobile Servers“.
11. Enter in the IP addr g and alter or leave the default name of the Virtual Server and click Continue. Note: Communication is HTTPS or SSL_Bridge as we choose not to perform HTTP or SSL Offloading in step 7 above.
12. You’ll notice that your XenMobile Servers IP addr’s are already automatically inserted under the XenMobile Servers section click Continue. Note: The Ports for communication are 443, 8443!
13. Click Done!
14. You have now successfully deployed a single XMS V/A fronted by a NS V/A. Once the wizard has completed you can click Edit under the “NetScaler Gateway” section on the top right-hand side under the Test Connectivity button to back into the wizard and modify the split tunnelling options to meet your organisations needs and or requirements.