Category Archives: ShareFile

2017 UKI #CitrixPartnerLove Challenge #7 Stop the Difference

The views expressed here are my own and do not necessarily reflect the views of Citrix.

You can download the image at https://t.co/nqooPlWElw to print.

2017 UKI #CitrixPartnerLove Challenge #6 Traffic Flows

The views expressed here are my own and do not necessarily reflect the views of Citrix.

You can download the image at https://lnkd.in/dN74-97 to print.

Why You’ll Love ShareFiles Workflows and eSignature Features

The following content is a brief and unofficial guide to testing and using ShareFile Workflows prior to implmenting it for a PoC. The views, opinions and concepts expressed are those by the author of this entry only and do not necessarily conform to industry descriptions or best practises. The views expressed here are my own and do not necessarily reflect the views of Citrix.

Shortened Names
SHAREFILE – sf
WORKFLOWS – wf
CITRIX – ctx

Understanding what is ShareFile?
Its a cloud-based file sharing service that enables users to easily and securely exchange documents from any cloud to any device or location around the global securely (HTTPS) with auditing, eSignature, document workflow, check in/out, multi-factor auth capabilties and so much more! For a good overview visit https://www.sharefile.com/features.

I love this why ShareFile video its simply brilliant! A good 2 minutes well spent that leaves you felling happy and understanding why ShareFile?

What are ShareFile Workflows?
It’s about wrapping a collaborative workflow around the actual document to acheive an outcome more efficently at a faster pace that before as all invited parties are able to collobrate on the same document by annotating with comments in any area and start a conversational thread with the ability to finally mark the annotated comment(s) as “Resolved” and the initiator of the Workflow can “Agree” to comment(s) using a simple thumbs up. Finally the invited party(s) have the ability to approve the workflow.

Approving the Workflow disables any further collaborating capabilities and therefore allows the initiator and most likely the document author to begin making necessary changes to the documents via a traditional installed, web or virtual Office app.

You can read more about – https://support.citrix.com/article/CTX213782

A Sample Workflow Explained


High resolutions image available at – https://pbs.twimg.com/media/DBZ5PcWXYAAgHfW.png:large

1. Login into https://*.sharefile.eu or .com from your favourite internet browser.
2. Once logged into select to Upload a sample Word or PowerPoint document with a screenshot of your organisations website and some text from a different webpage beneath it. If you’re already using ShareFile Drive Mapper drop it into a folder within your “Personal Folder” and if you have no idea what I am talking about you should def 100% STOP download it now from – https://www.citrix.co.uk/downloads/sharefile/clients-and-plug-ins/sharefile-drive-mapper.html and then read this CTX article before continuing to read further – https://support.citrix.com/article/CTX207791.
3.Once you’ve upload or synced the sample document refresh your internet browser and under “Recent Files” select the file and your see a preview (powered by MS Office365 Preview) of the document on the left and some actions on the right hand side look for “Initiate Approval” and select it which will open up a new browser tab with the following URL e.g https://citrixworkflows.sharefile.com/workflows/new?sharefileStreamId=xxxxxxxx where xxxxxxxx represents the ID of this workflow.
4. You’ll see a preview of your document on the right hand-side and on the left hand side your see a three workflow types (a) Get Approval (b) Collect Feedback (c) Create Request List
5. For this sample workflow we’ll going with option (a) Get Approval so select it
6. Select a due date e.g the next days date or a date within 7 days from the date of initiating the workflow so your approvers have time to respond if you aren’t able to view there calendar(s) so they can provide annotate and provide feedback on the sample document.
7. Add Approver(s) (Add people who are required to approve this document) E-mail address and Name (optional but preferred) and you can require that they have to login and I love this check box feature “Every approver must re-approve newly uploaded versions”!
8. My next favourite feature “CC’s” allows you to include any individual(s) whom can access the workflow workspace and comment, BUT they cannot approve the document workflow 🙂 !
9. You can also add message that the recipients will receive when you start the workflow.
10. Review your approvers, CC’s and message and then select to “Start Workflow”.
11. You can begin to annotate the document in your chosen area(s) including starting a conversation with all participant(s), while ShareFile e-mails them.
12. Approvers and CC’s receive an e-mail notification with a secure link too join the ShareFile workflow workspace that you have already started to work on.
13. You’ll receive notifications that participant(s) are commenting on your annotations, replying to your activity thread.
14. The Approver in this case has now agreed to all my annotations and has chosen to “Approve” the document approval workflow as he/she agrees with the suggested document changes, which the author can now begin to edit the way he/she would like to e.g online directly from ShareFile provided that you have the correct Office 365 subscription for more info check out “CTX208340 ShareFile Office Online Editing” – https://support.citrix.com/article/CTX208340.
15. You’ll also receive an e-mail notifying you that the workflow has been approved!.

There is also a simple overview of the Feedback and Approvals Workflow by Citrix ShareFile available at – https://www.youtube.com/watch?v=ASEUqcaOt7k or watch the embedded video below.

In summary ShareFile Workflows helps you and your organisation collaborate on documents more efficiently to acheive outcomes at pace with better results!

Workflow API’s
Quiet often I’m asked are there any available APIs for ShareFile Workflows? Yes! Its accessible at the following URL at – http://api.sharefile.com/rest/docs/resource.aspx?name=Workflows.

eSignature ShareFile RightSignature
The eSignature capabilities within Citrix ShareFile is powered by the acquisition of RightSignature with more details available at https://www.sharefile.com/resources/rightsignature and https://rightsignature.com.

I’ll be providing a tour of eSignatures in due course…

My Best of #CitrixSynergy 2017

The views expressed here are my own and do not necessarily reflect the views of Citrix.

Shortened Names
CITRIX USER GROUP COMMUNITY – cugc
HYPER CONVERGED INFRASTRUCTURE – hci

Introduction
Its my 5th #CitrixSynergy and this is def one of the best Synergy’s I have ever had the privilege of watching virtually from London, England. Why not in person? I prefer to watch virtually as I am to consume more content faster and translate that into content to update Citrix partners/customers in a timely manner at high level and tech deep dive where required in particular areas or topics. Finally this blog post will most likely change over the next 2-3 weeks as I consume all of the Synergy 2017 content as when/how I can.

My Highlights of the Key Notes
Vision Keynote

– 4:45 Citrix User Group Community – https://www.mycugc.org THANK YOU! Join the community today its powered by some of the most passionate Citrix and Technology advocates from around the global!
– 11:00 Red Bull Racing I’m not going to say anything you need to watch it!
– 21:45 Cloud powers the world
– 27:00 Digital Frontier Companies
– 39:00 Citrix Secure Digital Workspace with a software-defined preimeter
– 40:57 Citrix Workspace Services and a brief demonstration by Citrix’s CEO
– 42:25 SD-WAN / Gateway / WebApp Firewall / DDoS (NS 12+) as a Service
– 47:35 Citrix Analytics Service
– 1:01:00 “Better Together” and video message from Microsoft CEO Satya Nadella
– 1:12:25 Citrix + Google Chromebook (Skype for Business, Office365 and much more…)
– 1:18:00 Healthcare customer story “Partners Healthcare”

Technology Keynote

– 22:00 Unified Workspace (its Adaptive and Contextual by device/location and it changes the users published resources and its access type!) which brings together some of the most crucial aspects of todays modern apps, desktops, data & your location in a single view with casting capabilities but not demoed as instead instead*
– 29:00 *Workspace IoT (SmartSpaces) demonstration with a users own mobile phone enables an auto login to a Win 10 VD at guest location including welcoming the user based upon his/her smart phone used as there identity. Security people feel free or you will be going nuts right now!
– 32:30 Its all about layering you guessed it Citrix App Layer enabling IT to say YES! Note demo was demoed using a Samsung DEX check it out – https://www.citrix.com/blogs/2017/03/29/instant-desktop-computing-from-the-new-samsung-galaxy-s8-smartphone/
– 39:40 Workspace Appliance Program e.g HCI
– 42:35 Protect against Zero day attacks with XenServer and BitDefender which is available but is something which Citrix announced on 21/06/2016 yes thats right 2016 entitled “A Revolutionary Approach to Advanced Malware Protection” – https://www.citrix.com/blogs/2016/06/21/a-revolutionary-approach-to-advanced-malware-protection/ 21/06/2016 yes 2016!
– 47:00 Brad Anderson Corporate Vice President of the Enterprise Client & Mobility @Microsoft discusses shortly and then prefers to demonstrates our joint Citrix + Microsoft “Better Together” capabilities in Mobility, Virtualisation delivery from Azure and more.
– 1:01:38 Digital Jungle discussion its def worth your time if you about security and managing the experiences of your users workspace!
– 1:47:25 Vision of how the Digital Workspace is going to evolve

Citrix Synergy TV Breakout Sessions
The following are my current top sessions to watch in no particular order that I believe you’ll gain a lot of value out of watching BUT note that this may change as I continue to consume more of the on-demand content from Synergy 2017.

– SYN318 A to Z: best practices for delivering XenApp, XenDesktop – https://www.youtube.com/watch?v=jnnZTKBy18c&feature=youtu.be

– SYN111 – What’s new with Citrix Cloud and what’s to come – https://www.youtube.com/watch?v=C-UunHGKqLY

– SYN120 – NetScaler SD-WAN updates – https://www.youtube.com/watch?v=CdqIkCb86uU

– SYN103 – Citrix App Layering – https://www.youtube.com/watch?v=KBYoVeAYnSA

– SYN118 – What’s new with NetScaler ADC – https://www.youtube.com/watch?v=uMefjGwRMeU

– SYN121 – What’s new with NetScaler Unified Gateway – https://www.youtube.com/watch?v=-ovb4TIb5JY&t=28s

– SYN115 – Why should I use ShareFile if I already have Office 365? – https://www.youtube.com/watch?v=kESgKT7_mJw

Innovation Super Session
Awaiting for the on-demand video publication but for now I will leave you with the following Tweet as a thought or rather a reminder to make sure that you watch it if you missed it!

Synergy 2017 Advocates Blog Posts
Citrix Synergy 2017 – It’s a Wrap – See all the most important announcements listed here! By Christiaan Brinkhoff. – https://blog.infrashare.net/2017/05/29/citrix-synergy-2017-its-a-wrap-see-all-the-most-important-announcements-listed-here/

XenMobile 10.0 PoC Considerations

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile 10.0 prior to deploying in a PoC which will eventually mature to a Pilot, UAT then finally into an Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENMOBILE – xm
XENMOBILE SERVER – xms
VIRTUAL APPLIANCE – v/a
FEDERAL INFORMATION PROCESSING STANDARDs – fips
NETSCALER GATEWAY – nsg
MICROVPN – mVPN
FIREWALL – f/w
CERTIFICATE – cert
ACTIVE DIRECTORY – ad
INFRASTRUCTURE-AS-A-SERVICE – iaas
ENTERPRISE MOBILITY MANAGEMENT – emm
MOBILE CONTENT/INFORMATION MANAGEMENT – mc/im
MOBILE DEVICE MANAGEMENT – mdm
MOBILE APPLICATION MANAGEMENT – mam

Preparation & Pre-requisites (DRAFT & MAY CONTAIN ERROR(S))
1: XenMobile 10 is completely different from XenMobile 9 as it is now a single harden Linux V/A and the communication paths between the NSG and the XMS V/A are also now differently likewise setting and configuring XM 10 is different from XM 9 and its substantially more quicker and easier.
2: Never use a production NSG for a customer PoC why? When you upload the trial licenses it will require the NSG V/A to reboot which cannot be completed in a production environment without a scheduled and carefully planned maintenance window.
3: You may want to use the latest NS(G) firmware for the XM PoC to achieve the best possible outcome, result and of course to have the best optimal performance.
4: XenMobile has the ability to integration of a number of the Citrix products to form an end-2-end EMM solution that encompasses MDM, MAM, MC/IM.
5: Identify and visually understand where potentially all the components/products sit within the whole overall mobility solution. Here is a great visual reference that is clean and clear to understand – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-arch-overview-con.html for XenMobile 10.
6: Review the pre-requites and checklists if available for each product that you wish to deploy within XenMobile. I have listed a few here for you starting with all the required ports:

Architecture – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-arch-overview-con.html
System Requirements – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-system-requirements.html
Ports – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-deploy-component-port-reqs-con.html
Pre-Installation Checklist – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-xenmobile-install-checklist.html

7: Now that you have an understanding of the requirements I would strongly advise that you also read through the XenMobile security whitepaper available at – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/xenmobile-security.pdf. Although you may not actually want to read through this whitepaper even just a brief glance at the MDX technology sections will provide you with a greater understanding of mVPN’s and the MDX framework that powers all of Citrix’s Worx App’s – http://www.citrix.com/products/xenmobile/tech-info/worx-mobile-apps.html.

Pre & Post Discovery Meetings (DRAFT & MAY CONTAIN ERROR(S))
1: Ensure that you educate the organisation as to what XenMobile is and it’s capabilities surrounding enterprise mobility management commonly referred to EMM. I often find that individuals still today don’t have a very clear and defined understanding of what is MDM and MAM are so its worth educating your customer.
2: I would suggest that you setup 2-3 GoToMeeting sessions a minimum. This is to ensure and allow the organisation to ask any questions surrounding the pre-requites and system requirements of XenMobile including supporting any and all external dependencies e.g iOS Enterprise Developer Account for signing Worx’s apps. The second reason is to ensure that all the pre-requites have been completed successfully prior to you arriving onsite to complete a PoC implementation and to answer any further Q&A the organisation has. If the organisation has not completed the pre-requites then proceed with the third GoToMeeting and if the pre-requites have still not being completed successfully I would strongly advise escalating to managers on both organisations and rescheduling your PoC deployment date to an alternative date as the chances of your PoC being successfully will be less likely and as for example the required ports may not be opened correctly, certificates for securing communication are completed etc. If you do choose to proceed you’ll more than likely spend a great deal of time troubleshooting in order to successfully complete your XenMobile 10 PoC deployment.
3: Decide on a database platform note that Postgres SQL is built-in to the XMS V/A and it is recommended PoC deployments only, where as a remote MS SQL database is best utilised for production deployments.
4: Decide upon the MDM management addr for mobile devices which should be a FQDN e.g mdm.axendatacentre.com. If you intend to manage devices both in and outside of your organisation I would recommended implementing SplitDNS ref – http://en.wikipedia.org/wiki/Split-horizon_DNS.

Example of SplitDNS
///////////////////
Internal 10.10.1.1 resolves to mdm.axendatacentre.com over the corporate trusted Wi-Fi or wired ethernet
External 8.8.8.100 resolves to mdm.axendatacentre.com over 3/4G

5: Login to your Citrix My Account at – http://www.citrix.com/ locate and click Partner Central (Opens a new tab) then once the web page loads click Sales in the navigation menu bar and click on SalesIQ (Opens a new tab) then once loaded click on PoC Central scroll down and download the XenMobile PoC kit. Note only valid Citrix Partners may download content from Citrix SalesIQ.

How-to resolve – Profile Installation Failed The server certificate for “https://XM-FQDN:8443” is invalid when enrolling a device against XenMobile
1: The following error message Profile Installation Failed The server certificate for ‘https://XM-FQDN:8443″ is invalid is received when enrolling iOS 7.x.n + with XenMobile 10.
2: The issues is related to the private key within the exported *.p12/pfx certificate when exported from a Windows machine with either Certificate Manager or IIS Manager on Windows Server.
3: I would suggest that you download and run DigiCert Certificate Utility for Windows from – https://www.digicert.com/util/ on the server that originated the CSR that was used to generate a wildcard certificate. Once the tool is open find your wildcard cert and follow the steps at – https://www.digicert.com/util/pfx-certificate-management-utility-import-export-instructions.htm to export the certificate BUT before you proceed with the export please highlight the intended wildcard certificate and select “Test Key” once its completed successfully select “Export Certificate” option.
4: Upload the exported DigiCert p12/pfx cert to the XMS V/A for both the server and the SSL listener and restart the XMS V/A.
5: Once the XMS V/A is online login to both the SFP and the Admin WebUI to validate that the XMS V/A is active and responding as normal/expected.
6: Begin enrolling your iOS device and the following error message Profile Installation FailedThe server certificate for “https://” is invalid should no longer appear and you should be able to successfully enroll your iOS device.

PoC Notes & Tips
1: Deploy your first few XenMobile 10.0 PoC as single entities without the complexity of clustering, load-balancing e.t.c
2: Stick with 2 devices during a PoC to maximise your success and remember a PoC is designed to prove a concept or that a technology works as described.
3: If your deploying ShareFile On-Prem SZ remember to backup the SZKeys.txt in the root of your ShareFile Data CIFS share.
4: Support NetScaler Gateway (Builds + Versions) for XM 10.0 currently include – 10.5.55.8 MR5, 10.5.54.9 MR4, 10.5.53.9 MR3, 10.1.130 MR and 10.1.129 MR ref – http://support.citrix.com/proddocs/topic/worx-mobile-apps/xmob-10-understand-compatibilitymatrix-con.html. Please review the following CTX article entitled “FAQ: XenMobile 10 and NetScaler 10.5 Integration” available at – http://support.citrix.com/article/CTX200430 which is a great and resourceful CTX article.
5: Although this is typically not considered during a PoC Citrix provides detailed overview of scaling XenMobile 10.0 from 1000 up to 100,000 devices fronted by both VPX and MPX NS appliances – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-scaling-xm.html.

XenMobile 10.0

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile 10.0 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENMOBILE – xm
XENMOBILE SERVER – xms
VIRTUAL APPLIANCE – v/a
FEDERAL INFORMATION PROCESSING STANDARDs – fips
NETSCALER GATEWAY – nsg
VIRTUAL IP ADDRESS – vip
MOBILE APPLICATION MANAGEMENT – mam
MOBILE DEVICE MANAGEMENT -mdm

What’s New
1: XenMobile is now a single unified hardened Linux virtual appliance.
2: Complete overhaul of the Web UI which dramatically simplifies policy setup & configuration of MDM + MAM policies and it allows for the management of multiple platforms within a single policy.
3: Built-in V6 Citrix Licensing server provides a 30 day trial/evaluation and also support for remote V6 CTX licensing server.
4: Built-in PostgreSQL database recommended for PoC’s and there’s also support for remote MS SQL database which is recommended for production deployments.
4: XMS V/A includes IPtables which is a Linux firewall – http://en.wikipedia.org/wiki/Iptables.
5: XMS placement is in the DMZ. The V/A is hardened and is FIPS 140-2 compliant and remember you data is actually stored in a MS SQL database unless your utilising PostgreSQL database within the XMS V/A.
6: Traffic flow and ports between NetScaler Gateway and the XenMobile Server (XMS) have changed please refer to eDocs for an architecture overview of the changes at – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-arch-overview-con.html.
7: The Admin Web UI is now on https://XMS-FQDN:4443/. This port is not configured as part of the XenMobile 10 wizard on NetScaler Gateway build 10.5-55.8 which means that you will not be able to access the mgmt. Admin Web UI from the internet it will only be accessible from the DMZ and the TRU network dependant upon your firewall(s) ACL list.
8: New WorxHome build 10.0.3.83 which is also backwards compatible from XenMobile 10.x.n
9: The XenMobile NetScaler Connector (XNC) currently is still a separate Windows Server.
9: You can find our more by watching the following Mobility Master Class: What’s New in XenMobile 10 available from Citrix TV.

Mobility Master Class: What’s New in XenMobile 10

Mobility Master Class: Citrix XenMobile 10 Clustering & MDM Migrations

Deploying XenMobile 10
1: Review the system requirements for XMS at – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-system-requirements.html to understand the supported hypervisors, computing requirements. You should also make sure that you review the latest XM architecture as it has changed between XenMobile 9.0 vs. 10.0 and it can be viewed at – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-arch-overview-con.html. You’ll notice that the traffic between NSG and the XMS V/A has changed however all traffic externally still occurs on there traditional ports (443, 8443, 2195, 2196, 5223).
2: Review and understand the NetScaler Gateway compatible requirements at – http://support.citrix.com/proddocs/topic/worx-mobile-apps/xmob-10-understand-compatibilitymatrix-con.html.
3: Make sure that you print out and fill-in all the pre-requitses for the XMS V/A ref – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-xenmobile-install-checklist.html prior to deploying your XMS V/A on your chosen hypervisor.
4: Once you have uploaded the V/A to the hypervisor and booted it complete the onscreen instructions ref – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-install.html. Once you are finished login into the Admin WebUI replacing the IP Addr with your XMS V/A ip addr from this example https://XMS-IPADDR:4443/ and login with Administrator account your specified during the deployment and NOT admin which is used to access the XMS V/A CLI from your hypervisor only.
5: Once you’ve logged in you’ll need to have the following listed below available to successfully complete the second part of the initial XenMobile 10 deployment. There is also a pre-requites check list available at – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-xenmobile-install-checklist.html.

– Citrix v6 licensing file for either local or remote. Remote is recommended for H/A purposes.*
– Microsoft Active Directory (AD) ip addr or FQDN, base DN, domain, search service account with read-only permissions.
– Certificate in *.p12 or *.pfx format for the SSL_Listener which is used for two way secure HTTPS communication to the XMS V/A.
– APNS certificate.
– Separate MDM and MAM+ FQDN’s correctly setup in DNS with fwd and reserve lookup’s configured and each configured with its own static IP addr for external resolution.
– 3x VIP for configuring XenMobile 10 with NetScaler Gateway 10.5.55.8 +. You can find a compatible NSG V/A version and builds at – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-10-understand-compatibilitymatrix-con.html.
– MS SQL Database server configured to accept traffic and with write/read privileges to create and manage the remote XMS database.
– Mail server configuration which enables and provides workflow email messages, notifications to users e.t.c

6: Follow the onscreen prompts and once completed the web UI deployment wizard then you have successfully deployed a XMS V/A. Please not reboot the XMS V/A so that the existing SSL certificates for HTTPS can be unbound and the newly uploaded SSL cert(s) can be bound to HTTPS.
7: You may now setup a XMS cluster and configure H/A with a NSG and thereafter begin configuring your XenMobile 10.0 environment. See the H/A section for a how-to.
8: Logon to one of the XMS v/a direct IP addr e.g https://XMS:4443/ if in H/A fronted by the NSG as the XenMobile 10 wizard will not configure 4443 which means that you cannot access the mgmt interface via the VIP owned by the NSG. This means that the mgmt interface is not accessible either internally or externally on the FQDN that resolves the VIP owned by the NSG.
9: Scaling XenMobile 10.0 from 1000 up to 100,000 devices – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-scaling-xm.html.

XMS V/A High-Availability (H/A)
1: Prior to understanding how-to setup a XMS H/A or clustering you need to understand that the minimum requirements are for a remote CTX v6 licensing server and MS SQL database as the XMS V/A do not hold any user/cfg information this is all held in the remote database.
2: Once your have setup XMS follow the prompts in the CLI to enable clustering and configure the IPtables firewall ACL and then finally shut it down and clone it.
3: Rename the cloned XMS V/S to your required naming convention and then boot up the cloned XMS V/A login to the CLI and changed the IP addr and ensure that the IPtables firewall ACL ports are correctly enabled then shutdown the V/A.
4: Boot the first XMS V/A and then 60 seconds later boot the cloned XMS V/A and login to the CLI to very the cluster is enabled and then login into the XMS admin WebUI to verify that the cluster is up and functioning as expected. The original XMS V/A will be the oldest in the cluster.
5: You can now proceed to setting up the load-balancing for the XMS V/A’s with NSG to service MDM + MAM requests.

Supported NetScaler Gateway (Builds & Versions) for XM 10
1: 10.5.55.8 MR5; 10.5.54.9 MR4; 10.5.53.9 MR3; 10.1.130 MR & 10.1.129 MR ref – http://support.citrix.com/proddocs/topic/worx-mobile-apps/xmob-10-understand-compatibilitymatrix-con.html.

Deploying XM 10 with NetScaler Gateway 10.5.x.n (Draft)
1: Before beginning its worth mentioning that the way I will be describing how-to deploy XenMobile 10 in this blog article will be to utilise to external static IP addr’s + FQDN’s that are NATed to DMZ IP addr’s and I will utilising SplitDNS for device mgmt. in/outside of my TRU network. I will also be implementing the described XenMobile 10 environment below utilising an SSL Bridge although offloading includes a few more minor steps the intention of this section is aimed at helping you front your XenMobile 10.0 deployment with a NSG 10.5.x.n V/A.
2: Please review the following CTX article entitled “FAQ: XenMobile 10 and NetScaler 10.5 Integration” – http://support.citrix.com/article/CTX200430 which will aid you in been able to setup and configure load-balancing for XMS V/A’s, mVPN for Worx’s apps for XenMobile 10 with NetScaler Gateway 10.5.x.n.
3: You’ll require the following prior to be beginning:

– Correct NetScaler (Gateway) build +_ version the NSG version + build I’ll be discussing here is NetScaler Gateway 10.5.55.8 MR5 but you can check the latest supported version + builds at – http://support.citrix.com/proddocs/topic/worx-mobile-apps/xmob-10-understand-compatibilitymatrix-con.html
– 1x FQDN for MDM e.g. mdm.axendatacentre.com * that resolves to both external internet routable static IP addr and your internal assigned static IP. Please note that this should match exactly the FQDN entered in at the time of the deployment of your XMS V/A during the first phase in the CLI the text your looking for is/was “XenMobile Server FQDN:” and its highlighted in yellow. It is also worth/noting that if you have utilised an internal domain e.g xms.abc.local as the FQDN this will only manage devices internally as that FQDN is not routable on the internet so you’ll only be able to manage devices INSIDE of the trusted network to its recommended to a FQDN that is internet routable and you can utilise SplitDNS to manage traffic requests to the NSG VIP’s for XenMobile.
– 1x FQDN for MAM (Worx’s Apps) e.g. mobileapps.axendatacentre.com * that resolves to both external internet routable static IP addr and your internal assigned static IP
– 2x External routable internet IP addr’s * e.g 8.8.8.8 which most IT Pro’s utilise to ping to check internet connectivity
– 3x Internal IP addr’s owned by the NSG as VIP
|- 1x for MDM
|- 1x for MAM Gateway
|- 1x for Load-balancing IP
– Wildcard certificate for your domain e.g *.domain.com
– If your implementing SSL Offloading (HTTP) of your XenMobile traffic for MAM then you’ll require the devices cert from the XMS V/A which can be downloaded from the XMS Web AdminUI at https://xms:4443/

4: Setup the NetScaler Gateway configuration within the Admin WebUI of the XMS V/A following the process outlined at – http://support.citrix.com/proddocs/topic/xenmobile-10/xmob-netscaler-gateway.html its fairly straight forward and simple.
5: Login into the NSG Admin WebUI interface and click the XenMobile Wizard in the bottom left-hand corner and then you’ll be prompted to setup either XenMobile 9.0 or XenMobile 10.0 please selected XenMobile 10.0 and click “Get Started” to continue.
6: Ensure that “Access through NetScaler Gateway” which is for MAM, “Load Balance XenMobile Servers” which is for MAM are checked they should be by default, however you know have the opportunity to deselect either if one depending upon your deployment scenario/use case and obviously your acquired license. The current XenMobile 10 datasheet is available at –
https://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/citrix-xenmobile-the-revolutionary-way-to-mobilize-your-business.pdf.
7: Enter in your first VIP for the MAM Gateway then port should be 443 and provide a suitable name.
8: Select your previously uploaded SSL certificate (I am utilising a wildcard cert for my domain *.axendatacentre.com) or upload your SSL cert.
9: Create your (s)LDAP binding you will need to provide the following:

– LDAP IP addr
– LDAP Port default is 389
– Base DN e.g Cn=Users,dc=axendatacentre,dc=com
– Service account username & password
– Timeout default is 3 seconds
– Server Login sAMAccountName or UserPrincipalName (SuGgEsTeD)

10: Now enter in your MDM FQDN and then the Load-balancing IP addr beneath and accept the default port of 8443. You can now also choose to select HTTPS (SSL Bridge) vs. HTTP (SSL Offload) and you can choose your DNS mode including split tunnelling.
11: Select your previously uploaded SSL certificate (I am utilising a wildcard cert for my domain *.axendatacentre.com) or upload your SSL cert.
12: Enter in your MDM VIP and you’ll notice the default ports are 443, 8443 for communication to the XMS V/A(s). You’ll notice that you cannot change the SSL traffic configuration as I specified to not to perform any SSL offloading in set 10 above or its under section “Load Balancing IP address for MAM” within the NSG XenMobile 10 wizard.
13: Next add in the XMS ip addr’s of each V/A in your XMS cluster and provide an appropriate name and ports are automated defaulted to 443, 8443.
14: Click continue to finish and then click done and you have now setup and configured all your traffic for XenMobile to route through your NSG V/A and we are performing SSL Bridging in the above scenario.

Worx Features by Platform
1:The following eDocs web page lists the features by Worx app which includes WorxHome, WorxMail, WorxWeb, WorxEdit, WorxNotes, WorxTasks & WorxDesktop ref – http://support.citrix.com/proddocs/topic/worx-mobile-apps/xmob-worx-feature-platform-matrix.html.
2: Be sure to also checkout the known issues list at – http://support.citrix.com/proddocs/topic/worx-mobile-apps/xmob-worx-knownissues-con.html and it is also worth noting that as of writing this blogging entry WorxTask’s is in Tech Preview (TP) ref – http://support.citrix.com/proddocs/topic/worx-mobile-apps/xmob-worx-tasks.html.

Twitter
You should follow the XenMobile team on twitter at – https://twitter.com/xenmobile for the very latest on Worx’s apps, updates, upgrades and so much more.

Security
1: The XenMobile security web page is available at – http://www.citrix.com/products/xenmobile/tech-info/mobile-security.html.
2: The XenMobile Security whitepaper is available at – https://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/xenmobile-security.pdf and I would strongly advise that you read/review it to get a better understanding of how XenMobile can help and assist any organisations EMM (Mobility) requirements.
3: The Mobile Application Management with XenMobile and the Worx App SDK –
https://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/mobile-containers-with-citrix-mdx.pdf, this is well worth reading.

XenMobile AppController 9.0

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile AppController 9.0 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENMOBILE APPCONTROLLER – xac
CERTIFICATE SIGNING REQUEST – csr
FULLY QUALIFIED DOMAIN NAME – fqdn
RECEIVER FOR WEB – rfw
CERTIFICATE AUTHORITY – ca
STOREFRONT SERVICES – sfs
PUBLIC KEY INFRASTRUCTURE – pki
NETSCALER GATEWAY – nsg
XENMOBILE DEVICE MANAGER – xdm
XENMOBILE NETSCALER CONNECTOR – xnc
SECURE TICKET AUTHORITY – sta
DOMAIN NAME SERVER – dns

New & Existing XenMobile AppController (XAC) Admin & User Consoles
1: The NEWEST console is a troubleshooting one which is accessible at https://XAC-FQDN:4443/ControlPoint/support which allows troubleshooting of NetScaler Gateway, XenMobile Device Manager
2: Control Point Admin console – https://XAC-FQDN:4443/ControlPoint/
3: Hidden Admin console – https://XAC-FQDN:4443/admin.
4: Receiver for Web (RfW) provides user access to SaaS, Web-links – https://XAC-FQDN:4443/Citrix/StoreWeb/ natively. You can integrate XAC with StoreFront to enumerate published Windows apps, Sever and Desktop VDI’s from XenApp, XenDesktop 7.x.

What’s New
0: XenMobile Security PDF document – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/xenmobile-security.pdf and XenMobile security microsite is also available at – http://www.citrix.com/products/xenmobile/tech-info/mobile-security.html.
1: Support for Windows Phone 8.1 MDX Policy’s for WorxMail and WorxWeb only – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-worx-about-wrapper.html. You can learn how to wrap Worx apps for Windows Phone 8.1 using this useful CTX article entitled “FAQ: Windows Phone 8.1 and XenMobile 9” – http://support.citrix.com/article/CTX200105 and also watching the following video below from Citrix TV.

2: New troubleshooting and support console that can download logs, perform connectivity tests and upload logs to http://taas.citrix.com. The console is available at – https://XAC-FQDN:4443/ControlPoint/support once you have successful authenticated at https://XAC-FQDN:4443/ControlPoint/. You will need to know the admin access details for NSG, XAC and XDM in order to effectively use this console.

3: Wrapping iOS Worx Apps Video.

4: Wrapping Andriod Worx Apps including covering off how-to sign multiple *.APK files using a BASH script. Refer to the XenMobile 9.0 MDX Toolkit Documentation
– http://support.citrix.com/article/CTX140458 for more information once you have watched this video.

5: XenMobile 9.0 MDX Toolkit Documentation – http://support.citrix.com/article/CTX140458

Installing & Deploying XAC 9.0
1: Review and understand the systems & networking pre-requites of the XAC virtual appliance at – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-sysreqs-wrapper-con.html and http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-prepare-xenmobile-checklist-con.html.
2: Deploy the XAC virtual appliance on your chosen hypervisor and boot it and follow the onscreen instructions to apply the IP addr, DNS e.t.c and reboot upon completion connect to the Web Admin UI to compete the initialisation wizard thereafter you can begin to setup and configure your XAC virtual appliance and upload your MDX signed Worx apps and configure the MDX policies as required per app per supported platform. Don’t forget to generate and sign a CSR for the XAC and optionally sign it with your Enterprise CA (PoC/Demo environments) or a Public CA (PROD environments) and apply your own SSL certificate(s) to the XAC refer to – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-deploy-appc-cert-install-con.html or for a video demonstration watch – http://www.citrix.com/tv/#videos/9501.
3: Configuring MDX policies for Windows Phone 8.1 – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-mobile-apps-policies-wp81.html, iOS – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-mobile-apps-policies-ios-con-nike.html and Android – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-mobile-apps-policies-andr-con-1.html. Finally checkout how-to configure encryption policies – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-mobile-apps-encryption-con.html.
5: Once you have setup and configured your XAC appliance you can setup high-availability – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-ha-wrapper-con.html.
6: If you are looking for the XenMobile Reference Architecture please refer to http://support.citrix.com/article/CTX140433.

XenMobile Enterprise 9.0

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile Enterprise 9.0 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENMOBILE ENTERPRISE – xme
XENMOBILE CLOUD – xc
CERTIFICATE SIGNING REQUEST – csr
FULLY QUALIFIED DOMAIN NAME – fqdn
RECEIVER FOR WEB – rfw
CERTIFICATE AUTHORITY – ca
STOREFRONT SERVICES – sfs
PUBLIC KEY INFRASTRUCTURE – pki
NETSCALER GATEWAY – nsg
XENMOBILE DEVICE MANAGER – xdm
XENMOBILE APPCONTROLLER – xac
XENMOBILE NETSCALER CONNECTOR – xnc
SECURE TICKET AUTHORITY – sta
DOMAIN NAME SERVER – dns
PUBLIC KEY INFRASTRUCTURE – pki

XenMobile Security
1: Citrix have published a Whitepaper in PDF format covering the security within XenMobile which can be downloaded directly at – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/xenmobile-security.pdf there is also a new security web page within the XenMobile microsite on Citrix.com at – http://www.citrix.com/products/xenmobile/tech-info/mobile-security.html.
2: Security harden your XDM implementation leveraging Microsoft’s leading best practises I have listed below are a few (starter) useful resources. I always believe that you should challenge the way you are manage your infrastructure periodically from the services, ports, packages running on servers to the ACL at the edge of your network to ensure that you are using the latest leading best practises for monitoring, managing and supporting your environment(s) end-2-end and often this will require input from a Server, DBA SysAdmin & network engineer.

Windows Server 2008 R2
http://technet.microsoft.com/en-us/library/gg236605.aspx
http://technet.microsoft.com/en-us/library/dd548350(v=ws.10).aspx

Windows Server 2012
http://technet.microsoft.com/en-us/library/jj898542.aspx
http://technet.microsoft.com/en-us/library/hh831360.aspx.

What’s New & Fixed
1: Support for Windows Phone 8.1 MDM API’s which include but not limited to software inventory, disabling of the camera, encryption e.t.c and for a complete list checkout – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-dm-manage-config-win-81.html.
2: New MDX policies for Windows Phone 8.1 e.g Document exchange (Open In), App restrictions, iOS e.g AirDrop, Social media integration and others.

For a full list of MDX policies for iOS checkout – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-mobile-apps-policies-ios-con-nike.html and Android checkout – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-mobile-apps-policies-andr-con-1.html and for Windows Phone 8.1 checkout – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-mobile-apps-policies-wp81.html.

3: Cloud enabled Enterprise Mobility Management (EMM) powered by with XenMobile Cloud – http://www.citrix.com/products/xenmobile/tech-info/cloud.html.

4: New RBAC options within XDM to optionally ring or disown devices.
5: IPv6 licensing is now supported for XDM 9.0 check out – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-deploy-xenmobile-licenses-con.html in addition checkout this Citrix Blog article for a set by step how-to – http://blogs.citrix.com/2014/07/02/install-license-server-for-xenmobile-device-manager-in-xenmobile-9-0/.
6: XDM clustering for multiple geographic sites so that the device management service is resilient to outages at individual sites – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-dm-manage-ha-wrapper-con.html.
7: FIPS Compliance – http://support.citrix.com/proddocs/topic/xenmobile-90/clg-appwrap-fips-con.html
8: Secret Vault for iOS and Android- http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-appc-secret-vault-ios-andr.html.
9: Penetration tested by Veracode and Gotham who are specialists in digital science and research.
10: Full a complete and full list of Whats new in XenMobile 9.0 please take a look at – http://support.citrix.com/proddocs/topic/xenmobile/xmob-understand-whats-new.html.
11: XenMobile 9.0 – Issues Fixed in This Release – http://support.citrix.com/article/CTX140926.
12: Always check in with the XenMobile data sheet for the most up to date and accurate features and details for XenMobile vs. editions at – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/citrix-xenmobile-the-revolutionary-way-to-mobilize-your-business.pdf?accessmode=direct.

Citrix Support Forums for XenMobile 9.0
You can access the latest online Citrix Discussions focused on XenMobile 9 at – discussions.citrix.com/forum/1487-xenmobile-9x/ and previous discussions can be found at – discussions.citrix.com/forum/302-xenmobile/, including ZenPrise 7.x.

Wrapping & Deploying Worx Mobile Apps for Windows Phone 8.1
1: This CTX article provides a lot of detailed pre-requites & FAQ – http://support.citrix.com/article/CTX200105.
2: http://blogs.citrix.com/2014/07/11/deploying-worx-home-and-worx-apps-to-windows-phone-8-1-with-xenmobile/.

Xenmobile 9 Basic Upgrade Video Demonstration

XME Supported Mobile OS/Hardware Platforms
http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-understand-device-platforms.html

XenMobile 9.0 MDM Policies by OS Platform
http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-understand-device-platform-matrix.html

XenMobile 9.0 Compatibility Matrix
Currently the following NetScaler (Gateway) builds are supported for XenMobile 8.6 and 8.7 is 10.1.124.1308.e and for XenMobile 9.0 the following are supported 10.1.126.1203.e, 10.1.124.1308.e and 10.5 reference – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-understand-compatibilitymatrix-con.html.

Worx features by Platform
http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-understand-worx-feature-platform-matrix-con.html

XenMobile Public Key Infrastructure (PKI) Integration
Prior to implementing with XME I would suggest that you review and read through the PKI section in eDocs for XenMobile Enterprise 9.0 at – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-dm-manage-security-pki-overview-con.html so that you are aware and familiar with the supported PKI capabilities supported by XenMobile 9.0. The below embedded videos are from Citrix TV and covering the Symantec PKI integration for XenMobile 9.0.


http://www.citrix.com/tv/#videos/10866XenMobile Symantec PKI Integration Part1


http://www.citrix.com/tv/#videos/10867XenMobile Symantec PKI Integration Part2

Deploying & Hardening XenMobile 9.0
1: Here is a really good blog article to help you understand XenMobile Bandwith requirements and considerations – http://blogs.citrix.com/2014/07/10/xenmobile-bandwidth/ .
2. How-to restrict the XDM admin console from the Internet when using SSL Offloading – http://blogs.citrix.com/2014/07/14/mobility-experts-restrict-xenmobile-device-manager-admin-web-console-access-from-internet-when-deployed-in-ssl-offload-mode/.

XenMobile Enterprise 8.7

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile Enterprise 8.7 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENMOBILE DEVICE MANAGER – xdm
CERTIFICATE SIGNING REQUEST – csr
APPLE PUSH NOTIFICATION SERVICE – apns
FULLY QUALIFIED DOMAIN NAME – fqdn
SECURE LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL – (s)ldap
SHAREFILE STORAGEZONE CONNECTOR – szc
XENMOBILE APPCONTROLLER – xac
RECEIVER FOR WEB – RfW
OUT OF OFFICE – ooo
GoToMeeting – gtm
GoToAssist – gta
VOLUME PURCHASE PROGRAM – vpp

What’s New The Highlights
0: XenMobile Datasheet by edition – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/citrix-xenmobile-the-revolutionary-way-to-mobilize-your-business.pdf.
1: Enrol and manage Windows 8.1 including support for Windows 8.1 RT devices – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-understand-device-platforms.html.
2: Worx Home supports pin history & pin cycle checking.
3: Configure and deploy VPN cfgs to Amazon devices.
4: Shared Device Management support allows for multiple individuals to leverage MDM capabilities once the device has been enrolled.
5: ShareFile Single Sign-On (SSO) support from Worx apps to ShareFile.
6: Samsung SAFE devices support with the ability to now install Worx Home on Samsung SAFE devices running Android 4.3 and later from Google Play Store.
7: Support for Android 4.4.
8: Battery retention has improved by approximately 15% please see point 11 below for further details re the Tests performed.
9: IBM notes support for iOS in WorxMail.
10: Geo-fencing on Android.
11: A full and complete list of what’s new check out – http://support.citrix.com/proddocs/topic/xenmobile/xmob-understand-whats-new.html.
12: For a list of the new features in NetScaler Gateway 10.1 and NetScaler Gateway 10.1, Build 120.1316.e check out – http://support.citrix.com/proddocs/topic/netscaler-gateway-101/ng-whats-new-con.html.

XenMobile Compatibility Matrix
1: http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-understand-compatibilitymatrix-con.html

Supported Device Platforms
1: http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-understand-device-platforms.html

Pre-requisites, Understanding & Installing The XenMobile 8.7 Components End-2-End for a PoC or a Demo Environment (DRAFT & MAY CONTAIN ERROR(S))
1: I would suggest starting with this really good XenMobile Architectural XenMobile Diagram to help you understand where the individual components are placed between the DMZ and TRUSTED network, so check out – http://www.citrix.com/content/dam/citrix/en_us/images/info-graphics/xenmobile_architecture_86.png.
2: Understanding how-to deploy the components of XenMobile Enterprise – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-understand-deploy-architecture-wrapper-n-con.html and I would also recommend reading and understanding what ports are required to be enabled at – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-deploy-component-port-reqs-n-con.html and the review the XenMobile and NetScaler Gateway checklists which are available at – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-prepare-xenmobile-checklist-con.html & http://support.citrix.com/proddocs/topic/netscaler-gateway-101/ng-checklist-10-1-con.html#ng-checklist-10-1-con followed understanding the Server & SAML certificate types/ requirements of XenMobile at – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-deploy-certificates-con.html.
3: Sizing & System requirements for XenMobile 8.7 – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-deploy-netscaler-gateway-reqs-con.html.
4: How-to Install XenMobile 8.7 – . If your looking to install XDM at – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-deploy-device-manager-install-steps-tsk.html for a basic visual overview and instructions. To deploy the XAC use the following to pre-configure the XenMobile AppControllers IP addr, DNS e.t.c at – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-appc-change-ipaddress-tsk.html followed by configuring the XAC using the initial web UI wizard at – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-appc-setup-wizard-tsk.html. To configure your NetScaler Gateway for the first time use – http://support.citrix.com/proddocs/topic/access-gateway-hig-appliances/ag-vpx-configure-basic-settings-wrapper-con.html, http://support.citrix.com/proddocs/topic/netscaler-gateway-101/ng-config-ng-with-wizards-con.html followed by the initial NSG wizard accessible via the Web UI upon your initial login – http://support.citrix.com/proddocs/topic/netscaler-gateway-101/ng-config-first-time-new-install-con.html thereafter you can use the built-in NSG wizard to setup and configure remote access to the XAC for XenMobile Enterprise 8.7 at – http://support.citrix.com/proddocs/topic/netscaler-gateway-101/ng-install-simplified-config-tsk.html.

Enrolling by OS Platform
0: Prior to enrolling any devices you may want to consider configuring enrolment options – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-connect-config-enroll-mode-con.html.
1: iOS – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-ios-user-enroll-device-tsk.html.
2: Android – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-android-user-enroll-device-tsk.html.
3: Windows – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-enroll-users-devices-wrapper-con.html.
4: Symbian – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-symbian-user-enroll-device-tsk.html.

Performing In-place Upgrades from XenMobile 8.6 to 8.7
I performed in-place upgrade within my XenMobile Enterprise demo environment running Hyper-v on Microsoft Windows Server 2012 from 8.6 to 8.7 without any issues or errors.
2: Note: As I focus on PoC’s and Training the upgrade methods used below will be different for production environments and you should follow – http://support.citrix.com/article/CTX140444 for steps and guidance.
3: My current setup consisted of a XDM cluster on 8.6 l/b by NetScaler using a MS SQL database. I first performed a snapshot of both XDM servers and the SQL database then proceeded to shutdown the second XDM server and executed the XDM 8.7 software package on the primary XDM server which detected a XDM installation and performed a in-place upgrade following the onscreen steps. Once the software update completed I rebooted the VM and then proceeded to connect to XDM mgmt. Web UI locally via https://localhost/zdm on the primary XDM server desktop (Note: SSL error is normal as the FQDN your connected to is not for localhost but your organisations FQDN) and then logged in as a XDM admin then as domain user to verify that the SHP works as expected. Next shutdown the primary XDM server and boot the secondary XDM server and repeat the process above and once verified shutdown the secondary XDM server and boot the primary XDM server wait a few minute then boot the secondary XDM server and what a few minutes and then login to https://XDM-FQDN/Instance/helper.jsp e.g https://mdm.citrix.lab/zdm/helper.jsp and verify that the XDM cluster is active and working, next login to https://XDM-FQDN/Instance/ as a domain user and then a XDM admin to verify that everything works as expected e.g send a notification to an iOS device or enrol a new device using a custom deployment policies to verify your XDM is functioning as expected.

Security
1: XenMobile FIPS 140-2 Compliance – http://support.citrix.com/proddocs/topic/xenmobile-87/clg-appwrap-fips-con.html.
2: XDM supports internal and external PKI’s – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-security-pki-overview-con.html; SAML – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-securityid-saml-con.html.
3: Network Access Control (NAC) – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-securityid-configurenac-con.html.
4: Client certificate based authentication using Configuring Device Manager with Microsoft Active Directory Certificate Services – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-securityid-configdm-mscertificatesvs-con.html.

Synergy SYN308: Citrix Mobility & Desktop Integration