{"id":1896,"date":"2017-01-27T06:37:43","date_gmt":"2017-01-27T06:37:43","guid":{"rendered":"http:\/\/axendatacentre.com\/blog\/?p=1896"},"modified":"2017-02-12T08:24:08","modified_gmt":"2017-02-12T08:24:08","slug":"understanding-the-citrix-cloud-its-services-architecture-connectors","status":"publish","type":"post","link":"http:\/\/axendatacentre.com\/blog\/2017\/01\/27\/understanding-the-citrix-cloud-its-services-architecture-connectors\/","title":{"rendered":"Understanding the Citrix Cloud, its Services, Architecture &#038; Connectors (Draft)"},"content":{"rendered":"<p>The following content is a brief and unofficial prerequisites guide to better understand Citrix Cloud, Connector technology and the overall architecture required to setup, configure and test delivering virtual apps and desktops powered by XenApp &#038; XenDesktop Service prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessarily conform to industry descriptions or best practises. The views expressed here are my own and do not necessarily reflect the views of Citrix.<\/p>\n<p><strong>Shortened Names<\/strong><br \/>\nHIGH-AVAILABILITY &#8211; h\/a<br \/>\nXENAPP \u2013 xa<br \/>\nXENDESKTOP \u2013 xd<br \/>\nXENAPP\/XENDESKTOP \u2013 xad<br \/>\nVIRTUAL DELIVERY AGENT \u2013 vda<br \/>\nHIGH DEFINITION EXPERIENCE \u2013 hdx<br \/>\nCITRIX CLOUD &#8211; cc<br \/>\nINFRASTRUCTURE AS A SERVICE &#8211; iaas<br \/>\nCITRIX CLOUD CONNECTOR &#8211; connector<\/p>\n<p><strong>The Three Primary Cloud Types (Draft Section)<\/strong><br \/>\nFirstly i&#8217;d like to provide my definition of public, private vs. hybrid cloud and in my personal view things like SaaS, PaaS have naturally been spin out or off from IaaS e.g Public Cloud.<\/p>\n<p><i><u>Public Cloud<\/u><\/i> is whereby a ISP provides you with SPLA licensing (OS, Application, Service), compute, storage and network capabilities which in turn enables you to create your very own VM instances running in a virtual datacentre on the ISP&#8217;s h\/w and example providers may include AWS, Azure, Google Cloud Platform e.t.c<\/p>\n<p><i><u>Private Cloud<\/u><\/i> is where you the organisation owns there own OS, Application or Service licenses as well as the physical hardware that allows you to create your own VM instances within your virtual datacentre. In this scenario the h\/w is could (a) be purely Colocatied (Colocation) at ISP with or without managed services over and above the Colocation and example providers could include Rackspace, Qubems, Peer1 or (b) your h\/w is hosted within your own custom and purpose built data centres facility or comms room dependant upon the organisations size and IT\/Technology requirements.<\/p>\n<p><i><u>Hybrid Cloud<\/u><\/i> is when public and private clouds are connected securely over a IPSec R\/A, L2L or SSL VPN connection.<\/p>\n<p><strong>What is and how Citrix Cloud works<\/strong><br \/>\nCitrix Cloud is an evergreen, managed control plane from Citrix that provides the traditional Citrix management technologies to delivery e.g Virtual Apps &#038; Desktops as Services thereby reducing overhaul management updates &#038; upgrades. This means that Citrix is responsible for the availability of your Citrix management infrastructure in there Control Plane including ensuring that it is on the latest up to day and production version of e.g XAD to deliver DaaS and or virtual apps. Citrix customers and partners are responsible for what is known as a resource location which is where your apps, network and data resides and can exist in a public, private or hybrid cloud deployment scenario and each resource location is securely connected to the control plane using the Citrix Cloud Connector which initiates an outbound HTTPS connection so your completely in control of your apps, network &#038; data within your resource location(s) at all times.<\/p>\n<p>If I have not technically explained what is and how Citrix Cloud works successfully then please feel free to watch the below embedded YouTUBE video.<\/p>\n<p><b>Please note that <i>Citrix Workspace Cloud<\/i> is now know as <u><font color=\"#00d2ff\">Citrix Cloud<\/font><\/u><\/b><br \/>\n<iframe loading=\"lazy\" width=\"560\" height=\"315\" src=\"https:\/\/www.youtube.com\/embed\/rxYAssjhF88\" frameborder=\"0\" allowfullscreen><\/iframe><\/p>\n<p><strong>Citrix Cloud Services as of Jan 2017<\/strong><br \/>\nThe following is my own technical spin\/view of each of the Citrix services you can review the Citrix official view of each service at &#8211; <a href=\"https:\/\/www.citrix.com\/products\/citrix-cloud\/services.html\" title=\"https:\/\/www.citrix.com\/products\/citrix-cloud\/services.html\">https:\/\/www.citrix.com\/products\/citrix-cloud\/services.html<\/a>.<\/p>\n<p><i><font color=\"#0fd29c\">XenApp and XenDesktop Service<\/font><\/i> &#8211; HDX virtual app &#038; desktop delivery from any supported resource location running server\/workstation VDA(s) while all the XenApp\/XenDesktop mgmt infrastructure (Studio\/Director) resides in your tenant\/account at <a href=\"https:\/\/citrix.cloud.com\" title=\"https:\/\/citrix.cloud.com\">https:\/\/citrix.cloud.com<\/a>. <\/p>\n<p><i><font color=\"#0fd29c\">XenMobile Service<\/font><\/i> &#8211; Deploy Secure Apps (MAM), MDM to control your organisation devices with no need to deploy the XenMobile v\/a even at your resource location all you need is either an IPSeC VPN tunnel or the Connector to enumerate users in AD to be assigned to delivery groups. <\/p>\n<p><i><font color=\"#0fd29c\">ShareFile Service<\/font><\/i> &#8211; Follow-me data now controlled within one WebUI.<\/p>\n<p><i><font color=\"#0fd29c\">NetScaler Gateway Service<\/font><\/i> &#8211; Provides a simple and easy deployment method to gain external remote access to virtual apps &#038; desktops from your resource location(s) via the Citrix Cloud Connector.<\/p>\n<p><i><font color=\"#0fd29c\">Smart Tools Service<\/font><\/i> previously Lifecycle Management &#8211; Design, build, automate, auto check &#038; update your resource locations with Citrix validated blue prints.<\/p>\n<p><i><font color=\"#0fd29c\">Secure Browser Service<\/font><\/i> &#8211; Provides a secure remote virtual browser(s) to access web (internal vs. external), SaaS apps from the Citrix Cloud with zero configuration, with only a link to access your published web apps via the HTML5 Receiver.<\/p>\n<p><i><font color=\"#0fd29c\">Citrix Cloud Labs<\/font><\/i> &#8211; My personal favourite as this area of Citrix Cloud allows you get to test out some of the latest Citrix Innovations from our Labs team as services e.g AppDNA Express; Citrix Provisioning for Microsoft Office 365; IoT Automation; Citrix Launch for Microsoft Access; XenMobile MDX Service and Session Manager<\/p>\n<p><strong>Connector Architecture &#038; Security<\/strong><br \/>\nThe following diagram depicts the H\/A deployment of Citrix Cloud Connector for use with the <a href=\"https:\/\/www.citrix.com\/products\/citrix-cloud\/services.html\" title=\"https:\/\/www.citrix.com\/products\/citrix-cloud\/services.html\">XenApp and XenDesktop Service<\/a> from Citrix Cloud. Please note that this is a simple architectural diagram that does not include a NetScaler in resource location so the assumption is that you users will connect to their virtual apps and desktops either from within the actual Resource Location or via the NetScaler Gateway service hosted and managed by Citrix Cloud. My personal preference is to leverage a NetScaler physical or virtual appliance within your resource location as the benefits of a NetScaler far exceed and go above and beyond that of a simple ICA Proxy gateway for XenApp\/XenDesktop. Perhaps a follow-up blog article why I presume NetScaler in the resource location from my personal view point only or I may decide to update this blog article.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/pbs.twimg.com\/media\/C3Htv1fW8AAG5sA.png\" title=\"https:\/\/pbs.twimg.com\/media\/C3Htv1fW8AAG5sA.png\" \/><\/p>\n<p>To better understand how to best secure or harden your Cirix Cloud implmentation and its services please refer to &#8211; <a href=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/overview\/get-started\/secure-deployment-guide-for-the-citrix-cloud-platform.html\" title=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/overview\/get-started\/secure-deployment-guide-for-the-citrix-cloud-platform.html\">http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/overview\/get-started\/secure-deployment-guide-for-the-citrix-cloud-platform.html<\/a> for leading best practises, process &#038; procedures and configuration requirements.<\/p>\n<p><strong>Citrix Cloud Connector<\/strong><br \/>\nThe following is deep dive overview of Citrix Cloud connector technology for all the services with the exception of the Smart Tools service which leverages its own connector which is used to check your Citrix workloads, scale up\/down and or even build or tear down workloads in resource location(s) via blueprints.<\/p>\n<p><i><b><u>Installation &#038; Troubleshooting<\/i><\/b><\/u><br \/>\nYou must download and <b>only install<\/b> the Citrix Cloud Connector for your resource location from &#8220;Identity and Access Management&#8221; that matched your domain forest, don&#8217;t mix and match these! The installation is fairly straight forward and simple as descriobed and outlined at <a href=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/citrix-cloud-connector\/installation.html\" title=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/citrix-cloud-connector\/installation.html\">http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/citrix-cloud-connector\/installation.html<\/a>, once the installation completes wait for the connectvity test to pop-up and complete successfully prior to navigating back to Citrix Cloud to validate that the Connector has scuessfully registered with Citrix Cloud+.<\/p>\n<p>You can also perform automated installation leveraging the following command line arguments when installing the Connector &#8220;<b><u><i>CWCConnector.exe<\/i><\/u><\/b>&#8221; <u> \/q \/Customer:Customer \/ClientId:ClientId \/ClientSecret:ClientSecret \/ResourceLocationId:ResourceLocationId \/AcceptTermsOfService:true<\/u>.<\/p>\n<p>Although the Connector communicates outbound on HTTPS 443 it make also require one or more of the following ports <i>outbound only<\/i> as described at &#8211; <a href=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/overview\/get-started\/secure-deployment-guide-for-the-citrix-cloud-platform.html\" title=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/overview\/get-started\/secure-deployment-guide-for-the-citrix-cloud-platform.html\">http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/overview\/get-started\/secure-deployment-guide-for-the-citrix-cloud-platform.html<\/a> for one or more of the Citrix Cloud Services so please consultant the documenation for each Service carefuly for high security enviroments to ensure that the organisations firewall ACL&#8217;s for the PoC are correctly configured.<\/p>\n<p>You can install hypervisor tools, anti-virus software (Tested as of 26\/10\/2016++ McAfee VirusScan Enterprise + AntiSpyware Enterprise 8.8) on your VM instances that have the Citrix Cloud Connector technology installed however it is not recommended to install any other software or unnecessary system services nor should you allow any domain users access unless they are a Domain or System administrator of the Citrix environment. In summary treat these Connectors as you would your XAD Controller(Broker). <\/p>\n<p>The installation logs are available at &#8220;<u><i>%LOCALAPPDATA%\\Temp\\CitrixLogs\\CloudServicesSetup<\/i><\/u>&#8221; and post the installation its consolidated to the following location &#8220;<u><i>%ProgramData%\\Citrix\\WorkspaceCloud\\InstallLogs<\/i><\/u>&#8220;.<\/p>\n<p><i><b><u>Understanding Credential Handling<\/i><\/b><\/u><br \/>\nComing&#8230;http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/xenapp-and-xendesktop-service\/technical-security-overview.html<\/p>\n<p><i><b><u>Monitoring your Citrix Cloud Services<\/i><\/b><\/u><br \/>\n1. <a href=\"http:\/\/status.cloud.com\/\" title=\"http:\/\/status.cloud.com\/\">http:\/\/status.cloud.com\/<\/a> is your friend and will provide you with vital up to date information about the Citrix Cloud platform (control plane or SaaS tier) and each of its Services e.g XenApp and XenDesktop Service or Smart Tools.<br \/>\n2. Monitor the following Connector services described below ++<br \/>\n3. The leading best practises is for the Citrix Cloud Connectors to not be offline longer than two weeks as the connectors are regularly updated from Citrix Cloud with the latest updates (Evergreen) which is why each resource location requires at a bare min 2x or a pair of Connectors.<\/p>\n<p><i><b><u>Connectivity &#038; High-Availability<\/i><\/b><\/u><br \/>\nThe Citrix Cloud Connector firstly should always be implemented in pairs at a minimum within any resource location and installed onto either Windows Server 2012 R2 or 2016 AD joined VM instances. The connectors are stateless and brokering requests are load-balanced via Citrix Cloud to the connectors within your resource location(s) and if a connector does not respond the queued tasks are redistributed to the remaining connector(s). As the connectors are stateless this also means that they do store any mgmt configuration for Citrix Workloads at the resource location as this is held within the Citrix Cloud by the Service that you are utilising e.g XenApp and XenDesktop Service.<\/p>\n<p>+If you setup a PoC with a single Connector it will probably display as amber for a period of time prior to turning green as you have only configured 1x Connector for your resource location. You can check your Connector status for your resource locations by navigating from <a href=\"https:\/\/citrix.cloud.com\/\" title=\"https:\/\/citrix.cloud.com\/\">https:\/\/citrix.cloud.com\/<\/a> to <a href=\"https:\/\/citrix.cloud.com\/identity\" title=\"https:\/\/citrix.cloud.com\/identity\">https:\/\/citrix.cloud.com\/identity<\/a> and under &#8220;<b>Domains<\/b>&#8221; select your domain forest(s) and expand it and you can review your Connectors name e.g servername.dommain e.g connector1.x1co.eu and its status (red, amber or green).<\/p>\n<p>The leading best practise for h\/a at your resource location is for your Citrix Cloud Connectors to be implemented as N+1 for redundancy &#8211; <a href=\"https:\/\/en.wikipedia.org\/wiki\/N%2B1_redundancy\" title=\"https:\/\/en.wikipedia.org\/wiki\/N%2B1_redundancy\"> &#8211; https:\/\/en.wikipedia.org\/wiki\/N%2B1_redundancy<\/a>.<\/p>\n<p><i><b><u>Logs &#038; Services++ of the Connector<\/i><\/b><\/u><br \/>\nThe Connector logs are stored at &#8220;<u><i>C:\\ProgramData\\Citrix\\WorkspaceCloud\\Logs or use %ProgramData%\\Citrix\\WorkspaceCloud\\Logs<\/i><\/u>&#8221; for verifying ongoing communication and helping with troubleshooting. Once the log(s) size exceeds a certain threshold its deleted BUT Administrators are able to control the log retention size by adjusting the following entry in the Windows registry &#8220;<b>HKEY_LOCAL_MACHINE\\SOFTWARE\\Citrix\\CloudServices\\AgentAdministration\\MaximumLogSpaceMegabytes<\/b>&#8221; to meet your organisations logging\/auditing requirements.<\/p>\n<p>The core four primary functions\/roles of the Connector are <b>Authentication<\/b>, <u>Proxy<\/u>, <i>Provisioning<\/i> and <u>Identity<\/u> which are powered by the following Citrix Cloud services listed below (as of Jan 2017). You can view a detailed architecture technical diagram of the Connector under the XenApp and XenDesktop Service online documentation at &#8211; <a href=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/xenapp-and-xendesktop-service\/technical-security-overview.html\" title=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/xenapp-and-xendesktop-service\/technical-security-overview.html\">http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/xenapp-and-xendesktop-service\/technical-security-overview.html<\/a>.<\/p>\n<p><u>Connector Functions\/Roles<\/u><br \/>\nFor a more accurate diagram please check out &#8211; <a href=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/xenapp-and-xendesktop-service\/technical-security-overview.html\" title=\"http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/xenapp-and-xendesktop-service\/technical-security-overview.html\">http:\/\/docs.citrix.com\/en-us\/citrix-cloud\/xenapp-and-xendesktop-service\/technical-security-overview.html<\/a><\/p>\n<table border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\n<tbody>\n<tr>\n<td style=\"width: 25%; background-color: rgb(84, 252, 252); text-align: center; font-weight: bold;\">Authentication<\/td>\n<td style=\"width: 25%; background-color: rgb(51, 204, 255); text-align: center; font-weight: bold;\">Proxy<\/td>\n<td style=\"width: 25%; background-color: rgb(0, 204, 204); color: white; text-align: center; font-weight: bold;\">Provisioning<\/td>\n<td style=\"width: 25%; text-align: center; font-weight: bold; background-color: rgb(153, 153, 153);\"><span\n style=\"color: white;\">Identity<\/span>\n      <\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<div style=\"text-align: center;\">\u2195<\/div>\n<table style=\"text-align: left; width: 100%;\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\n<tbody>\n<tr>\n<td style=\"font-weight: bold; text-align: center;\">NetScaler<br \/>Unified Gateway<\/td>\n<td style=\"font-weight: bold; text-align: center;\">StoreFront<br \/>(Optional)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\n      <\/td>\n<td colspan=\"2\" rowspan=\"1\">\n<div style=\"text-align: center;\">\u2195\n      <\/div>\n<table style=\"text-align: left; width: 100%;\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\n<tbody>\n<tr style=\"font-weight: bold; color: rgb(102, 204, 204);\" align=\"center\">\n<td rowspan=\"1\" colspan=\"2\"><span style=\"color: black;\">Hypervisor&nbsp;<\/span><\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: center; color: black;\"><span style=\"font-weight: bold;\">Server VDA<\/span><br \/> &nbsp;Server 2012 R2, 2016<\/td>\n<td style=\"text-align: center; color: black;\"><span style=\"font-weight: bold;\">Desktop VDA<\/span><br \/>Windows 10<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<div style=\"text-align: center;\">\u2195<\/p><\/div>\n<table style=\"font-weight: bold; color: black; width: 100%; text-align: left; margin-left: auto; margin-right: auto;\"  cellpadding=\"0\" cellspacing=\"0\">\n<tbody>\n<tr>\n<td>Active Directory, DNS<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<tr>\n    <\/tr>\n<tr>\n    <\/tr>\n<tr>\n    <\/tr>\n<tr>\n    <\/tr>\n<\/tbody>\n<\/table>\n<p><i><b><u><font color=\"#21c921\">I&#8217;ll update this section with what each of the Connector services actually does<\/font><\/u><\/b><\/i><\/p>\n<p>Citrix Cloud AD Provider<br \/>\nCitrix Cloud Agent Logger<br \/>\nCitrix Cloud System<br \/>\nCitrix Cloud WatchDog<br \/>\nCitrix Cloud Credential Provider<br \/>\nCitrix Cloud WebRelay Provider<br \/>\nCitrix Cloud Config Synchronizer Service<br \/>\nCitrix Cloud High Availability Service<br \/>\nCitrix Cloud NetScaler Cloud Gateway<br \/>\nCitrix Cloud Remote Broker Provider<br \/>\nCitrix Cloud Remote HCL Server<br \/>\nCitrix Cloud Session Manager Proxy<\/p>\n<p><strong>Citrix Cloud PoC Guide for the XenApp and XenDesktop Service<\/strong><br \/>\nI have writen a fairly detailed blog article describing how-to deploy the <a href=\"http:\/\/axendatacentre.com\/blog\/2016\/11\/15\/deploying-a-citrix-cloud-xenapp-and-xendesktop-service-poc\/\" title=\"http:\/\/axendatacentre.com\/blog\/2016\/11\/15\/deploying-a-citrix-cloud-xenapp-and-xendesktop-service-poc\/\">XenApp and XenDesktop Service<\/a> here.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The following content is a brief and unofficial prerequisites guide to better understand Citrix Cloud, Connector technology and the overall architecture required to setup, configure and test delivering virtual apps and desktops powered by XenApp &#038; XenDesktop Service prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[568,1,687,567,678,569,681,272,66,691,694,680,679,693,689,692,688,690],"tags":[580,797,695,425,725,790,798,795,792,582,793,794,791],"class_list":["post-1896","post","type-post","status-publish","format-standard","hentry","category-apps-desktop-service","category-ctx","category-citrix-cloud","category-citrix-workspace-cloud","category-cloud","category-cwc-connector","category-hybrid-cloud","category-iaas","category-infrastructure","category-lifecycle-management-service","category-netscaler-gateway-service","category-private-cloud","category-public-cloud","category-secure-browser-service","category-sharefile-service","category-smartscale","category-xenapp-and-xendesktop-service","category-xenmobile-service","tag-citrix-cloud","tag-cwcconnector-exe","tag-deploying-a-citrix-cloud-xenapp-and-xendesktop-service-poc","tag-https","tag-https-xendesktop-net","tag-httpscitrix-cloud-com","tag-n1","tag-netscaler-gateway-service","tag-sharefile-service","tag-xenapp-and-xendesktop-service","tag-xenapp-essentials-service","tag-xendesktop-essentials-service","tag-xenmobile-service"],"_links":{"self":[{"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/posts\/1896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/comments?post=1896"}],"version-history":[{"count":64,"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/posts\/1896\/revisions"}],"predecessor-version":[{"id":2066,"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/posts\/1896\/revisions\/2066"}],"wp:attachment":[{"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/media?parent=1896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/categories?post=1896"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/axendatacentre.com\/blog\/wp-json\/wp\/v2\/tags?post=1896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}