Cloud Gateway FINAL DRAFTv1

8/2/2019 Cloud Gateway FINAL DRAFTv1

1/42

White Paper | Citrix CloudGateway Express 1.2

www.citrix.com

Citrix CloudGateway Express 1.2

Proof of Concept Implementation Guide


2/42

Page 2

Contents

Contents ..............................................................................................................................................................

Introduction ........................................................................................................................................................

Architecture ......................................................................................................................................................

Installation and Configuration ......................................................................................................................... 5

Section 1: Receiver Storefront Server Initial Deployment ....................................................................... 6

Receiver Storefront Initial Server Configuration ................................................................................... 9

Create Authentication Service ................................................................................................................ 14

Create Store ...............................................................................................................................................

Section 2: Configure Second Receiver StoreFront Server ..................................................................... 20

Section 3: Accessing Applications through Receiver .............................................................................. 24

Receiver for Web ...................................................................................................................................... 2

Section 4: Configure Citrix Access Gateway Authentication ................................................................ 29

Section 5: NetScaler Load Balancing Configuration ............................................................................... 36

Design Considerations .................................................................................................................................... 4

Remote Users ................................................................................................................................................... 4

Conclusion ........................................................................................................................................................

Acknowledgments............................................................................................................................................ 4

References .........................................................................................................................................................

Revision History ............................................................................................................................................... 4


3/42

Page 3

IntroductionCitrix CloudGateway Express provides users with a common access experience across devices.Each CloudGateway Express user is able to subscribe to their favorite application and desktopresources, these favorite resources then automatically follow the user between devices. With Citrix

Web Interface reaching end-of-life in 2015, it is important that administrators become familiar withCloudGateway Express to facilitate a successful transition between products.

CloudGateway Expresss new modular architecture improves upon the existing design of WebInterface. It includes a new user authentication method which directly queries Active Directory rather than the existing double-hop Web Interface process where user credentials are sent from the

Web Interface server to the XML broker who then negotiates authentication with the DomainController. CloudGateway Express also makes the process of deploying multiple servers easierthrough its configuration synchronization feature.

Customers that require a single point of access and self-service for Windows, Web, and SaaSapplications should utilize the Enterprise version of CloudGateway. CloudGateway Enterprise is apremium product that must be purchased. CloudGateway Express is a no-cost product that is freely available for download for Citrix XenDesktop and XenApp customers. For a complete list of bothCloudGateway Express and Enterprise features, please reference the CloudGateway section of Citrix.com.

This document will guide the reader through the steps required to create a successful CloudGateway Express proof of concept environment. To allow users and administrators transition time to becomefamiliar with CloudGateway Express as compared to the well-known Web Interface, Citrix

Consulting recommends that a small subset of Windows users should be selected for theCloudGateway Express proof of concept in parallel to an existing Web Interface environment. Toexperience the full self-service ability of CloudGateway Express this user group should primarily access XenApp published applications from multiple locations both inside and outside the corporatenetwork.
http://www.citrix.com/English/ps2/products/subfeature.asp?contentID=2319322http://www.citrix.com/English/ps2/products/subfeature.asp?contentID=2319322http://www.citrix.com/English/ps2/products/subfeature.asp?contentID=2319322http://www.citrix.com/English/ps2/products/subfeature.asp?contentID=2319322http://www.citrix.com/English/ps2/products/subfeature.asp?contentID=2319322http://www.citrix.com/English/ps2/products/subfeature.asp?contentID=2319322


4/42

Page 4

ArchitectureCloudGateway Express consists of the Citrix Receiver Storefront and Citrix Merchandising Servercomponents. Receiver Storefront is a server component which resides on Windows 2008 R2 server

while Merchandising Server is a virtual appliance. This document only focuses on ReceiverStorefront which performs the authentication and enumerating of applications and desktops.Receiver Storefront integrates seamlessly with an existing XenDesktop and XenApp infrastructure

which allows users to have a consistent experience from multiple devices. Receiver StoreFrontemploys a modular architecture, as shown in the following diagram:

Figure 1: Citrix Storefront Receiver Architecture

Authentication Service . Authenticates users to XenDesktop sites, XenApp farms, and AppController, handling all interactions to ensure that users only need to log on once.

Store Services . Retrieves user credentials from the authentication service to authenticateusers to the XenApp and XenDesktop servers providing the application and desktopresources. Enumerates the resources currently available from the servers and sends thedetails to Citrix Receiver.

Receiver for Web. Enables users to access applications and desktop resources through a web page providing the same user experience as accessing those resources through CitrixReceiver.


5/42

Page 5

Resource Subscription Database . Stores details of individualized user subscriptions plusassociated shortcut names and locations.

Beacon . Citrix Receiver uses beacon points to determine whether users are connected tointernal or public networks and then selects the appropriate access method.

Hardware and Software Requirements

In preparation for executing all the steps outlined in this Proof of Concept (PoC) ImplementationGuide, the following components will be required:

Windows Server 2008 R2 SP1: Receiver Storefront is only available for installation on this version of Windows Server.

Citrix Receiver 3.1 Windows (Standard): This is the only version of Citrix Receiver thatsupports direct connection to Receiver Storefront Stores. Previous versions of Receiver canbe used, but applications and desktops will only be available from the Receiver for Web site.

Citrix Access Gateway 9.3, Enterprise Edition or Citrix Access Gateway 5.0.4: While notrequired for internal access to resources, Access Gateway is a key feature to enable secureremote access.

Microsoft SQL Server 2008 R2 Enterprise or Microsoft SQL Server 2008 R2 Express: Theapplication subscription feature of CloudGateway Express requires a central database. It isrecommended that Microsoft SQL 2008 R2 Enterprise be used so that high availability canbe configured.

Please note that this information will be updated frequently, so please reference Citrix eDocs for thelatest server and receiver requirements

Installation and Configuration The purpose of this document is to provide step-by-step instructions for the implementation of eachcomponent within the Proof of Concept environment. Each step is broken down into the following individual sections:

Section 1: Receiver Storefront Initial Deployment Section 2: Configure Second Receiver StoreFront Server Section3: Accessing Applications through Receiver Section 4: Configure Citrix Access Gateway Authentication

Section4: NetScaler Load Balancing Configuration
http://support.citrix.com/proddocs/topic/cloudgateway/clg-cloudgateway.htmlhttp://support.citrix.com/proddocs/topic/cloudgateway/clg-cloudgateway.htmlhttp://support.citrix.com/proddocs/topic/cloudgateway/clg-cloudgateway.htmlhttp://support.citrix.com/proddocs/topic/cloudgateway/clg-cloudgateway.html


6/42

Page 6

Section 1: Receiver Storefront Server Initial DeploymentReceiver Storefront can be setup in a single or multi-server deployment. For simple Proof of Concept environments a single-server deployment should be used and SQL Server must be installedlocally on the Receiver Storefront server. In the case of a multi-server deployment for evaluating HAand the configuration synchronization feature, SQL Server can either be installed on one of theReceiver Storefront servers or on another server in the same Active Directory forest. CitrixConsulting recommends that Receiver StoreFront be deployed in a multi-server configuration toensure high availability.

The following steps detail acquiring the installation media and initial database configuration on the Windows 2008 R2 SP1 server and database server.

1 The first step is to download

the install media fromCitrix.com

Select Downloads from thetop menu

2 Select CloudGateway from

the drop down menu

3 Select CloudGateway Express


7/42

Page 7

4 Select Receiver StoreFront

1.2 and download the

executable

5 Before the Receiver

StoreFront installation canbegin, the SQL database must

be manually created

To create the ReceiverStorefront database, use SQLServer Management Studioto run the commands locatedon this page

Three variables must bechanged before the script isrun:

%% DATABASE_NAME %%%% MDF_FILE %%%% LOG_FILE %%
http://support.citrix.com/proddocs/topic/dws-storefront-10/dws-deploy-multi-database.htmlhttp://support.citrix.com/proddocs/topic/dws-storefront-10/dws-deploy-multi-database.htmlhttp://support.citrix.com/proddocs/topic/dws-storefront-10/dws-deploy-multi-database.htmlhttp://support.citrix.com/proddocs/topic/dws-storefront-10/dws-deploy-multi-database.htmlhttp://support.citrix.com/proddocs/topic/dws-storefront-10/dws-deploy-multi-database.htmlhttp://support.citrix.com/proddocs/topic/dws-storefront-10/dws-deploy-multi-database.html


8/42

Page 8

6 Once the database is created,

begin the Receiver StoreFrontinstallation by double clickingon the installation media

previously downloaded

7 Check the accept terms of

license box

Select Next

8 Select Install Any pre-requisites missing

such as the Web Server willbe installed automatically byReceiver StoreFront installer.


9/42

Page 9

9 The installation has now been

completed

Select Finish The StoreFront Receiver

administration console willautomatically appear

Receiver Storefront Initial Server Configuration

The first setup in configuring Receiver StoreFront is binding a SSL certificate (self-signed orprocured through an internal certificate authority), defining a load balancing hostname, andspecifying the database. The following section walks through the steps needed to complete thesetasks.

Initial Server ConfigurationScreenshot Description

1 Before beginning the

configuration, a SSLcertificate matching thehostname chosen must beimported and bound tothe default IIS Web Site

This is accomplished in IISManager

Select the local Serverfrom the left menu

Select Server Certificates from the features menu


10/42

Page 10

2 Select Import on the

Actions menu

3

Select the certificate file toimport Select OK

4 The certificate is now

imported


11/42

Page 11

5 Select Default Web Site Select Bindings

6 Select Add

7 Select https as the Type Select the SSL Certificate

from the dropdown menu

Select OK


12/42

Page 12

8 The https binding is now

listed

Return to the ReceiverStorefront console

9 When deploying a multi-

server configuration, onlythe bottom two optionsare available

The Deploy a SingleServer option is greyedout because SQL Server isnot installed locally

Select Deploy a multipleserver group


13/42

Page 13

10 Since a SSL certificate has

already been bound, thehostname willautomatically be filled in

This is the Hostname of the load balancing vServeron the NetScaler for theStorefront servers

If the hostname is blank,go back to the SSLcertification installationsteps

Enter the SQL Databaseserver

Enter the Database namechosen

Choose Test Connection

11 Select OK

12 Select Create


14/42

Page 14

13 Once the server group has

been created, the initial

screen will be returned

Create Authentication Service

Before any Citrix resources can be configured, an authentication service must be created. Thisprocess defines the access method allowed for the environment.

Initial Server Configuration

Screenshot Description

1 Select Create Service


15/42

Page 15

2 Choose which

authentication methods toenable

Select Create

3 The Authentication Service

has been configured

Create Store

Use the Store menu to add the XenApp farms and XenDesktop sites that will be made available tousers. Administrators can create as many stores as needed; for example, the administrator may wantto create a store for a particular group of users or to aggregate a specific set of resources. While allthe stores in a Receiver Storefront deployment use the same authentication service, they each requiretheir own database. A Store is created using the following instructions:


16/42

Page 16

Store Configuration


1 Select Create Store under the

Actions menu

2 Choose a name for the Store Recommend choosing a

name that matches theXenApp farm so that it iseasily identifiable

Select Next


17/42

Page 17

3 This is the screen where the

address of the XML server forXenApp or XenDesktop isentered

Enter the Server address andchoose the Transport Type and Port number

Select Create

4 Select Finish


18/42

Page 18

5 The newly created Store will

now be listed

Additional XML servers cannow be added to the Store by

selecting Manage ServerFarms

6 A generic farm name and theXenApp XML server enteredin the previous screen arelisted

Select Edit


19/42

Page 19

7 Enter in the desired new

Farm name

Select Add to have anadditional XML server listed

to this farm

8 Enter the Server name for

the additional XML server

Select OK


20/42

Page 20

9 Once completed, select OK

Section 2: Configure Second Receiver StoreFront ServerOnce the first server has been configured, a second server should be added to the multi-serverdeployment.

1 On the first serverdeployed select AddServer from the ServerGroup menu


21/42

Page 21

2 This server will now showan Authorization codethat must be entered onthe next server joined tothe deployment

Make a note of thisinformation

3 On the second Storefrontserver select Join ExistingDeployment

4 Enter the hostname of theprimary Storefront server

Enter the Authorizationcode presented earlier(Step 1)

Select Join


22/42

Page 22

5 Once successfully joinedselect OK

6 On the primary Storefrontserver (cloudgateway2),the following dialog boxappears indicating that thesecondary server(cloudgateway3) wasadded.

Select OK 7 Switch back to the primary

Storefront server

Click Refresh to now seetwo servers listed

Select Propagate Changes

8 Select OK


23/42

Page 23

9 Once the propagation hascompleted, select OK

10 Back on the administrationpanel, the

Synchronization Status has been updated


24/42

Page 24

Section 3: Accessing Applications through ReceiverOnce a Store has been configured inside Receiver Storefront it will be accessible to Citrix Receiver.

The following steps require that Receiver 3.1 be installed on a Windows device.

1

Double Click the CitrixReceiver Icon from the

system tray

2 Click on the settings icon and

choose Edit Accounts

On the Edit Accounts Menu,

select Add


25/42

Page 25

2 Enter a Name for the account Enter in the URLof your

Storefront listed in the Stores menu.

3 The newly added Storefront

Account is now listed


26/42

Page 26

If Pass-Through is notenabled, the end user willneed to login with theirdomain credentials

Published applications anddesktops are now available tobe launched


27/42

Page 27

Receiver for Web

In addition to accessing Receiver Storefront stores within Citrix Receiver, users can also accessStores through a web page. This Proof of Concept guide focuses on Windows users because they are able to access Storefront via both Receiver and Receiver for Web (via website). If users of any

other operating systems such as Mac, iOS, or Linux require access, either the PNAgent URL enabled via legacy support or the Receiver for Web site must be used. A website is created using thefollowing instructions:

Receiver for Web Configuration


1 Select Create Website under

the Actions menu

2 Select the Store that the

Website will serve

Choose a Website path Select Create when finished


28/42

Page 28

3 The following screen will

appear when the Website hasbeen created successfully

The URL for the Website is

also displayed

4 The newly created Website is

now listed


29/42

Page 29

5 At this point, Citrix Receiver

Storefront can be accessedvia the Website URL. As longas the User name and

Password authenticationmethod was selected earlier,a user can logon and accesstheir applications or desktops

The Storefront is not ready atthis point to be accessed

from Citrix Access Gateway

Section 4: Configure Citrix Access Gateway Authentication To enable connections through Access Gateway, the Receiver Storefront configuration must beupdated with URLs outside of the corporate network to be used as Beacon points. Citrix Receiveruses Beacon points to determine whether users are connected to internal or public networks and

then selects the appropriate access method. If the internal Beacon, which is the internal hostname(cloudgateway.ccslab.net) can be resolved, Receiver connects locally and not through AccessGateway. The following steps include configuring Beacons & enabling remote access through

Access Gateway:

Remote Access Configuration


1 Select Add Gateway

Server


30/42

Page 30

2 Enter a Display name for

the Gateway server

Enter the Gateway URL for the Access Gateway

server. This is the addressfrom which users will beaccessing the environment

Choose the deploymentmode: Appliance

Select Set server as AccessGateway Enterprise

Edition

Enter in the SNIP or MIP address configured on

your NetScaler Select Next

3 Enter the FQDN of the

Access Gateway server

Select Next


31/42

Page 31

4 Choose to enable Session

reliability or the ability to

request tickets from twoSTAs

Select Add to enter in aSTA server

5 Enter in the STA URL Select OK


32/42

Page 32

6 Select Finish

7 The newly created

Gateway is now shown

Before a Store can beassigned to the Gateway,two Beacons must beconfigured

To do this, select Beaconsfrom the left menu


33/42

Page 33

8 Select Manage Beacons

9 Select Add The internal beacon is

automatically configuredto be the internalhostname

10 Enter in any URL that can

be resolved on the publicInternet

Select OK


34/42

Page 34

11 Repeat Step 10 again so

that there are two BeaconURLs listed

Select OK

12 The two Beacon URLs are

now listed

Now remote access mustbe enabled for the Store

Select Stores from the leftmenu

13 Select Enable Remote

Access


35/42

Page 35

14 Click the Gateway created

earlier

Select OK

15 Back on the Gateways

menu, Used By Stores is

now set to Yes


36/42

Page 36

Section 5: NetScaler Load Balancing Configuration

This section will give an overview of the steps necessary to configure a NetScaler to load balance aCloudGateway Express deployment.

1 Select Service Groupsfrom the Load Balancing feature menu

Select Add from thebottom menu

2 First, select a name for theService Group

Change the Protocol fromHTTP to SSL

Under Specify Members,enter the IP address, portnumber, and weight forone of the ReceiverStoreFront servers

Select Add when all theinformation has beenentered


37/42

Page 37

3 Once the second ReceiverStoreFront server hasbeen added, selectMonitors

4 Select a monitor such ashttps

Select the Advanced tab

5 In the Settings box, selectOverride Global

Check Client IP Header Type in X-Forward-For

Select the SSL Settings tab


38/42

Page 38

6 Select the appropriate SSLcertificate thatcorresponds to your loadbalancing hostname

Select Create when all thesteps have beencompleted

7 Select Virtual Servers under the Load Balancing

feature menu

Select Add


39/42

Page 39

8 Select the Service Groups tab

Enter in a Name for theLoad Balancing vServer

Select the Service Groupcreated earlier

In the Protocol dropdownbox, select SSL

Choose an IP address forthe vServer

Select the Method andPersistence tab

9 At the bottom underPersistence , choose

SourceIP

Choose None underBackup Persistence

Select the SSL Settings tab


40/42

Page 40

10 Select the correspondingSSL certificate and clickAdd

Select Create

11 The newly created vServeris now able to be used


41/42

Page 41

Design Considerations As discussed earlier, while CloudGateway Express offers new functionality such as applicationsubscriptions, it does have some additional considerations that need to be taken into account. Forthese reasons, it is important to properly choose the users who should be a part of the proof of concept.

Since Windows and Mac are the only operating systems that currently support direct access to storesthrough Citrix Access Gateway, it is recommended that the proof of concept be limited primarily tothese users in an effort to showcase the consistent user experience across access methods. Otheroperating systems and earlier Receiver clients require legacy support to be enabled for users toaccess applications remotely. Direct access to stores through mobile devices on iOS and Android issupported when connecting from the internal network.

It is recommended that the user base be restricted primarily to XenApp users since Receiver

Storefront currently is limited in some of XenDesktop features such as desktops restarts, DesktopGroup, and visual separation of desktops and applications, but it should be noted that these features

will be incorporated in the future.

Remote Users Users can access their resources from either their locally installed Citrix Receiver or via the Receiverfor Web site. For an optimal deployment that allows users to easily connect from inside and outsidethe organization, it is recommended that a Receiver Provisioning file be used. This file can either bedistributed by the administrator or manually downloaded by the end user. This file contains

information that allows Citrix Receiver to determine if the user is located on the corporate network or if a remote connection should be made through Access Gateway. This decision is made using thebeacon addresses specified during the Gateway configuration on the Receiver Storefront panel. If the internal beacon can be resolved, Receiver will connect using the local address. If the internaladdress cannot be resolved, Receiver will instead make a connection through the Access Gateway URL specified during the setup of Gateways inside the Receiver Storefront console. For moreinformation on configuring the Receiver Provisioning file, please reference Citrix eDocs.

Conclusion

CloudGateway Express should be piloted to users that are constantly switching between multipledevices and would like to have a consistent access experience. Citrix Consulting currently recommends installing CloudGateway Express for the aforementioned user group in parallel to theexisting Web Interface environment to ensure that administrators start to become familiar with thenew technology and features. Citrix Consulting strongly recommends a full analysis of user needsand CloudGateway Express 1.2 version functionality before migrating users away from WebInterface. By developing an understanding the CloudGateway Express now in a proof of concept
http://support.citrix.com/proddocs/topic/dws-storefront-10/dws-configure-wr-conf-file.htmlhttp://support.citrix.com/proddocs/topic/dws-storefront-10/dws-configure-wr-conf-file.htmlhttp://support.citrix.com/proddocs/topic/dws-storefront-10/dws-configure-wr-conf-file.htmlhttp://support.citrix.com/proddocs/topic/dws-storefront-10/dws-configure-wr-conf-file.html


42/42

capacity, administrators will be better prepared for the Web Interface migration process they will befacing in the future.

Acknowledgments

Citrix Consulting Solutions would like to thank all of the individuals that offered guidance andtechnical assistance during the course of this project - Carisa Stringer, Ray De Varona, Peter Schulz,and Adolfo Montoya. Additionally, thanks go to Peter Smeryage who helped with the build out of the environment.

References

How to Configure Access to Citrix Receiver StoreFront 1.0 through Access GatewayEnterprise Edition : http://support.citrix.com/article/CTX131908

Revision History

RevisionChange Description Updated By Date

1.0 Initial Document Citrix Consulting Solutions March 27, 20121.2 Document Update Citrix Consulting Solutions April 12, 2012

About CitrixCitrix Systems, Inc. (NASDAQ:CTXS) is the leading provider of virtualization, networking andsoftware as a service technologies for more than 230,000 organizations worldwide. Its CitrixDelivery Center, Citrix Cloud Center (C3) and Citrix Online Services product families radically simplify computing for millions of users, delivering applications as an on-demand service to any user, in any location on any device. Citrix customers include the worlds largest Internet companies,99 percent of Fortune Global 500 enterprises, and hundreds of thousands of small businesses andprosumers worldwide. Citrix partners with over 10,000 companies worldwide in more than 100countries. Founded in 1989, annual revenue in 2009 was $1.61 billion.

2012 Citrix Systems, Inc. All rights reserved. Citrix, Access Gateway, Branch Repeater,Citrix Repeater, Citrix Receiver, HDX, XenServer, XenApp, XenDesktop ,XenClient and Citrix Delivery Center are trademarks of Citrix Systems, Inc. and/or one ormore of its subsidiaries, and may be registered in the United States Patent and Trademark Officeand in other co ntries All other trademarks and registered trademarks are propert of their
http://support.citrix.com/article/CTX131908http://support.citrix.com/article/CTX131908http://support.citrix.com/article/CTX131908http://support.citrix.com/article/CTX131908

Cloud Gateway FINAL DRAFTv1

Documents

Transcript of Cloud Gateway FINAL DRAFTv1