Citrix CloudGateway 2.5 Technical Overview and Troubleshooting

CloudGateway 2.5 Enterprise TM

Unified storefront for apps, data and services

Adolfo Montoya

Sr. Support Readiness Specialist

January, 2013

Agenda

• What is CloudGateway?
• Deployment scenarios
• What‟s new on CloudGateway 2.5?
• Troubleshooting
• Q&A

© 2012 Citrix | Confidential – Do Not Distribute

CloudGateway
What is CloudGateway?

• Enterprise Mobile Management (EMM) solution that allows
IT deliver on-demand access to Web, SaaS, Mobile and
Windows apps and data
• Key solutions
ᵒMDM – Mobile Device Management (Zenprise technology)
ᵒMAM – Mobile Application Management (MDX technology)
ᵒMIM – Mobile Information Management (ShareFile technology)
• Control access policies for apps, data and devices
• Provides unified store for users to access apps and data
• Seamless user experience across multiple platforms


CloudGateway
What is CloudGateway?

• Follow-me apps – Known as “App Subscription” that allows
StoreFront or AppController remember what apps will follow end-
users
• Follow-me data – Self-service user experience to access data
available in ShareFile
• Auto provision apps – App provisioning process that allows IT pre-
subscribe a set of apps on behalf of end-users
• One-click Configuration – XML-based file (.cr) that configures
Citrix Receiver with one or more accounts (ie. Stores)
• Email-based account discovery – Self-service user experience to
configure accounts with Citrix Receiver by entering email address

CloudGateway
One solution

Citrix CloudGateway

Receiver Access StoreFront AppController
Gateway


CloudGateway
Access
Receiver StoreFront AppController
Gateway

Mobile Apps

Web & SaaS Apps

ShareFile
Data
Virtual Desktops
& Apps

CloudGateway Editions

Receiver StoreFront Receiver Access StoreFront AppController
Gateway

Licensing

FREE!


Licensing


CloudGateway
System Requirements

• Citrix StoreFront
ᵒWindows Server 2008 R2 SP1
ᵒMicrosoft SQL 2008 R2 / 2012 (Express or Enterprise)
ᵒMust be a Windows domain member
• Citrix AppController
ᵒHypervisors
• Citrix XenServer 5.6 FP2 or later
• VMware ESX 5.x or later
ᵒActive Directory authentication support
• NetScaler Access Gateway
ᵒMinimum release – 10.0.69.4
ᵒVPX or MPX


CloudGateway Deployments
AppController only in HA

AppController
HA

NetScaler /
Access Gateway

Internet DMZ LAN


Single server StoreFront only

XenApp/
XenDesktop
StoreFront
NetScaler / (Single Server)
Access Gateway

Internet DMZ LAN

Enterprise deployment

NetScaler HA XenApp/
StoreFront XenDesktop
Primary Server Group

SQL

Secondary AppController
HA

Internet DMZ LAN

AG + StoreFront AG + AppController AG + StoreFront +
only only AppController
• Ideal for XenApp / • Ideal for Enterprise • Ideal for Enterprise
XenDesktop customers that want customers that want
Application and User
customers migrating Management the unified store
from Web Interface solution
• Customers do not have
• No need for clientless XenApp / • Clientless access
access (CVPN) XenDesktop, hence, no (CVPN) is required
StoreFront is needed
• Only needs Access • Access Gateway
Gateway Platform • Clientless access needs Universal
(CVPN) is required
license Licenses
• Access Gateway needs
Universal Licenses


How do we configure AG?

• Check out our CloudGateway Best • Configure a brand new Access
Practices Guide @ Gateway in minutes with
http://support.citrix.com/article/CTX1 CloudGateway Remote Access
31908 Gateway wizard
• Check out our Citrix eDocs @
http://support.citrix.com/proddocs/top
ic/access-gateway-10/agee-clg-
integration-wrapper-con.html


What’s new?

• Initial configuration workflow – updated
• Device Enrollment feature
• Policies for Web/SaaS apps
• Mobile application preparation tool
• Citrix Me@Work mobile apps (@WorkMail and @WorkWeb)
• MDX Mobile App policies
• NetScaler Access Gateway 10
• Citrix Receivers


CloudGateway 2.5 Releases
Citrix Product Name Version
Citrix AppController 2.5.0.142500
Citrix NetScaler Access Gateway 10.0.71.6014.e.nc
Citrix Receiver for Windows 3.4
Citrix Receiver for Mac 11.7
Citrix Receiver for iOS 5.7
Citrix Receiver for Android 3.3 (coming soon)
Citrix Receiver for HTML5 1.1
Citrix Receiver for Win8/RT 2.x (coming soon)
Citrix ShareFile Plug-in for Windows 1.0.137

End-Point Controller


MDX
App Vault


MDX
Access


MDX
InterApp


MDX
Policy

Allow Camera 
InterApp Sharing 
iCloud Backup 
Enable DLP 
Require Authentication 
Trusted Network Only 
Disable printing 
Restrict outbound URL 
Offline lease period 24 h

New Mobile Wrap Tool

• Support for both iOS/Android native apps
• Wrap tool can be downloaded from Citrix.com/downloads
• Takes a pre-compiled iOS/Android native application
bundle (.IPA/.APK) as input
• Produces repackaged iOS/Android application bundle
with Citrix app wrapper logic inserted (.MDX)
• Recertifies the repackaged app when using a customer
provided enterprise distribution profile
• Mobile App Wrap tool runs only on Mac OS X 10.7 or
later


Mobile Apps

• New mobile app policies for greater security


App Preparation Process
Secure app with App available as Push App via
Upload app to App is visible on
App Preparation a secure, CloudGateway
CloudGateway iOS “home screen”
Tool managed app

QuickOffice Enterprise
QuickOffice
QuickOffice.ipa Enterprise

QuickOffice


Me@Work
mobile app family

@WorkWeb @WorkMail ShareFile GoToMeeting Podio
Secure Email, calendar Follow-me Integrated Social Team
Browsing & contacts Data Collaboration Collaboration


What is @WorkMail

• Enterprise-ready native iOS / Android mail application
• Securely connects to Exchange Server via ActiveSync
• Features available
ᵒMail
ᵒCalendar @WorkMail
ᵒContacts
ᵒSeamless integration with other Me@Work apps like
@WorkWeb, GoToMeeting, ShareFile and Podio


Secure Mobile Mail inbox create new message add attachment
start

set time check availability

What is @WorkWeb

• Enterprise-ready native iOS / Android mobile browser
application
• HTML5-based mobile browser
• Securely connects to corporate network using on-
@WorkWeb
demand micro-VPN tunnel
• Features available
ᵒBookmarks
ᵒSeamless integration with other Me@Work apps such as
@WorkMail or GoToMeeting


Web page view Multiple tab support Adding a bookmark Select bookmark


Secure Browse Micro-VPN @WorkWeb

• Client-side rewrite • On-demand • Native iOS/Android
feature to access application VPN tunnel mobile HTML5
intranet sites (via Web between mobile browser application
device and NetScaler
links) • Securely connects to
Access Gateway
• Available on Receiver • Available on Receiver corporate network
for iOS 5.6.1 or later for Android 3.1 or later using on-demand
• Must use NetScaler and Receiver for iOS Micro-VPN tunnel
Access Gateway 10 5.7 • Must use NetScaler
(build 69.4 or later) • Must use NetScaler Access Gateway 10
Access Gateway 10 (build 69.4 or later)
(build 69.4 or later)


Secure Browse
Example


Micro-VPN
How does it work?

• Mobile Receivers provide VPN capable parameter in user-agent:

CitrixReceiver/com.citrix.ReceiveriPad iOS/5.7 (build 170) CitrixReceiver-iPad CFNetwork
Darwin VpnCapable

• Access Gateway returns the /cgi/setclient?

For iOS: HTTP/1.1 302 Object Moved For Android: HTTP/1.1 302 Object Moved
Location: /cgi/setclient?iosc Location: /cgi/setclient?andr
Set-Cookie: Set-Cookie:
NSC_AAAC=55f4f4d9926e4b6533f6033 NSC_AAAC=55f4f4d9926e4b6533f6033
24b45fa1f0311fe8c345525d5f4f58455 24b45fa1f0311fe8c345525d5f4f58455e
e445a4a42;Secure;HttpOnly;Path=/ 445a4a42;Secure;HttpOnly;Path=/


https://<IP>:4443/ControlPoint


New Look


Settings


Dashboard


Exporting Snapshots

• Export / import configuration

• Upload software releases
ᵒ(no export)


CLI Snapshots


Saved Settings

• Snapshots contain all appliance settings, including
ᵒAdmin password
ᵒApplications & Links
ᵒCertificates
ᵒHostname and IP address


Send Service Record File (.cr)

• Table in DB
ᵒMaintains list of e-mail
addresses
ᵒEntries deleted once
e-mail is sent

• Currently no support
for HTML content


Send Service Record File (.cr)


Device Management
Enrollment service

Functionality Overview

• Requirement to have more control over „Apps‟ deployed to
mobile devices.
• Receiver needs to communicate with AppController either
directly, or through Access Gateway.
• Receiver „checks in‟ to the AppController when it starts
• Management functions in CG 2.5 are:
1. Device Registration
2. Device Lock or Wipe
3. Device Update

DMS

• Device Management Service: Runs on the AppController –
and processes requests from Receiver clients.
• Upon a successful registration, it returns a Device ID which
is used by receiver in subsequent requests.


Device Management
Checklist

• Must use AppController 2.5
• (Optional) Modify StoreFront 1.2 Roaming
Accounts web.config file
• For Remote connections, must use Access
Gateway 10.0.71.6014e version
• Receivers compatible
ᵒReceiver for iOS 5.7
ᵒReceiver for Android 3.3


Device Management GUI

• Devices tab which lists all the device parameters.
• Admins can delete, wipe and lock


StoreFront
Configuration

• If mobile users are connecting via StoreFront to AppController, you must
modify the web.config file from Roaming Accounts – ie.
c:inetpubwwwrootCitrixRoamingweb.config
• Three key pieces that need to be added
<property name="DeviceRegistrationServiceV1"
value="https://<AppControllerFQDN>/Citrix/Device/v1" />

<property name="KeyManagementServiceV1"
value="https://<AppControllerFQDN>/xv/locate_vaults" />

<property name="STATicketServiceV1"
value="https://<AppControllerFQDN>/STA/get_ticket_v1"/>


StoreFront
Configuration

• Citrix eDocs has the complete step-by-step configuration
process
• http://support.citrix.com/proddocs/topic/appcontroller-25/clg-
appc-device-mgmt-storefront-tsk.html
• No changes needed if you are just using AppController 2.5


Receiver for Windows VPN
Integration

CG 2.0
Client Workstation

1. Client Initiates Clientless VPN
or Receiver Session:
1 license consumed.

2. Client now chooses to start the
full VPN Client:
2nd Auth Request &
2nd license consumed

CG 2.5
Client Workstation

1. Client Initiates Clientless VPN or
Receiver
Session, authenticates, & 1
Already license consumed.
Authenticated! 2. Client now chooses to start the
full VPN Client.
3. No additional license
consumed, & no second auth
request – True SSO.

Allowing for StoreFront Cookies

• Create Pattern set for StoreFront
Cookies.


Create custom Clientless Profile

• Use the
„ns_cvpn_default_profile‟
profile as a template.
• Remove Request Header
rewrite.
• Remove all „Finding
URLs‟ pattern classes.
• Configure Custom
Storefront Client Cookies
Pattern Set.


Create Custom Clientless Profile

• This needs to be bound to the VPN VServer using „True‟.


2 x Session Profiles

• One Session Profile for Receiver Clientless access
• One for full VPN access.
• Ensure that the expressions are correct, and use „&&‟ or „Match All‟


Session Policies

• Clientless Access set
„Allow‟ on Full VPN Client Profile.
• Clientless Access set to „On‟ for
Clientless or Receiver profile.


Workflows
Application Provisioning

Workflow Management


Troubleshooting
Support Bundle Menu

• Provide Admins collection all
AppController logs and network
traces in a compressed file (.ZIP)
• Admins have the choice to encrypt
the Support Bundle (optional)
• To extract the Support Bundle
ᵒUpload via FTP
ᵒUpload via SCP


Troubleshooting
Generate Support Bundle

• Admins have the option to encrypt or not the Support Bundle
• Support Bundle filename will contain date/time, IP address and compression
format extension (.ZIP)


Troubleshooting
Upload Support Bundle

• Admins have the option to upload it via
FTP or SCP
• For more information on how to upload
it via FTP, please refer to
http://support.citrix.com/article/CTX128
855
• Admins have to enter FTP server
hostname and location where to upload
the file


Troubleshooting
Support Bundle Contents

• Sas_core – core dumps
• Sas_log – management, system, debug, informational
logs
• Sas_trace – network traces
• Sys_info – AppController system information
ᵒARP entries
ᵒDisk space usage
ᵒInterface configuration
ᵒRouting table
ᵒRunning processes
• Var_log – authentication, daemon, kernel, mail, system
and user logs


Citrix Receiver for Windows 3.2 or later
CTX Articles

• How to enable logging on Citrix Receiver -
• Unable to run the Provisioning File -
• How to add an HTTP store - http://support.citrix.com/article/CTX134341
• Testing Citrix Receiver inside an RDP session -
• Disable FTU prompt -
http://support.citrix.com/article/CTX135141, http://support.citrix.com/article/CTX
135438


Citrix Receiver for WinRT
CTX Articles

• FAQ: Using Citrix Receiver for Windows 8 / RT -
• User can enable AETrace logging by creating an empty file called
ReceiverAETrace.enabled in the user's
%localappdata%Packages[D50536CD.CitrixReceiver*]LocalState folder.
• For AppReceiver and Main App Logging Create a blank file named
ReceiverMainLogging.enabled in the following folder
%LOCALAPPDATA%PackagesD50536CD.CitrixReceiver_hmf6bx7z76t54Lo
calState


StoreFront Services
Deployment
StoreFront Service Identity Account (Default)
Option

Single
Citrix Credential Wallet Network Service
server

• Citrix Configuration
Replication • Network Service
Server
• Citrix Credential Wallet • Network Service
Group
• Citrix Peer Resolution • Network Service
Service
© 2012 Citrix | Confidential – Do Not Distribute Citrix Confidential - Do Not Distribute

Useful Tools
• Microsoft Event Viewer
• IIS Logs
• Microsoft .NET tracing
• Microsoft DebugView
• Fiddler
• Live HTTP Headers
• Wireshark
• Microsoft NetMon

© 2012 Citrix | Confidential – Do Not Distribute Citrix Confidential - Do Not Distribute

About Educate | Guide | Support | Succeed

Citrix Services
Citrix Services make sure How we can help
you succeed with your
virtualization programs. Citrix Education – The fastest, most efficient way to
get your team the virtualization skills they need. Online,
on-site or in class.
citrix.com/training

Citrix Consulting – Intensive engagements for
complex, critical or just plain massive projects.
citrix.com/consulting

Citrix Support – Always-on support services that
leverage everything we know about best-practice
deployment and maintenance.
citrix.com/support

Secrets of the Citrix Support Ninjas

• 40 insider troubleshooting tips
• Covering XenDesktop, XenServer, XenApp and NetScaler
• Citrix Support top engineers
• FREE eBook
• Citrix Auto Support
• Available NOW!

Hardware and Software Tech Support
• Access: Unlimited Citrix Worldwide Technical Support
– 24x7x365 or business hours
• Coverage: Hardware returns & software updates
• Products Covered: NetScaler, Access Gateway,
Branch Repeater
• citrix.com/support

– 24x7x365
• Coverage: Version updates & Tech Support
• Products Covered: VDI-in-a-Box, CloudPlatform,
CloudPortal Business Manager, AppDNA, XenClient
• citrix.com/support

Support Programs
– 24x7x365
• Coverage: Major/minor software updates
• Products Covered: All software products eligible for
Subscription Advantage
• citrix.com/premiersupport

• Proactive: Knowledge of environment helps avoid issues
and drives best practices
• Responsive: Single point of contact to accelerate issue
resolution
• Relationship: Trusted advisor and customer advocate in
Citrix
© 2012 Citrix | Confidential – Do Not Distribute • citrix.com/support

Citrix CloudGateway 2.5 Technical Overview and Troubleshooting

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (9)

Similaire à Citrix CloudGateway 2.5 Technical Overview and Troubleshooting

Similaire à Citrix CloudGateway 2.5 Technical Overview and Troubleshooting (20)

Plus de David McGeough

Plus de David McGeough (20)

Dernier

Dernier (20)

Citrix CloudGateway 2.5 Technical Overview and Troubleshooting

Notes de l'éditeur