Archive
#NetScaler – Join Live Webinar: Learn More about #Citrix/#Cisco Partnership and Program (AMP)
Ok, this is interesting! Have a look and join this seminar!
JOIN US for an exciting Master Class experience! At this live webinar,Wednesday November 7th, you will learn about the most critical elements of cloud infrastructures and enterprise datacenter architectures. Get details on the latest features of NetScaler, tips and tricks for easy configuration, and get a chance to consult with the experts.
Agenda:
• News and views – Cisco partnership and Ace Migration Program (AMP)
• NetScaler 101 – Responder, rewrite and URL transformation?
• In the spotlight – Innovative security strategies for protecting apps and data
• What’s new – NetScaler product updates?
• Master Class extra – Be heard and get the answers you’re looking for
Read more and register here.
//Richard
#Citrix #NetScaler, #AGEE and Macbook OS X… bad start of the evening session!
Ok, I was just going to log in and play around and setup another AppController to verify some thoughts around a customer case in our EnvokeIT environment. And what did I do? I just opened my lovely Macbook Air (no one will ever take that one from me!!) and thought I would connect into our internal EnvokeIT lab environment and decided for some reason to connect over SSL VPN this time rather than running everything on the internally published desktop.
So I opened the browser and connected to our AGEE vip that presented me with the rather ok-looking login page as you can see here that my colleague modified to make it a bit more aligned with the StoreFront/Receiver for Web that we use in this little environment (otherwise you get that black ugly NetScaler login prompt, please get your product look & feel in synch Citrix!).
But then after I logged in I though that why not try out the SSL VPN client for my Mac! So I choose Network Access here;
And then I realised that the modifications weren’t really all ok as you can see here when I was prompted to download the Access Gateway Plugin for OS X (SSL VPN client)…
My Post-Synergy View – Update 2 #CitrixSynergy #Citrix #CitrixSummit #XenApp #XenDesktop #NetScaler #Sanbolic
Hi again!
Ok, time to wrap up my Synergy update post series… In the previous post I started to give U my view of the takeaways from Citrix Synergy. So let’s continue! 🙂
As I wrote before I tried to structure the post using the following; each heading represents the enhancement request topic and/or the takeaway item, and then the subheading of Description and Status is showing you my personal view on the topic and its status.
NetScaler
Description:
These where the items that we had on the enhancement list before going to Synergy:
- Create SDX platform/architecture to run on all MPX appliances, for more info why see; NetScaler MPX vs. SDX dilemma; https://richardegenas.com/2012/10/03/netscaler-mpx-vs-sdx-dilemma/
- Add support for AG session policies so that ICA proxy can be turned on for specific published apps and desktops and not per session. This for situations where you might have one app or desktop that sits behind an AGEE and others don’t.
- The NetScaler/Access Gateway HTML/GUI pages used shall be able to be customized per AGEE/AAA Virtual Server. Today they are global pages so that specific modifications/customizations cannot be made and you have to buy an additional NetScaler unless major customizations are done and then life-cycle management becomes an issue.
- Change so that you can specify different Authentication policies and requirements mapped to Session policies instead of to a Virtual Server, AAA group etc. This could then provide a way so that you could offer ICA proxy mode with single auth and two-factor if you launch/select to open an SSL VPN tunnel. And then a user that has forgotten a hardtoken could still get access but only in ICA proxy mode and have all virtual channels disabled without having to have multiple accounts in the Receiver and admin doesn’t need multiple NS AGEE VS.
- It would be good to get the same Account Self-Service functionality that the Single Sign-On/Password Manager service can provide and have integrated into the AGEE login page where end-users can themselves unlock their accounts and reset their passwords without involving Service Desk. And the solution for how to get the single sign-on account self service feature should be an integration part of the NetScaler AGEE console rather than manually updating the HTML pages etc.
NetScaler SDX – value add, #CitrixSynergy #NetScaler
Sitting here listening to the SDX model and its capabilities etc. And I must agree that the concept is great in terms of isolation, flexibility, density and other added values that the platform provides…
But I still see the need for the same SDX model on the smaller appliances where you may need the capabilities of feature isolation etc but where you don’t need the performance/throughput etc. of the larger appliances where the SDX model starts.
If you look at the NetScaler data sheet I can’t understand why you don’t get the SDX model option on for instance the 8200 box and why not down to the 5500?
More on my thoughts on this from my previous blog can be found here.
//Richard
Please contribute – What do we expect from Citrix? – Citrix community enhancement list
Ok, there are a lot of things that I think we all expect Citrix to deliver now in Barcelona when Synergy soon kicks off! But so far I’ve not seen someone that has been combining a community list yet…
And the most important part I feel is that I get more and more information from companies out there that have enhancement requests and issues that they have a hard time expressing and getting into Citrix. The larger enterprises can of course through their channels get more information and also make their voice heard, but the SMB’s have a hard time to do so!
So this is my attempt to start a dialogue with all of U out there on what we expect to see from Citrix in the future! I think it would be interesting to see if the items I’m waiting for a change on is aligned with the rest of the community!
So why don’t we all contribute to a list that we all can share and prioritise over time? I can for a start moderate this list if you comment or send me items that you think should be on the list and then I’ll try to make sure that people within Citrix get the items and I’ll try to follow up! Of course we need help from the CTP’s (just to be clear; I’m not a CTP so don’t get me wrong here) and others as well to put pressure and assist in the governance of this activity.
So this is my first list of items that I think that we can build upon… It’s a first draft and far from the total number of items are there so bear with me! 😉
Please comment below to have your item(s) added to the list and let’s make a change!
| ID | Product/Area | Enhancement request/Issue | Status |
| 1 | Licensing | Ensure that all products supports the license server (NetScaler etc.) | Not fullfilled |
| 2 | Monitoring & Reporting | Ensure that you can get historical concurrent user reports that spans across ALL products (NetScaler/AG, XenApp, XenDesktop etc.) | Not fullfilled |
| 3 | Monitoring & Reporting | Ensure that Citrix provides an end-2-end monitoring and reporting service for the whole Citrix stack. This to ensure that delivery organizations can deliver reports like “Service Availability in %” over time that includes all service components (NetScaler AGEE VIP, StoreFront/WI, PVS/MSC, XenServer, XenApp/VDA, Profile Server, etc. If Citrix isn’t going to do this; then please point on a product that does the job. | Not fullfilled |
| 4 | Monitoring & Reporting | Provide a monitoring solution to ensure health and best practise configurations of all products involved in a traditional “XenDesktop” stacked service. | Not fullfilled |
| 5 | Cross-product | Improve your testing!! There have been to many issues with updates to products in the “Citrix stack” that has caused issues in others, like update to XenServer that caused PVS issues, or updates to a specific NetScaler feature that caused others to fail. | Not fullfilled |
| 6 | Cross-product | Create an central update service for all products that can inform the admin about updates not applied or if components aren’t in synch in terms of SW versions etc. | Not fullfilled |
| 7 | Cross-product | Ensure that the end-user look & feel are the same across the products used in the stack (NetScaler AGEE login page, Web Interface/StoreFront, Receiver etc..). This should not require admins to do and should be a design principle. | Not fullfilled |
| 8 | Cross-product | Come on, simplify the administration of the products in the stack = reduce the number of consoles! | Not fullfilled |
| 9 | AppController | Multi-domain support | Not fullfilled |
| 10 | AppController | Support for multiple setups that can synch the DB. This to ensure that you can have an HA pair setup for instance in Europé and one in the North Americas and have the end-user be logged in against both and have their subscriptions etc follow them (as well as of course reporting, monitoring etc. etc.) | Not fullfilled |
| 11 | AppController | Support for really large AD domains with LARGE # of AD users and AD groups | Not fullfilled |
| 12 | AppController | Support for AD domain structure where the BASE DN is different to where AD users and the AD security groups you want to use for roles | Not fullfilled |
| 13 | EdgeSight | Ensure that EdgeSight or equivalent end-user monitoring and reporting is integrated and that works on both XenApp and XenDesktop VDA’s and that doesn’t increase the IOPS with rediciolous numbers… | Not fullfilled |
| 14 | NetScaler | Create SDX platform to run on all MPX appliances, for more info why see; NetScaler MPX vs. SDX dilemma; https://richardegenas.com/2012/10/03/netscaler-mpx-vs-sdx-dilemma/ | Not fullfilled |
| 15 | NetScaler | Provide out of the box integration with the Single Sign-On product (former CPM) so that Account Self-Service can be made directly from AGEE VIP login page. | Not fullfilled |
| 16 | NetScaler | Add support for AG session policies so that ICA proxy can be turned on for specific published apps and desktops and not per session. This for situations where you might have one app or desktop that sits behind an AGEE and others don’t. | Not fullfilled |
| 17 | NetScaler | The NetScaler/Access Gateway HTML/GUI pages used shall be able to be customized per AGEE/AAA Virtual Server. Today they are global pages so that specific modifications/customizations cannot be made and you have to buy an additional NetScaler unless major customizations are done and then life-cycle management becomes an issue. | Not fullfilled |
| 18 | NetScaler | Change so that you can specify different Authentication policies and requirements mapped to Session policies instead of to a Virtual Server, AAA group etc. This could then provide a way so that you could offer ICA proxy mode with single auth and two-factor if you launch/select to open an SSL VPN tunnel | Not fullfilled |
| 19 | NetScaler | It would be good if you on the Receiver could select what authentication you want to perform upon login and not just at setup of the Account. That would mean that you could pass that info the the NS VS and then in AGEE handle that to the authentcaiton policies and session policies. Then a user that has forgotten a hardtoken could still get access but only in ICA proxy mode and have all virtual channels disabled without having to have multiple accounts in the Receiver and admin doesn’t need multiple NS AGEE VS. | Not fullfilled |
| 20 | Merchandising Server | Ensure that it supports larger AD environments and multi-domain support | Not fullfilled |
| 21 | Merchandising Server | Create a central DB for config etc or ensure that MS is migrated into SF asap. | Not fullfilled |
| 22 | Provisioning Services | Improved/simplified support/update functionality for when you use KMS licensing | Not fullfilled |
| 23 | Provisioning Services | Create REAL update msp or msi files for updates, you can’t require admins to go in and replace DLL-files etc in 2012 | Not fullfilled |
| 24 | Provisioning Services | Implement replication of vDisk files (diff-files) etc so that it’s automated within the PVS solution so that you don’t have to rely on DFS-R etc. | Not fullfilled |
| 25 | ShareFile | Ensure that encryption on local devices are available for all device types and OS’s (iOS, Android, Windows Phone, Win XP/7/8, Linux, OS X) | Not fullfilled |
| 26 | ShareFile | Design the product so that you could leverage public storage providers for your storage but encrypt it using your own PKI service and proxy traffic to it through the Storage Center server(s) without having to invest in in-house storage solutions and reduce CAPEX. | Not fullfilled |
| 27 | ShareFile | Design the solution so that you can configure the plygin/Receiver functionality when it comes to StoreFront on groups/roles instead of just for the whole account. | Not fullfilled |
| 28 | Storefront | Support for multiple setups that can synch the DB. This to ensure that you can have an HA pair setup for instance in Europé and one in the North Americas and have the end-user be logged in against both and have their subscriptions etc follow them (as well as of course reporting, monitoring etc. etc.) | Not fullfilled |
| 29 | Storefront | Simplify configuration and branding of the StoreFront for Web sites like most other providers have and they had in Web Interface | Not fullfilled |
| 30 | Storefront | Add all features that where available in Web Interface | Not fullfilled |
| 31 | StoreFront | Design the product to allow the user to select whether he/she can group apps and desktops into folders or tabs in StoreFront for Web | Not fullfilled |
| 32 | Receiver | Ensure that email-enrollment to StoreFront stores can somehow support multidomain support (like if you have multiple users having the same email-address; name@company.com can be linked to different AD domains | Not fullfilled |
| 33 | Receiver | Corporate branding for the Receiver, logo, text etc. | Not fullfilled |
| 34 | Receiver | Ensure that all Receivers have the same look & feel and functionality. Like the secondary and primary password field names should be the same on a Mac and a Windows client, as well as other features. | Not fullfilled |
| 35 | Receiver | Add so that Receiver passes DOMAINNAME to NetScaler/AG VS so that it can be used to determine which AD domain to authenticate with. In todays version you have to either make one VS per domain or cascade through multiple domains on the same VS. And cascading is available as a workaround but triggers failed logins against AD and is not that nice and security/AD teams are not that happy… | Not fullfilled |
| 36 | XenDesktop | Support for Linux VDA’s (Ubuntu for example) | Not fullfilled |
| 37 | XenApp | Support for Linux Terminal Servers (Ubuntu for example) | Not fullfilled |
I’ll post an excel-spreadsheet as well for download soon, and then let’s see if there is an interest or not! 😉
Cheers!
//Richard
Citrix Knowledge Center Top 10 – September 2012
Citrix has released the September Top 10 list, ensure you have a look at it!
Citrix Support is focused on ensuring Customer and Partner satisfaction with our products.
One of our initiatives is to increase the ability of our Partners and Customers to leverage self-service avenues via our Knowledge Center.
Find below the Citrix Knowledge Center Top 10 for September 2012.
Top 10 Technical Articles
| Article Number | Article Title |
|---|---|
| CTX129229 | Recommended Citrix and Microsoft Hotfixes for XenApp 6 and Windows Server 2008 R2 |
| CTX129082 | Application Launch Fails with Web Interface using Internet Explorer 9 |
| CTX132875 | Citrix Receiver Error 2320 |
| CTX804493 | Users Prompted to Download ICA File, Launch.ica, Instead of Launching the Connection |
| CTX105793 | Error: Cannot connect to the Citrix server. Protocol Driver Error |
| CTX101644 | Seamless Configuration Settings |
| CTX101810 | Communication Ports Used By Citrix Technologies |
| CTX127030 | Citrix Guidelines for Antivirus Software Configuration |
| CTX133037 | Citrix Receiver 3.2 – Issues Fixed in This Release |
| CTX115637 | Citrix Multi-Monitor Configuration Settings and Reference |
Continue reading here!
//Richard
NetScaler MPX vs. SDX dilemma
Hi again!
Ok, I may be totally off and wrong here but I see a bit of a problem with the Citrix product packaging and offering around the whole NetScaler product.
I love the fact that the product is available as virtual appliances (VPX) and physical appliances (MPX) and the lovely “mix-product” which is the SDX platform. The SDX is a lovely addition and I see so many reasons for why you want to go towards that platform, so bear with me.
The NetScaler product itself is a great product and the feature set it rich! It’s definitely rich in terms of what features it offers from the same appliance! Some of the marketing of the product against competitors is that you can do it all (GSLB, LB, SSL offloading, SSL VPN, Application Firewall, ICA/HDX proxy etc.) on one appliance instead of purchasing several. Have a look at the editions of the product and the rich feature offering;
But I must challenge this whole idea of putting all features/capabilities on one appliance! What if you decide to build a service on the NetScaler product and decide to provide these capabilities;
- Access Gateway
- Network Connect (SSL VPN access)
- Network Proxy (ICA/HDX proxying)
- End-to-end Web Security (AAA etc.)
- Load Balancing (LB, GSLB)
So imagine that if for some reason you need a new version of the NetScaler appliance or if Citrix provides a fix for a bug/issue that is related to one of the capabilities. Then you have to stop your whole service delivery of all of them just to apply a patch/update targeted for one of them. Is that good from an incident, problem, change management point of view? I guess that’s why I like the SDX platform where I then can put the capabilities on different VPX instances on the same SDX HW platform.
This then also leads you to the whole cost of the service if you also like this idea of separation of duties, how much does the SDX cost and what does the VPX instances cost (they are purchased in bundles of 5 where 5 is included with the SDX purchase). And except for the cost of the HW, SW and SA you have the complexity that you have to select which of the SDX platforms to choose (see a more detailed NetScaler Datasheet here). And this is the biggest issue as I see it! I’d like to recommend the SDX platform to more customers than the enterprise segment. But then you have an issue, the SDX platforms starts on the 11 500 appliance.
Why doesn’t Citrix offer the SDX model on the smaller appliances?? I’d like to understand that because I think that most customers out there will not require that much throughput or CCU etc that the 11 500 delivers….
And there are more reasons to why you would like an SDX model other than separation of duties.. but more on that in another post.
Cheers!
//Richard
Mobile Application Management (MAM) = Complete Mobile Workplace?
Ok, so I’ve been looking at some of the players out there that say they have a “MAM” product and everybody seem so hooked on talking about MAM and how that’s gonna solve all the needs of a Mobile Workplace… and to be totally frank I think that people tend to run to fast with new cool and hip buzz-words or solutions.
To start of with, what is the definition of a MAM system? This is a pretty good summary I’d say that I stole from WikiPedia;
“Mobile Application Management (MAM) describes software and services that accelerate and simplify the creation of internally developed or “in-house” enterprise mobile applications. It also describes the deployment and management of in-house and commercially available mobile apps used in business settings on both company-provided and “bring your own” smartphones and tablet computers.
Mobile application management has also been defined as “the strategy and process around developing/procuring, securing, deploying, accessing, configuring, updating and removing (business) applications from mobile devices used by the employees. To read more at wikipedia click here…”
And does a solution like this provide all the capabilities for businesses today for a complete Mobile Workplace?
Cisco Ceasing Development Of Load-Balancer Products
Wow… ok, it may not be the biggest news but it’s indeed interesting!
“The ADN market has since become more crowded as the technology gets hotter. Behind F5 is No. 2 player Citrix(NSDQ:CTXS), estimated to hold between 15 percent and 17 percent, along with a host of other vendors, from Brocade and Radware to smaller, scrappier alternatives such as A10 Networks.
Suppiger’s research note highlighted F5, Citrix and A10 specifically as being well-positioned to take advantage of Cisco’s decline. Indeed, both F5 and A10 are among Cisco competitors that already are moving to capitalize on Cisco’s decision.”
Read more here!
//Richard
Web Interface 5.4 vs. StoreFront 1.2 – What has changed since last comparison?
Hi all,
Ok, let’s start this post by thanking Thomas Koetzing for his newly updated post! Thx a lot man and keep up the great work!
Thomas has summarized most of the features that Web Interface 5.4 offers and how StoreFront matches that, it’s a really good table and one that all of you architects out there shall review and plan accordingly. What are you using today and what are the needs going forward, then once you have your business needs and requirements you have your wanted position and it’s just to make a roadmap of how your service gets there, or not if features are missing, then call Citrix!! 😉
I think that Thomas’s summary is good, one thing to consider though that I really urge you to think of is if you’re planning to use multiple access points around the world for an enterprise. How would this work? What if you have one in Europe, APAC and Americas? You would probably have a couple of NetScalers with AGEE and use GSLB to nicelly provide a simple URL for everyone and network proximity or so to direct the users to the closest entry point. But that regional NetScaler would most likely have its own set of StoreFront servers including a pair of AppControllers to ensure that you don’t have a single point of failure in terms of your internal WAN to get to another regional StoreFront/AppController setup from the local NetScaler AGEE? And if you then think like me; how are you going to do this?
The StoreFront server is relying on the DB for the subscriptions that the end-users have done in terms of selection apps etc for his “workspace”, and the same is with the AppController! There is no “supported” way today that I’ve found where you can synchronize two or multiple sets of HA-pairs of StoreFront or AppControllers so that no matter where the end-user is logging on he/she doesn’t get the same set of subscriptions (apps, desktops, SaaS, etc.) and neither his/her SSO credentials if AppController is used. And just imagine how it would be if you integrate and use the federation of SaaS applications on all locations and an end-user is logging in and subscribing from multiple AppControllers agains for instance Salesforce, and how would you do the overall enterprise reporting? This is the enterprise feature I’m missing and I’m hoping that we could see some solution to this fairly soon!
And it’s now you should start evaluating StoreFront, this is key to understand what it offers now so you know where you are compared to your As-Is architecture with Web Interface and map that to your wanted position going forward!
But a part from that I must say that Thomas did a great job in his comparison and read more about it in detail here!
//Richard
The IT Melting Pot! 