Citrix Access Gateway: Frequently Asked Questions for Partners Contents What s New... 5 PRODUCT LINE OVERVIEW... 8

Transcription

1 Frequently Asked Questions: Citrix Access Gateway: Frequently Asked Questions for Partners Contents What s New... 5 PRODUCT LINE OVERVIEW... 8 Frequently Asked Questions: Access Gateway... 8 Citrix Access Gateway VPX and What is the Citrix Access Gateway? Licensing Changes Is the Access Gateway Model 2010 appliance being discontinued?... 8 Access Gateway VPX... 8 Does Access Gateway Frequently VPX include Asked all Questions: features and functionality as Model 2010 physical appliance?... 8 Why does Citrix Citrix offer Access Gateway Gateway as both VPX virtual and and physical appliances?... 8 Access Gateway 2010 VPX Express Licensing... Changes 9 What is Access Gateway VPX Express?... 9 Who should try it?... 9 Is Access Gateway Frequently VPX Express Asked limited Questions: in functionality?... 9 How many licenses Citrix does Access Gateway VPX VPX Express and include?... 9 How many Access 2010 Gateway Licensing VPX Express Changes license files can I request?... 9 Why is a My Citrix account required to download Access Gateway VPX Express?... 9 Access Gateway vs. NetScaler... 9 Frequently Asked Questions: What are the differences between Access Gateway and NetScaler?... 9 Citrix Access Gateway VPX and Which product would suit my customers? Licensing Changes Citrix Integration XenApp and XenDesktop Does Citrix Access Gateway Work With Citrix XenApp and Citrix XenDesktop? Frequently Asked Questions: What are the Benefits of Using Access Gateway in Place of Secure Gateway? Citrix Access Gateway VPX and Do I Need to License Access Gateway for Tunneling Citrix XenApp Connections? Licensing Changes Will Citrix Continue to Support the Secure Gateway in Citrix XenApp? Does Access Gateway Provide Double-Hop DMZ Support? XenServer... Frequently Asked Questions: 12 What is Citrix Citrix XenServer? Access... Gateway VPX and 12 Can I host other 2010 Citrix Licensing virtual machines Changes or VPX appliances on the same XenServer? Does Access Gateway VPX support XenServer NIC bonding? Frequently Asked Questions: Citrix Access Gateway VPX and 2010 Licensing Changes

2 Does Access Gateway VPX support XenServer High Availability? Does Access Gateway VPX support XenServer XenMotion? What is the difference between an Access Gateway failover cluster and XenServer high availability? Can Access Gateway failover cluster and XenServer high availability work together? Can Citrix Provisioning Server deploy Access Gateway VPX? Branch Repeater What is Citrix Branch Repeater? Does Access Gateway VPX work with Citrix Branch Repeater? Technical Information Do SSL VPNs Provide a Similar Level of Security as IPSEC VPNs? What Client Platforms Does Access Gateway Support? What Fault Tolerant Options are Available? Is a Complete List of Access Gateway Features Available? What are the minimum hardware requirements for Access Gateway VPX? What are Intel VTx and AMD-V? How common are Intel VTx and AMD-V? Is there a hardware compatibility list (HCL) for Access Gateway VPX? Can I add more memory or virtual CPUs to increase performance and scalability? How many users does Access Gateway VPX support? Deployment and Planning Where in the network is Access Gateway VPX deployed? What are the supported deployment modes? Can I pair Access Gateway VPX with a Model 2010 appliance in a failover cluster? Does the Access Gateway VPX operate in one-arm or two-arm mode? Does Access Gateway work with Citrix Receiver and Citrix Merchandising Server? How does Access Gateway integrate with Dazzle and Merchandising Server? Can multiple instances of Access Gateway VPX run on the same physical server? Licensing Is Access Gateway Included in the Platinum Edition Products? What is an Access Gateway Universal License? What is the Access Gateway Platform License? What features does the Access Gateway Platform License enable?... 17

3 How does a customer receive an Access Gateway Platform License? When will the Access Gateway Platform License be available? What features do Access Gateway Universal Licenses enable? Can the Access Gateway Platform License and Universal Licenses work together? I already own Access Gateway appliances and licenses; do I need to purchase new licenses? What is happening to Access Gateway Standard Edition User Licenses? Does the End of Sale announcement mean that Access Gateway Standard Edition is being discontinued? How many licenses does Access Gateway VPX Express include? How many Access Gateway VPX Express license files can I request? Can I share Access Gateway Universal Licenses between Access Gateway VPX and Model 2010 appliance? What are the CCU Pricing Bands and How Do They Work in Conjunction with Program Discounts? Do the Discounts Provided by Pricing Bands Extend Across Multiple Transactions? How does Citrix deliver License Codes? How Do I Allocate and Download Access Gateway License Files? What about Disaster Recovery? Packaging and Pricing Has the Pricing for Appliance Models Changed? Why are Discounts for High-Availability Pairs Not Offered on the MPX 5500? Is Access Gateway Functionality Available on the New NetScaler MPX Appliances? Has the Price for Access Gateway User Licenses Changed? How is Subscription Advantage Renewal Pricing Calculated for Universal Licenses? How does Citrix deliver Access Gateway VPX? How much does an Access Gateway Universal License cost? What are annual Universal Licenses and how much do they cost? Does the price change affect Subscription Advantage renewal costs? Ordering How is the Citrix Access Gateway Priced? Is There a Minimum Purchase Requirement? Are Firmware Updates Available for Access Gateway Appliances? Are the Access Gateway Appliances Covered by Warranty? Can Resellers Obtain NFR Licenses? How Do Customers Obtain Evaluation Licenses?... 23

4 Support and Subscription Advantage Does Access Gateway VPX include Subscription Advantage? Does Subscription Advantage include technical support? Can Access Gateway VPX be upgraded? Are warranties and maintenance available for the Access Gateway VPX? What do I do if I experience a technical support issue with the XenServer hosting Access Gateway VPX?... 23

5 What s New What s new for the Citrix Access Gateway product line? Citrix has announced notable changes to the Access Gateway product line including the release of Access Gateway 5.0 on October 27 th. The release serves as an upgrade and replacement for Access Gateway Standard and Advanced Editions, combining the benefits of these two editions while enhancing the administration and availability of the system. In early 2010, Citrix also released a virtual appliance called Access Gateway VPX and updated licensing and pricing for the product line. Citrix Access Gateway 5.0 Feature Access Gateway VPX for VMWare ESX Simple and Intuitive Administration Basic High Availability support for Model 2010 and VPX appliances Variable Logon Points Description Access Gateway VPX running on VMware ESX and ESXi hypervisors allows organizations to leverage their existing server virtualization investments and provides additional deployment flexibility. Access Gateway 5.0 uses a new Flash-based administration tool for the appliance that makes it easy to install certificates, configure access control and monitor activity from any Flashenabled web browser. Two Access Gateway appliances can be configured as a failover pair. The appliances operate in active/passive mode, with the primary appliance servicing all user connections and the secondary appliance monitoring the primary and synchronizing session information. If the primary appliance fails, the secondary appliance takes over. This capability has been previously available with only MPX appliances. With Access Gateway 5.0, this capability is available on the Model 2010 and Access Gateway VPX appliances to facilitate the upgrade from Secure Gateway where Windows Load-balancing was used. Each Access Gateway appliance can host multiple logon points for support of different features or different user communities. Logon Points are now available in two varieties: Basic logon points enable access to XenApp or XenDesktop only and are enabled by the free Access Gateway platform license; SmartAccess logon points enable rich access control features such as network-layer VPN, endpoint

6 interrogation and remediation, clientless access to web sites and file shares, and adaptive access control. Endpoint Remediation Improved architecture Feature No Longer Supported When users fail to access the system because of a failed endpoint analysis scan, you can provide a customized HTML message informing them of why they failed and what steps to take for remediation. Significant updates have been made to the appliance firmware and Access Controller web services in this release to improve the overall performance, stability and feature set of Access Gateway. Compared to earlier versions of Access Gateway Standard or Advanced Edition, the following features are not available in the 5.0 release: HTML Preview LiveEdit Client certificate checking SYSLOG support SNMP support Support for multiple Web Interface sites per user in the Navigation UI Continuous endpoint analysis scans Citrix Access Gateway VPX Feature Access Gateway VPX Free trial download - Access Gateway VPX Express Description Access Gateway VPX is a virtual appliance form factor that delivers the same features and functionality as the Model 2010 physical appliance. Customers may deploy Access Gateway VPX as a virtual workload on their own hardware, in addition or as an alternative to using a physical appliance. Pricing starts at US $995 per virtual instance and includes the new Access Gateway Platform License, plus one year of Subscription Advantage TM. Access Gateway VPX works with the following hypervisors: XenServer 5.5 and higher, and VMWare ESX/ESXi. Access Gateway VPX is now available as a free download from Express includes 5 Universal Licenses that are valid for 12 months, giving customers the chance to try all the features of

7 Access Gateway before they buy. Access Gateway Licensing Changes Feature Access Gateway Platform License Access Gateway Annual Licenses Access Gateway Universal License Price Reduction Access Gateway Standard Edition User License End of Sale Description Support for user connections through Access Gateway to XenApp hosted applications or XenDesktop hosted desktops is now provided without requiring an Access Gateway user license for each connection. Access Gateway VPX instances and Universal Licenses are now available as annual subscriptions to help reduce large upfront investments. The starting list price of Access Gateway Universal licenses is reduced from US $170 to $100 per concurrent user. Corresponding Subscription Advantage renewal pricing is also reduced. Customers who purchased Access Gateway Universal licenses at the higher price tier will see a reduction in their Subscription Advantage renewal prices beginning on February 3, The Access Gateway Standard Edition concurrent user license was discontinued, effective June 30, Existing Access Gateway Standard Edition licenses under active Subscription Advantage may be converted to Access Gateway Universal licenses at no cost.

8 PRODUCT LINE OVERVIEW Access Gateway What is the Citrix Access Gateway? Citrix Access Gateway is the only SSL VPN that securely delivers desktops and applications with HDX SmartAccess - giving users easy-to-use secure access to all of the enterprise applications and data they need to be productive while allowing IT to maintain security with adaptive application-level policies. With Access Gateway organizations are empowered to cost effectively meet the anywhere access demands of all workers enabling flexible work options, easier outsourcing and non-employee access, and business continuity readiness while ensuring the highest-level of information security. Citrix Access Gateway is an industry-leading and comprehensive product line designed to meet customer needs and compete in all customer segments. Deployed as an appliance on the perimeter of an organization s network (often in the DMZ), it provides a single point of access to all applications and data - including resources such as Windows desktops delivered via Citrix XenDesktop, Windows applications delivered via Citrix XenApp, client-server applications, , files shares, internal Web applications, and IP telephony services. Access Gateway was designed with the best user experience in mind to make access transparent. Single signon capabilities minimize the number of authentication prompts, making it easy to navigate to key resources and Always-on access ensures sessions are automatically reconnected after losing a network connection, or after users roaming between access points. Is the Access Gateway Model 2010 appliance being discontinued? No. Citrix will continue to sell and support the Access Gateway Model 2010 appliance. Access Gateway VPX Does Access Gateway VPX include all features and functionality as Model 2010 physical appliance? Yes. The Access Gateway VPX provides the same features and functionality as the Model 2010 appliance, but runs as a virtual machine instance rather than a physical appliance. The current release is based on Access Gateway Why does Citrix offer Access Gateway as both virtual and physical appliances? Citrix offers a choice of form factors to ensure customers have the flexibility of multiple deployment options not available from other vendors. Virtual appliances are ideal for customers who: Have limited rack space and infrastructure and need to consolidate physical appliances. An Access Gateway VPX instance can be co-located with other virtual machines on a single server to reduce the overall infrastructure requirements. Want to reduce costs by cutting power consumption and standardize all hardware in the data center to get the best pricing from server vendors Need to minimize downtime. XenServer capabilities such as XenMotion (dynamic workload relocation) and NIC bonding offer an ideal way to lessen the impact of hardware failures. Virtual appliances also eliminate the need for appliance replacements when failures occur.

9 Require a solution that offers isolated, multi-tenancy configurations for different user populations. Prefer to create a non-production environment for training and testing. Physical appliances remain the preferred option for customers who: Need the scalability and performance of a dedicated appliance. Access Gateway VPX can support up to 500 concurrent users when deployed on a server with a recommended configuration. Appliances such as Access Gateway 5500 MPX can support up to 5,000 concurrent users per appliance and are the more cost effective solution in deployments supporting more than 1,500 concurrent users. Can only address policy requirements of security and network infrastructure teams through the use of physical appliances. The virtual appliance form factor makes it easier and less expensive for customers and partners to learn the Access Gateway product and test new configurations without disrupting a production deployment. Access Gateway VPX Express What is Access Gateway VPX Express? Access Gateway VPX Express is a free trial download available from It is a fully-functional image of Access Gateway VPX that allows customers to try the solution before they buy. Access Gateway VPX is available for XenServer 5.5 or higher and VMware ESX / ESXi. Who should try it? Anyone interested in exploring the features and benefits of Access Gateway in a test lab should try Express. It is not supported for production environments and anyone looking to conduct a proof of concept in live production should request an evaluation license from a Citrix Solution Advisor. Is Access Gateway VPX Express limited in functionality? No, it is fully functional version of Access Gateway version 5.0. How many licenses does Access Gateway VPX Express include? Access Gateway VPX Express includes 5 Universal Licenses that are valid for 12 months. License keys must be requested from the Access Gateway VPX Express download page and activated before they can be used. How many Access Gateway VPX Express license files can I request? Customers can only request 1 license key in a 12 month period. This license key is an entitlement for 5 concurrent users. After the expiration period of the license, a replacement license can be requested. Why is a My Citrix account required to download Access Gateway VPX Express? Access Gateway is a categorized as an ENC-R product by the US government. As a result, Citrix must limit who can download the trial version of the product and the use of My Citrix helps address these download requirements. In some situations, customers may be asked a series of questions before the download begins. Access Gateway vs. NetScaler What are the differences between Access Gateway and NetScaler? Access Gateway runs on the NetScaler platform (the Operating System ) and is one of a multitude of features that are available on the platform. NetScaler is also the product line name for Citrix s web application delivery

10 controllers. The features of the platform may or may not be activated depending on which SKU item a customer purchases. The Universal License that enables NetScaler provides activation of the following platform features: Better platforms with redundant components and increased performance License upgradability to enable additional functionality from MPX platforms Integrated load-balancing for internal servers Multi-site failover with Global Server Load Balancers Site health monitoring for the protected internal resources The key is to remember that while Access Gateway and NetScaler are housed on the same hardware representing different capabilities and are targeted at solving different business issues. Citrix customers can choose between Access Gateway and NetScaler to address their secure access requirements. Which product would suit my customers? It really depends on the customer s network and performance requirements. If the customer is a network administrator or is in the network infrastructure team, NetScaler is the solution that can address all their requirements. However, if the network infrastructure team is pre-disposed to another vendor such as F5, Access Gateway may be the better solution to expedite the sales process and avoid competitive friction. Customers who are primarily XenApp or XenDesktop administrators will find Access Gateway easy to deploy within their environment. This product is designed to be Citrix s simplest solution for securing end-to-end application and desktop environments. XenApp customers looking to upgrade from Secure Gateway should consider Access Gateway VPX which provides a new of improvements over Secure Gateway including support for Citrix Receiver and Merchandising Server. Access Gateway VPX or Access Gateway on a Model 2010 appliance are purpose-built solutions and should be used when low-complexity is desired since these solutions are easier to learn and deploy than NetScaler. Access Gateway VPX is Citrix s virtual appliance that offers the best price-to-performance ratio. However, customers looking to support more than 1,500 concurrent users are advised to deploy physical appliances such as the MPX 5500 for the most cost-effective solution. With the release of Access Gateway 5.0, Citrix shifts focus from the traditional edition-based versioning of the solution to a more customer-friendly platform-based model. Citrix now focuses on providing a higher customer value by diversifying the Access Gateway appliance portfolio based on the demands of the customer s secure access requirements and their performance demands. Citrix Integration Access Gateway is the best SSL VPN solution for achieving seamless integration with other Citrix solutions such as XenApp, XenDesktop, XenServer and Branch Repeater. By combining with these components, Access Gateway offers a powerful, secured and highly optimized end-to-end solution. XenApp and XenDesktop Does Citrix Access Gateway Work With Citrix XenApp and Citrix XenDesktop? Yes better than any other SSL VPN. Access Gateway provides tight integration with XenApp and XenDesktop, allowing customers to:

11 Replace the XenApp Secure Gateway feature in the DMZ with a hardened physical or virtual appliance. The solution provides single sign-on to Web Interface, reducing user frustration from entering credentials multiple times. Provide auto-reconnection of sessions without the need to re-authenticate. Secure connections to Citrix XenDesktop and Citrix XenApp directly without the need to load other clients, port redirectors, and network connect drivers. Add secure access to local applications and all protocols, such as synchronization and VoIP softphones. In addition, Access Gateway extends adaptive application-level policy capabilities to XenDesktop and XenApp environments, allowing administrators to: Define policies based on access scenarios using information such as client configuration, machine identity, user identity, and network location. Control which applications and desktops can be accessed based on a user s access scenario. Add granular control over which virtual channels are associated with a XenDesktop or XenApp session to provide custom levels of access to a desktop or application (e.g., local printing and client drive mapping). Provide users with access to confidential resources in public or untrusted access scenarios, where standard cache clean-up mechanisms are insufficient or unreliable. Adhere to compliance standards by ensuring that certain resources are only accessed when the user, even if roaming, is in a compliant access scenario. What are the Benefits of Using Access Gateway in Place of Secure Gateway? The Secure Gateway feature available in Citrix XenApp provides secure remote access to published applications. It is implemented as a Windows Service running on Microsoft Windows Server, which resides within the DMZ. Additionally, when Secure Gateway is used, the Web Interface Server must also reside within the DMZ. Access Gateway is a product line of hardened SSL VPN appliances that incorporate all the capabilities of Secure Gateway and also provide access to other standalone applications and/or corporate datacenter resources. Organizations can continue to securely deliver published applications, but can also provide access to additional resources, such as or CRM application synchronization and voice over IP telephony. Organizations who replace their Secure Gateway with Access Gateway benefit from: A lower cost of ownership (no need to purchase, patch, maintain or replace the Windows server that houses Secure Gateway) Reduced administrative effort via simplified patch management Better application and data security A simpler architecture that moves Web Interface server behind the firewall into the corporate datacenter and consolidates existing VPN solutions into a single point of access Higher security compliance via endpoint analysis and adaptive policy control on XenDesktop and XenApp sessions Do I Need to License Access Gateway for Tunneling Citrix XenApp Connections? No. Access Gateway will not require user licenses for securing Citrix XenDesktop or XenApp connections. This capability is included as an entitlement with each Access Gateway or NetScaler appliance purchase. Will Citrix Continue to Support the Secure Gateway in Citrix XenApp? The Secure Gateway feature of XenApp will continue to ship as a supported feature running on the Microsoft Windows Server system and will continue to support secure transit of XenApp traffic only. However, no major new functionality will be added.

12 Access Gateway is the premier secure access solution offered by Citrix and should be used when: Secure access to more than just XenApp hosted applications is required More granular control over access to XenApp applications is desired A hardened appliance is preferred over servers in the DMZ Does Access Gateway Provide Double-Hop DMZ Support? Yes, all Access Gateway appliances provide support for two-stage DMZs. However, only Secure Gateway style or ICA Proxy connections are supported in this configuration. Network level connections with the Access Gateway Plug-in in a double-hop DMZ are not supported by any Access Gateway version. XenServer What is Citrix XenServer? Citrix XenServer provides a rich set of management integration and automation capabilities that increase IT flexibility, agility and automation to lower costs and helps to transform today s complex IT environments into simplified virtual datacenters. Can I host other Citrix virtual machines or VPX appliances on the same XenServer? Yes. Other virtual machines (Citrix or non Citrix) can be hosted on the same physical XenServer. How an organization intends to use Access Gateway VPX (e.g. pilot, training, production) and where they deploy Access Gateway VPX will dictate which additional virtual machines are suitable for sharing the same XenServer. For best performance, the administrator should ensure that physical host has adequate resources (RAM, CPU, I/O, storage) to support additional virtual machines. Does Access Gateway VPX support XenServer NIC bonding? Yes. Access Gateway VPX supports the NIC Bonding feature of Citrix XenServer. NIC Bonding enables XenServer to join multiple physical network interfaces (PIFs) and present them as a single virtual interface (VIFs) to a virtual machine. This XenServer feature provides increased network throughput and fault tolerance for network interfaces. Does Access Gateway VPX support XenServer High Availability? Yes. Access Gateway VPX supports the High Availability feature included with Citrix Essentials for XenServer. High Availability enables multiple XenServer host machines to participate in a server pool. In the event that the XenServer host on which Access Gateway VPX is running were to fail, another server in the pool will load and initialize the Access Gateway VPX workload. In the event of a high availability failover, active user sessions need to be re-established. Does Access Gateway VPX support XenServer XenMotion? Yes. Access Gateway supports XenMotion. XenMotion enables XenServer to transfer a running instance of Access Gateway VPX from one physical XenServer host to another XenServer host without terminating existing user sessions. What is the difference between an Access Gateway failover cluster and XenServer high availability? An Access Gateway failover cluster enables up to three physical or virtual instances of Access Gateway to participate in an active/active cluster. Each Access Gateway in the cluster has the same configuration and is capable of accepting connections. If a cluster member fails, active and new user sessions can be seamlessly reconnected to another member of the cluster. All members of the cluster must be online in order to participate

13 in a failover event because the failover cluster does not support dynamic powering on cluster members. Keep these important requirements in mind when planning a failover deployment: Each Access Gateway instance in the cluster requires a separate FQDN, with a separate public IP address and separate SSL certificate. The Access Gateway Plug-in (the full VPN client) is required for failover. This is because the failover login occurs within the Access Gateway Plug-in, not the Access Gateway. After a failover, users have to re-authenticate to Access Gateway. However, the Access Gateway Plugin can be configured to store and resubmit the users credentials providing a seamless reconnection. XenServer high availability guarantees service uptime in the event of XenServer host failure. In the event that the XenServer host on which Access Gateway VPX were to fail, another server in the pool will load and initialize the Access Gateway VPX workload. In the event of a high availability failover, active user sessions need to be re-established. Can Access Gateway failover cluster and XenServer high availability work together? Yes. By leveraging both features additional failover protection can be added to an Access Gateway VPX deployment. Consider a scenario where two Access Gateway VPX instances, AG1 and AG2, are members of a failover cluster. The two Access Gateway VPX instances have also been configured for XenServer high availability. If AG1 failed, users would immediately attempt to connect to AG2, while XenServer automatically starts AG1 on a different XenServer host. To achieve even greater high availability, a network load balancer, such as Citrix NetScaler, can be deployed to load balance the traffic between the Access Gateway s in the cluster. Can Citrix Provisioning Server deploy Access Gateway VPX? No. Access Gateway VPX does not support automated deployments using Citrix Provisioning Server. Branch Repeater What is Citrix Branch Repeater? Citrix Branch Repeater is a branch optimization solution that provides a high definition desktop and application experience to branch and mobile users while dramatically reducing bandwidth costs and simplifying branch infrastructure. Does Access Gateway VPX work with Citrix Branch Repeater? Yes. The Citrix Repeater TM Plug-in integrates seamlessly with the Access Gateway Plug-in to provide a highdefinition user experience to the remote and mobile worker. The Repeater Plug-in provides the benefits of Branch Repeater solutions to remote users in small branch offices, homes, airports or other locations that do not enjoy the luxury of a Branch Repeater appliance. Citrix Repeater Plug-in is a PC software WAN optimization solution that works in conjunction with a Citrix Repeater appliance located in the datacenter. Technical Information Do SSL VPNs Provide a Similar Level of Security as IPSEC VPNs? Yes, the Citrix Access Gateway uses industry standard SSL/TLS encryption to secure the connection between the endpoint and the network the same encryption that is used by Internet banking and online commerce sites. The Access Gateway also supports many of the well-known security features of IPSec VPNs, such as

14 two-factor user authentication, split tunneling control, Access Control Lists (ACLs) and client-side certificate support. What Client Platforms Does Access Gateway Support? Access Gateway supports Windows 7 (32-bit and 64-bit), Windows Vista, Windows XP, Linux, and Mac OS X (10.5 and higher). All SSL-enabled Citrix Receiver Online plugins are supported directly without any additional Secure Access Client software. What Fault Tolerant Options are Available? Access Gateway appliances include server-side failover capabilities, ensuring that when an appliance fails, end-users are automatically reconnected to the backup appliance with little or no distribution. Global Server Load-balancing (GSLB) is always available when Access Gateway runs on a Citrix NetScaler appliance. This capability allows Access Gateway sessions to be distributed across geographically-dispersed data centers, or can route users to the nearest or most responsive data center. Is a Complete List of Access Gateway Features Available? Yes, Access Gateway literature can be found at The Citrix Access Gateway Datasheet contains details on specific features. What are the minimum hardware requirements for Access Gateway VPX? The hardware requirements for Access Gateway VPX are divided into two categories, the host XenServer requirements and the Access Gateway VPX virtual machine requirements. Minimum hardware requirements for a XenServer running Access Gateway VPX: Hardware item CPU Memory Hard disk space Network interface Requirements One or more 64-bit x86 CPUs with virtualization assist (Intel-VT or AMD-V) enabled. Note: To run Access Gateway VPX, hardware support for virtualization must be enabled on the XenServer host. Make sure that the BIOS option for virtualization support is not disabled. Consult your BIOS documentation for more details. At least 2 GB of RAM. Locally attached storage (PATA, SATA, SCSI) with minimum 40 GB of disk space. General disk space requirements for Access Gateway VPX: XenServer installation creates a 4 GB partition for the XenServer host control domain; remaining space is available for Access Gateway VPX and other VMs. One 1 Gbps network adapter required. Recommended: Two network adapters of 1 Gbps each for a two-arm deployment, which uses an internal and an external interface. Minimum virtual hardware requirements for an Access Gateway VPX virtual machine:

15 Hardware item Memory Virtual CPU Hard disk space Network interface Requirements 1 GB of RAM. Up to two virtual CPUs Locally attached storage (PATA, SATA, SCSI) with minimum 40 GB of disk space. Two What are Intel VTx and AMD-V? Intel VTx and AMD-V are CPU components, which trap sensitive or privileged CPU instructions executed by the guest virtual machine out to the hypervisor. These features are sometimes referred to as hardware assist or virtualization assist. How common are Intel VTx and AMD-V? Virtually all servers shipped within the last two years support either Intel VTx or AMD-V. However, many servers ship with virtualization assist disabled in the BIOS. Is there a hardware compatibility list (HCL) for Access Gateway VPX? Access Gateway VPX is designed to run on any XenServer supported hardware platform. A XenServer HCL is available at Can I add more memory or virtual CPUs to increase performance and scalability? Access Gateway VPX should only be configured with 1 GB of memory. Adding additional memory does not improve the performance or scalability. Access Gateway VPX can be configured with two or more virtual CPUs for optimal performance and scalability. Adding more than two virtual CPUs improves performance by reducing latency but does not improve scalability beyond 500 concurrent users. How many users does Access Gateway VPX support? When configured with two or more virtual CPUs, Access Gateway VPX supports 500 concurrent users, the same amount as the Model 2010 appliance. Deployment and Planning Where in the network is Access Gateway VPX deployed? Access Gateway is traditionally deployed in the DMZ. What are the supported deployment modes? Access Gateway supports the following deployment modes: Single-DMZ deployment with SSL VPN access Single-DMZ deployment with Citrix Web Interface behind Access Gateway Single-DMZ deployment with Citrix Web Interface parallel to Access Gateway Dual-DMZ deployment, which only supports Citrix Web Interface and Citrix XenApp/XenDesktop traffic

16 Access Controller Mode where policies are deferred to an Citrix server (Model 2010 and Access Gateway VPX only) Multiple Access Gateway instances configured in a failover cluster Can I pair Access Gateway VPX with a Model 2010 appliance in a failover cluster? Yes. A virtual and physical appliance can be joined to the same failover cluster. Both members must be online in order to participate in a failover event. Does the Access Gateway VPX operate in one-arm or two-arm mode? Access Gateway VPX supports both one-arm and two-arm mode. One-arm mode uses one XenServer virtual network interface for inbound and outbound connections. In one-arm mode, a single IP address is assigned to Access Gateway. The default configuration of Access Gateway is one-arm mode. Two-arm mode uses two XenServer virtual network interfaces, one for external and one for internal connections. In two-arm mode, two IP address are assigned to Access Gateway, one for the external interface and one for the internal interface. Does Access Gateway work with Citrix Receiver and Citrix Merchandising Server? Yes. The Access Gateway Plug-in is supported by Citrix Receiver and Citrix Merchandising Server. Citrix Receiver is the first universal client for IT service delivery. With Citrix Receiver installed on a device, IT can deliver applications and desktops as an on-demand service with no need to manage, own or care about the physical device or its location. Citrix Merchandising Server is a new head-end infrastructure component that helps create, deliver and manage a high quality end user experience on laptops, desktops and smartphones. Now with the introduction of the Merchandising Server, IT can easily merchandise their IT services in a convenient, simple way that seamlessly connects users to virtual applications, desktops and other services in the same way retail merchandising managers create a compelling shopping experience for their customers. How does Access Gateway integrate with Dazzle and Merchandising Server? The management console of Access Gateway 5.0 allows administrators to specify the IP address of the Merchandising Server. After this configuration step, Citrix Receiver will seamlessly establish a secure tunnel to the Merchandising Server through Access Gateway. Administrators should configure firewall rules to allow the connection between Access Gateway and Merchandising Server. Can multiple instances of Access Gateway VPX run on the same physical server? Yes. Multiple instances of Access Gateway VPX can run on the same physical server. The administrator must ensure that the host server has enough adequate resources (RAM, CPU, I/O, storage) to support the total running workload.

17 Licensing Is Access Gateway Included in the Platinum Edition Products? The Access Gateway enables secure application and desktop access for the Citrix application and desktop delivery controllers through the Platinum edition: XenApp Platinum contains an Access Gateway Universal license for every purchased CCU. Access Gateway appliances must be purchased separately in order to use Access Gateway. XenDesktop Platinum contains an Access Gateway Universal license for every purchased CCU. Access Gateway appliances must be purchased separately in order to use Access Gateway. NetScaler Platinum contains 100 Access Gateway Universal licenses per purchased appliance or HA Pair. Please note that additional AG Universal License CCUs can be purchased. Non-Platinum editions of XenApp and XenDesktop can be used with Access Gateway for no additional cost per user. Each Access Gateway and NetScaler appliance includes secure access to these products (see Access Gateway Platform License ). What is an Access Gateway Universal License? An Access Gateway Universal License is a concurrent user license, which is only required for sessions in which users connect to resources other than XenApp, XenDesktop, Citrix Receiver, or where endpoint analysis is used to determine the appropriate level of access for that session. The Access Gateway Universal license is a version-less and edition-less license entitlement for the Access Gateway product line. It can be applied to any edition of Access Gateway or any model of Access Gateway appliance to enable relevant functionality. The Access Gateway Universal license allows customers to simply purchase the needed number of concurrent remote access users and move between Access Gateway editions as their needs change simply by purchasing new appliances. Using the Access Gateway Universal license enables Citrix to dramatically simplify the purchasing, upgrade, and migration options by offering a single license with three volume pricing tiers. What is the Access Gateway Platform License? Access Gateway Platform Licenses enable basic connections through Access Gateway to XenApp hosted applications or XenDesktop hosted desktops without requiring an Access Gateway user license for each connection. Each Access Gateway and NetScaler appliance (physical and virtual) includes an Access Gateway Platform License as an entitlement and allows user connections up to the maximum capacity of the appliance. Previously, connections to XenApp and XenDesktop required an Access Gateway concurrent user license so this change represents a significant cost savings to customers. What features does the Access Gateway Platform License enable? A basic connection using the Access Gateway platform license supports: Strong authentication Integration with Citrix Web Interface to broker connections to XenApp or XenDesktop Secure SSL relay of ICA session traffic Compatibility with Citrix Receiver (hosted applications only) Secure tunneling for support of Merchandising Server and Citrix Dazzle

18 These capabilities and the reduced cost of ownership make Access Gateway an ideal replacement to Secure Gateway. All XenApp customers are highly encouraged to upgrade their environment from Secure Gateway to Access Gateway and new XenApp and XenDesktop customers should deploy Access Gateway exclusively as their preferred secure access solution. How does a customer receive an Access Gateway Platform License? The platform license is available with all new Access Gateway and NetScaler appliance purchases. In addition, existing customers with appliances covered under Warranty or Maintenance are entitled to Access Gateway platform licenses at no additional charge. When will the Access Gateway Platform License be available? Support for the Access Gateway platform license is initially available only for the Model 2010 and Access Gateway VPX appliance models. For MPX series appliances, firmware version 9.2 is required to recognize the platform license. What features do Access Gateway Universal Licenses enable? A concurrent user connection using the Access Gateway Universal license supports: Full network-layer VPN tunneling Endpoint Analysis Adaptive policy control (including published application and virtual channel filtering) Clientless access to , web sites and file shares Can the Access Gateway Platform License and Universal Licenses work together? With Access Gateway Enterprise Edition 9.2, the Access Gateway Platform License and Universal Licenses will be able to co-exist on the same appliance. Access Gateway Universal Licenses will be consumed only when users log on to an Access Gateway virtual server running in SmartAccess mode. For connections to an Access Gateway virtual server running in Basic mode, Access Gateway Universal licenses will not be consumed. For Access Gateway 5.0, mixed usage of the Access Gateway platform and Access Gateway Universal licenses is available using separate Logon Points. I already own Access Gateway appliances and licenses; do I need to purchase new licenses? Existing customers who own an Access Gateway appliance, which is covered under Warranty or Maintenance, are entitled to the Access Gateway platform license at no additional cost. Platform licenses for existing appliances may be obtained using the license allocation/activation tool at What is happening to Access Gateway Standard Edition User Licenses? The Access Gateway Standard Edition concurrent user license will no longer be sold, effective June 30, Existing customers can migrate to Access Gateway Standard Edition licenses, which are covered under Subscription Advantage to Access Gateway Universal licenses at no cost. This migration option allows customers currently running Access Gateway Standard Edition to migrate to Access Gateway Advanced Edition or Enterprise Edition with no per-ccu price increase. New licenses may be obtained using the license allocation/activation tool at

19 Does the End of Sale announcement mean that Access Gateway Standard Edition is being discontinued? No. This End of Sale announcement for the Access Gateway Standard Edition user licenses does not constitute an end of life announcement for Access Gateway Standard Edition. For deployments of Access Gateway Standard Edition that require user connection licenses, Access Gateway Universal licenses should be purchased instead of Access Gateway Standard Edition licenses. Please note: the price of the Access Gateway Universal licenses have been reduced to the same price point where Access Gateway Standard Edition licenses were sold. How many licenses does Access Gateway VPX Express include? Access Gateway VPX Express includes 5 Universal Licenses that are valid for 12 months. License keys must be requested from the Access Gateway VPX Express download page and activated before they can be used. How many Access Gateway VPX Express license files can I request? Customers can only request 1 license key in a 12 month period. This license key is an entitlement for 5 concurrent users. After the expiration period of the license, a replacement license can be requested. Can I share Access Gateway Universal Licenses between Access Gateway VPX and Model 2010 appliance? Yes, because both Access Gateway VPX and Access Gateway appliances can access the same license server. The license server can be either a virtual or a physical Access Gateway. The maximum number of concurrent user sessions will be governed by the Universal License. What are the CCU Pricing Bands and How Do They Work in Conjunction with Program Discounts? The Access Gateway Universal license (CCU) is available in two pricing tiers: 1-2,499 users; and 2,500 or more users, and the price per user varies depending upon the pricing tier. The pricing band is determined by the number of concurrent user licenses purchased in the transaction, and then the standard licensing program discounts (e.g. ELP, etc.) are applied. In other words, there are two possible discounts that may be applied to the full SRP: first the volume purchase discount (which establishes a new SRP depending on the quantity) and then the standard discount programs are applied to the new SRP. Please see the table provided within this FAQ document for details around the two pricing tiers.

20 Do the Discounts Provided by Pricing Bands Extend Across Multiple Transactions? No. The volume discounts offered by the pricing bands are calculated based on the number of concurrent licenses purchased during the transaction and do not span multiple transactions or line items. For example, a customer who purchases 1,000 concurrent licenses and then purchases 1,600 concurrent licenses in the second transaction, will pay based on the 1-2,499 users band in both transactions. The license purchases are not cumulative (pricing for the 2nd transaction is not discounted based on 1,000+1,600 user licenses and does not use the pricing for the 2,500 or more user price band). How does Citrix deliver License Codes? For new orders, license codes are delivered via . How Do I Allocate and Download Access Gateway License Files? License codes are converted to license files on the MyCitrix site Under the menu, choose SupportProduct Activation and select the Activate/Allocate tab. What about Disaster Recovery? The End User License Agreement for Citrix Access Gateway allows user licenses to be installed on an unlimited number of appliances. Organizations are free to distribute load across multiple active Access Gateway appliances as long as the total number of concurrent sessions across all appliances does not exceed the total number of licenses purchased from Citrix. Packaging and Pricing Has the Pricing for Appliance Models Changed? No, appliance pricing has not changed recently. Here is the current pricing and support user guidelines: Appliance Versions Supported List Price (US) Max Users Access Gateway VPX 5.0 $ Access Gateway VPX (Annual License) 5.0 $ 419 per year 500 Model $ 3, MPX $ 9,000 5,000 Why are Discounts for High-Availability Pairs Not Offered on the MPX 5500? High-availability pair discounts are no longer required because the lower single unit price is exactly 50% of the previous HA pair price (of the Series 7000). Customers who require HA pairs should purchase two units of the MPX 5500 and the total cost will be equal to the previous HA pair pricing.

21 Is Access Gateway Functionality Available on the New NetScaler MPX Appliances? Yes, all NetScaler appliances include 5 concurrent user licenses that enables Access Gateway functionality on these devices (NetScaler Platinum includes 100 Access Gateway Universal Licenses). Access Gateway Universal Licenses may be added to increase the number of user connections supported on these appliances. Has the Price for Access Gateway User Licenses Changed? No, the pricing for the Access Gateway licensing has not changed since early 2010: Concurrent User Licenses (CCU) License Cost (with 1 full year SA) Renewal (per CCU) Universal License (1-2,499) $100 $13 Universal License (2,500+) $50 $7 As with appliances, licensing is eligible for program discounts. How is Subscription Advantage Renewal Pricing Calculated for Universal Licenses? All Access Gateway Universal license Subscription Advantage renewal pricing is based on the original SRP as defined by the pricing tier. Subscription Advantage renewal pricing is NOT based on the aggregate number of Access Gateway Universal licenses owned (if purchased across multiple transactions). How does Citrix deliver Access Gateway VPX? Access Gateway VPX will be delivered via electronic download through the MyCitrix customer portal. How much does an Access Gateway Universal License cost? Access Gateway Universal Licenses start at $100 per user for up to 2,499 users. The license cost drops to $50 per user for volumes greater than or equal to 2,500 users. Yes. Citrix has reduced the price of Access Gateway Universal licenses from US $170 to $100 per concurrent user. In addition, the volume pricing discount tiers have been reduced from three to two. What are annual Universal Licenses and how much do they cost? Universal licenses are available for purchase on an annual basis. These licenses must be renewed every 12 months and include Subscription Advantage. Volume discounts apply and pricing is as follows: New pricing tiers $42 per user per year ( users) $21 per user per year (2500+ users)