609: Front-ending and load balancing XenDesktop and XenApp with NetScaler

Transcription

1 609: Front-ending and load balancing XenDesktop and XenApp with NetScaler Hands-on Lab Exercise Guide This session is offered as both an instructor led training and a self-paced online lab.

2 Contents Overview... 2 Scenario... 4 Exercise Initial Configuration and Licensing... 5 Exercise Deploying the NetScalers as a High Availability Pair...10 Exercise Load Balancing StoreFront Servers...16 Exercise Load Balancing XenDesktop Delivery Controllers...35 Exercise Configuring NetScaler Gateway for Secure Access...42 Exercise Configuring StoreFront for use with NetScaler Gateway...52 Exercise Testing Access to XenDesktop...58 Exercise Smart Access with NetScaler Gateway...62 Exercise Using NetScaler Gateway Filters with XenDesktop

3 Overview Hands-on Training Module Objective This training will provide hands-on experience with using NetScaler VPX virtual appliances to load balance, monitor, and secure a XenDesktop deployment. Prerequisites This training focuses on using NetScaler to front-end a working XenDesktop deployment. It is assumed that the student already knows how to deploy XenDesktop. Audience Citrix Partners, Customers, Sales Engineers, Consultants, Architects, and Technical Support Lab Environment Details The system diagram of the lab is shown below: The Student Desktop is accessed remotely using Citrix Receiver. All Windows applications such as XenCenter, (the XenServer GUI management tool), are accessed from the Student Desktop. 2

4 Lab Guide Conventions This symbol indicates particular attention must be paid to this step Start Bold text indicates reference to a button, object, or text to enter. Focuses attention on a particular part of the screen (R:255 G:20 B:147) List of Virtual Machines Used VM Name IP Address Description / OS Student Desktop Windows 7 Professional AD.training.lab Windows Server 2012 R2, Active Directory Controller DC Windows Server 2012 R2, XD 7.1 Delivery Controller DC Windows Server 2012 R2, XD 7.1 Delivery Controller NS NetScaler VPX NS NetScaler VPX SF Windows Server 2012 R2, StoreFront 2.1 Server SF Windows Server 2012 R2, StoreFront 2.1 Server SQL Windows Server 2012 R2, SQL 2012 Express Win7Client DHCP Windows 7 Professional Win8Desktop1 thru 3 DHCP Windows 8.1, Virtual Desktops WIN2012R21 thru 3 DHCP Window Server 2012 R2, Shared Desktops and Applications Required Lab Credentials The credentials required to connect to the environment and complete the lab exercises. VM Name IP Address Password Description All Windows VMs Citrix123 Password for the Domain Administrator All Windows VMs Citrix456 Password for the Local Administrator NS1 and 2 nsroot nsroot is username and password 3

5 Scenario The AnyCo company has deployed a working XenDesktop VDI solution that provides Windows 8.1 virtual desktops to users, as well as shared desktops and applications from Windows 2012 R2 servers. You have been hired to add NetScaler application delivery controllers in a high availability pair to provide load balancing of the critical components, and also to provide necessary security using the NetScaler Gateway feature. Your task is to use the guidelines outlined below to implement a solution that meets the business needs. Guidelines: Two NetScaler VPX virtual appliances need to be deployed in a high availability pair and all traffic into the XenDesktop deployment will be routed through them. AnyCo s XenDesktop deployment has two Delivery Controllers, and two StoreFront servers. These need to be load balanced and monitored for high availability using the NetScaler s load balancing and monitoring capabilities. AnyCo wants the IT staff alerted via SNMP if a Delivery Controller or StoreFront server fails. AnyCo s internal deployment needs to be protected from unauthorized access and attack using NetScaler Gateway. AnyCo wants the XenDesktop-delivered resources to be granularly accessed or denied based on various criteria. Users who accidently fail to specify SSL-encrypted HTTPS will be automatically redirected to use the more secure protocol. 4

6 Exercise 1 Initial Configuration and Licensing Overview To save time in the lab environment, two NetScaler VPX virtual machines have already been imported into the XenServer hypervisor. For more information on how to import NetScaler VPX virtual appliances into your chosen hypervisor, see The NetScalers now need to be configured for initial use and licensed. The initial configuration is necessary to establish the management IP address (the NSIP) of each NetScaler. To save time, the appropriate licenses for the NetScalers have been copied to a backup directory on each NetScaler. The license file will need to be placed into the correct directory on the NetScaler and then the NetScaler will need to be rebooted. This exercise will introduce you to the Command Line Interface (CLI) of the NetScaler and the BSD shell. It will also introduce you to using the PuTTY utility to get to the CLI of the NetScaler from a remote machine. Step by step guidance The lab environment virtual machines required for this exercise are: NetScaler VPX appliance NS1 NetScaler VPX appliance NS2 Win7Client Estimated time to complete this lab: 20 minutes. Step Action 1. Start the virtual machines NS1, NS2, and Win7Client if they are not already running. The AD.training.lab virtual machine should already be running. If not, start it. 5

7 2. Go to the console of NS1. Since there is no ns.conf file, the appliance prompts you to set its NSIP. Enter the following when prompted: IPv4 address: Netmask: Gateway IPv4 address: Select choice 4, Save and quit by pressing Enter. The NetScaler will restart. 3. Go to the console of NS2. Again, since there is no ns.conf file, the appliance prompts you to set its NSIP. Enter the following when prompted: IPv4 address: Netmask: Gateway IPv4 address: Select choice 4, Save and quit by pressing Enter. The NetScaler will restart. 4. After giving the NetScalers time restart, go to the Win7Client virtual machine and log in as Administrator in the Training domain using the password Citrix On the desktop, double-click putty.exe. Enter for the Host Name and click Open. In the PuTTY Security Alert dialog box, click Yes. Login as nsroot and use nsroot as the Password. You are now logged into the Command Line Interface (CLI) of the NS1 NetScaler. 6

8 6. Type show license to reveal that the NetScaler is not yet licensed. No features will work at this time. 7. Type shell and press Enter to get into the NetScaler s BSD shell. This gives you access to the NetScaler s file system. The prompt will change and show a pound sign at the end. 8. We will now copy a license file to the proper location for the NetScaler. Type the following case sensitive command, then press Enter: cp /var/license_backup/netscaler_vpx1_plt.lic /nsconfig/license Note: There is a space after cp and a space after.lic. There are no other spaces. Remember to use tab completion to make the typing easier. If you get no error messages, the copy was successful. 9. Type exit to exit the BSD shell back to the NetScaler prompt. The prompt changes back to a simple greater than (>) sign. Let s change the prompt to give us more information. Type set prompt NS1 and press Enter. 10. When licenses are added to a NetScaler, it must be restarted. Type reboot and Enter, followed by y and Enter, to reboot the NetScaler. 7

9 11. On the Win7Client, desktop, double-click putty.exe again. Enter for the Host Name and click Open. In the PuTTY Security Alert dialog box, click Yes. Login as nsroot and use nsroot as the Password. You are now logged into the Command Line Interface (CLI) of the NS2 NetScaler. 12. Type show license to reveal that the second NetScaler is not yet licensed. No features will work at this time. 13. Type shell and press Enter to get into the NetScaler s BSD shell. The prompt will change and show a pound sign at the end. 14. Type the following case sensitive command, then press Enter: cp /var/license_backup/netscaler_vpx2_plt.lic /nsconfig/license Note: There is a space after cp and a space after.lic. There are no other spaces. If you get no error messages, the copy was successful. 15. Type exit to exit the BSD shell back to the NetScaler prompt. Type set prompt NS2 and press Enter. Then, type reboot and Enter, followed by y and Enter, to reboot the second NetScaler. 16. From the Win7Client desktop, using Putty, login to each NetScaler s CLI and type: show license and press Enter. The result should look like the following: 8

10 Exercise Summary In this exercise, you learned how to do the initial configuration of a NetScaler VPX appliance, setting the NSIP, and how to license the appliance. You also learned how to connect to the CLI of the NetScaler from a remote machine using PuTTY, and how to set the NetScaler prompt. 9

11 Exercise 2 Deploying the NetScalers as a High Availability Pair Overview In this exercise, you will configure the two NetScaler appliances as a High Availability (HA) pair. You will also be introduced to the NetScaler Configuration Utility (the Graphical User Interface or GUI). Step by step guidance Estimated time to complete this lab: 30 minutes. Step Action 1. On the Win7Client virtual machine, launch Internet Explorer. Type for the URL address. This will open the login page of the Configuration Utility on NS1. Click the Show Options link on the login page to see the options available. 10

12 2. One useful option is to extend the time allowed before the Configuration Utility times out. Another may be to increase the Java Memory the application is allowed to use. Enter nsroot for the User Name and nsroot for the Password and click Login. 3. The Welcome configuration wizard starts automatically. The previously set NSIP and Netmask are already entered. Enter for the Subnet IP address and for the Subnet Netmask. Enter NS1 for the Hostname, and for the DNS address. Click Continue. Ordinarily it would be a good idea to check Change Administrator Password. For the purposes of the lab environment however, leave the password as the default, nsroot. 4. This wizard could have been used to license the NetScaler. Since our NetScalers are already licensed, click Continue in the next screen of the wizard and then click Done on the last screen. 11

13 5. The Configuration Utility now shows its main screen: Click the Disk icon in the top right corner and confirm that you want to save the changes you have made to the NetScaler s configuration. 6. Open another tab or another instance of Internet Explorer and connect to Repeat steps 1 4 above, except make the Hostname NS2. Be sure to save the running configuration. 7. In the instance of Internet Explorer that is connected to NS1 ( ), expand the System node on the left. Then, select High Availability. On the right, under the Nodes tab, click Add 12

14 8. If you get the following Security Information dialog, make sure that Always trust content from this publisher is checked, and click Run. Click Allow, Run, or OK on any other security warnings you may get. 9. Enter NS2 s NSIP and click OK. 10. Click OK on the Information message. We won t be using the RPC communication in this lab. For more information on RPC communication on the NetScaler, see con.html. 13

15 11. To confirm that HA is established between the two NetScalers, putty to At the NetScaler prompt, type show ha node (this can be abbreviated all the way down to sh node). Note the information shown. 12. At the command line, type force failover and confirm with a y. Then, type show ha node again. Notice that NS2 is now the Primary of the pair. 13. Type force failover and confirm again. Use show node to confirm that is now the primary. For the rest of the lab, we will want NS1 to be the Primary of the HA pair. Important! All configuration must be done on the Primary node of the HA pair. 14

16 14. On the Win7Client virtual machine, using Internet Explorer, connect to Using the Configuration Utililty, login as nsroot. Expand the System node on the left, then select Settings. On the right, click Configure basic features. 15. Select SSL Offloading, Load Balancing, NetScaler Gateway, and Authentication Authorization and Auditing. Then click OK. 16. Click the disk icon in the upper right corner of the GUI and save the running configuration. Exercise Summary In this exercise we configured NS1 and NS2 to be an HA pair. We used the NetScaler Configuration Utility (the GUI) to make the configuration. We also learned how to check on the HA status of the pair with the CLI and how to force a failover to ensure that HA is working. Finally, we turned on a selection of basic features we will be using in this lab. 15

17 Exercise 3 Load Balancing StoreFront Servers Overview AnyCo currently has a working XenDesktop deployment. However there is no load balancing being done across the two StoreFront servers. If the StoreFront server they use primarily went down, they would have to manually point users to the second server. This is not acceptable because there would be an interruption in service. They want the NetScaler to load balance and monitor the two StoreFront servers so that there will be no interruption of service if one StoreFront server goes down. Currently, the StoreFront servers only accept HTTPS traffic from clients, although the traffic from StoreFront to the Delivery Controllers is clear text. AnyCo wants the NetScalers to accept only HTTPS traffic from clients and to use HTTPS to the StoreFront servers. They also want the NetScalers to redirect any request using HTTP to HTTPS. Step by step guidance Estimated time to complete this lab: 55 minutes. Step Action 1. Using the Win7Client virtual machine, open Internet Explorer and point it to (NS1). Log on as nsroot. 2. When the AnyCo StoreFront servers were deployed, a wildcard SSL certificate was requested from a Certificate Authority for any server named *.training.lab. This certificate was exported in a PKCS#12 format. We would like to import this certificate to be used on the NetScaler. Expand Traffic Management on the left side of the Configuration Utility, then click on SSL. On the right side, click Import PKCS#12. 16

18 3. Enter wccert.pem for the Output File Name. On the PKCS12 File line, use the pull-down arrow to select Local. This will allow you to browse the file system on the Win7Client machine. Browse to C:\ and choose WildcardCert.pfx and click Open. When the certificate was exported originally, a password was placed upon it of Citrix123. Enter that into the Import Password field and click OK. 4. On the left side, expand SSL and click on Certificates. On the right side, click Install 17

19 5. For the Certificate-Key Pair Name, enter WildcardCert. For the Certificate File Name, click the down-arrow and choose Appliance, then click Browse. Select wccert.pem and click Open. Do the same for the Key File Name. The Certificate Format will be PEM and the Password is Citrix123. Notify When Expires should be checked and set the Notification Period for 30 days. Click Create. Don t click Close yet. The WildcardCert certificate is now ready to use on the NetScaler and will work for any address that ends with training.lab. 6. While we are here, let s install another certificate that we will be using in a later exercise. When we configure the NetScaler Gateway for external access, we will need a wildcard certificate for any address that ends with mycitrixtraining.net. The files for this are already on the NetScaler, but they need to be installed. Change the Certificate-Key Pair Name to MCTWildcardCert. For the Certificate File Name, browse on the appliance to MCTWildcard.cer. For the Key File Name, browse the appliance for MyCitrixTraining.key. No password is needed. Click Create, but don t click Close yet. 18

20 7. This certificate needs an intermediate CA certificate. We need to install the intermediate cert and then link it to this one. Change the Certificate-Key Pair Name to MCTIntermediateCert. For the Certificate File Name, browse on the appliance to MCTIntermediate.cer. No Key File Name or Password is necessary. Click Create. Now click Close. 8. Right-click on the MCTWildcardCert and choose Link MCTIntermediateCert should be already selected. Click OK. Now the MCTWildcardCert is ready for us to use later. 19

21 9. Load balancing requires a number of things: Servers that actually do some kind of work to balance Services that tell us what the work is and what port and protocol is used A virtual server using a virtual IP address to receive incoming client requests A monitoring mechanism so the load balancer knows when a service is down A persistence method if necessary One way to keep all this straight is to use the NetScaler Load Balancing Wizard. On the left side, under Traffic Management, click on Load Balancing. On the right, choose Load Balancing wizard. 10. If you encounter a message like the following at any time while using the Configuration Utility, click Yes. 20

22 11. Click Next on the Introduction dialog box. Type SFService1 for the new service s Name. Then, click New on the right side to create a new Server instance. 12. Name this first server sf1. Click the Domain Name button and enter sf1.training.lab for the Domain Name. Click Create. 21

23 13. Choose SSL for the Protocol and the Port will change to 443 for you. Click Add to place this service in the list. 14. The dialog box stays open so that we can create another service. Change the name to SFService2 and click the New button again. 22

24 15. Name the new server instance sf2. Click the Domain Name button and enter sf2.training.lab into the Domain Name field. Click Create. 16. Click the Add button to enter the new service into the list. These are all the services we re going to load balance, so click Next. 23

25 17. Type SF_vServer for the virtual server name. Enter for the IP address. This will automatically be a VIP on the NetScaler. Choose SSL for the Protocol and the Port will automatically change to 443. The LB Method can remain the default, Least Connection. Select both the Available Services and then click Add> to move them into the Configured Services list. Click the pull-down arrow beside Certificate and choose the WildcardCert certificate we created earlier. Click Next. 18. Click Finish, then Exit to end the wizard. 24

26 19. In the Configuration Utility, under Traffic Management, then under Load Balancing, click on Servers to see the list of StoreFront servers that we created. 20. Click on Services to see the StoreFront services we created. 21. Click on Virtual Servers to see the virtual server we created. 25

27 22. Click on the SF_vServer virtual server, then click on Open You can also just doubleclick on it. This will expose the virtual server s properties. 23. Click the Method and Persistence tab. Change the Persistence type to CookieInsert and the Time-out to 0. Change the Backup Persistance to SourceIP and the Time-out to 30. Set the IPv4 Netmask to Click OK. 26

28 24. When monitoring services, NetScaler uses TCP as a default. This is not the most intelligent choice for StoreFront services. NetScaler 10.1 now has a monitor type specifically for StoreFront. Let s use it. In the Configuration Utility, under Traffic Management, choose Load Balancing, then choose Monitors. StoreFront is not in the list of already configured monitor types, so click Add Type StoreFront for the Name and pull down the list to the right of Type. Select STOREFRONT at the bottom of the list. On the Standard Parameters tab, check the Secure box since StoreFront expects outside traffic to be HTTPS. 27

29 26. Click the Special Parameters tab and enter CorporateStore for the Store Name. (CorporateStore is the StoreFront store name created when the StoreFront servers were configured.) Click Create, then click Close. 27. In the Configuration Utility, under Traffic Management, then under Load Balancing, select Services. On the right side, you will see the two services we configured. Doubleclick on SFService1 to open its properties. Click the Monitors tab and scroll down to find the new monitor we just created, StoreFront. Click the Add> button to move StoreFront into the Configured list. Click OK. 28. Using the same steps as above, apply the StoreFront monitor to SFService2. 28

30 29. In the top right corner of the Configuration Utility, click the disk icon and confirm to save the running configuration. 30. Go to the AD.training.lab virtual machine. Logon as Administrator with the password of Citrix123. From Administrative Tools, double-click on DNS to open the DNS Manager. In the left pane, click on the training.lab zone. 29

31 31. In the right pane, double-click on the connect host to open its properties. Change the address from which was the SF1 server, to which is the NetScaler VIP for load balancing both StoreFront servers. Click OK. 32. On the Win7Client machine, open a browser and connect to Log in as training\administrator with a password of Citrix123. StoreFront should present the XenDesktop resources. Log off StoreFront. 33. AnyCo wants any user who points their browser to StoreFront to use HTTPS even if the user doesn t think to type into their browser. We will use the NetScaler to make this redirect for us. In the NetScaler Configuration Utility, under Traffic Management, then under Load Balancing, choose Virtual Servers. On the right side, choose Add to create a new virtual server. 30

32 34. Enter SF_vServer-Redirect for the name. Set the protocol to HTTP. Enter as the IP Address, then click the Advanced tab. Enter for the Redirect URL. Click Create, then Close. 35. The new SF_vServer-Redirect virtual server shows as Down because we did not bind any services to it. When a user makes a request for a down vserver, the NetScaler sends the user to the redirect URL. Right-click on it and choose Disable. This will show that it is purposely out of service. 36. Point the browser to to verify that it gets redirected to 31

33 37. One advantage of using NetScaler for load balancing is its ability to report when a service goes down. AnyCo wants to use SNMP for this. On Win7Client, in the Configuration Utility, on the left, expand System, then expand SNMP, and click on Community. Click Add 38. Enter public for the Community String and click create, then Close. 39. Under SNMP, choose Traps. Click Add Enter for the Destination IP Address. (We don t have an SNMP console in the lab, so it doesn t really matter what address is used here. In a production environment, you would want an SNMP management console installed, such as Citrix Command Center.) Use the pull-down arrow to choose as the Source IP Address. This is the NetScaler s SNIP. Click Create, but don t click Close yet. 32

34 40. Click the Specific button and fill in , for Destination IP Address. Choose , for the Source IP Address. Choose Critical for Minimum Severity. Click Create, then click Close. 41. From the Win7Client desktop, start Putty and type in as the Host Name and click Open. Login as nsroot with nsroot as the password. At the prompt, type shell and press Enter. Then type tail f /var/log/ns.log. (There is a space after tail and a space after the f.) Press Enter. This shows the end of the NetScaler s syslog in real time. Anything that happens on the NetScaler will show here. 42. From XenCenter, in the far left pane, right-click on the SF2 server and choose Shut Down and confirm the action. 33

35 43. Switch to the Win7Client machine and watch the Putty window showing the syslog. Notice the EVENT MONITORDOWN and EVENTDEVICEDOWN alerts. Also you can see that the NetScaler sent an SNMP trap with the entitydown message. 44. Right-click on SF2 and choose Start. Switch back to Win7Client and watch for the alerts and SNMP trap. When you are done, in the Putty window, press Ctrl-C to return to the BSD shell. Type exit and press Enter to return to the NetScaler prompt. Type save config and press Enter to save the running configuration. When you see Done, close the Putty window. Exercise Summary In this exercise, we learned how to import and install an SSL certificate to use for the NetScaler. We then created server objects that pointed to the two StoreFront servers, services that specified the protocol and port the services on the servers used, and a virtual server object for client access to the services, and assigned the certificate to the virtual server. We used the Load Balancing wizard to create these. We also saw how to set persistence and backup persistence and how to replace the default TCP monitor with a custom StoreFront monitor. We configured a virtual server on the NetScaler that will automatically redirect users from HTTP to HTTPS when they type in the URL to access StoreFront. Finally, we configured SNMP to send traps when a load balanced service goes down. 34

36 Exercise 4 Load Balancing XenDesktop Delivery Controllers Overview Currently, the XenDesktop deployment has StoreFront sending all requests to DC1. This works, because DC2 is listed as a failover server, but it would be more efficient for the NetScaler to balance the load between DC1 and DC2. In this exercise, we will see how to load balance the delivery controllers and how to monitor them. Step by step guidance Estimated time to complete this lab: 30 minutes. Step Action 1. If the Configuration Utility isn t already pointed to NS1, open Internet Explorer on Win7Client and enter for the URL. Login as nsroot. In the left pane of the Configuration Utility, under Traffic Management, click on Load Balancing. On the right side, choose Load Balancing wizard for Citrix XenDesktop. 35

37 2. Click Next on the Introduction. We are using StoreFront not Web Interface, so click Skip at the Load Balance WI servers page. 3. In the Load Balance DDC servers page, enter for the virtual IP address for the new virtual server we are making. Change the port to 80 and the protocol to HTTP. Under DDC Servers, enter the first DC address, and the port of 80 and click Add. Do the same for the second DC, which has the address of Click Next. Then Finish on the next screen, then Exit. 36

38 4. Under Load Balancing, click on Virtual Servers to see the new virtual server you created, named XD-DDC_ _80_lbvip. Right-click on it and choose Rename and name it XD71_vServer. 5. Double-click on the XD71_vServer to see its properties. Click on the Service Groups tab to see that the wizard made a service group instead of two separate services. Click on the Method and Persistence tab. The default load balancing method of Least Connection is fine, and no persistence is necessary for load balancing DCs. Click Close. 6. Under Load Balancing, click on Service Groups to see the new service group consisting of the two DCs you specified. Right-click on it and choose Rename, and rename it to XD71_ServiceGroup. 37

39 7. Double-click on the service group to open its properties. Click on the Monitors tab to see that a custom monitor has been configured for you. Click Close. 8. Under Load Balancing, choose Monitors. Scroll down the list until you see the XD_DDC_ _80_mn monitor. Notice that it s of the CITRIX-XD-DDC type. Double-click it to see its properties. Click Close. 9. Under Load Balancing, choose Servers. Notice the two new servers, which are the XenDesktop delivery controllers, listed by their IP addresses. Right-click on and rename it to dc1. Change to dc Click on the disk icon in the top right corner of the Configuration Utility to save the NetScaler running configuration. 38

40 11. Go to the SF1 virtual machine and log in as training\administrator with the password of Citrix123. Click on the Start icon in the bottom left corner of the desktop. The Start screen will open. At the bottom on the left side, click on the down arrow. 12. This reveals the Apps list. On right side, under Citrix, click on Citrix Storefront to open the StoreFront Console snap-in. 13. On the left side, click on Stores. In the center pane, make sure that Corporate Store is selected. On the right side, choose Manage Delivery Controllers. 39

41 14. Click on Controller and choose Edit 15. Remove the two delivery controllers in the list, dc1.training.lab and dc2.training.lab. 40

42 16. Click Add and put in the address of the XD71_vServer, Click OK, OK, and click OK again to close the dialog boxes. 17. In the left pane, choose Server Group. In the right pane, click Propagate Changes, and confirm by clicking OK. Click OK at the success message. Now, all the StoreFront to delivery controller traffic will be load balanced and monitored by the NetScaler. SNMP traps will be sent in case of delivery controller failure. 18. Let s test to make sure that we ve done everything right. From the Win7Client virtual machine, open a browser and go to Log in as training\user1. All the XenDesktop resources should be available. Log off. Exercise Summary In this exercise, we used the XenDesktop load balancing wizard to create servers, a service group, and a load balancing vserver for the two XenDesktop Delivery Controllers. We also saw that the wizard created a custom monitor of the CITRIX-XD-DDC type. We then reconfigured StoreFront to use the NetScaler s vserver to load balance all traffic from StoreFront to the DCs. 41

43 Exercise 5 Configuring NetScaler Gateway for Secure Access Overview Protecting your XenDesktop deployment from unauthorized access is very important. The NetScaler Gateway is the state of the art product for secure front-ending of XenDesktop. In this exercise you will learn how to configure NetScaler Gateway for secure external access. Step by step guidance Estimated time to complete this lab: 25 minutes. Step Action 1. In the portal information you were given is the external public address for your lab environment. You will need this information for this lab. 2. On the Win7Client virtual machine, use Internet Explorer and point to Log into the Configuration Utility as nsroot. On the left side, click on NetScaler Gateway. On the right side, click on the Configure NetScaler Gateway for Enterprise Store wizard. 42

44 3. Click on the Get Started button on the Welcome screen. 4. Enter RemoteAccess for the Name. Type in the IP Address field. Check the box Redirect requests from port 80 to secure port. For the Gateway FQDN, enter the public address for your lab, but with dashes instead of dots, followed by.mycitrixtraining.net. For example: if your public address is , then the Gateway FQDN would be mycitrixtraining.net. This is being done because when we wish to access the lab environment from the outside, your external address will be translated to Click Continue. 5. Click the button for Choose Certificate. This is where we will use the certificate we installed in a previous exercise. On the Certificate line, click the down arrow and choose MCTWildcardCert. Click Continue. 43

45 6. We are using Active Directory (LDAP) for authentication, so choose LDAP for Primary Authentication. Click Configure New. Enter for the IP Address. Enter cn=users, dc=training, dc=lab for the Base DN, and cn=administrator, cn=users, dc=training, dc=lab for the Admin Base DN. Type samaccountname for the Server Logon Name Attribute, and enter Citrix123 for both Password fields. Important! Double-check your typing. Click Continue. 7. Click the button for XenApp / XenDesktop. Change the Deployment Type to StoreFront. Enter connect.training.lab for the StoreFront FQDN. The Receiver for Web Path is /Citrix/CorporateStoreWeb. The Single Sign-on Domain is training.lab. Enter for the STA URL. Click Done. 44

46 8. Close the NetScaler Gateway monitor window. 9. In the Configuration Utility, under NetScaler Gateway, click on Virtual Servers to see the virtual server you just created. On the right side, double-click on the RemoteAccess virtual server. Here you can see, change, or add to the properties that were configured in the wizard. Click the Published Applications tab. In the Secure Ticket Authority section, click the lower Add link. 10. Enter and click Create. This adds a second STA for redundancy. 45

47 11. Click the Policies tab. Here you can see the session policies and profiles made for you by the wizard. Double-click the first profile entry. 12. This shows the settings that will be applied to the traffic through the Gateway. Click on the Client Experience tab and review the settings. 46

48 13. Click on the Security tab and review the settings. Then click on the Published Applications tab. 14. Make sure that the URLs for Web Interface Address and Account Services Address both start with https. Click OK. 47

49 15. Double-click the second profile entry. 16. As before, explore the different settings. Under the Published Applications tab, make sure that the Web Interface Address starts with Click OK. 17. Double-click on the first policy. 48

50 18. This shows the expressions that govern what traffic the profile will apply to. The expressions allow for a very wide allowance of client methods for remote access through the Gateway. Click Close. For more information on Gateway expressions see: Click the Authentication tab. Then double-click on the Profile. 49

51 20. This shows the LDAP configuration. Click the Retrieve Attributes link. 21. You should receive the success message. If not, check your setting for typos or wrong information. Click OK to close the Information dialog box. Click OK to close the Configure Authentication Server dialog box. 22. Remember checking the box saying Redirect requests from port 80 to secure port? Let s see what the wizard did to make that happen. On the left side of the Configuration Utility, choose Traffic Management > Load Balancing > Virtual Servers. On the right side, right-click on http_redirect and choose Rename. 50

52 23. Change the name to RemoteAccess-Redirect. Click OK. 24. Double-click on the RemoteAccess-Redirect virtual server to see its properties. Click on the Advanced tab. Notice the Redirect URL that was filled in for you by the wizard. Click Close. 25. Right-click on the RemoteAccess-Redirect virtual server and choose Disable, and confirm. This way, everyone will know that this vserver is down on purpose. Exercise Summary In this exercise, you learned how to configure the NetScaler Gateway using the Enterprise Store wizard. The wizard led you through the process of setting an IP address, choosing a certificate, configuring LDAP authentication, and setting StoreFront information which included the Secure Ticket Authority. After running the wizard, you went back and looked at all the components the wizard created. We added another STA and we examined the session policies and profiles, along with the Authentication profile. We also tested the authentication settings for accuracy. 51

53 Exercise 6 Configuring StoreFront for use with NetScaler Gateway Overview Now that NetScaler Gateway is configured, we will make changes to StoreFront to be able to receive the traffic through the Gateway. Step by step guidance Estimated time to complete this lab: 15 minutes. Step Action 1. On the SF1 virtual machine, log in as Training\Administrator with a password of Citrix123. From the Start screen, launch Citrix StoreFront. 2. In the StoreFront configuration snap-in, click on Authentication on the left side. On the right side, click Add/Remove Methods. 3. Check the Pass-through from NetScaler Gateway box and click OK. 52

54 4. On the left side, select NetScaler Gateway. On the right side, click Add NetScaler Gateway Appliance. 5. Fill in the Display name as Primary Gateway. Enter the NetScaler Gateway URL as where the xxx-xxx-xxx-xxx is your lab s public IP with the octets separated by dashes instead of dots. For example, if your lab s public IP was , then your URL would be Enter the Logon type as Domain and the Callback URL is the same as the Gateway URL. Click Next. 53

55 6. Click the Add button to add the following Secure Ticket Authority URLs: Click Create. Then, click Finish on the last screen. 7. On the left side, click Stores. On the right side, click Enable Remote Access. 54

56 8. Click the button for No VPN tunnel. Check Primary Gateway. Click OK. 9. On the left side, click on Beacons. The middle pane shows the default settings based on our previous configuration choices. These choices work fine for our lab. On the right side, click on Manage Beacons. 55

57 10. Here we can set different Beacon points if desired. Click Cancel. 11. On the left side, click Server Group. On the right side, click Propagate Changes. 56

58 12. Confirm that you wish to propagate the changes, and then click OK at the success message. Exercise Summary In this exercise, you learned how to configure StoreFront to allow traffic from the NetScaler Gateway. We added Pass-through from NetScaler Gateway to the Authentication methods and then specified the settings for the NetScaler Gateway. We specified the two STAs, enabled the Store for remote access, and propagated the changes from SF1 to SF2. 57

59 Exercise 7 Testing Access to XenDesktop Overview In this exercise we will test access to the XenDesktop Deployment. Internal access has already been tested, but we will test again to make sure that setting up the NetScaler Gateway has not caused any unwelcome changes. We will then test external access which comes through the NetScaler Gateway. Step by step guidance Estimated time to complete this lab: 30 minutes. Step Action 1. From the Win7Client virtual machine, launch a new instance of Internet Explorer and enter for the URL. It should redirect to Log on as training\user1 with the password of Citrix

60 2. Test to see that XenDesktop resources are available to User1. 3. Close any apps, sign off of any desktops, and log off Citrix Receiver. 4. From your local workstation (external to your lab environment), launch a browser. Navigate to where the xxx-xxx-xxx-xxx represents your lab s external IP address. It should redirect to Log on as User1 with the password of Citrix

61 5. If you don t already have the Citrix Receiver installed, you will be prompted to install it. Check the box I agree with the Citrix license agreement and click Install. 6. Click Run or Allow or Yes at any security warnings or UAC prompts you may see. 7. The Citrix Receiver will take some time to download. Click Install when prompted. 8. When the installation is finished, click Finish. 60

62 9. All the XenDesktop resources available to User1 should now be able to be accessed. 10. After testing to make sure that your access is working, log off User1 and close the browser. Exercise Summary In this exercise we tested access, both internal access without using the NetScaler Gateway, and external access using the Gateway. We also installed the Citrix Receiver. 61

63 Exercise 8 Smart Access with NetScaler Gateway Overview AnyCo knows that when users access XenDesktop resources internally, they are using IT managed client devices that have adequate security software installed. However, when AnyCo employees log in from home or other external locations, they may be using unmanaged devices that don t have the required security. AnyCo has asked you to configure the NetScaler Gateway to check that a necessary process is running on each external client before allowing access. Note: In this exercise we will use a simple process, notepad.exe, as our required security software. In a real production environment, this can be a commercial anti-virus program, a firewall, anti-spam software, a required file, a necessary registry entry, or a combination of these. Step by step guidance Estimated time to complete this lab: 25 minutes. Step Action 1. On the Win7Client virtual machine, use the Configuration Utility and navigate on the left side to NetScaler Gateway > Virtual Servers. On the right side, double-click RemoteAccess to open its properties. 62

64 2. Click the button SmartAccess Mode, then click OK. 3. On the left side, navigate to NetScaler Gateway > Policies > Pre-Authentication. On the right side, click Add 63

65 4. Type PreAuthPol_EPAnotepad for the Name. On the Request Profile line, click the New button. 5. Type PreAuthProfile_EPAallow for the Name. Make sure the Action is ALLOW. Click Create. 6. Below the Expression field, click Add 64

66 7. For Expression Type, use the pull-down and choose Client Security. Under Component, use the pull-down and choose Process. Type notepad.exe in the Name field. The operator should be EXISTS. Click OK. 8. In the Create Pre-authentication Policy dialog box, click Create. Then, click Close. 9. Return to NetScaler Gateway > Virtual Servers and double-click on RemoteAccess. Click the Policies tab, then click Pre-authentication. Click Insert Policy. 65

67 10. Use the pull-down to choose PreAuthPol_EPAnotepad. Then click OK. 11. On your local workstation (external to your lab environment), make sure that Notepad is not running. Launch a browser. Navigate to where the xxx-xxx-xxx-xxx represents your lab s external IP address. It should redirect to You should be prompted to download and install the Citrix Endpoint Analysis Plug-in. Click Download. 12. Choose Run, Allow, or Yes on any security warnings or UAC messages you may get. 66

68 13. Click Install. Click Finish when the installation is done. 14. Click Always to grant Citrix Endpoint Analysis permission to scan your system. 15. Since Notepad was not running, you should get the Access Denied message. 67

69 16. Start Notepad on your workstation. Once Notepad is running, click the Back button in the Access Denied message to rescan. Endpoint Analysis reruns the scan. This time you should be able to log in as User1 and have access to all the resources. After testing, log off as User1 and close the browser. Exercise Summary In this exercise, we turned on SmartAccess mode and created a Pre-Authentication policy that checked for a necessary process to be running. We also created a Pre-Authentication profile that is used when the policy evaluates as true. The profile simply gives Allow permission to be authenticated. We then bound the policy to the RemoteAccess NetScaler Gateway virtual server. On the external client machine, we installed the Citrix Endpoint Analysis plug-in. We then tested access without and then with, our necessary process running. 68

70 Exercise 9 Using NetScaler Gateway Filters with XenDesktop Overview Now we re going to get more granular with SmartAccess and show how it interacts with XenDesktop. The AnyCo Company has decided that certain people with extra-secure devices should get access to all the resources via XenDesktop, but the others should only get Windows 8 desktops. The extra-secure devices are identified by the fact that they have a special file located in their file systems. Step by step guidance Estimated time to complete this lab: 30 minutes. Step Action 1. Before XenDesktop can benefit from NetScaler Gateway s SmartAccess, The XenDesktop farm must be set to trust requests sent to the XML port. By default, this trust is turned off. To change this, go to the DC1 virtual machine and log in as training\administrator. Then, launch Citrix Studio from the Start screen. 2. When Citrix Studio opens, on the left side, click at the very top on Citrix Studio (XD71Site). In the middle pane, click the PowerShell tab. Down at the bottom, click the Launch PowerShell button. 69

71 3. In the PowerShell window that opens, type Get-Brokersite and press Enter. 4. Notice at the bottom that TrustRequestsSentToTheXmlServicePort is set to False. To change this, in the PowerShell window, type: Set-Brokersite TrustRequestsSentToTheXmlServicePort $true and press Enter. 5. Type Get-Brokersite again to see that the setting has changed. 70

72 6. Go to the Win7Client virtual machine. In the Configuration Utility, Navigate to NetScaler Gateway > Policies > Session, then click the Add button on the right side. 7. Name the policy SmartAccess_Policy. To the right of the Request Profile line, click New 71

73 8. The Create NetScaler Gateway Session Profile dialog opens up. Name the profile SmartAccess_Profile. Click the Client Experience tab. To the right of Single Sign-on to Web Applications, check the Overide Global box. Then, check the Single Sign-on to Web Applications box. 9. Click the Security tab. Check the Override Global box to the right of Default Authorization Action. Change the Action to Allow. 72

74 10. Click the Published Applications tab. Override Global on the ICA Proxy line and set it to ON. Overide for Web Interface Address and set it to Override for Single-Sign-on Domain and set to training.lab. Then, click Create. 11. Under the Expression area, click Add 73

75 12. Change the Expression Type to Client Security, change the Component to File. Type the name as c:\\fullaccess.txt (notice the two backslashes). No Qualifier is necessary, and leave the Operator as EXISTS. Click OK. 13. In the Create NetScaler Gateway Session Policy dialog box, we are finally ready to click Create, then Close. 14. Notice after the SmartAccess_Policy has been created, NetScaler added two more backslashes to the file path. This is normal and necessary and has to do with how Unixbased systems handle backslashes. 74

76 15. Under NetScaler Gateway go to Virtual Servers and double-click on RemoteAccess. Click on the Policies tab. Toward the bottom left, click on Insert Policy. Use the pulldown arrow to choose SmartAccess_Policy. 16. Double-click on the SmartAccess_Policy Priority number and change it to 90. This will give it a higher priority. Click OK. Save the running configuration. 17. Return to the DC1 virtual machine. Open Citrix Studio. In the left pane, click on Delivery Groups. In the middle pane, click on the Win 2012 R2 Servers group and then right-click on it and choose Edit Delivery Group. 75

77 18. On the left, click on Access Policy. On the right, click Add 19. Enter RemoteAccess as the Farm name. This must match the name of the NetScaler Gateway virtual server we are using. Enter SmartAccess_Policy as the Filter. This must match the name of the session policy we just created. Click OK, then OK again. 20. Now, let s test it. On your local workstation, create a text file at the root of the C: drive. Name it fullaccess.txt. Make sure that Notepad is running. 76

78 21. Open your browser and go to where the xxx-xxx-xxx-xxx is your lab s external address separated by dashes. Endpoint analysis will run and then you can log on as User1 with the password of Citrix123. After logging on, you should see the Windows 2012r2 Desktop available as well as the Apps. 22. Log off as User1 and close your browser. Delete (or just rename) the c:\fullaccess file. Open your browser and go to again, and log in as User1 again. This time, you should not see the Win 2012r2 Desktop or the Apps. Exercise Summary In this exercise we tested the SmartAccess, granular capabilities of the NetScaler Gateway. We set the XenDesktop farm to trust requests sent to the XML port, we created a session policy along with a session profile. We created an expression for the policy to look for a certain file on the client workstation. If that file exists, the user gets all resources, but if it doesn t the user only gets partial resources. We set the NetScaler Gateway s virtual server as the Farm name on the XenDesktop Delivery group and set the session policy as the Filter name. Please complete this survey We value your feedback! Please take a moment to let us know about your training experience by completing the brief Learning Lab Survey 77

79 Revision: Change Description Updated By Date 1.0 Original version Richard Nash May 2014 About Citrix Citrix (NASDAQ:CTXS) is a cloud company that enables mobile workstyles empowering people to work and collaborate from anywhere, securely accessing apps and data on any of the latest devices, as easily as they would in their own office. Citrix solutions help IT and service providers build clouds, leveraging virtualization and networking technologies to deliver high-performance, elastic and cost-effective cloud services. With market-leading cloud solutions for mobility, desktop virtualization, networking, cloud platforms, collaboration and data sharing, Citrix helps organizations of all sizes achieve the speed and agility necessary to succeed in a mobile and dynamic world. Citrix products are in use at more than 330,000 organizations and by over 100 million users globally. Annual revenue in 2012 was $2.59 billion. Learn more at 78