Home

Citrix XenApp Platinum Reference Design

Posted May 1st, 2008 by roddyr

 

Citrix XenApp Platinum
 
Reference Design
 
April 30, 2008
 

 

Authors:
This publication was originally created by Rick Dehlinger the CEO/Chief Technologist of the iQurious Corporation in 2004 / 2005. From 2005 through 2008 Roddy Rodstein maintained and re-distributed the publication.

Limits of Liability and Disclaimer of Warranty

 
This publication contains information protected by copyright. This publication may not be duplicated in any way without the express written consent of the publisher, except in the form of brief excerpts or quotations for the purpose of review. The information contained herein is for the personal use of the reader and may not be incorporated in any commercial programs, other books, databases, or any kind of software without the written consent of the publisher. Making copies of this book or any portion for any purpose other than your own is a violation of United States copyright laws.
 
Warning and Disclaimer
 
Every effort has been made to make this publication as complete and as accurate as possible, but no warranty or fitness is implied. The information provided is on an "as is" basis. The authors and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book.
 
The information found in this publication was gathered from many different sources in the computing world. It is provided for informational purposes only. Use common sense in applying these concepts and tips. Screen shots may vary from environment to environment.  Please verify correctness and applicability in a test environment first and then deploy to your production environment(s).
 
© 2008 Roddy Rodstein
http://www.seoutsourcing.com
All rights reserved.
 
Trademarks
 
Trademarked names appear throughout this publication. Rather than listing the names and entities that own the trademarks or include a trademark symbol with each mention of the trademark name, the publisher states that he is using the name for editorial purposes only and to the benefit of the trademark owner, with no intention of infringing upon that trademark.
 
 
Table of Contents
 
 
1.1      Introduction
The XenApp Platinum Reference Design is a best-practice based comprehensive standard. The XenApp Platinum Reference Design was designed with simplicity, reproducibility, usability, scalability, supportability, security, privacy and accessibility in mind.
The XenApp Platinum Reference Design represents a complete XenApp Platinum standard that can be leveraged as a vanilla solution or modified to more accurately reflect organizational-specific needs. The XenApp Platinum Reference Design includes the following categories and solutions:
  • Perimeter. A secure perimeter for internal and external access.
  • Hardware Virtualization. Hardware virtualization provides an abstraction layer that allows multiple virtual machines to share the processor, memory, storage and networking resources of a shared hardware environment allowing server consolidation, and rapid server provisioning.
  • XenApp. Citrix XenApp enables the centralization, management and delivery of Windows applications.
  • Application Streaming. Citrix XenApp Streaming allows applications to be packaged, streamed and executed in an isolated environment on XenApp Servers or Windows Desktops.
  • Enterprise Single Sign-on. Citrix Password Manager enables single-sign on capabilities for published and local applications, whether they are host (legacy), web, or windows based.
  • Server Utilization Monitoring: Citrix EdgeSight for XenApp monitors applications, devices, and the network in real time, allowing organizations to quickly analyze, resolve, and proactively prevent problems.
  • Web Interface Portal. A consistent user interface containing XenApp applications, streamed desktop applications, web applications, web content, documents, announcements and information.
The XenApp Platinum Reference Design provides a well defined starting point for each implementation. It also serves as a baseline upon which all solution additions, revisions, and tools will be based.  As such, there is an increasing value to XenApp Platinum Reference Design users in keeping implementations as close to the reference design as possible.
 
Prior to implementing XenApp Platinum based upon the XenApp Platinum Reference Design, it’s important that an infrastructure assessment and gap analysis be performed. During the IA/GA, the architecture of the solution will be customized to match the customer’s business needs while maintaining the integrity of the XenApp Platinum Reference Design. Implementation and support will follow the analysis phase after careful consideration has been given to any specific design modifications that deviate from the reference.
This document outlines the decision points necessary for implementing the XenApp Platinum Reference Design. For decisions that rely on pre-existing factors or specific organizational needs, the appropriate best practice has been provided. The best practices should be analyzed carefully and decisions should be made based on organizational needs, architecture present and budget resources availability.
The XenApp Platinum Reference Design is designed to be scalable and resilient for ease of implementation, high availability, and ease of maintenance. The complete solution is made up of six architectural components that work together to provide flexibility and options with respect to server consolidation, monitoring, authentication and security requirements, user access scenarios, and component migration/modification.  The design breaks down into the following six components:
  • Perimeter. The XenApp Platinum Reference Design supports the use of multiple secured perimeters. This allows for flexibility in global load balancing, accommodating different applications and their performance requirements, authentication, security, and branding (look/feel) requirements. It also supports techniques for multiple brands, making it possible to support multiple business unites, and partners.
  • The XenApp Server farm. The XenApp Platinum Reference Design may have one or more XenApp Server farms available to provide application resources for the environment. This design builds on the ability to test new farm builds alongside production farm builds, leveraging the other two components without sacrificing the integrity of the production environment. This will allow the customer to be agile and proactive in their efforts to deliver the most current, feature rich, stable OS, application functionality, and XenApp Server versions. 
  • Application Streaming. The XenApp Platinum Reference Design will support an organizations entire application portfolio with a single Citrix XenApp Server silo. Application streaming allows applications to be packaged, streamed and executed in an isolated environment on Citrix XenApp Servers or to Windows Desktops. Application streaming used in conjunction with XenApp CPU management allows organization to safely run an entire application portfolio on a single XenApp Server silo.  
  • Server Utilization Monitoring: The XenApp Platinum Reference Design provides complete transparency from an end user perspective to any application running on a XenApp farm to see exactly what’s happening for a specific user or group of users. Citrix EdgeSight allows organizations to consistently and quantitatively measure performance across the organization for all XenApp hosted applications.
  • Hardware Virtualization. The XenApp Platinum Reference Design offers a generic hardware virtualization layer that allows multiple Windows and Linux virtual machines to run on a shared hardware environment allowing x86 and x86-64 bit server consolidation, and rapid VM provisioning.
  • Web Interface Portal. The XenApp Platinum Reference Design supports existing corporate portals used to deliver both XenApp and streamed desktop application using Citrix XenApp Platinum.

Figure2.0 show a high level overview of the XenApp Platinum Reference Design components.

The XenApp Platinum Reference Design supports a variety of access scenarios, providing users with the most functional, best performing user experience possible. The user is guided to the appropriate access scenario through end point analysis and global load balancing. The users’ location, device/operating system type, browser version, and connectivity method can be considered. The two primary supported use cases, with available services/functionality, are listed below:
1 – Win32 OS, Internet Explorer, broadband quality connectivity.
In this use case, the user is on the Windows platform running Internet Explorer, with broadband access to the Internet/network. The user launches a web browser locally, navigates to a public URL, and authenticates with the appropriate combination of credentials/passcodes. After the user is authenticated, their web browser is securely directed to a Portal, which serves as their starting view of the organizations’ applications, desktops and data.
This use case leverages the most common corporate platform and reasonably rich, low latency connectivity to provide the user with a highly functional user experience with a rich, diverse set of access services. These services include the following:
  • Full access to all appropriate XenApp hosted applications. Users can access published applications directly with the Citrix ICA client or applications from a Portal, e.g. the Web Interface. This service leverages either a native, locally installed Citrix client or a JAVA based ICA client. Both options deliver the appropriate software to the client device through a portal.
  • Full access to secure, internal web content using the local web browser. By leveraging the Access Gateway Secure Access Client, the user can access content such as intranets, web applications, web-based e-mail, EIP implementations, etc. The Secure Access Client provides layer 3 connectivity and encryption for all approved applications and content. This includes internal web content that is not natively encrypted with SSL.
  • Single sign-on functionality. Once a user is authenticated at the perimeter, their experience accessing web apps/content and published applications is significantly improved. By leveraging Password Manager running on the XenApp Server farm(s) any application that requires secondary authentication (including most web, client/server, and host based apps) can be automatically passed an appropriate credential on behalf of the authenticated user. This functionality is fully compatible with and complimentary to WebSSO products and technologies.
  • Full access to corporate e-mail systems through a local e-mail client (such as Outlook), a published e-mail client, a web mail client, etc. This includes support for offline e-mail, which is a requirement for users who spend time in an offline mode. This service also leverages the Secure Access Client to provide secure connectivity to the messaging services without the use of any application specific encryption mechanisms (such as SSL or RPC over HTTP).
  • Support for locally installed applications, including TCP based applications that need to communicate with the secured data center network (such as Blackberry synchronization, terminal emulation, etc.).  Similar to above, this service leverages the Access Gateway for layer 3 connectivity and security.
  • High latency connections (such as WWAN and Satellite) users can continue to be productive when using these applications over lower quality connection types by leveraging XenApp delivered applications.
2 – Any device, any OS, any connectivity mechanism.
For users who are attempting to access services from a none compliant device, fringe devices, or devices using lower quality connection types, the solution provides services for the following situation(s):
  • An end point analysis scan determines the posture of the device, and corporate policy dictates weather a user receives full or restricted connectivity.
  • Access device is not Win32 based. This includes devices running the Macintosh OS (both current and previous generations), or Linux.
  • Access device is running a browser other than Internet Explorer. This includes Netscape/Firefox/Mozilla variants, Safari, and others.
  • Access device is locked down, such that the installation/use of the local Citrix ICA client is impossible. An example may be an airport kiosk, or a locked down business partner’s PC.
  • User is utilizing a connectivity medium that is lower quality, such as wireless WAN, dial-up, or satellite.
For these none compliant and ‘fringe’ devices/connectivity mechanisms, the XenApp Platinum Reference Design provides the following services:
  • Full or limited access to all appropriate XenApp published applications. User’s access published applications from the Web Interface, and pre-tune published application performance for a variety of connectivity medium. Either option delivers the appropriate software to the client device through the web browser.
  • Single sign-on functionality. Once a user is authenticated at a the perimeter, their experience accessing XenApp applications is significantly improved. By leveraging Password Manager running on the XenApp Server farm(s) any application that requires secondary authentication (including most web, client/server, and host based apps) can be automatically passed an appropriate credential on behalf of the authenticated user. This functionality is fully compatible with and complimentary to WebSSO products and technologies.
Any of the above use cases can be supported by Windows or Linux Based Terminals that comply with the XenApp Platinum Reference Design standard.
The XenApp environment for a typical XenApp Platinum Reference Design implementation has a single-farm single or multiple zone configuration, that should reside in a central data center. Decisions made for this design were based on a large-sized, 5000 concurrent user deployment and should be adjusted to accurately reflect the environment. Shared hardware and infrastructure components such as Citrix Licensing Server, Citrix Data Collectors, Citrix Data Store should reflect Citrix best practices while leveraging what currently exists in the infrastructure.
Support is an integral part of the XenApp Platinum Reference Design and includes a combination of a Citrix support agreement, on and off-site support from the implementing party, and GoToAssist for help-desk support. Users will have several options for support, including FAQ’s, Live Assist, phone support, and GoToAssist.
Part 1 Reference Design
This section provides a decision matrix for the XenApp Platinum Reference Design. Implementers of the XenApp Platinum Reference Design can use the decision matrix as quick reference guides to identify settings and configuration decisions to be implemented in the environment. Decisions highlighted in yellow may rely on pre-existing environment factors or differ depending on organizational needs. These decisions should be carefully analyzed during a gap analysis phase.
 

Decision Point
Citrix  Decision
Justification
Farm Layout
Single farm with XenApp Servers in one data center
Single point of administration, global license pooling, global application access.
 
If more than one location exists, XenApp Servers may be dispersed to different locations if proximity to file servers is necessary.
Version of XenApp Server

The latest version and hotfix level of XenApp will be used.
Number of Zones
One Zone
A single or multiple zones depending on customer requirements.
Zone Data Collector Configuration
Dedicated Primary and Backup Zone Data Collectors
Two servers dedicated to the ZDC role, one primary and one backup ZDC. This configuration provides sufficient capacity for future growth and redundancy for serving critical farm information across the XenApp Server environment. All Web Interface servers will be configured to exclusively contact the ZDCs for authenticating users and enumerating published applications.
 
The Primary ZDC will be set to “Most Preferred,” the Backup ZDC will be set to “Preferred,” and all other servers will be set to “Not Preferred.”
 
Best practice is to have a dedicated primary and backup ZDC; however this decision should be made based on the size of the environment.

 
 

Decision Point
Citrix Decision
Justification
Data Store Database Platform
MS SQL 2000 SP3 or MS SQL 2005 running on Windows Server 2003
MS SQL 2000 or MS SQL 2005provides robust and scalable support for multiple server access, supports replication, and can be clustered. The existing database team will administer the data store.
Data Store Hardware
For up to 1,500 users, a shared dual processor, P4 or greater processor, 1 GB of RAM or greater server will suffice. SQL Server data store and license server may be co-located
Assuming less than 1,500 users (less than 50 servers), this decision will hold. A dedicated dual-processor server should be utilized for more than 3,000 users.
Data Store Access Method
Direct Mode access
XenApp member servers will query the data store directly to maximize efficiency and eliminate single points of failure.
Data Store Location
Main data center; replica in disaster recovery or secondary site
The data store should be located in the central data center, along with all other XenApp components.
Data Store Redundancy
Hardware Component Redundancy and SQL Backup and Replication
The data store component should be redundant with dual power supplies and dual NICs. Regular backups should be performed in conjunction with the data backup strategy.
 
Clustering is not necessary for the data store, since there is no time limit placed on the ability for users to log in when the data store is unavailable.
Data Store Backup Strategy
Full backup daily with 90 day retention period
Recommended regular full backups. If there is already a structured backup regiment in place that will be appropriate for the environment, it may be leveraged here.
Data Store Database Authentication
Windows NT Authentication with “db_owner” rights
For high security environments, Citrix recommends using Windows NT Authentication only. The account used for the data store connection must have “db_owner” rights for the database being used for the data store.
Data Store Database Connection Type
TCP/IP Sockets
Data transmissions are more streamlined for TCP/IP sockets and have less overhead than Named Pipes. Named Pipes is an authentication protocol. Therefore any time a user attempts to open a connection to the SQL Server using named pipes, the Windows NT authentication process occurs.
License Server Location(s)
The Citrix license server will be hosted on the backup zone data collector
In order to centrally manage and pool licenses, it is recommended to install the Citrix license server on the Data Store server and configure connections to the license server as a farm-wide setting.
License Server Hardware
Enterprise-class hardware with dual processors and 2 GB of RAM minimum
Servers with these characteristics will be able to handle the license server for a medium-sized farm.
License Server Disaster Recovery
No backup License Server
Because there is a 30 day grace period in the event the license server is made unavailable, it is not necessary to have a backup License Server.
License Management Console
The web server component the LMC will be hosted on the license servers.
The LMC console web server will be installed on the license servers.
 

 
 

Decision Point
Citrix Decision
Justification
Applications
Microsoft Office Suite, Internet Explorer 7.0, any other mission critical applications
Applications should be proven in a Terminal Services environment or tested for functionality.
Application Requirements and Dependencies
Internet Explorer 7.0, WinZip 8.x, Adobe Acrobat Reader 6.x
Applications should be analyzed for requirements and dependencies; these listed are expected for typical deployments.
Load Managed Groups (LMGs)
Only 1 for typical deployment.
If any applications are more resource intensive or conflict with all other applications; multiple LMGs should be considered.
Application Packaging and Distribution
Office – MSI
WinZip, Adobe – Install Shield
Applications should be packaged using the XenApp Streaming Profiler. All packages should be distributed to servers using XenApp Streaming.
Application Streaming
Citrix XenApp Streaming. 
If any applications planned for deployment require customizations, the party implementing the solution should work with the organization to include the change in the application’s installation package and/or modify the server’s login script.

 
 

Decision Point
Citrix Decision
Justification
Load Evaluators
Advanced
Initially, the Advanced load evaluator will be assigned to all the servers in the XenApp  environment. 
 
The Advanced load evaluator measures load based on CPU Utilization, Memory Utilization, and Pages Swaps/sec.
 
During a pilot testing phase, the effectiveness of the Advanced load evaluator should be assessed. If necessary custom load evaluators may be developed that are appropriate for the environment.

  
 

Decision Point
Citrix Decision
Justification
XenApp Streaming Profiler
XenApp Streaming Profiler
Shared XenApp Server
To consolidate hardware resource requirements, the XenApp Streaming Profiler can be co-located with a test XenApp Server.
Network Share Point(s)
File share on existing server
XenApp Streaming packages should be stored on a centrally located file server.
Scheduled Installs
Low to no usage
Installations should occur during regularly scheduled system downtime.
Network Account
AD: Domain\Username
An Active Directory administrator account should be created and used to install applications with XenApp Streaming packages.
Server Groups
One
Since the XenApp Platinum Reference Design is designed for one LMG, only one server group will be used and all servers will have the same applications. If design has more than one LGM, one server group should exist for each LMG.
 
If the server group is over 40 servers, multiple groups would be recommended to stagger XenApp Streaming package deployments.
Package Groups
None
All applications will be installed using XenApp Streaming.
XenApp Componients
Primary Farm Metric Server (FMS)
 
Primary Zone Data Collector
To conserve hardware resources, the primary Zone Data Collector will be configured with the FMS role
Backup Farm Metric Server
Backup Zone Data Collector
The backup Zone Data Collector will be configured as the backup FMS
Database Connection Server (DCS)
Backup zone data collector
The DCS will be located in the backup zone data collector, thus avoiding an extra load on other servers when reports are run.
Database Connection Server Update Time
Off peak hours
The update needs to be scheduled during off-peak hours such that it does not affect end users.
Collected Processes
Custom
Administrators will monitor various server metrics aimed at assessing the XenApp Server health and utilization levels.
Schedule Reboots
As Needed
Servers should be rebooted based on the applications being deployed. This should be a regularly scheduled event, whether it be daily, weekly or monthly.
Network Manager
SNMP Plug-in
If available
Leverage an enterprise management tool such as HP OpenView or Tivoli if it is pre-existing in environment

 
 

Decision Point
Citrix Decision
Justification
XenApp Farm Properties
Connection Limits
Disable “Maximum connections per user”
If it is necessary to conserve resources, a user connection limit may be set. Resource availability should be analyzed.
ICA Keep-Alive
Enabled, timeout set to 60 seconds (default)
Keep-Alives should be enabled to ensure more resilient connections.
ICA Settings - Redundant Graphics Operations
Enable “discard Redundant graphics operations” (Default)
Good for low bandwidth connections.
ICA Settings - Alternate Caching Method
Default: Enabled
Default configuration is suitable.
ICA Settings - Session Graphics
Default: 5625 KB
Default configuration is suitable.
ICA Settings - Degradation Bias
Degrade color depth first
 
Do not notify user
It is preferable for most applications to degrade color depth before resolution.
 
User notification should be turned off to avoid confusion in the part of the end-user.
ICA Settings - Auto Reconnect
Disable “require user authentication” and enable “log automatic reconnection attempts”
This setting allows for the reconnection process to be as seamless as possible.
License Server – Port Number
TCP 27000
Default port for communication with the license server.
 Settings - Broadcast Response
Enable “data collections respond to ICA Client broadcast messages” only
Citrix recommendation.
 Settings –
Client Time Zone
Disable “use local time of ICA Clients”
Disable local time estimation
If user base is in one time zone disable setting; if user range is global then enable.
 Settings –
XML Service Address Resolution
Disable XML Services DNS address resolution (default)
Default configuration is suitable.
 Settings –
Content Redirection
Disable server to client redirection
Not required for the XenApp Platinum Reference Design.
 Settings –
Remote Connections to the Console
Default: Enabled
Default configuration is suitable; administrators may require remote connections.
Session Reliability
Enabled
 
SNMP
Disable SNMP Agent (default)
Not required for AIRDF solution.
SpeedScreen Browser Acceleration
Enable SpeedScreen Browser Acceleration
Level: medium (Default)
SpeedScreen Browser Acceleration improves end-user perception by increasing the speed of screen refreshes.
 
SpeedScreen Browser Acceleration\ Compress JPEG Images
Enabled
JPEG images will be compressed.
SpeedScreen Browser Acceleration\ Determine When to Compress
Enabled
When WAN links are limited, compression will automatically be invoked.
SpeedScreen Flash Acceleration
Enable SpeedScreen Flash Acceleration
Improves end-user perception by lowering playback quality of Flash running on the server.
SpeedScreen Multimedia Acceleration
Enable SpeedScreen Multimedia Acceleration
Leverages local players to ensure high-quality multimedia.
Zone Properties
Servers hosting applications: “Not Preferred”
 
Primary ZDC: “Most Preferred”
 
Backup ZDC: “Preferred”
All XenApp application servers will be set to “Not Preferred&