Thursday, March 4, 2010

Citrix and Microsoft: Better together for “merchandising” applications

By:Scott E. Lane
What exactly is application merchandising? It is a term that we will start hearing more and more about in the industry. Especially as desktop virtualization becomes more prevalent and application virtualization technologies continue to mature. We will also see more of a focus on this as companies start to leverage “bring your own PC initiatives”. This document is an overview of how Citrix and Microsoft are working together to enable easy, iTunes-like access to corporate issued applications that are delivered with different technologies.
This News Article details a joint announcement between Citrix and Microsoft to extend the capabilities of Application Virtualization. This means that Citrix will add value to App-V in a similar manner to the way Citrix has for years added value to RDS or Terminal Services.

Overview
First off let me approach this from a very high level, and then I'll get specific about the moving pieces that make this all happen. Basically, you have three methods for placing applications inside of virtual desktops.
  1. Install the applications directly onto the base vdisk image that comprises the virtual desktops. This is less attractive because each time an application requires updates, the vdisk requires updates. However, it does afford a very fast launch for the user when the application icon is clicked. We typically see this for core system apps like anti-virus and the Citrix Receiver Framework (more on that in a moment). We also see it sometimes for apps that everyone has, like Adobe Reader and the corporate MS Office Standard.
  2. Stream the apps into the virtual desktop. This would be either XenApp streaming or MS App-V (hence the announcement). The bigger issue here is once we supply applications that aren't installed, how do we merchandise them to the users? I'll have more on that in a moment, but this is part of the bigger Citrix Microsoft partnership. The advantage of streaming these apps is that one vanilla desktop image can host a wide variety of applications for different user classes, depending upon who logs in. The application set dynamically assembles for the user upon logon to the VDI session. Additionally, even if you installed office into the base OS image, you can leverage streaming or application virtualization technologies for differing versions. For example, say you've standardized your company on Office 2007. But then someone says they have an old Access database on Office 97 and it won't convert. You can stream Access 97 to this user or group exclusively and it won't interfere with Office 07. This is true whether Office 07 is installed or streamed. We are able to do this because streaming, both in Citrix or MS App-V flavor places the application execution into isolation environments on the target. In this case the target being the virtual desktop. Management of streamed apps really helps with overall application delivery. That's because file shares, which Citrix calls App Hubs, hold single instance streaming profiles of each app to be delivered thru streaming. That means patching these apps doesn't require the VDI disk image to be modified. It also means that an app administrator can apply patches to the app image just once, replicate it to all "app hubs", and have the patch automatically be in place for all users. Application streaming can also enable offline usage of centralized apps. This is not pertinent to VDI approaches. But it is very useful for road warriors who carry laptops, and in the near future for our XenClient laptop hypervisor users.
  3. XenApp hosted approach. You are most familiar with this one, as most Citrix customers deliver apps this way. Its the application running on a XenApp server and showing up on a target. But in VDI, the target for XenApp hosted application is the virtual desktop itself. The reasons why this is chosen for delivery in a VDI world are varied. One would be that you already have applications set up and tuned for delivery in this method, and that it makes sense to continue using XenApp infrastructures in this manner. Also, it depends on the data tier location. For example if the VDI infrastructure is in Kansas City but the application backend itself resides somewhere far away, it would make sense to deliver the application with a XenApp hosted infrastructure located at the remote location where the application resides. Additionally, there are sometimes resource intensive applications that will cut into your VDI session per hypervisor host scalability. These apps are sometimes better off being delivered from a XenApp server where their resource needs can be better managed while keeping balanced in the hypervisor silos.
Delivery Framework
Okay, now I've described 3, and really 4 methods for placing applications inside virtual desktops. The "install on vdisk" option is pretty self explanatory. But when we choose the other methods, we suddenly end up with a bunch of clients, client interfaces, and client updates. The user suddenly has different methods to get their apps depending on how they are delivered. That's where Citrix comes into a partnership again with Microsoft with two new technologies, Receiver and Dazzle.

Receiver is a client framework that you install on an endpoint, and in this case the base Vdisk of your VDI infrastructure. It is the "keeper of the clients" or what we now call plug-ins. Once receiver is in place it talks back to a virtual appliance, Merchandising Server.

Merchandising Server runs as a small footprint on a XenServer back in the datacenter. Administrators install the plug-ins there, and configure which plug-ins (versions) are to be used. When the user logs into their VDI session the Receiver checks with the Merchandising Server. If there is a newer version of say the ICA Client (now called the Plug-in for Hosted Apps), the new version is automatically downloaded and made available for the user in the VDI session. Same is true for the Citrix streaming client (now called the Citrix offline plug-in). We'll do other plug-ins too from the Citrix side including the Password Manager Agent and the Access Gateway Secure Access Client (which doesn't apply in VDI, but its great for laptop users again, and XenClient users in the future). But here's the MS and Citrix marriage again, we'll also deliver the App-V streaming client thru Receiver, so that it’s always kept up to date.

So now with of the plug-ins in place, we need one central place for users to get their apps. Typically users expect them to be on the Start Menu. But with so many varied ways to get applications into the virtual desktops, only the "hard installed into the vdisk" apps are showing in the Start menu. That's where Citrix Dazzle comes in. We call this delivery "merchandising" the applications, much like iTunes provides a self service store for music and video content. Dazzle is a self service store for application content.

Dazzle can be pushed out and managed thru, you guessed it, the Citrix Receiver and Merchandising Server. Once I open Dazzle, I can pick and choose from all of the apps being made available to me. The sources can be App-V, Citrix Streaming, or Citrix Hosted. If I'm a road warrior who uses a laptop or XenClient, I am told if the application is available for offline use, and I can choose appropriately. Once I select my apps, they appear in the start menu. The user can then put icons on the desktop if they wish. File type association works.

So there is one final piece to this simple puzzle. As you know, when I log off a VDI session, the pooled VM reboots and any changes made while the VM was running are thrown away. That means all of the icons for the apps that I selected, right? Not when profile management is in place. That's why Citrix has Profile Management. It’s a lot like roaming profiles, extending the base profile infrastructure that MS provides us. Profile Manager takes the user environment changes, like the desktop shortcuts and Start Menu changes, and migrates them off when the VDI session is logged off. When the user logs back in, perhaps to a completely different pooled VDI VM, the users profile settings are automatically applied. That means the icons are there for launch.

So what if I need a new app, and I go into Dazzle and can't find it? In future releases we will include application requesting. When a user requests an app it will set off a workflow to get the request reviewed, and ultimately fulfilled if appropriate.

So that's our vision, and after that explanation of how all of these pieces fit together, and what they do, where is Citrix with releasing these components. Here are the current releases, as of this writing, with the status of functionality.

Citrix Receiver
  • Currently available, version 1.1
  • App-V plug-in support is expected in future release
Receiver supports the following new plug-in releases:
  • Online plug-in 11.2 (XenApp Hosted)
  • Offline plug-in 5.2 (XenApp Streaming)
  • Service monitoring plug-in 5.1 (EdgeSight)
  • Secure access plug-in 4.6.1 (Access Gateway)
  • Dazzle Tech Preview
  • Communications plug-in 3.0 (EasyCall)
  • Profile Management plug-in 2.0

Citrix Merchandising Server
  • Currently available, version 1.2
  • Must run on a XenServer as a virtual appliance
  • Support for other hypervisor platforms expected in the future
  • Manages the setup of Citrix Receiver component that is running in VDI desktops and mobile endpoints
  • Enables "plug-ins" to support multiple types of delivery services
  • Centralizes management of all updates
  • Enables access to web-based user support services
  • Offers robust management reporting feature
Citrix Dazzle

  • Currently available, version 1.1
This is basically a Tech Preview version, I have noticed the following issues/workarounds:
  • This version is English only
  • Launching Dazzle invokes an animated splash screen which requires Windows Media. For quicker launches, especially in VDI situations, this splash screen can be disabled by simply renaming the windows media source file
  • This release doesn't inform users when certain streamed apps are not configured for their OS
  • Pass thru authentication is not available yet. However, users can choose to have their credentials saved for subsequent launches.
  • Receiver does not yet officially support App-V plug-ins, however, there is a documented way to deploy App-V plugins with the Merchandising Server. It is in tech preview right now. Dazzle can merchandise App-V apps, this being done as published content thru XenApp or a published app (which pulls the App-V package to the XenApp server and connects the user thru ICA). We will probably see more App-V options within the XenApp console itself in coming releases/feature packs.
Availability
So to answer a question you probably have by now, are we there yet? Well no, not quite. But I expect in the very near term we will have new releases. This announcement is nearly 7 months old now. I know we have made significant progress in these areas, as it is a VERY high priority. I also know that internally at Citrix we have all of this working. Check out the attached video; My colleague at Citrix proves this is not vaporware, and note this video was recorded 7 months ago.
Following Kurt’s steps, I have actually pieced it together in a lab. Nothing official here, but we could see a full release of Dazzle with XenApp6 (Project Parra). Who knows? We may see more details on App V delivery. I honestly don’t know myself, as I’m not in Product Management. But I can assure you this tight Microsoft integration is a very high priority for Citrix, and we can expect the missing pieces to be in place very quickly.

Keep your ear to the ground for timeframe announcements.
Read Even MORE!!!

Read more!

Friday, February 19, 2010

Direct Booting a VHD in XenServer

By:Andy Paul


Running XenServer, you may run into instances where you needed to directly mount and boot a VHD file in XenServer. I have encountered this several times, including migrating a virtual server from Hyper-V to XenServer as well as updating XenTools and Provisioning Tools for Citrix-based deployments.

The following process will take you through preparing a storage repository in XenServer and importing your VHD file for direct boot.


PART I - Creating an EXT3 DRIVE

VHD files require an NFS or EXT3 formatted storage repository. The standard install of XenServer creates a local storage repository using LVM format. You can destroy this and create an EXT partition instead. In my XenServer farms where I am using shared storage, I like to create at least one host with an EXT drive for flexibility.
Please note, this will also destroy ANY VMs on that partition, so proceed with caution.
  1. Connect to your XenServer command line interface. You can use XenCenter for this, but I like to use PuTTY for the copy/paste and scroll features.   
  2. Collect your necessary information:
    1. Find the default SR device ID (DEFAULT_SR_PHYSDEVS=) In a single disk system this should be /dev/sda3:  # cat /etc/xensource-inventory  
    2. Determine the UUID for your default SR: # xe sr-list type=lvm
    3. Determine the UUID your default SRs PBD your default SR: # xe pbd-list sr-uuid=your SR UUID (from step 2b above) 
    4. in a multi-host pool, you want to make sure you reference to correct host.  You can find this results step 2a under the label INSTALLATION_UUID= or run the command: # xe host-list
  1. Destroy the existing LVM partition:
    1. Disconnect the default SR: # xe pbd-unplug uuid=your PBD UUID (from 2c above) 
    2. Remove the default SR: # xe sr-destroy uuid=your SR UUID (from 2b above)
  1. Create EXT partition
    • # xe sr-create content-type="Local SR" host-uuid=[YOUR HOST ID] type=ext device-config-device=[YOUR DEVICE] shared=false name-label=" Local EXT3"
    • NOTE: This command takes a few minutes to run and will return the UUID of the new partion when complete.  Also, if you are on a single host system, you can tab after host-uuid= to poplate the host-id value 
    • Example Command: # xe sr-create content-type="local SR" host-uuid=0d1c9ba5-2304-46d9-8b75-459f41fb7f8a type=ext device-config-device=/dev/sda3 shared=false name-label="Local EXT3"
YOUR NEW SR IS READY TO USE AND SHOULD APPEAR IN XENCENTER

However, if you need to define a default SR, such as in a single host / single drive system, use the following:
  • Set the default SR: # xe pool-param-set default-SR=YOUR NEW SR UUID uuid=xxxxxxxx 
  • Set your SR as the default location for suspended VM images: # xe pool-param-set suspend-image-SR= YOUR NEW SR UUID uuid=xxxxxxxxxx

PART II - COPYING VHD FILES TO XENSERVER

  1. Connect to your target XenServer with an SCP Utility to copy the files. I have used WinSCP with good results.
  2. Copy to /var/run/sr-mount/[uuid of ext3 SR create in Part 1] 
  3. If using explorer mode of WinSCP, you can drag and drop your files to initiate the copy
IMPORTANT NOTE: MAKE SURE YOU COPY YOUR FILES TO THE CORRECT PARTITION!!!! (not the Root!)

PART III - DIRECT MOUNTING

  1. In XenCenter, create a new VM with setting similar to the configuration of the VHD you copied over.  DO NOT POWER ON THIS VM
  2. Using your SSH utility, note the name (UUID) of the new VHD file created by the wizard.
  3. Delete this file (UUID.VHD)
  4. rename your target VHD to this UUID name
  5. Power on your machine... and if everything goes right, VIOLA!
Your VHD is now imported and locally mounted.  Once you power on the VM, you can update drivers, files, etc. If you plan on provisioning this server, connect a new blank vDisk and use XenConvert to capture an updated image. If you have enough storage space, I recommend keeping this image on the server for future updates/captures.


Additional Reading:

Read more!

Monday, February 8, 2010

Using Hyper-V for PVS VDisk Offline Maintenance

By:Rick Rohne

I’ve recently been toying with the idea of using Microsoft Hyper-V to perform offline maintenance of my Provisioning Server VDisks. Furthermore, I’ve discovered that it is very possible to install the Hyper-V role directly on the PVS server or servers in your production environment.

While this may not be the best solution for all deployments, I have found that installing the hyper-V role directly on the PVS server saves a lot of time when having to perform tasks such as updating PVS target device software, Anti-Virus software that modifies the network stack, or updating physical computer network drivers.
This blog hosted on the Citrix Blog site shows exactly how to use Hyper-V to update your Vdisk images. Be sure to follow these instructions to the “T”.. Using Hyper-V to update Offline vDisks , and since the best way to get super performance out of your PVS server is to run it on a Windows Server 2008 x64 box, it just makes sense to use the same server to run the hyper-v role.

If you choose to do this, I strongly suggest adding a new directory outside of your PVS store to perform the offline maintenance. You may also choose to keep the Hyper-V services stopped when you are not using them, and finally, create a dedicated network on the Hyper-V host (maybe your management network) to assign your external network to your VM’s. Although these steps are not necessary, it will ensure that your hyper-V services never interfere with your PVS services.

I would like to know if anyone else is doing this, I currently have one production deployment and my own lab running this scenario and it really does seem to work great.

Read more!

Wednesday, January 13, 2010

Agentless backup for Citrix XenServer VM's

By:Rick Rohne
One of the great things about Virtualization is the ability to take quick snapshots of your XENServer VM’s so that you have a restore point to go back to at any time; however, keeping snapshots in your XENServer Storage Repositories is not always the answer to a good solid disaster recovery plan.
Take a look at this product which performs automated online snapshots and archives of your XenServer VM's.

There is always a free way for everything

You can use the XENAPI to perform automated snapshots and even schedule this on a Windows Server, you can even go so far as to archive these images off using SSH etc. But anytime scripting is involved, you have to take into account the changes, additions, and deletions of VM’s in your environment. You can learn more about automating XENServer backups using the XENAPI on the Citrix XENServer Codeshare site http://community.citrix.com/cdn/xs/codeshare.

Alike (Agentless Snapshots) http://www.quorumsoft.com/

I’ve been using Alike to perform automated snapshots and backups of the VM’s in my lab since it first came out of BETA. Alike is a Citrix Ready product that can perform an agentless snapshot and download of your XenServer VM’s to the servers Disk. This may seem trivial, however, Alike actually performs De-duplication of the snapshots and provides an easy to use interface that allows you to schedule a backup job and perform restores without any downtime.
Take a look at some of the key features of Alike:
  • Data Deduplication - Performs block-level data deduplication across all VMs backed up
  • Friendly UI - This easy-to-use User Interface will get you backing up quickly
  • XenServer Integration - Leverages XenServer snapshots to capture guest VM state. Recomended XenServer 5.5
  • Pool Support - Alike is pool-aware and can back up guests deployed to a XenServer storage pool
  • Quiesce Support - Quiesced snapshots are supported in XenServer 5.5
  • Supported Storage Repositories (SRs) - Alike Supports any SR in XenServer 5.5
  • Point-in-time restore - Versions each snapshot that is backed up
  • Syslog integration - Logging can be sent to a syslog server email/paging notifications
  • Flexible Scheduling - Jobs can be scheduled daily, weekly, or monthly; may be configured for multiple runs per day
How Alike Works
1. The Alike scheduler service launches a Job and connects to the appropriate XenServer host.
2. A snapshot of the Virtual Machine (with or without Quiescence) is created.
3. The snapshot image is exported to the temporary work area in an XVA format.
4. Guest image white space is eliminated, then downloaded and processed (deduplicated, compressed and encrypted).
5. Only delta data is vaulted to the storage repository for permanent storage.
6. The backup is now complete and resides safely on disk.

Now if that’s not enough, here’s an excellent video that pretty much tells you the rest of my story:


Keep in mind, however, that even if you are taking snapshots of your VM’s, it is still a good practice to also perform a nightly agent backup of the data that is within the VM. By using both technologies, you can perform an easy restore of your XenServer VM’s so that all the applications and server settings are restored as well as get all the data since the last daily or hourly backup.

My experiences
1. It's much faster than scripting.
2. Works with Citrix Storagelink technology (Netapp storage).
3. New VM's can be automatically added to the Backups.
4. You can even clean up the old snapshots.
5. It would be nice if it worked with XenServer Tags to automate scheduling.
6. I'm hoping it works with Hyper-V and other Virtualization software soon.


For more information on Alike and to get updated pricing, visit their website at http://www.quorumsoft.com/


Read about other products that work with XenServer


Read more!

Tuesday, January 12, 2010

Citrix Desktop Virtualization

By:Rick Rohne / Video by Scott Lane
In this video, Scott Lane gives a very well driven presentation of the Citrix Desktop Virtualization solution. He has a good focus on the user experience, along with nice coverage of all the things you will be concerned about in a typical vdi environment. Great one to share with the boss if you are considering a VDI solution!
HDX
XENServer
XENDesktop
Dazzle
XD Setup tool
Provisioning Server



More Information on XENDesktop... Check it out!

Read more!

Tuesday, December 22, 2009

NetScaler MPX vs. VPX - The finer differences

By:Rick Davis
The NetScaler VPX virtual appliance has some decisive differences from its MPX hardware counterparts. While the performance differences are well documented, some of the finer points are a bit obscure and not readily discoverable. While none of them are likely to be show stoppers, it’s important to be familiar with the limitations.

Here’s a short table I’ve assembled describing the impact of the hypervisor on the NetScaler virtual appliance as compared to the network stack of the MPX:

MPX

VPX

Native 802.1q VLAN Tagging

Tagging is defined on the hypervisor. XenServer is limited to 7 tagged networks and 16 on VMware.

Native 802.3ad Link Aggregation

802.3ad is not supported by XenServer. Source Level Balancing (SLB) NIC bonding is the closest parallel and offers NIC redundancy with great performance. But not all switches work well with SLB so be sure to test under load, plug both links into a single switch, or skip SLB entirely in favor of native NetScaler device failover.

Device Fail-over

Failover is supported between VPX devices through NetScaler's native redundancy mechanism. So there's no need for XenMotion or VMotion support with the VPX.

Dedicated SSL Chipset

No SSL chipsets are available to the VPX, but none the less, it is capable of 300 3DES and 1000 RC4 sessions. At double the VPN capacity, VPX makes a great upgrade path from Secure Gateway by providing a full SSL-VPN, Smart Access, and improved security.


Licensing Changes in VPX 9.1 Build 100.3:

For VPX appliances only, the 9.1_100.3 license software will check the MAC address of the FIRST INTERFACE listed. In previous builds, the license software checked the MAC address of the NEWEST INTERFACE. For VPX customers who upgrade to 9.1_100.3, this change will invalidate licenses on VMs which had more than one interface. They will need to revisit MyCitrix.com licensing portal to re-host their license. CTX122426 - NetScaler VPX Licensing Guide has been updated with the rehosting instructions.

VPX owners are allowed to relicense their VPX system up to 3 times.


Read more!

Saturday, December 12, 2009

Citrix Command Center Basics with Netscaler

By:Rick Rohne

If you have been working with Citrix Netscaler, VPX, Access Gateway Enterprise, Application Firewall, or Brach Repeater you are probably interested in ways to collect statistics, reports, and alerts for all your Application Networking devices… Citrix Command Center is just the tool to use, and when configured right, you can get a deep understanding of how your devices are operating in the field. Here, I’m going to go over some of the basic Command Center setup tasks to get you on your way to total knowledge of your Application Networking Infrastructure.


Citrix Command Center is an SSH and SNMP monitoring station that also triples as Config Archiving and mission control center for all of Citrix’s Application Networking gear (both physical and virtual). You can use it to build graphs and receive alerts on system usage and individual entity usage. You can also use it to upload batched commands or transfer configs from development to production. Best of all, it’s included with your purchase of Netscaler Enterprise, Application Firewall, Access Gateway Enterprise, or Branch Repeater.


Who should use Command Center?
• Anyone that has two or more Branch Repeaters, Netscalers, Netscaler VPX, or Application Firewalls.
• Any time you will be transferring your configs from test to development
• When you are using Application Firewall
• When you want to be alerted on up/down events (i.e. when a Service fails and recovers such as the Citrix XML service or your e-commerce web site).
• When you want to keep historic trends of your ANG Infrastructure (i.e. Authentications, VServer hits, Packets received and transmitted, or http requests per second to your Web Sites etc.).
• If you will be writing policies and actions based on traffic usage i.e. Sure Connect or MAX client.


Installation


When setting up Command Center (CCC) for the first time, it’s probably a good idea to have a beefy server and a database that can hold plenty of gathered statistics. It supports a MYSQL, Microsoft SQL, or Oracle datastore and it will generally get pretty big (depending on how much information you gather and how long you keep it. Here is a link to the installation guide (It supports both Windows and Linux installations) Citrix Command Center Installation Guide 3.3 .

After you have it setup, you can choose to run CCC manually or as a Windows Service. If you want to run it as a service, simply run the "C:\Program Files\Citrix\Citrix Command Center\bin\InstallCCAsService.bat" file. This will set the service to start automatically and also install an Apache service on TCP port 9090 (unsecure) or 8443 (secure). It’s managed using a web browser pointed at the Server IP with the port specified during setup. The default username is root with the password of public.


First Steps


The first thing you will want to do is go to the Admin tab to setup some default settings for your CCC installation. Here you can:
• Change the Authentication and authorization settings to Local User accounts or central Directory accounts.
• Configure Log rotations and how long to keep logs around
• Configure your email server default settings
• Configure Inventory settings (Such as whether certificates are backed up etc.


After you have your default settings configured, you will want to create a MAP (Under Citrix Network). A Map is a collection of similar devices with similar roles (Such as an HA pair or a quad of devices in a GSLB configuration). Once you setup your map with all the default information, you can then add devices to the map individually or by running a discovery with an IP range (see below).


Provided that you have not locked down the snmp managers in your ANG devices, Command Center will automatically configure the SNMP community and Trap destinations. It is a good idea to later lock down the SNMP manager hosts to just the devices that will be enabled for management.

NOTE: If an SNMP manager or SNMP manager Network is defined, the automatic configuration will fail. Simply delete all SNMP managers and run the discovery again, or manually configure the SNMP settings.

Once the MAP has been defined, you will start collecting Alarms, however, you must still do some manual configuration if you want to receive alerts or build custom graphs.


Alarms


Alarms can be found under the Fault tab. The Alarms section shows Active Alarms and the status of the Alarm. Not all alarms are enabled by default, Citrix Netscaler comes with some basic alarms that are already configured such as Entity up/down status, Config Changes, Login Failures, HA failover etc.. If you would like to get alarms for typical tasks such as CPU, memory, or Disk usage you will have to configure the alarm thresholds on each device (Or batch a command to configure all the devices from Command Center).


If you would like to setup email alerts, you will want to configure Alarm Triggers. With Alarm triggers you can select what emails addresses receive information on what alarms. You can target specific categories or failure objects and you can use Wild Cards for matching similar failure objects.
NOTE: if you want Command Center to alert on part of a service name for multiple services called SVC_Email_01 and SVC_Email_02, you can add *Email* in the failure object.



Graphing and Reporting statistics


Reporting is one of my favorite features of Command Center because it allows you to know exactly what is going on with your Application Infrastructure and web applications such as:
• CPU, Disk and memory usage over time
• How much traffic is being received and at what are the peak times
• How many SSL VPN connections are occurring
• Authentication Successes and failures
• Reporting also helps you identify if you are using the right size device

The first thing you must do when configuring reporting is configure your Polled Counters… You can configure Counters under the Performance tab of Command Center. Some counters are configured by default; however, you should go in and disable counters that you will not use as well as select counters that are important to your organization.

NOTE: The more counters that are selected, the more processing the Command Center will have to do. Also, Counters with a Plus sign next to them will require additional processing by the appliances. These counters provide the most detailed information such as service and Vserver hit counts, packet rates, etc.


Once you have your counters selected, wait about 5 – 10 minutes and run a quick report or setup a custom report… Custom reports are reports that can be re-used and scheduled and sent to an email distribution. To start, select quick report or Add Custom report from its view.

Select the devices and the counters that you would like to see in your report, and select finish.



Here you can see the counters in the view of your choice.


Central Configuration


The Configuration gives you a single place to execute common tasks for your devices. You can Update Certificates, or Generate Certificates from a central location. You can also use Custom tasks to Batch configurations from Test to Production. You can read more about the custom tasks in a previous blog that I wrote about creating Template configurations for Application Firewall Application Firewall goes Commando


This is just the beginning


There are many other things you can do with Command Center, if you are running any of Citrix’s application networking products in production, I encourage you to download this and give it a try…. Although there is not a whole lot of documentation on Command Center, you can get some useful information from the Admin and User Guides found at http://support.citrix.com/product/nscc/v3.3


More information on Netscaler


Read more!

Friday, December 11, 2009

Netscaler's Application Firewall goes Commando!

By:Rick Rohne

Application Firewall is a relatively complex feature of the Netscaler using complex policies and profiles to identify un-wanted traffic that is flowing to and from an organization’s extranet. Building the policies the first time can be a challenging task alone, but when it comes to duplicating and transporting the policies, well we will just say it’s NO picnic.

Let's take a look at how Citrix Command Center can be used to easily "create" and "transport" Application Firewall Template profiles from Development into Production without having to go deep into the cli.

First of all, if you haven’t heard of Citrix Command Center, you are definetly missing out. Citrix CC is a great tool that can alert and track historic trends of Citrix Netscaler, Application Firewall, Access Gateway Enterprise, and Branch Repeater. It can also be used to transport commands from development to production with just a few simple steps. I’ll be posting more information about Command Center in a later blog, but for now, let me give you a little teaser by making AppFW Profiles portable.

Let’s start by creating a simple Application Firewall Profile (and Policy) Template. vThis template will be a starting point for all your Vservers, and it will give you practice on how to export and import the profiles and policies using Command Center…
First, go in and create a simple AppFW policy and profile that can be re-used by all sites. i.e. no host header matching and no learned data. Call the Policy Template_Pol and the Profile Template_Prof.


Once you have your profile created and configured, you will want to save the config by clicking the little Save button on the Top right.
NOTE: if you don’t save your config, you will not be able to read the commands that were entered using the cat command.
Open a Secure Shell client and login to your Netscaler and type Shell to drop to FreeBSD. You can then use the CLI to grep the commands into a Template File that you can later copy out and re-use any time:


After your Template file is created, simply download the file using an SFTP client to your Computer. (WinSCP does a great job here because you can use it’s built in text editor that works well with Citrix Netscaler Config files). You will find this file under the "/Var" directory on the Netscaler.


Next make a copy of the file on your PC and rename it to something that is a little meaningful… Something like “AppFW_Website_00001”... Then open the new file and do a Find all occurrences of “Template_” and replace with “Website_00001”.



Now you are ready to import this new policy and profile using Citrix Command Center. Open Command Center; go to Configuration / Custom Task / Add Custom Task. Use the Import from command line to browse to your newly created file and select next. The Custom Task wizard will capture the contents of the file and place them in sequential commands that can be fed into the Netscaler.
NOTE: Make sure you remove any task variables at the bottom of the page. Citrix Command center reads some of the commands and misinterprets Deny-URL’s as Task Variables..




Finally, go back to the Netscaler Configuration utility and refresh the screen. You will see that you have a complete copy of the original Profile and Policy (with a new name) ready to begin learning mode on a new Web Application….




Ok, since you have the basic concepts, let’s take this one step further… Since it is relatively risky to place the App Firewall Rules in learning mode while facing the public Internet, you can use Netscaler VPX to create your initial profiles and policies and build all the learned and deployed data in a development environment. Once you are finished deploying all the rules, save the configuration and perform the same steps, only this time deploy rules to the production Netscalers and bind them to the production Vservers.




Read more!

Wednesday, December 9, 2009

Upgrading Provisioning Services vDisks Target Device Software, Virtual Machine Tools, and Network Drivers

By:Jarian Gibson

With each release of a Provisioning Services Target Device update, hypervisor virtual machines tools update, or network drivers update we are tasked with upgrading the Provisioning Services vDisk and what method to use to complete the upgrade. In this blog post I am going to go over the options for upgrading Provisioning Services vDisk Target Device software, Virtual Machine Tools, and Network Drivers.
Why can't Target Device software, Virtual Machines Tools, and Network Drivers just be upgraded while the vDisk is online?

Provisioning Services Target Devices network boot to access their assigned vDisk on the Provisioning Servers. This relies heavily on the Target Devices network connection to remain in constant communication with the Provisioning Server it is accessing for its vDisk. If the communication is broken, the Target Device will pause or even worse, cause the Windows blue screen of death we all love to see.

When the Target Device initially boots it uses network/PXE boot to the contact the Provisioning Server and access its assigned vDisk to boot into a Windows Operating System with the Target Device software installed. The Target Device software is the Provisioning Services client software that is used by Windows once the Target Device has booted into a Windows Operating System. The Target Device software stays in constant communication with the Provisioning Server while the vDisk is online.

The Target Device software relies heavily on the network card and network stack of the Target Device. If anything changes with the network card or network stack (drivers, settings, state, etc) while the Target Device is accessing the vDisk, then communication with the vDisk will be broken and the Target Device will most likely blue screen. Updating the Target Device software, virtual machine tools, or network drivers all effect the Target Devices network card/network stack and cannot be done while the vDisk is online.

What options are there for updating vDisk Target Device software, Virtual Machine Tools, and Network Drivers?

As of today there are three main options for updating vDisk Target Device software, virtual machine tools, and network drivers. All three options are done offline and you should always make a backup copy of your vDisk before doing any of these options. You can use the Reverse Image, Hyper-V Direct VHD Boot, or XenServer Direct VHD Boot options to upgrade vDisk Target Device software, virtual machine tools, and network drivers.

Reverse Imaging

Reverse Imaging has been around the longest for updating vDisk Target Device software, virtual machine tools, and network drivers. The process is pretty straight forward and requires a locally attached disk on the Target Device. When you first create a vDisk you image the locally attached disk to the vDisk. Reverse Imaging is imaging the vDisk back to the locally attached disk.

Reverse Imaging Process:

  1. Boot to the vDisk in Private or Standard Mode.

  2. Make sure the locally attached disk is marked active in Disk Management and make note of the drive letter.

  3. Run XenConvert or the Image Builder Utility (C:\Program Files\Citrix\Provisioning Services\bnimage.exe) and image back to the locally attached disk.

  4. Reboot and change the BIOS to boot from local disk instead of network boot.

  5. Boot to local disk.

  6. Uninstall Target Device software and install new Target Device software, update virtual machine tools, or update network drivers. If you are updating a combination of the three or just updating virtual machine tools and/or network drivers make sure to uninstall the Target Device software, update virtual machine tools and/or network drivers, and then install Target Device software.

  7. Change the Target Device to boot from hard disk in the Provisioning Services Console.

  8. Create a blank vDisk and assign to the Target Device or use the existing assigned vDisk (make sure you have a backup copy and no other Target Devices are accessing the existing vDisk) in the Provisioning Services Console.

  9. Change the vDisk to Private Mode in the Provisioning Services Console.

  10. Reboot and change the BIOS to boot from network instead of local disk.

  11. Run XenConvert or the Image Builder Utility (C:\Program Files\Citrix\Provisioning Servers\bnimage.exe)and image back to the vDisk.

  12. Shutdown the Target Device and change it to boot from vDisk in the Provisioning Services Console.

  13. Change the vDisk to Standard Mode in the Provisioning Services Console.

  14. Assign the vDisk to Target Devices in the Provisioning Services Console.

  15. Boot Target Devices and test.


Hyper-V Direct VHD Boot

Hyper-V Direct VHD Boot is a newer option of updating vDisk Target Device software, virtual machine tools, and network drivers since Provisioning Services 5.1. If you are using or have a Hyper-V server around this a really nice option. See the Citrix blogs for the Hyper-V Direct VHD Boot option.

XenServer Direct VHD Boot

XenServer Direct VHD Boot is another newer option of updating vDisk Target Device software, virtual machine tools, and network drivers since Provisioning Services 5.1. If you are using or have a XenServer around this another really nice option. See the Citrix blogs for the XenServer Direct VHD Boot option. There is more information in the Citrix forums. See the Citrix forums for Using XenServer and NFS to update PVS device target software.

As you can see you have a few options for updating vDisk Target Device software, Virtual Machine Tools, and Network Drivers. If you have Hyper-V or XenServer in your environment then you have some very nice options without having to Reverse Image your vDisks.

If you have found this article interesting or if you have any other insights, please feel free to leave comments on this article.



More information on Provisioning Server


Read more!

Monday, December 7, 2009

How XENDesktop recovers from a XENServer failed pool master

By:Rick Rohne
According to Citrix Article CTX122458 you can configure a XENDesktop DDC to communicate with two or more XENServers in a Farm with HA configured.  In the case of a failure, the DDC simply goes through the list until it finds the new XENServer master. This got me thinking… It goes through the list???  What happens when you have a large farm?   Does this mean that XENDesktop will not be able to control Virtual Machines for the duration of the outage?  Time to get some Network traces to find out what is going on under the covers…

The Basics
The basis of the article shows that you can add multiple XENServers to the options tab of the XENDesktop DDC configuration as seen here:


1. Create a desktop group as normal using the XENDesktop Setup Wizard or manually in the Delivery Center Console by selecting Citrix Xen VM infrastructure (included with XenDesktop) as the host infrastructure. Specify the address of a single XenServer in the Address field.

2. Select Options and enter:
Addresses=[http://xenserver1.pool1.citrix.com,http://xenserver2.pool1.citrix.com,...][http://xenserver1.pool2.citrix.com,http://xenserver2.pool2.citrix.com,...]...

Does Every Server have to be entered?
Citrix states that you do not have to add all of the XENServers in the Farm to the DDC configuration. I was a little weary about this, so I had to do some testing to see what happens when you don’t list all the servers and one of the “Un-listed” servers becomes the Pool Master.
To my surprise, the answer was definitely NO (You don't have to list all the Pool Members)! When and if the Pool Master fails, the DDC just needs to be able to communicate with one other Member Server in the XENServer Pool. The DDC then performs the Authentication Request and if the authentication succeeds, the Member Server will tell the DDC the IP address of the Pool Master. If no Pool Master is elected, the DDC continues to poll the XENServers until the election has taken place.
The Proof is in the Trace
When the Pool Master experiences a failure; the DDC senses the failure and begins to go down its list of listed XENServers in the list.


The First XENServer that responds may be a Pool Member, however, the Member accepts the authentication request and awaits commands.


The DDC then issues a command to get all records


The XENServer Member recognizes and accepts the command but informs the DDC of the Pool Master IP address in the response.


The DDC then connects to the New Pool Master (Even if it is not listed in the options)



As you can see, you don't have to enter all of the servers in the XENServer farm. I would probably recommend adding at least 4 XENServers in each farm to allow for some flexibility for server reboots and server maintenance...


More on XENDesktop


Read more!