Author: Carl Stalhood

VMware Horizon 7.13.3 Security Server

Last Modified: Mar 22, 2023 @ 5:48 am

87 Comments

Navigation

This post applies to all VMware Horizon 7 versions, including 7.13.3.

💡 = Recently Updated

Change Log

Preparation

The newer Horizon Console does not support Security Servers. The older Flash-based Horizon Administrator won’t work for much longer, so take it as a clue that you should deploy Unified Access Gateways (UAG) to replace your Security Servers. Horizon 8 also does not support Security Servers.

Security Servers are intended to be deployed in the DMZ.

Horizon Security Server is installed on Windows. If you prefer a Linux appliance, see VMware Unified Access Gateway. Note: Some of the newer Blast Extreme functionality only works in Unified Access Gateway. See Configure the Blast Secure Gateway at VMware Docs.

Security Considerations for Horizon View 5.2 – http://www.vmware.com/resources/techresources/10371

Firewall Ports

If there is only one Security Server in the DMZ, create a NAT’d public IP to the Security Server. Create a public DNS entry that resolves to this IP address.

If your load balancer (e.g. NetScaler ADC, F5) is able to provide persistence across multiple port numbers, then you only need one public IP. For example, in NetScaler, this is called Persistency Groups.

If your load balancer doesn’t support persistence across multiple port numbers, then create three public IPs:

  • Public IP NAT’d to the load balancer IP. Create a public DNS entry that resolves to this IP address. This is the DNS name that users will enter into their Horizon Clients.
  • Public IP NAT’d to each of the Security Servers. Each Security Server must be exposed directly to the Internet. Create public DNS names that resolve to these public IPs. When installing Security Server, specify these public DNS names and not the load balanced DNS name.

Firewall Rules for View Connection Server at VMware Docs.

Open these ports from any device on the Internet to all Security Server and Load Balancer public IPs:

  • TCP 80
  • TCP and UDP 443
  • TCP and UDP 4172. UDP 4172 must be opened in both directions.
  • TCP and UDP 8443 (for Blast)

Open these ports from the Security Servers to internal:

  • If IPSec is enabled in View Administrator (Global Settings > Security > Edit), open ISAKMP Protocol (UDP 500) and ESP. Or if there is NAT between the Security Server and the Connection Server, open NAT-T ISAKMP (UDP 4500). Configuring a Back-End Firewall to Support IPsec at VMware Docs.
  • TCP 8009 (AJP13) to the paired internal Horizon Connection Server.
  • TCP 4001 (JMS) to the paired internal Horizon Connection Server.
  • TCP and UDP 4172 (PCoIP) to all internal Horizon Agents. UDP 4172 must be opened in both directions.
  • TCP 32111 (USB Redirection) to all internal Horizon Agents.
  • TCP and UDP 22443 (HTML Blast) to all internal Horizon Agents.
  • TCP 9427 (MMR) to all internal Horizon Agents.
  • TCP 4002 for Enhanced Messaged Security – Change the JMS Message Security Mode to Enhanced at VMware Docs

Pairing Password

The newer Horizon Console does not support Security Servers. The older Flash-based Horizon Administrator won’t work for much longer, so take it as a clue that you should deploy Unified Access Gateways to replace your Security Servers.

  1. VMware Code Script to manage Horizon 7.x Security Servers via the View-API without needing the FLEX based Administrator Console
  2. In Horizon Administrator, on the left, expand View Configuration, and click Servers.
  3. On the right, switch to the Connection Servers tab.
  4. Select the Horizon Connection Server to which the Security Server will be paired. Then click More Commands, and click Specify Security Server Pairing Password.
  5. Enter a temporary password, and click OK.

Install – Security Server

  1. Ensure the Horizon Security Server has 10 GB of RAM and 4 vCPU.
  2. Windows Server 2019 is supported for the Horizon Security Server 7.8 and newer.
  3. Login to the Horizon Security Server.
  4. Download Horizon 7.13.3 Horizon Connection Server.
  5. If you are upgrading an existing Security Server, then you must prepare it for upgrade:

    1. In Horizon Administrator (Flash/Flex console), on the left, expand View Configuration, and click Servers.
    2. On the right, switch to the tab named Security Servers.
    3. Highlight the Security Server, then click the menu named More Commands and click Prepare for Upgrade or Reinstallation.
    4. Click OK to remove the IPSec rules.
  6. On the Security Server, run the downloaded VMware-Horizon-Connection-Server-x86_64-7.13.3.exe.
  7. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  8. In the License Agreement page, select I accept the terms, and click Next.
  9. In the Destination Folder page, click Next.
  10. In the Installation Options page, select Horizon 7 Security Server, and click Next.
  11. In the Paired Horizon 7 Connection Server page, enter the name of the internal Horizon Connection Server that this Security Server will be paired with. If using a hostname, it must be resolvable (edit the local HOSTS file) to the correct IP. Also, the correct firewall ports are required. Click Next.
  12. In the Paired Horizon 7 Connection Server Password page, enter the pairing password specified earlier, and click Next.
  13. In the Horizon 7 Security Server Configuration page, edit the URLs as appropriate. These URLs must be externally accessible. The top URL is a FQDN, while the middle URL is an IP address. These can be changed later. Click Next.
  14. In the Firewall Configuration page, click Next.
  15. In the Ready to Install the Program page, click Install.
  16. In the Installer Completed page, click Finish.

SSL

Security Server Certificate

  1. Run certlm.msc (Windows 2012+). Or run mmc, add the Certificates snap-in and point it to Computer > Local Machine.
  2. Request a new certificate with a common name that matches the public FQDN of the Security Server, or import a wildcard certificate.
  3. Note: the private key must be exportable. If using the Computer template, click Details, and then click Properties.
  4. On the Private Key tab, click Key options to expand it, and check the box next to Mark private key as exportable.
  5. In the list of certificates, look for the one that is self-signed. The Issuer will be the local computer name instead of a Certificate Authority. Right-click it, and click Properties.
  6. On the General tab, clear the Friendly name field, and click OK.
  7. Right-click your Certificate Authority-signed certificate, and try to export it.
  8. On the Export Private Key page, make sure Yes, export the private key is selectable. If the option to export the private key is grayed out, then this certificate will not work. Click Cancel.
  9. Right-click your Certificate Authority-signed certificate, and click Properties.
  10. On the General tab, in the Friendly name field, enter the text vdm, and click OK. Note: only one certificate can have vdm as the Friendly name.
  11. Then restart the VMware Horizon 7 Security Server service.

Load Balancing

See Carl Stalhood – Horizon View Load Balancing

Enable PCoIP Secure Gateway

  1. In View Administrator, on the left, expand View Configuration, and click Servers.
  2. On the right, switch to the Connection Servers tab.
  3. Right-click the Connection Server that is paired with the Security Server, and click Edit. Note: you can’t configure this directly on the Horizon Security Server, and instead must configure it on the paired Horizon Connection Server.
  4. On the General tab, check the box next to Use PCoIP Secure Gateway for PCoIP connections to machine. Also, make sure HTTP(S) Secure Tunnel and Blast Secure Gateway are enabled. Click OK.

Related Pages

VMware Horizon 7.13.3 Configuration

Last Modified: Mar 22, 2023 @ 5:46 am

73 Comments

Navigation

This post applies to all VMware Horizon 7 versions including 7.13.3.

💡 = Recently Updated

Change Log

Preparation

Horizon Service Account

  1. Create an account in Active Directory that Horizon View will use to login to vCenter. This account can also be used by Composer and Instant Clones to create computer accounts in Active Directory.
  2. Make sure the password does not expire.
  3. Domain User is sufficient. Permissions will be delegated where needed.

vCenter Role for View Composer

This role has all permissions needed for both full clones and linked clones. See Privileges Required for the vCenter Server User and View Composer and Instant Clone Privileges Required for the vCenter Server User at VMware Docs.

See the Product Interoperability Matrix for supported vCenter versions.

Create vSphere Role:

  1. In vSphere Web Client, go to Administration.
  2. In the Roles node, click the plus icon to add a Role.
  3. If you are using vTPM, then on the left, click Cryptographic operations. On the right, enable Clone, Decrypt, Direct Access, Encrypt, and Manage KMS. Scroll down on the right to see more Cryptographic operations permissions.

    1. While still in Cryptographic operations, scroll down and enable Migrate and Register host.
  4. On the left, click Datastore. On the right, enable Allocate space, Browse datastore, and Low level file operations.
  5. On the left, click Folder. On the right, enable Create folder, and Delete folder.
  6. On the left, click Global. On the right, enable Act as vCenter Server, Disable Methods, and Enable Methods, and then scroll down on the right to see more Global permissions.

    1. While still in Global, enable, Manage custom attributes, Set custom attribute, and System tag.
  7. On the left, click Host. On the right, in the Configuration section, enable Advanced Settings. Then scroll down on the right to see more Host settings.

    1. While still in Host, scroll down to the Inventory section and click Modify cluster.
  8. On the left, click Network. On the right, enable All Network Privileges.
  9. For Virtual SAN, enable Profile-driven storage and everything under it. VMware 2094412 When attempting to deploy linked clones using VMware Virtual SAN (VSAN) you receive the error: Unable to connect to PBM sub system PB may be down
  10. On the left, click Resource. On the right, enable Assign virtual machine to resource pool, and Migrate powered off virtual machine.
  11. On the left, click Storage views. On the right, enable View.
  12. On the left, click Virtual Machine. On the right, click Change Configuration to enable all Configuration permissions. Scroll down on the right to see more Virtual machine permissions.

    1. While still in Virtual Machine, scroll down and click Edit Inventory to enable all Inventory permissions.
    2. While still in Virtual Machine, scroll down to the Interaction section, enable Connect devices, and then click See more privileges.
    3. While still in Virtual Machine, scroll down and enable Perform wipe or shrink operations,  Power Off, Power On, Reset, and Suspend.
    4. While still in Virtual Machine, scroll down to the Provisioning section and enable Allow disk access, Clone template, and Clone virtual machine. Then click See more privileges.
    5. While still in Virtual Machine, scroll down and enable Customize guest, Deploy template, and Read customization specifications.
    6. While still in Virtual Machine, scroll down and click Snapshot Management to enable all Snapshot permissions.
  13. Click Next.
  14. Name it Horizon or similar. Then click Finish

Assign role to service account:

  1. Create an account in Active Directory that Horizon View will use to login to vCenter.
  2. In vSphere Web Client, in Hosts and Clusters view, browse to the vCenter object. Permissions must be assigned at the vCenter level. It won’t work at any lower level.
  3. On the right, select the tab named Permissions.
  4. Click the plus icon to add a permission.
  5. In the Add Permission dialog box, do the following:
    1. Change the User domain.
    2. Search for the service account.
    3. Change the Role to the one you created in the previous section.
    4. Check the box next to Propagate to children.
  6. Click OK.
  7. The service account is now listed on the Permissions tab.
  8. From VMware Docs Configure a vCenter Server User for Horizon 7 and View Composer: If you install Horizon Composer on the same machine as Windows vCenter Server, you must make the Horizon service account a local system administrator on the Windows vCenter Server machine.
    • If you install Horizon Composer on a different machine than Windows vCenter Server, you do not have to make the Horizon service account a local administrator on the Windows vCenter Server machine. However, the Horizon service account must be a local administrator on the Horizon Composer standalone machine.
  9. On the Horizon Composer server, right-click the Start button, and click Computer Management.
  10. Go to System Tools > Local Users and Groups > Groups. Double-click Administrators. Add the Horizon service account, and click OK.

Active Directory Delegation for Instant Clones and Composer

Horizon Composer and Instant Clones create computer objects in Active Directory. Horizon is configured with an Active Directory service account that must be granted permission to create computer objects. See Create a User Account for Instant-Clone Operations at VMware Docs.

  1. Create an OU in Active Directory where the Horizon Agent computer objects will be stored.
  2. In Active Directory Users & Computers, right-click the Horizon Agents OU, and click Delegate Control.
  3. In the Welcome to the Delegation of Control Wizard page, click Next.
  4. In the Users or Groups page, add the Active Directory service account for Instant Clones and/or Horizon Composer. Then click Next.
  5. In the Tasks to Delegate page, select Create a custom task to delegate, and click Next.
  6. In the Active Directory Object Type page, do the following:
    1. Change the radio button to select Only the following objects in the folder.
    2. Check the boxes next to Create select objects in this folder and Delete selected objects in this folder.
  7. Click Next.
  8. In the Permissions page, check the boxes next to Read All Properties, Write All Properties, and Reset Password. Then Next.
  9. In the Completing the Delegation of Control Wizard page, click Finish.
  10. If you are viewing Advanced Features in Active Directory Users & Computers, if you view the properties of the OU, on the Security tab, click Advanced, find your service account, you should see permissions similar to the following.

Events SQL Database

A new empty SQL database is needed for storage of View Events.

  1. Only SQL Server authentication is supported, so make sure it’s enabled on your SQL Server > Properties > Security page.
  2. In SQL Server Management Studio, create a new database.
  3. Name it VMwareHorizonEvents or similar. Switch to the Options tab.
  4. Select your desired Recovery model, and click OK.
  5. Under Security > Logins, add a SQL login if one does not exist already. Windows authentication is not supported.
  6. Right-click a SQL login, and click Properties.
  7. On the User Mapping page, check the Map box next to the VMwareHorizonEvents database.
  8. On the bottom, add the user to the db_owner database role. Click OK when done.

Horizon Consoles

On the desktop of the Horizon Connection Server is an icon to launch Horizon 7 Administrator Console.

Horizon 7.5 and newer have two administrator consoles:

  • Horizon Console (HTML5)
  • Horizon Administrator (Flex) – Flash-based

In Horizon versions 7.5 through 7.10, Horizon Console was not yet feature complete so most administrators continue to use the Flash-based Horizon Administrator. In these versions, you can access Horizon Console by navigating to https://viewConnectionServer/newadmin (add /newadmin to the end of your Connection Server FQDN). Or click the Horizon Console link at the top right of the Horizon Administrator console.

In Horizon 7.10 and newer, Horizon Console is feature complete and is now the primary administrator interface. The Flash-based Horizon Administrator is now deprecated.

In Horizon 7.11 and later:

  • When you connect to Horizon Administrator (/admin at the end of the Connection Server URL), you are prompted to choose between Horizon Console and Horizon Administrator. In prior versions of Horizon, going to /admin always opens the Flash-based administrator console.
  • If you navigate to /newadmin, it will redirect you to /admin where you can choose between the two consoles.
  • You can go directly to the Flash-based administrator console by navigating to /flexadmin.

Horizon Console 7.11 and newer’s Dashboard can show you the CPU/Memory of the Connection Servers:

  1. On the top left, expand Monitor and click Dashboard.
  2. On the right, in the top-left block named System Health, click VIEW.
  3. With Components selected on the left, the first tab on the right is Connection Servers. It shows you a list of Connection Servers in the pod and each server’s CPU and Memory Consumption.

Licensing

As of Horizon 7.9, Horizon Licensing can be configured in either the new HTML5-based Horizon Console or the classic Flash-based Horizon Administrator.

  1. Open Horizon Console or Horizon Administrator.
  2. Login using a Horizon administrator account.

  3. In Horizon Console on the left, expand Settings and click Product Licensing and Usage.

    1. Or in Horizon Administrator, on the left, under View Configuration, click Product Licensing and Usage.
  4. In the right pane, on the top left, click Edit License.

  5. In the Edit License window, enter your license serial number, and click OK.
  6. Licensing information is displayed:
    • License expiration is shown.
    • Application Remoting (published applications) requires Horizon Advanced Edition.
    • Skype Optimization requires Horizon Advanced Edition.
    • In Horizon 7.13, Instant Clones are available in all editions of Horizon. Prior to 7.13, Instant Clones requires Horizon Enterprise Edition.
    • Session Collaboration requires Horizon Enterprise Edition.
    • Help Desk tool requires Horizon Enterprise Edition.

Horizon Administrators

To configure Horizon Administrators:

  1. In Horizon Console 7.8 or newer, on the left, expand Settings, and click Administrators.

    • Or in Horizon Administrator, on the left, expand View Configuration, and click Administrators.
  2. On the right, near the top, click Add User or Group.

  3. In the Select administrators or groups page, click Add.

  4. Enter the name of a group that you want to grant Horizon Administrator permissions to, and click Find.
  5. After the group is found, check the box next to the group (or highlight the group), and then click OK.

  6. Continue adding groups, or just click Next.
    Note: This wizard only lets you select one role; so, only add groups that will have the same role assigned. You can run the wizard multiple times.
  7. In the Select a role page, select the role (e.g. Administrators). Newer versions of Horizon include a built-in Help Desk Administrators role, which grants access to the Help Desk tool. Then click Next.

  8. Select an access group to which the permission will be applied and then click Finish.
    • Access Groups let you designate permissions to specific pools instead of to all pools.
    • Note: If you intend to integrate Horizon with VMware Identity Manager (aka VMware Access), then only pools in the Root Access group will sync with Identity Manager. Other Access Groups won’t work.

Help Desk Website

Horizon 7.2 and newer have a new web-based Help Desk tool built into Horizon Connection Server.

  • In Horizon Console (Horizon 7.5 and newer), simply enter a user name in the search box.
  • VMware also has an alternative Horizon Helpdesk Utility Fling
  • For Horizon 7.2 through 7.4, go to https://HorizonFQDN/helpdesk (e.g. https://view.corp.com/helpdesk).

The Desktops and Applications tabs let you see what the user it entitled to. You can even export these lists.

On the Sessions tab, click a session to see more details.

On the Details tab, scroll down to find action buttons like Remote Assistance. These buttons are kind of hidden.

Keep scrolling down and you’ll see Logon Segments.

The Processes tab lets you end processes in the user’s session.

Notes on the Help Desk feature:

  • Enterprise Licensing – Help Desk tool requires Horizon Enterprise edition license, or Horizon Apps Advanced edition license. Horizon Standard Edition licenses do not include this tool. In Horizon 7.3 and newer, the Product Licensing page indicates if Help Desk is licensed or not.

  • In Horizon 7.2, only Full Horizon Administrators can login to the Help Desk web page.
  • Horizon 7.3 and newer have built-in Help Desk Administrators roles that can log into the Help Desk tool.

    • Add Help Desk users to the Administrators and Groups tab, and assign them one of the Help Desk roles.

  • 15 minutes of History – There’s only 15 minutes of collected metric data. Use vRealize Operations for Horizon for longer historical monitoring.
  • See Rob Beekmans Helpdesk functionality added to VMware Horizon 7.2.
  • According to Pascal van de Bor Horizon 7.2: With a little helpdesk from my friends, checkOrigin needs to be disabled to prevent the “Authentication failed, invalid domain, username or password. Please try again” error.

See Troubleshooting Users in Horizon Help Desk Tool at VMware Docs.

vCenter Connection, and optional Horizon Composer

Horizon must connect to vCenter for several reasons:

  • Power manage the virtual machines
  • Create new virtual machines using Instant Clones or Horizon Composer
  • Update virtual machines using Instant Clones or Horizon Composer

See the Product Interoperability Matrix for supported vCenter versions.

If you are adding multiple vCenter servers to Horizon, make sure each vCenter Server has a Unique ID. In vSphere Web Client, go to the vCenter Server > Manage > Settings > General > Edit > Runtime Settings, and confirm that the ID is unique for each vCenter server.

  1. In Horizon Console 7.8 or newer, on the left, expand Settings, and click Servers.

    • Or in Horizon Administrator, on the left, expand View Configuration, and click Servers.
  2. In the right pane, in the vCenter Servers tab, click Add.

  3. In the VC Information page, do the following:
    1. In the Server address field, enter the FQDN of the vCenter server.
    2. In the User Name field, enter the previously created Active Directory account (domainname\username) that Horizon will use to login to vCenter.
    3. Also enter the service account’s password.
  4. Click Next.

  5. If you see a message regarding invalid certificate, click View Certificate. Then click Accept.


  6. In the View Composer page, if you are using Horizon Composer, then do the following:
    1. Select Standalone View Composer Server.
    2. Enter the FQDN of the Composer Server, and the credentials of an account to access the Horizon Composer server. The service account must be a local administrator on the Horizon Composer Server.
  7. Click Next.

  8. If you see an invalid certificate, click View Certificate. Then click Accept.


  9. If you are using Horizon Composer, then in the View Composer Domains page, do the following:
    1. Click Add.

    2. Enter the Full domain name of where the virtual desktop computer objects will be created.
    3. Enter the Active Directory service account credentials that has permission to create computer objects, and click Submit.

  10. Then click Next.
  11. In the Storage page, do the following:
    1. Reclaim VM disk space requires IOPS during its operation. This feature is not needed for Instant Clones.
    2. Check the box to Enable Horizon Storage Accelerator, and increase the host cache size to 2048. Notes:
      • Horizon Storage Accelerator is required for Instant Clones.
      • Horizon Storage Accelerator causes digest files to be created, thus increasing disk space requirements and increasing how long it takes to Recompose a pool.
  12. Click Next.

  13. In the Ready to Complete page, click Submit.

Instant Clone Domain Accounts

If you plan to use Instant-Clone to create non-persistent virtual desktops, then add an administrator account that can join machines to the domain.

  1. In Horizon Console 7.9 or newer, on the left, expand Settings and click Instant Clone Domain Accounts.

    • Or in Horizon Administrator, on the left, expand View Configuration, and click Instant Clone Domain Accounts.
  2. On the right, click Add.

  3. Select the domain.
  4. Enter credentials of a service account that can join machines to the domain. Click OK.

Disable Check Origin

If you connect to Horizon Connection Server using any DNS name (e.g. load balancing DNS name) that doesn’t match the server’s DNS name, then it might not work unless you disable Origin Check as detailed at VMware 2144768 Accessing the Horizon View Administrator page displays a blank error window in Horizon 7.

Restrict Remote Access

The Users and Groups node has a new Remote Access tab. You can configure this in either the Horizon Console or in Horizon Administrator.

If you add groups or users to this tab, only these groups and users can login through Unified Access Gateway (UAG) or Security Server.

Users not in the list can’t login through Unified Access Gateway (UAG) or Security Server.

Disable Secure Tunnel

By default, internal Horizon Clients connect to Horizon Agents by tunneling (proxying) Blast or PCoIP through a Horizon Connection Server. It would be more efficient if the internal Horizon Clients connect directly to the Horizon Agents instead of going through a Connection Server.

  • If the tunnels are enabled, and if you reboot the Connection Server, then user connections will drop.
  • If the tunnels are disabled, then rebooting the Connection Server will not affect existing connections.

To disable the tunnels in either Horizon Console or Horizon Administrator:

  1. In Horizon Console, on the left, expand Settings, and click Servers.

    • Or in Horizon Administrator, on the left, expand View Configuration, and click Servers.
  2. On the right, switch to the Connection Servers tab.

  3. Click the Connection Server to highlight it, and click Edit.

  4. On the General tab, uncheck the boxes next to HTTP(S) Secure Tunnel and the two Gateways. Click OK.
  5. Note: if you are using HTML5 Blast internally, then disabling the Blast Secure Gateway will cause HTML5 Blast connections to go directly to the Horizon Agent, and the Agent certificate is probably not trusted. Newer versions of Horizon have an option to use Blast Secure Gateway only for HTML Access.

Event Database and Syslog

  1. In Horizon Console 7.9 or newer, on the left, expand Settings and click Event Configuration.

    • Or in Horizon Administrator, expand View Configuration, and click Event Configuration.
  2. On the right, under Event Database, click Edit.

  3. In the Edit Event Database dialog box, do the following:
    1. Enter the name of the SQL server.
    2. Select Microsoft SQL Server as the Database type.
    3. Enter the name of the database.
    4. Enter the SQL account credentials (no Windows authentication).
    5. Optionally, enter VE_ (or similar) for the Table prefix. This allows you to use the same Events database for multiple View installations.
  4. Click OK.

  5. On the right, in the Event Settings section, you can click Edit to change the age of events shown in Horizon Console or Horizon Administrator.

  6. To add a Syslog server, look on the right side of the page.

  7. There are configuration options for logging to a file (Events to File System).

  8. You can go to Monitor > Events to view the events in the database.

Event Database SQL Index

VMware Knowledgebase article – The Event database performance in VMware View 6.0.x is extremely slow (2094580): Symptoms:

  • The Event database performance in VMware View 6.0.x is extremely slow when browsing within View
  • High CPU usage on the SQL server, hosting the Event database
  • The larger the Event database becomes, the slower the queries run.

To resolve this issue, create an index. Run this command on your SQL Event database:

CREATE INDEX IX_eventid ON dbo.VDIevent_data (eventid)

Substitute VDIevent_data for the table name using your Event database prefix.

Event Queries

VMware Fling – Horizon View Event Notifier: collects and sends the alerts via email (SMTP) to users that are specified during the configuration process. It allows aggregation of alerts across multiple Horizon View Pods and for near real-time alerting of Horizon View alerts that are otherwise very difficult to be notified on.

Chris Halstead – VMware Horizon View Events Database Export Utility: this utility allows administrators to easily apply very detailed filtering to the data and export it to .csv. You can filter on time range,  event severity, event source, session type (Application or Desktop), Usernames and Event Types.  The application allows for extremely granular export of data.   The exported columns can also be customized and the application will export data from both the live and the historical tables in the View Events Database.

VMware Knowledgebase article – Creating SQL views to retrieve the top 50 maximum number of concurrent desktop sessions over a period: This article provides steps to create database views to retrieve the maximum number of concurrent desktop sessions over a period from the event_historical table.

To retrieve the top 50 maximum number of concurrent desktop sessions over a period time from the event_historical table, run this query:

select Count, Time from(select top 50 DOB.<prefix>_data_historical.IntValue as 'Count', DOB.<prefix>_historical.Time as 'Time' from DOB.<prefix>_historical.DOB.<prefix>_data_historical where DOB.<prefix>_historical.EventID = DOB.<prefix>_data_historical.EventID and DOB.<prefix>_data_historical.Name = 'UserCount' and DOB.<prefix>_historical.EventType='BROKER_DAILY_MAX_DESKTOP order by DOB.<prefix>_historical.Time DESC) A Order by Time

Where <prefix> is the prefix for the event table. You can find the prefix that you must use by examining other view definitions, such as user_events.

Global Settings

  1. In Horizon Console 7.9 or newer, on the left, expand Settings and click Global Settings. Or in Horizon Administrator, on the left, under View Configuration, click Global Settings.

  2. On the right, under Global Settings, in the General Settings tab (or General section), click Edit.

  3. Set the Connection Server Session Timeout (7.13 only) or View Administrator session timeout, which applies to both administrators and help desk. 4320 minutes (72 hours) is the maximum.


  4. Forcibly disconnect users is an active session timeout. It is not an idle timeout in that it doesn’t care if the user is working or not. The default is 10 hours so consider increasing it. Note: this timer does not log the user out of Windows. Instead it merely disconnects the user, and requires the user to logon to Horizon Connection Server again.

  5. Under Client-dependent settings you can set an idle timeout. This is a disconnect, not logoff.

  6. To configure an idle timeout for desktop sessions:
  7. Enable automatic status updates enables automatic updating of the table displayed in the top-left corner of Horizon Administrator.

  8. In Horizon 7.8 and newer, the Send domain list option in Horizon Console and Horizon Administrator is unchecked by default, which means users must enter a domain name instead of picking one from a list. Check this box to restore functionality from Horizon 7.7 and earlier. See VMware Blog Post Changes in Logon for VMware Horizon. Note: This setting is configurable in Horizon Console 7.10 and newer.

  9. Make other changes as desired. Click OK when done.

Horizon 7.8 and newer disable “Log On as Current User” by default. To enable this client feature:

  1. In Horizon Console 7.10 or newer, on the left, expand Settings, and click Servers.

    • Or in Horizon Administrator, on the left, expand View Configuration and click Servers.
  2. On the right, switch to the Connection Servers tab.

  3. Highlight a Connection Server and click Edit.

  4. Switch to the Authentication tab.

  5. Scroll down. Check the box next to Accept logon as current user. Click OK.

Horizon 7.11 and newer can restrict connections to a minimum version of Horizon Client. 💡

  1. In Horizon Console 7.11 or newer, on the left, expand Settings, and click Global Settings.
  2. On the right, switch to the tab named Client Restriction Settings.
  3. Click Edit.
  4. For each client type, enter a minimum version number. Click OK when done.
  5. The client version is enforced when you try to launch an icon.

Global Policies

By default, Multimedia Redirection is disabled. You can enable it in Global Policies.

  1. In Horizon Console 7.8 or newer, go to Settings > Global Policies. Or in Horizon Administrator, go to Policies > Global Policies.

  2. On the right, click Edit Policies.

  3. Set Multimedia redirection to Allow, and click OK. Notice that Multimedia redirection is not encrypted.

Backups

Connection Server LDAP Backup and Composer Database Backups can be configured in Horizon Administrator, or in Horizon Console.

  1. in Horizon Console 7.8 or newer, on the left, expand Settings and click Servers. Or in Horizon Administrator, on the left, expand View Configuration, and click Servers.

  2. On the right, switch to the Connection Servers tab.

  3. Select a Horizon Connection Server, and click Backup Now. Backups can be found in C:\ProgramData\VMware\VDM\backups.

  4. To change automatic backup settings, Edit the Horizon Connection Server, and switch to the Backup tab.

  5. you can schedule automatic backups. This also backs up the View Composer database but not the vCenter database. See VMware 1008046 Performing an end-to-end backup and restore for VMware View Manager.

Tips

VMware Blog Post Top 10 Tips for a Successful Horizon VDI

Related Pages

VMware Horizon 7.13.3 Connection Server

Last Modified: Mar 22, 2023 @ 5:43 am

239 Comments

Navigation

This post applies to all VMware Horizon 7 versions including 7.13.3 (ESB).

💡 = Recently Updated

Change Log

Upgrade

If you are performing a new install, skip to Install Horizon 7 Standard Connection Server.

Notes regarding upgrades:

  • Upgrade all Connection Servers during the same maintenance window.
    • Downgrades are not permitted.
      • You can snapshot your Connection Servers before beginning the upgrade. To revert, shut down all Connection Servers, then revert to snapshots.
    • For Cloud Pod Architecture, you don’t have to upgrade every pod at once. But upgrade all of them as soon as possible.
    • Horizon Agents cannot be upgraded until the Connection Servers are upgraded.
    • All Connection Servers in the pod must be online before starting the upgrade.
    • Upgrade Horizon Composer before upgrading the Connection Servers.
    • It’s an in-place upgrade. Just run the Connection Server installer and click Next a couple times.
      • If upgrading from version 7.7 or older to version 7.8 or newer, then be aware of authentication changes.
    • For Security Servers, in Horizon Administrator, go to paired Connection Server, More Commands > Prepare for Upgrade or Reinstallation.
  • Upgrade the Horizon Group Policy template (.admx) files.
  • Upgrade the Horizon Agents.
    • It’s an in-place upgrade.
    • There’s no hurry. Upgrade the Horizon Agents when time permits.
  • Upgrade the Horizon Clients.
    • Horizon Clients can be upgraded anytime before the rest of the infrastructure is upgraded.

Install Horizon 7 Standard Connection Server

The first Horizon Connection Server must be a Standard Server. Subsequent Horizon Connection Servers are Replicas. Once Horizon Connection Server is installed, there is no difference between them.

A production Horizon Connection Server should have 10 GB of RAM and 4 vCPU.

  • In Horizon 7.2 and newer, each Horizon Connection Server can handle 4,000 connections.
  • In Horizon 7.1 and newer, each Horizon Connection Server can handle 2,000 connections.

Horizon 7.13.3 is the last release of Horizon 7 and will be supported until May 2023. VMware recommends upgrading all Horizon 7 implementations to Horizon 8.

To install the first Horizon Connection Server:

  1. Ensure the Horizon Connection Server has 10 GB of RAM and 4 vCPU. Source = Hardware Requirements for View Connection Server at VMware Docs.
  2. Windows Server 2019 is supported with Horizon Connection Server 7.8 and newer.
  3. Windows Server 2016 is supported with Horizon Connection Server 7.1 and newer.
  4. Horizon Composer cannot be installed on the Horizon Connection Server, and vice versa.
  5. The older Horizon Administrator (/flexadmin) is a Flash-based console. After December 2020, Chrome will no longer support Flash.
    • Horizon Console (/newadmin) is HTML5 and does not need Flash.
  6. Download Horizon 7.13.3 View Connection Server.
  7. If Horizon Toolbox is installed, uninstall it.
  8. Run the downloaded VMware-Horizon-Connection-Server-x86_64-7.13.3.exe.
  9. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  10. If you are upgrading from version 7.7 or older to version 7.8 or newer, then acknowledge the authentication changes warning by clicking OK.
  11. In the License Agreement page, select I accept the terms, and click Next.
  12. In the Destination Folder page, click Next.
  13. In the Installation Options page, select Horizon 7 Standard Server, and click Next.
  14. In the Data Recovery page, enter a password, and click Next.
  15. In the Firewall Configuration page, click Next.
  16. In the Initial Horizon 7 Administrators page, enter an AD group containing your Horizon administrators, and click Next.
  17. In the User Experience Improvement Program page, uncheck the box, and click Next.
  18. In the Ready to Install the Program page, click Install.
  19. In the Installer Completed page, uncheck the box next to Show the readme file, and click Finish.
  20. If you upgraded to Horizon 7.8 or newer and want to re-enable Logon as current user:
    1. In Horizon Console 7.10 or newer, on the left, expand Settings and click Servers. Or in Horizon Administrator, on the left, go to View Configuration > Servers.

    2. On the right, switch to the tab named Connection Servers.
    3. Highlight the server you just upgraded and click Edit.

    4. Switch to the tab named Authentication.

    5. Scroll down, check the box next to Accept logon as current user and then click OK.

  21. If you upgraded to Horizon 7.8 or newer and want to re-enable sending the domain list to Horizon Client:
    1. In Horizon Console 7.10 or newer, on the left, expand Settings and click Global Settings. Or in Horizon Administrator, on the left, go to View Configuration > Global Settings.
    2. On the right, in the General section, click the Edit button.

    3. Near the bottom, check the box next to Send domain list. You might want to uncheck Hide domain list in client user interface. Then click OK.

Install Horizon 7 Replica Connection Server

Additional internal Horizon Connection Servers are installed as Replicas. After installation, there is no difference between a Replica server and a Standard server.

A production Horizon Connection Server should have 10 GB of RAM and 4 vCPU.

  • In Horizon 7.2 and newer, each Horizon Connection Server can handle 4,000 connections.
  • In Horizon 7.1 and newer, each Horizon Connection Server can handle 2,000 connections.

To install Horizon Connection Server Replica:

  1. Ensure the Horizon Connection Server has 10 GB of RAM and 4 vCPU.
  2. Windows Server 2019 is supported with Horizon Connection Server 7.8 and newer.
  3. Windows Server 2016 is supported with Horizon Connection Server 7.1 and newer.
  4. Download Horizon 7.13.3 View Connection Server.
  5. Run the downloaded VMware-Horizon-Connection-Server-x86_64-7.13.3.exe.
  6. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  7. In the License Agreement page, select I accept the terms, and click Next.
  8. In the Destination Folder page, click Next.
  9. In the Installation Options page, select Horizon 7 Replica Server, and click Next.
  10. In the Source Server page, enter the name of another Horizon Connection Server in the group. Then click Next.
  11. In the Firewall Configuration page, click Next.
  12. In the Ready to Install the Program page, click Install.
  13. In the Installer Completed page, click Finish.
  14. Load balance your multiple Horizon Connection Servers.

Horizon Connection Server Certificate

  1. Run certlm.msc (Windows 2012+). Or run mmc, add the Certificates snap-in, and point it to Computer > Local Machine.
  2. Request a new certificate with a common name that matches the FQDN of the Connection Server, or import a wildcard certificate.
  3. Note: the private key must be exportable. If using the Computer template, click Details, and then click Properties.
  4. On the Private Key tab, click Key options to expand it, and check the box next to Mark private key as exportable.
  5. In the list of certificates, look for the one that is self-signed. The Issuer will be the local computer name instead of a Certificate Authority. Right-click it, and click Properties.
  6. On the General tab, clear the Friendly name field, and click OK.
  7. Right-click your Certificate Authority-signed certificate, and try to export it.
  8. On the Export Private Key page, make sure Yes, export the private key is selectable. If the option to export the private key is grayed out, then this certificate will not work. Click Cancel.
  9. Right-click your Certificate Authority-signed certificate, and click Properties.
  10. On the General tab, in the Friendly name field, enter the text vdm, and click OK. Note: only one certificate can have vdm as the Friendly name.
  11. Then restart the VMware Horizon View Connection Server service. It will take several seconds before you can connect to Horizon View Administrator.

Horizon Portal – Client Installation Link

If you point your browser to the Horizon Connection Server (without /admin in the path), the Install VMware Horizon Client link redirects to the VMware.com site for downloading of Horizon Clients. You can change it so that the Horizon Clients can be downloaded directly from the Horizon Connection Server.

  1. On the Horizon Connection Server, go to C:\Program Files\VMware\VMware View\Server\broker\webapps.
  2. Create a new folder called downloads.
  3. Copy the downloaded Horizon Client 5.2 for Windows to the new C:\Program Files\VMware\VMware View\Server\broker\webapps\downloads folder.
  4. Run Notepad as administrator.
  5. Open the file C:\ProgramData\VMware\VDM\portal\portal-links-html-access.properties file with a text editor (as Administrator).
  6. Go back to the downloads folder, and copy the Horizon Client filename.
  7. In Notepad, modify link.win32 and link.win64 by specifying the relative path to the Horizon Client executable under /downloads. Note: In Horizon Client 4.3 and newer, there’s only one Horizon client for both 32-bit and 64-bit. The following example shows a link for the Horizon win64 client. 
    link.win64=/downloads/VMware-Horizon-Client-5.2.0-14570289.exe
  8. Then Save the file.
  9. Restart the VMware Horizon View Web Component service, or restart the entire Connection Server.
  10. It will take a few seconds for the ws_TomcatService process to start so be patient. If you get a 503 error, then the service is not done starting.
  11. Now when you click the link to download the client, it will grab the file directly from the Horizon Connection Server.
  12. Repeat these steps on each Connection Server.

Portal Branding

Chris Tucker at Horizon View 7.X – Branding the Logon page details how to brand the Horizon 7.1 and newer portal page.

LDAP Edits

Horizon Console Timeout

The HTML5 Horizon Console (https://MyConnectionServer/newadmin) has a default timeout of 10 minutes. Changing the Horizon Administrator timeout will not affect the Horizon Console timeout. You can use adsiedit.msc to increase the Horizon Console timeout.

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit, and click Connect to.
  3. Change the first selection to Select or type a Distinguished Name, and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server, and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Scroll down, click to highlight pae-APISessionTimeout, and click Edit.
  7. Enter a value in minutes. Click OK.

Mobile Client – Save Password

If desired, you can configure Horizon Connection Server to allow mobile clients (iOS, Android) to save user passwords.

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit, and click Connect to.
  3. Change the first selection to Select or type a Distinguished Name, and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server, and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Scroll down, click to highlight pae-ClientCredentialCacheTimeout, and click Edit.
  7. Enter a value in minutes. 0 = no saving of credentials. -1 = no timeout. Click OK.

Biometric Authentication – iOS Touch ID, iOS Face ID, Fingerprints, Windows Hello

Biometric authentication, including Touch ID, Face ID, Fingerprints, and Windows Hello, is disabled by default. To enable: (source = vDelboy – How to Enable Touch ID in VMware Horizon 6.2 and Configure Biometric Authentication at VMware Docs)

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit and click Connect to…
  3. Change the first selection to Select or type a Distinguished Name and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Find the attribute pae-ClientConfig and double-click it.
  7. Enter the line BioMetricsTimeout=-1, and click Add. Click OK. The change takes effect immediately.

Disallow Non-empty Pool Deletion

Configure View to Disallow the Deletion of a Desktop Pool That Contains Desktop Machines at VMware Docs.

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit and click Connect to…
  3. Change the first selection to Select or type a Distinguished Name and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Find the attribute pae-NameValuePair, and double-click it.
  7. Enter the line cs-disableNonEmptyPoolDelete=1, and click Add. Click OK. The change takes effect immediately.

Load Balancing

See Carl Stalhood’s Horizon Load Balancing using NetScaler 12.1.

Remote Desktop Licensing

If you plan to build RDS Hosts, then install Remote Desktop Licensing somewhere. You can install it on your Horizon Connection Servers by following the procedure at https://www.carlstalhood.com/delivery-controller-7-15-ltsr-and-licensing/#rdlicensing.

Antivirus

VMware Tech Paper Antivirus Considerations for VMware Horizon 7: exclusions for Horizon View, App Volumes, User Environment Manager, ThinApp

Help Desk Tool Timing Profiler

Horizon 7.2 and newer include a web-based Help Desk Tool. Run the following command to enable the timing profiler on each Connection Server instance to view logon segments.

vdmadmin -I -timingProfiler -enable

Logon Monitoring

The VMware Logon Monitor Fling is built into Horizon 7.1 and newer.

The logon logs are stored at C:\programdata\VMware\VMware Logon Monitor\Logs on each Horizon Agent. The Fling website has a PDF that explains how to also store them on a file share.

Inside each session log file are logon time statistics. 

VMware Horizon 7.13.3 Composer

Last Modified: Mar 22, 2023 @ 5:46 am

93 Comments

Navigation

This post applies to all VMware Horizon 7 versions including 7.13.3 (ESB).

Change Log

Planning

If you’re doing Instant Clones, then you don’t need Horizon Composer. Composer is only needed for the older method of creating Linked Clones. However, Instant Clones requires Horizon Enterprise Edition, so maybe Composer is your only option.

  • Instant Clones in Standard Edition – In Horizon 7.13, all editions of Horizon, including Standard Edition, include licensing for Instant Clones. Horizon 8 removes Composer, so start migrating to Instant Clones today.

vCenter Server planning:

  • A single vCenter Server can handle 10,000 VMs. However, this is a single point of failure. VMware recommends separate vCenter servers for each 2,000 or 4,000 VMs. More vCenter Servers means more concurrent vCenter operations, especially if your pools are configured for Refresh on Logoff.
    • Horizon 7.2 and newer supports 4,000 VMs per vCenter Server.
    • Horizon 7.1 and older supports 2,000 VMs per vCenter Server.
  • Each ESXi cluster is managed by one vCenter Server.
  • Don’t use existing vCenter servers. Build separate vCenter servers for the vSphere clusters that host Agent VMs. Horizon licenses include vCenter licenses, so there’s no excuse to not use separate vCenter servers.

Horizon View Composer server planning:

A remote SQL Server is needed for databases:

  • vCenter database
  • Horizon Composer database
  • Horizon Events database
  • Supported SQL versions are listed on the Solution/Database Interoperability tab at VMware Product Interoperability Matrices.

SQL Server Preparation

Only SQL Authentication is supported.

  1. Open the properties of the SQL Server.
  2. On the Security page, make sure SQL Server authentication is enabled.
  3. Create a new SQL database for View Composer.
  4. Call it VMwareHorizonComposer or similar. Then switch to the Options page.
  5. Select your desired Recovery model, and click OK.
  6. View Composer only supports SQL authentication on remote SQL servers. Expand Security, right-click Logins, and click New Login to create a new SQL login.
  7. Name the new account.
  8. Select SQL Server authentication.
  9. Enter a password for the new account.
  10. Uncheck the box next to Enforce password policy.
  11. Then switch to the User Mapping page.
  12. On the User Mapping page, in the upper half, check the Map box for VMwareHorizonComposer.
  13. On the bottom, check the box for the db_owner role, and click OK.

SQL Native Client

  1. Download SQL Native Client (sqlncli.msi).
  2. On the Horizon View Composer server, run sqlncli.msi.
  3. In the Welcome to the Installation Wizard for SQL Server 2012 Native Client page, click Next.
  4. In the License Agreement page, select I accept, and click Next.
  5. In the Feature Selection page, click Next.
  6. In the Ready to Install the Program page, click Install.
  7. In the Completing the SQL Server 2012 Native Client installation page, click Finish.

ODBC

  1. On the Horizon View Composer server, run ODBC Data Sources (64-bit) from the Start Menu.
  2. On the System DSN tab, click Add.
  3. Select SQL Server Native Client, and click Finish.
  4. Enter the name HorizonComposer for the DSN, and enter the SQL server name. Click Next.
  5. Change the selection to With SQL Server authentication, and enter the credentials of the new ViewComposer SQL account. Then click Next.
  6. Check the box next to Change the default database, and select the VMwareHorizonComposer database. Then click Next.
  7. Click Finish.
  8. Click OK twice.

Install/Upgrade Composer

  1. Upgrade can be performed in-place.
  2. Windows Server 2019 is supported with Horizon Composer 7.8 and newer.
  3. Don’t install on Horizon Connection Server: Horizon Composer cannot be installed on the Horizon Connection Server. Composer and Connection Server must be separate machines.
  4. Extra Memory for vCenter: If you install Horizon Composer on a Windows vCenter server, VMware recommends adding 8 GB of RAM to the server. See VMware 2105261 Intermittent provisioning issues and generic errors when Composer and vCenter Server are co-installed
    1. vCenter Service Account: if you install Horizon Composer on a Windows vCenter server, login as the same account that was used to install vCenter. See VMware 2017773 Installing or upgrading View Composer fails with error: The wizard was interrupted before VMware View Composer could be completely installed
  5. Internet access for CRL checking: If the Horizon Composer server does not have Internet access, see VMware 2081888 Installing Horizon View Composer fails with the error: Error 1920 Service VMware Horizon View Composer (svid) failed to start
  6. Certificate: If you install a certificate now, Composer installer will prompt you to select it during installation. Or, you can replace the certificate later.
  7. Download: Horizon 7.13.3 (ESB) Composer.
  8. Install: Run the downloaded VMware-viewcomposer-7.13.3.exe.
  9. In the Welcome to the Installation Wizard for VMware Horizon 7 Composer page, click Next.
  10. In the License Agreement page, select I accept the terms, and click Next.
  11. In the Destination Folder page, click Next.
  12. In the Database Information page, enter the name of the ODBC DSN.
  13. Enter the SQL account credentials (no Windows accounts), and click Next. For remote SQL databases, only SQL accounts will work. The SQL account must be db_owner of the database.
  14. The VMware Horizon 7 Composer Port Settings page appears. If you already installed a valid certificate on the Composer server, select Use an existing SSL certificate, and select the certificate. Click Next.
  15. In the Ready to Install the Program page, click Install.
  16. In the Installer Completed page, click Finish.
  17. Click Yes when asked to restart the computer.
  18. If you encounter installation issues, see VMware 2087379 VMware Horizon View Composer help center

After Upgrade, Accept Untrusted Certificate

If you upgraded Composer, then go to Horizon Console or Horizon Administrator and verify the certificate. Ideally, Composer should be using a Trusted Certificate. Or you might have to Accept an untrusted certificate.

In Horizon Console 7.10 or newer: (scroll down for Horizon Administrator instructions)

  1. On the left, expand Monitor and click Dashboard.
  2. On the right, in the top left box labelled System Health, click View.
  3. With Components selected on the left, on the right, switch to the tab named View Composer Servers.
  4. Click the link for Untrusted Certificate.
  5. Scroll down and Accept the certificate.

Or in Horizon Administrator:

  1. On the top left, click Dashboard.
  2. On the right, expand View Composer Servers and click the red Composer server.
  3. Next to Untrusted certificate, click Verify.
  4. Click the button labelled View Certificate.
  5. At the bottom, click the button labelled Accept.

Administrator Permissions

If Horizon View Composer is installed on a standalone server (not on vCenter), Horizon Connection Server will need a service account with administrator permissions on the Horizon View Composer server. Add your Horizon View Composer Service Account to the local Administrators group.

Composer Certificate

  1. Open the MMC Certificates snap-in (certlm.msc).
  2. Make sure your Composer certificate private key is exportable. Try exporting the certificate, and make sure Yes, export the private key is a selectable option.

  3. Stop the VMware Horizon 7 Composer service.
  4. In the certificates console, double-click your Composer certificate. On the Details tab, note the Thumbprint.
  5. Run Command Prompt as Administrator
  6. Change the directory to C:\Program Files (x86)\VMware\VMware View Composer.
  7. Run sviconfig -operation=replacecertificate -delete=false.
  8. Select the certificate that matches the thumbprint you noted earlier.
  9. Then restart the VMware Horizon 7 Composer service.

SQL Database Maintenance

SQL password: The password for the SQL account is stored in C:\Program Files (x86)\VMware\VMware View Composer\SviWebService.exe.config. To change the password, run SviConfig ‑operation=SaveConfiguration as detailed at VMware 1022526 The View Composer service fails to start after the Composer DSN password is changed.

Database Move: To move the database to a new SQL server, you must uninstall Composer and reinstall it. See VMware 2081899 VMware Horizon View Composer fails to work properly after migrating the Composer database to a new SQL server

Related Pages

Citrix SCOM Management Pack – NetScaler (1.17.93)

Last Modified: Nov 6, 2020 @ 7:12 am

40 Comments

Navigation

💡 = Recently Updated

Requirements

  • NetScaler Platinum Edition
  • NetScaler 9.3 or newer
  • System Center Operations Manager 2012 or newer

Citrix Blog Post SCOM NetScaler Management Pack Resource Consumption & Performance Overview:

  • For 14,000 NetScaler objects, extra 3 GB of RAM is needed on the SCOM monitoring agent. CPU is minimal.
  • For more than 14,000 NetScaler objects, the Agent started dropping data due to workflows.
  • Performance overview at Citrix Docs

NetScaler Pack

Full documentation at http://docs.citrix.com/en-us/scom-management-packs/netscaler/1-17.html.

Install Citrix NetScaler Pack

  1. On the System Center Operations Manager server, go to the downloaded Citrix SCOM Management Pack for NetScaler, and run Citrix_SCOM_Management_Pack_for_NetScaler.1.17.93exe.
  2. In the Welcome to the setup wizard for Citrix SCOM Management Pack for NetScaler page, click Next.
  3. In the View Relevant Product Configuration page, click Next.
  4. If you see a page indicating that an older version is already installed, click Next.
  5. In the License Agreement page, check the box next to I accept the terms, and click Next.
  6. In the Choose Destination Location page, click Next.
  7. In the Configure Post-Install Actions page, check the box next to Automatically import the Management Pack, and click Install.
  8. In the Completed the setup page, click Next.
  9. In the All post-install actions were successfully completed page, click Finish.

MP Agent Installation Account

Configure the MP Agent Installation Account as detailed for the XAXD Pack.

NetScaler Monitoring Account

On the NetScaler appliances, run the following commands to add a local account, and bind it to a restrictive cmdPolicy. Replace the password with a secure password. If you leave the password off the command, then NetScaler will prompt you.

add system cmdPolicy polNetScalerMonitoring ALLOW (^show\s+system\s+\S+)|(^show\s+system\s+\S+\s+.*)|(^show\s+configstatus)|(^show\s+configstatus\s+.*)|(^shell\s+nsconmsg\s+-K\s+\S+\s+.*)

add system user usrNetScalerMonitoring MyPassword

bind system user usrNetScalerMonitoring read-only 1

bind system user usrNetScalerMonitoring polNetScalerMonitoring 1

show system user usrNetScalerMonitoring

SCOM Device Discovery

  1. System Center Operations Manager uses SNMP to communicate with NetScaler. If Windows Firewall is enabled on the SCOM server, enable some Inbound and Outbound rules.
  2. Inbound Rule: Operations Manager Ping Response.
  3. Inbound Rule: Operations Manager SNMP Response.
  4. Inbound Rule: Operations Manager SNMP Trap Listener.
  5. Outbound Rule: Operations Manager Ping Request.
  6. Outbound Rule: Operations Manager SNMP Request.
  7. Make sure the NetScaler is configured with an SNMP community string with ALL permission at System > SNMP > Community.
  8. If you have SNMP Managers configured, then make sure SCOM is in the list.
  9. In SCOM Console, go to the Administration workspace, right-click, and click Discovery Wizard.
  10. Select Network devices, and click Next.
  11. In the General Properties page, give the discovery rule a name. Select a SCOM server, and resource pool to run the discovery rule. Then click Next.
  12. In the Discovery Method page, select Explicit discovery, and click Next.
  13. In the Default Accounts page, if you are using SNMPv2 (instead of SNMPv3) to connect to NetScaler, then you can add the community string now. Click Create Account.
  14. In the Introduction page, click Next.
  15. In the General Properties page, give the community string a display name, and click Next.
  16. In the Credentials page, enter the community string, and click Create.
  17. Then click Next.
  18. In the Devices page, click Add.
  19. Enter the hostname of the device.
  20. Select the SNMP version.
  21. If SNMPv2, select the community string. If SNMPv3, you can add the user account now.
  22. Click OK when done.
  23. Add more devices. Then click Next.
  24. In the Schedule Discovery page, select how often you want this rule to run, and click Next.
  25. In the Summary page, click Create.
  26. Click Yes to distribute the accounts.
  27. In the Completion page, click Close. The rule will run now.
  28. You  can also go to Administration > Network Management > Discovery Rules, and run the rule manually.
  29. And Network Devices Pending Management will show you discovery issues.
  30. The NetScaler appliance needs to be discovered and listed in the Network Devices node.
  31. You can use a SNMP Tester tool on the SCOM server to verify SNMP communication with NetScaler.  💡
  32. Also see CTX219765 Monitoring NetScaler with SCOM Management Packs – Understanding Discovery.  💡

Install Citrix NetScaler Agent

The Citrix SCOM Agent for NetScaler must be installed on the same SCOM server that is running the device discovery rule.

  1. If upgrading, uninstall the older Agent for NetScaler.
  2. On the SCOM servers that are running the SNMP Discovery Rule, go to \\scom01\CitrixMPShare\NetScaler MP, and run MPNSAgent.exe.
  3. In the Welcome to the setup wizard for Citrix SCOM Management Pack Agent for NetScaler page, click Next.
  4. If you see a page indicating that an older version is already installed, click Next.
  5. In the License Agreement page, check the box next to I accept the terms, and click Next.
  6. In the Destination Folder page, click Next.
  7. In the  Destination Data Folder page, click Install.
  8. In the Completed the setup wizard page, click Finish.

NetScaler Monitoring RunAs Account

  1. In SCOM console, go to Administration workspace, right-click, and click Create Run As Account.
  2. In the Introduction page, click Next.
  3. In the General Properties page, change the account type to Basic Authentication.
  4. Give the account a display name and click Next.
  5. In the Credentials page, enter the credentials of the local monitoring account on the NetScalers, and click Next.
  6. In the Distribution Security page, best practice is to select More secure. But you’ll need to manually specify every agent that should receive these credentials. Click Create.
  7. In the Completion page, click Close.
  8. In the Administration workspace, go to Run As > Profiles.
  9. Double-click Citrix NetScaler Appliance Action Account.
  10. In the Introduction page, click Next.
  11. In the General Properties page, click Next.
  12. In the Run As Accounts page, click Add.
  13. Select the previously created NetScaler monitoring account.
  14. Change the selection to A selected class, group, or object. Then click Select > Object.
  15. Search for the NetScaler appliances these credentials apply to, click Add, and then click OK.
  16. Then click OK.
  17. Click Save.
  18. In the Completion page, if the Run As account is configured for Secure Distribution then click the link to specify Agents to receive the credentials.

Use Management Pack

In the Monitoring workspace, under Citrix NetScaler, your appliance should eventually show up. These views should give you an inventory of the NetScaler configuration, current health status, etc.

Related Pages

Citrix SCOM Management Packs – XenApp/XenDesktop (2017_10_27)

Last Modified: Nov 7, 2020 @ 6:34 am

69 Comments

Navigation

Change Log

Requirements

  • XenApp/XenDesktop Platinum Edition with current Subscription Advantage
  • XenApp/XenDesktop version 6.0 or newer
  • Citrix Licensing Server 11.13.1 or newer
  • System Center Operations Manager 2012 or newer

Citrix provided an overview of the SCOM Management Packs during a breakout session at Synergy 2016.

Licensing Pack

See Citrix Docs for Full Documentation of the Licensing Pack.

  1. Download the Citrix SCOM Management Pack Bundle and extract it.
  2. Extract the Citrix_SCOM_Management_Pack_for_LicenseServer.zip file.
  3. In SCOM Console, go to Administration, right-click Management Packs, and click Import Management Packs.
  4. Click Add, and click add from disk.
  5. Browse to the extracted License Server Management Pack, and select all three files. Click Open.
  6. Click Install.
  7. Click Close when done.
  8. Go to Administration > Device Management > Agent Managed.
  9. Double-click your license server.
  10. On the Security tab, check the box next to Allow this agent to act as a proxy, and click OK.
  11. If you go to Monitoring > Citrix License Server > License Server State, you’ll eventually see your license server.

XenApp/XenDesktop Pack

See Citrix Docs for Full Documentation of the XenApp/XenDesktop Pack.

Links:

To upgrade:

  • Install the updated SCOM Pack on the SCOM Server.
  • Run the Install MPXAXD Agent task, and override the UpgradeAgent parameter to true.
  • In-place upgrade the Machine Agent.
  • Import updated SLA Dashboard Management Pack.

Install/Upgrade Citrix XenAppXenDesktop Pack

To install or upgrade:

  1. To upgrade, simply run the installer again as detailed in the next step.
  2. Download the Citrix SCOM Management Pack Bundle.
  3. On the System Center Operations Manager server, run Citrix_SCOM_Management_Pack_for_XenAppXenDesktop.exe.
  4. In the Welcome to the setup wizard for Citrix SCOM Management Pack for XenApp and XenDesktop page, click Next.
  5. In the View Relevant Product Configuration page, click Next.
  6. If upgrading, the installer will detect the older version. Click Next to begin the upgrade. For new installs, skip to the next step.
  7. In the License Agreement page, check the box next to I accept the terms, and click Next.
  8. In the Destination Folder page, click Next.
  9. In the Configure Post-Install Actions page, check the box next to Automatically import the Management Pack. Feel free to uncheck Enable the product to send anonymous usage statistics to Citrix. Click Install.
  10. In the Completed the setup for Citrix SCOM Management Pack for XenApp and XenDesktop page, click Next.
  11. In the All post-install actions were successfully executed page, click Finish.

Citrix XAXD Pack Action Account

  1. Create a new account. This account must be an administrator on all monitored Citrix machines: Controllers, VDAs, etc.
  2. In Citrix Studio, add the action account with Read-only permissions.



  3. In SCOM console, go to Administration workspace, right-click, and click Create Run As Account.
  4. In the Introduction page, click Next.
  5. In the General Properties page, change the account type to Windows.
  6. Give the account a display name and click Next.
  7. In the Credentials page, enter the previously created action account credentials and click Next.
  8. In the Distribution Security page, best practice is to select More secure. But you’ll need to manually specify every agent that should receive these credentials. Click Create.
  9. In the Completion page, click Close.
  10. In the Administration workspace, go to Run As > Profiles.
  11. Double-click Citrix XenApp/XenDesktop Monitoring Account.
  12. In the Introduction page, click Next.
  13. In the General Properties page, click Next.
  14. In the Run As Accounts page, click Add.
  15. Select the previously created action account, and click OK.
  16. Click Save.
  17. In the Completion page, if the Run As account is configured for Secure Distribution, then click the link to specify Agents to receive the credentials.

MP Agent Installation Account

Several of the Management Packs require an additional agent to be installed on top of the SCOM agent. Create an Active Directory account that will be used by the agent installer to connect to the file share on the System Center Operations Manager server. This configuration is used by several of Citrix’s Management Packs.

  1. In Active Directory, create a new regular account for Management Pack Agent installation.
  2. On the System Center Operations Manager server, open Computer Management.
  3. Edit the CitrixMPShareUsers local group.
  4. Add the MP Agent Installation Account. Also add the Citrix Admins group. Click OK.
  5. In SCOM Console, go to the Administration workspace, right-click, and click Create Run As Account.
  6. In the Introduction page, click Next.
  7. In the General Properties page, change the account type to Windows.
  8. Give the account a display name and click Next.
  9. In the Credentials page, enter the previously created Agent Installation account credentials, and click Next.
  10. In the Distribution Security page, best practice is to select More secure. But you’ll need to manually specify every agent that should receive these credentials. Click Create.
  11. In the Completion page, click Close.
  12. In the Administration workspace, go to Run As > Profiles.
  13. Double-click Citrix Management Pack Network Share Account.
  14. In the Introduction page, click Next.
  15. In the General Properties page, click Next.
  16. In the Run As Accounts page, click Add.
  17. Select the previously created Management Pack Agent installation account, and click OK.
  18. Click Save.

SCOM Proxy Agent

All Microsoft SCOM Agents running Citrix Agents must be marked as a Proxy Agent.

  1. In the SCOM Console, go to the Administration workspace, expand Device Management, and click Agent Managed.
  2. Double-click your SCOM Agent.
  3. On the Security tab, check the box next to Allow this agent to act as a proxy, and click OK.

Director URL

  1. On the SCOM server, run XenApp and XenDesktop MP Configuration.
  2. In Management Pack 3.12 and newer, the first time you launch the tool, you’ll be taken to the Configuration encryption tab. Click Set, and enter a permanent password. Note: the password will later be entered in clear text when running a SCOM Task to install or upgrade the agent.

  3. For environments with more than 100 Delivery Groups, 600 Server OS machines, and 1,500 applications, see Configuring SCOM Administrator at Citrix Docs to configure the SCOM Connector by specifying a SCOM Administrator on the SCOM Administrator tab.
  4. On the Director URL tab, click Add.
  5. Enter the XenDesktop Site name (farm name).
  6. Enter the Director URL for the farm, and click OK twice.

Push Citrix XAXD Agent

To push the XAXD Agent:

  1. In the SCOM Console, go to Monitoring workspace, expand Citrix Library, and click XenApp/XenDesktop Delivery Controller Computers.
  2. Select a Delivery Controller.
  3. On the bottom right, in the XAXD Delivery Controller Computer Role Tasks pane, click Check Installation Prerequisites.
  4. Click Run.
  5. Review the report, and then click Close.
  6. Now click the Install Citrix MPXAXD Agent task.
  7. If desired, you can override the Task Parameters. See the documentation for details.
  8. In 3.12 and newer, you must override the Encryption Password parameter, and specify the password you entered in the Configuration Tool.
  9. If upgrading, set UpgradeAgent to true. Then click Run.
  10. When done, review the task output, and then click Close.
  11. If you see an Error about the service logon account…

    1. Then go to the Delivery Controller, open Services, and reconfigure Citrix MPXAXD Agent service to run as a local administrator that has read-only permissions in Citrix Studio.
  12. The agent will eventually report as Healthy.
  13. You can verify configuration by running the Check Requirements and Configuration task. You might have to also run the Update Configuration task.

  14. If you scroll down, you’ll see the agent version.
  15. Citrix CTX224736 Citrix SCOM Management Pack for XenApp and XenDesktop 7.x – Disabling monitoring of VDA Services in large environments: In large environments, with 500+ Server OS machines, disable monitoring of VDA services on Server OS machines.
  16. Citrix CTX225735 Citrix SCOM MP Agents – Support Information Logging: The information in the SCOM MP Agent log files might be insufficient to troubleshoot certain issues. You can set additional product logging by modifying the log level registry key.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Comtrade\<SCOM MP Agent>
      • LogLevel (REG_SZ) = ERROR, WARN, INFO, or DEBUG
    • The log files are located at %ProgramData%\Citrix\SCOM MP Agent\logs
    • Logging configuration for some agents is located in the mp_config.ini file.
  17. Citrix CTX230082 Citrix SCOM Management Pack for XenApp and XenDesktop – Monitoring failure on connections live for more than 24 hours. If any Session A in the monitored environment last longer than 24 hours, any new sessions that start after the 24-hour retention period but before Session A ends will not be monitored properly.  💡
    • HKEY_LOCAL_MACHINE\SOFTWARE\ComTrade\XenDesktop MP Agent
      • ConnectionEventsMaxAgeInHours (DWORD) = number of hours you expect the longest connections in the monitored environment to last

Install Citrix Machine Proxy Agent

To monitor the performance of the VDAs, install the Citrix Machine Agent on any Windows Server 2012 or newer machine (Windows Server 2008 R2 is not supported). This Agent will use PSRemoting to connect to a Delivery Controller to enumerate the VDAs in the farm. The Agent will then use WinRM to pull performance data and session data from the VDAs.

  1. Enable PSRemoting on the Delivery Controllers.
  2. On the VDAs, run winrm quickconfig.
  3. The Machine Agent uses an account to connect to Delivery Controller and VDAs. You can use the same Action Account created earlier for the Management Pack. This account must be a read-only administrator in XenDesktop and it must have administrator permissions to all Controllers and VDAs.

  4. To verify WinRM, run Command Prompt as the action account.

  5. Run winrm identify -r:http://myvda.corp.local:5985 -auth:Kerberos. It should connect.
  6. Go to any Windows Server 2012 or newer machine that you want to run the VDA Machine Agent on. The Machine Agent uses WinRM to connect to the VDAs. One option is to install it on one of the Delivery Controllers.
  7. Connect to \\scom01\CitrixMPShare.
  8. Copy XenDesktop Machine MP to the local machine.
  9. Run Support.exe /checkprereq to verify prerequisites.

  10. Then run MPXAXDMachineAgent.exe.
  11. In the Welcome to the setup wizard for Citrix SCOM Management Pack Machine Agent for XenApp and XenDesktop page, click Next.
  12. The installer will detect the previously installed version. Click Next.
  13. In the End User License Agreement page, check the box next to I accept the terms, and click Next.
  14. In the Destination Folder page, click Next.
  15. In the Destination Data Folder page, click Next.
  16. In the Agent Service Account page, enter the service account (action account) credentials, and click Next.
  17. In the Delivery Controllers page, enter the hostnames of the Delivery Controllers you want this agent to monitor, and click Install.
  18. In the Completed the setup wizard for Citrix SCOM Management Pack Machine Agent for XenApp and XenDesktop page, click Finish.
  19. In SCOM console, go to Monitoring > Citrix Library > XenApp/XenDesktop Machine Monitoring.
  20. Select a Proxy computer.
  21. On the bottom right, run the Update Configuration task.
  22. Then run the Check Requirements task.

If the Machine Agent Proxy Computer is monitoring a large environment, then see the following. Environments with more than 100 Delivery Groups, 600 Server OS machines, and 1,500 applications are considered large.

New Reports

3.14 adds new Application – Usage report as described in Citrix Blog Post What’s New with the Citrix SCOM Management Packs – Nov 2017.

3.9 adds two new Reports as described in Citrix Blog Post Monitor Site Infrastructure & Delivery Group Availability with Citrix SCOM Management Pack for XenApp and XenDesktop:

  • Site – Infrastructure Availability report – availability of a Site infrastructure over time. Availability is determined by health (availability) of most important Citrix services on the Delivery controller computers, and availability of configured hosting connections.
  • Delivery Group – Availability – availability of desktops provided with the selected Delivery Group

3.8 adds two new Reports as described in Citrix Blog Post Analyzing Application/Desktop Usage with Citrix SCOM Management Pack for XenApp and XenDesktop.

  • Application – User Activity report – see for a selected application which users have been using it and when. For each specific usage you also get usage duration, IP address of the client computer, and machine name on which the application was running.

  • Delivery Group – Desktop User Activity report – shows which users have been using desktop and when for each selected Delivery Group. It is almost identical to the “Application – User Activity” report, except that the delivery group is selected instead of application and you get desktop usages in the specific delivery group instead of application usages.

Customize Management Pack

Citrix Blog Post Increasing the Application Discovery Limit in Citrix SCOM Management Pack: That limit is around 1,500 applications. Now, you can discover more than 1,500 applications using the following method. We have tested the discovery of up to 4,500 applications in our lab environment.

The existing management pack has five discoveries for applications. Each discovery can discover approximately 300 applications. We have created a custom management pack that includes an additional 10 discoveries to be able to discover a total of 4,500 applications. See the Blog Post for the download link.

SLA Dashboards

The XAXD Pack has an extra Management Pack that adds SLA Targets and dashboards.

  1. In SCOM Console, go to Administration workspace, right-click Management Packs and click Import Management Packs.
  2. Click Add and then click Add from disk.
  3. Connecting to the online catalog is not required.
  4. Browse to C:\Program Files\Citrix\XenDesktop MP (orC:\Program Files\Comtrade\XenDesktop MP) and select the Citrix.XenApp.And.XenDesktop.SLADashboards Management Pack. Click Open.
  5. Click Install.
  6. Click Close when done.
  7. Go to the Monitoring workspace, expand Citrix XenApp and XenDesktop, expand Dashboards, and click Delivery Group SLA Dashboard.
  8. On the right, click the gear icon, and click Configure.
  9. In the General Properties page, click Next.
  10. In the Scope page, click Add.
  11. Select the Desktop OS  Delivery Group Health and Server OS Delivery group Health SLAs and click Add. Then click OK.
  12. Click Finish.
  13. On the left, click the Site SLA Dashboard.
  14. On the right, look for the lower gear icon and click Configure. You might have to click the Site SLAs pane first.
  15. In the General Properties page, click Next.
  16. In the Scope page, click Add.
  17. Select Site Health and click Add. Then click OK.
  18. Click Finish.
  19. If you go to Authoring > Service Level Tracking, you can create more SLAs. See the documentation for details.
  20. The XAXD pack also adds a bunch of reports.

StoreFront Pack

Full documentation at http://docs.citrix.com/en-us/scom-management-packs/storefront/1-12.html.

Install Citrix StoreFront Pack

  1. Download the Citrix SCOM Management Pack Bundle.
  2. On the System Center Operations Manager server, run Citrix_SCOM_Management_Pack_for_StoreFront.exe.
  3. In the Welcome to the setup wizard for Citrix SCOM Management Pack for StoreFront page, click Next.
  4. In the View Relevant Product Configuration page, click Next.
  5. The installer could detect an older version. Click Next.
  6. In the License Agreement page, check the box next to I accept the terms and click Next.
  7. In the Destination Folder page, click Next.
  8. In the Configure Post-Install Actions page, check the box next to Automatically import the Management Pack, and click Install.
  9. In the Completed the setup for the Citrix SCOM Management Pack for StoreFront page, click Next.
  10. In the All post-install actions were successfully executed page, click Finish.

MP Agent Installation Account

Configure the MP Agent Installation Account as detailed earlier for the XAXD Pack.

SCOM Proxy Agent

All Microsoft SCOM Agents running Citrix Agents must be marked as a Proxy Agent.

  1. In the SCOM Console, go to the Administration workspace, expand Device Management and click Agent Managed.
  2. Double-click your SCOM Agent.
  3. On the Security tab, check the box next to Allow this agent to act as a proxy, and click OK.

Probe Account

The StoreFront Management Pack logs into StoreFront using an account. StoreFront must be configured with Explicit Authentication.

  1. On the SCOM server, run StoreFront MP Configuration.
  2. In Management Pack 1.11 and newer, the first time you launch the tool, you’ll be taken to the Encryption Password tab. Click Set, and enter a permanent password. Note: the password will later be entered in clear text run running a SCOM Task to install or upgrade the agent.

  3. On the StoreFront availability tab, click Add.
  4. Enter credentials that can log into StoreFront. Make sure the userPrincipalName suffix or domain name matches one of the allowed domains configured on StoreFront (Source = CTX222920 Error: “StoreFront Store Service Probe Failed” While Using Citrix SCOM Management Pack for StoreFront). Click OK twice.
  5. Click OK.

Push Citrix StoreFront Agent

  1. If the StoreFront Server is Windows 2008 R2, install Microsoft hotfix 2847346 Svchost.exe running NSI service leaks memory and non-paged pool memory leak Tag NSpc. Also see Citrix CTX225624 Citrix SCOM MP for Storefront causes high memory utilization on Windows Server 2008 R2.
  2. In the SCOM Console, go to Monitoring workspace, expand Citrix Library, and click StoreFront Computers.
  3. Select a StoreFront server.
  4. On the bottom right, in the StoreFron Server Computer Role Tasks pane, click Check Installation Prerequisites.
  5. Click Run.
  6. Review the report, and then click Close.
  7. Now click the Install Citrix MPSF Agent task.
  8. If desired, you can override the Task Parameters. See the documentation for details.
  9. In 1.11 and newer, you must override the Encryption Password parameter, and specify the password you entered in the Configuration Tool.
  10. If upgrading, override UpgradeAgent, and set it to true.
  11. Then click Run.
  12. When done, review the report, and then click Close.
  13. The agent will eventually report as Healthy.
  14. You can verify configuration and version by running the Check Requirements and Configuration task. You might have to also run the Update Configuration task.

Provisioning Services Pack

Full Documentation is at http://docs.citrix.com/en-us/scom-management-packs/provisioning-services/1-19.html.

Install Citrix Provisioning Services Pack

  1. Download the Citrix SCOM Management Pack Bundle.
  2. On the System Center Operations Manager server, run Citrix_SCOM_Management_Pack_for_ProvisioningServices.exe.
  3. In the Welcome to the InstallShield wizard for Citrix SCOM Management Pack for Provisioning Services page, click Next.
  4. In the View Relevant Product Configuration page, click Next.
  5. If an older version is detected, click Next to upgrade it.
  6. In the License Agreement page, check the box next to I accept the terms, and click Next.
  7. In the Destination Folder page, click Next.
  8. In the Configure Post-Install Actions page, check the box next to Automatically import the Management Pack, and click Install.
  9. In the Completed the setup for Citrix SCOM Management Pack for Provisioning Services page, click Next.
  10. In the All post-install actions were successfully executed page, click Finish.

MP Agent Installation Account

Configure the MP Agent Installation Account as detailed earlier for the XAXD Pack.

SCOM Proxy Agent

All Microsoft SCOM Agents running Citrix Agents must be marked as a Proxy Agent.

  1. In the SCOM Console, go to the Administration workspace, expand Device Management, and click Agent Managed.
  2. Double-click your SCOM Agent.
  3. On the Security tab, check the box next to Allow this agent to act as a proxy and click OK.
  4. If you have many Provisioning Services servers, you can run Provisioning Services MP Configuration from the Start Menu, and enable Proxy using this tool.
  5. In Management Pack 1.17 and newer, the first time you launch the tool, you’ll be taken to the Configuration encryption tab. Click Set, and enter a permanent password. Note: the password will later be entered in clear text run running a SCOM Task to install or upgrade the agent.

  6. Then you can configure the Proxy tab.

Farm Account

The Provisioning Services Management Pack needs to log into the Provisioning Services farm.

  1. Create a service account and make it a full Provisioning Services farm administrator.
  2. On the SCOM server, run Provisioning Services MP Configuration.
  3. In Management Pack 1.17 and newer, the first time you launch the tool, you’ll be taken to the Configuration encryption tab. Click Set, and enter a permanent password. Note: the password will later be entered in clear text run running a SCOM Task to install or upgrade the agent.

  4. On the Provisioning Services tab, click Add.
  5. Enter a farm name. You’ll need this farm name later.
  6. Enter credentials for a full farm administrator, and click OK.
  7. Click OK.

Push Citrix Provisioning Services Agent

  1. In the SCOM Console, go to Monitoring workspace, expand Citrix Library, and click Provisioning Services Computers.
  2. Select a Provisioning Services server.
  3. On the bottom right, in the Tasks pane, click Check Installation Prerequisites.
  4. Click Run.
  5. Review the report, and click Close.
  6. Now click the Install Citrix MPPVS Agent task.
  7. If desired, you can override the Task Parameters. For example, UpgradeAgent can be overridden to true. See the documentation for details.
  8. In 1.18 and newer, you must override the Encryption Password parameter, and specify the password you entered in the Configuration Tool.
  9. Then click Run.
  10. When done, review the report, and click Close.
  11. Run the Set Farm Name on Citrix MPPVS Agent task.
  12. Override the Task Parameter.
  13. Specify the farm name. This should match the farm account created earlier. Then click Override.
  14. Click Run.
  15. Review the task output, and click Close.
  16. The agent will eventually report as Healthy.
  17. You can verify configuration by running the Check Requirements and Configuration task. You might have to also run the Update Configuration task.

  18. From John Haggerty in the comments: If you see: “Connection to PVS Soap Server Failed”, and if C:\ProgramData\Citrix\Provisioning Services MP Agent\mppvs_agt.log says “Security Support Provider Interface (SSPI) authentication failed”, then configure Kerberos Authentication for Citrix MPPVS Agent service. To enable Kerberos authentication, perform the following steps:
    1. Set “Log On” account for “Citrix MPVPS Agent” service to the account you are using for MPPVS.
    2. In command prompt, go to “%Program Files%\Citrix\Provisioning Services MP Agent” and execute PVSMonitorSvc.exe /setconnection runninguser
    3. Restart “Citrix MPVPS Agent” service and after a minute run check requirements tool to check if agent is ok now.
    4. NOTE: Issue will be resolved in next discovery cycle (by default 5 minutes).

Related Pages

NetScaler Gateway 11 – SSL VPN

Last Modified: Nov 7, 2020 @ 6:35 am

117 Comments

Navigation

💡 = Recently Updated

Overview

NetScaler Gateway supports five different connection methods:

  • ICA Proxy to XenApp/XenDesktop – client is built into Citrix Receiver
  • SSL VPN – requires NetScaler Gateway plug-in
  • Clientless – browser only, no VPN client, uses rewrite
  • Secure Browse – from MDX-wrapped mobile applications (XenMobile), uses rewrite
  • RDP Proxy – only RDP client is needed

If Endpoint Analysis is configured, then an Endpoint Analysis plug-in is downloaded to the Windows or Mac client.

Users use SSL to connect to NetScaler Gateway Virtual Servers.

  • NetScaler Gateway prompts the user for authentication.
  • Once the user is authenticated, NetScaler Gateway uses Session Policies to determine what happens next.

You can configure NetScaler Gateway Session Policies to only use one of the connection methods. Or NetScaler Gateway can be configured to let users choose between ICA Proxy, Clientless, and SSL VPN connection methods. Here’s a sample Client Choices screen using the X1 theme:

Enable SSL VPN in a Session Policy as detailed later. Then configure additional NetScaler Gateway objects including the following:

  • DNS Servers and Suffix – enable DNS resolution across the VPN tunnel
  • NetScaler Gateway Universal Licenses – all VPN users must be licensed.
  • Intranet IP addresses – give IP addresses to VPN clients. If no client IP, then VPN clients use NetScaler SNIP to communicate with internal resources. Requires routing changes on internal network.
  • Intranet Applications – if split tunnel is enabled, configure this object to dictate what traffic goes across the tunnel and which traffic stays local.
  • Authorization Policies – if default authorization is DENY, use Authorization Policies to dictate what resources can be accessed across the NetScaler Gateway connection. These Authorization Policies apply to all NetScaler Gateway connections, not just VPN.
  • Bookmarks – displayed on the built-in NetScaler Gateway portal page. Users click bookmarks to access resources across the VPN tunnel or clientless access (rewrite).
  • Endpoint Analysis Scans – block endpoints that fail security requirements. Configured in Session Policies or Preauthentication Policies.
  • Traffic Policies – Single Sign-on to internal web applications
  • AAA Groups – bind Session Policies, Authorization Policies, Intranet Applications, Intranet IPs, Bookmarks, and Traffic Policies to one or more Active Directory groups. Allows different Active Directory groups to have different NetScaler Gateway configurations.

Prerequisites

Except for ICA Proxy, all NetScaler Gateway connection methods require a NetScaler Gateway Universal License for each concurrent session. Go to System > Licenses and make sure NetScaler Gateway User licenses are installed.

Also make sure the maximum AAA users equals the number of licenses. Go to NetScaler Gateway > Global Settings > Change authentication AAA settings.

DNS usually needs to function across the VPN tunnel. Go to Traffic Management > DNS > Name Servers to add DNS servers.

Create Session Profile

You can create multiple Session Policy/Profiles, each with different settings. Then you can bind these Session Policies to different AAA groups or different NetScaler Gateway Virtual Servers. You can also bind Endpoint Analysis expressions to a Session Policy so that the Session Policy only applies to machines that pass the Endpoint Analysis scan.

If multiple Session Policies apply to a particular connection, then the settings in the policies are merged. For conflicting settings, the Session Policy with the highest priority (lowest priority number) wins. Session Policies bound to AAA groups only override Session Policies bound to NetScaler Gateway Virtual Servers if the AAA group bind point has a lower priority number. In other words, priority numbers are evaluated globally no matter where the Session Policy is bound. You can run the command nsconmsg –d current –g pol_hits to see which Session Policies are applying to a particular connection.

Do the following to enable SSL VPN. First create the Session Profile. Then create a Session Policy.

  1. On the left, expand NetScaler Gateway, expand Policies, and click Session.
  2. On the right, switch to the Session Profiles tab and click Add.
  3. Name the profile VPN or similar.
  4. In Session Profiles, every line has an Override Global checkbox to the right of it. If you check this box next to a particular field, then the field in this session profile will override settings configured globally or in a lower priority session policy.
  5. Switch to the Network Configuration tab and check the box next to Advanced Settings.
  6. You will find a setting that lets you select a DNS Virtual Server. Or if you don’t select anything then the tunnel will use the DNS servers configured under Traffic Management > DNS > Name Servers.
  7. Configure the behavior when there are more VPN clients than available IPs in the address pool. This only applies if you are configuring Intranet IPs.
  8. There are also a couple timeouts lower on the page.
  9. Switch to the Client Experience tab. This tab contains most of the NetScaler Gateway VPN settings.
  10. Override Plug-in Type and set it to Windows/Mac OS X.
  11. Whenever NetScaler firmware is upgraded, all users will be prompted to upgrade their VPN clients. You can use the Upgrade drop-downs to disable the automatic upgrade.
  12. By default, if Receiver and NetScaler Gateway Plug-in are installed on the same machine, then the icons are merged. To see the NetScaler Gateway Plug-in Settings, you right-click Receiver, open Advanced Preferences and then click NetScaler Gateway Settings.

  13. You can configure the Session Policy/Profile to prevent NetScaler Gateway Plug-in from merging with Receiver. On the Client Experience tab, scroll down and check the box next to Advanced Settings.
  14. Check the box next to Show VPN Plugin-in icon with Receiver. This causes the two icons to be displayed separately thus making it easier to access the NetScaler Gateway Plug-in settings.

  15. On the Client Experience tab, override Split Tunnel and make your choice. Setting it to Off will force all traffic to use the tunnel. Setting it to On will require you to create Intranet Applications so the NetScaler Gateway Plug-in will know which traffic goes through the tunnel and which traffic goes directly out the client NIC (e.g. to the Internet).
  16. On the Client Experience tab, there are timers that can be configured. Global Settings contains default timers so you might want to override the defaults and increase the timeouts. See Configuring Time-Out Settings at Citrix Docs for details.
    1. Client Idle Time-out is a NetScaler Gateway Plug-in timer that disconnects the session if there is no user activity (mouse, keyboard) on the client machine.
    2. Session Time-out disconnects the session if there is no network activity for this duration.
    3. In addition to these two timers on the Client Experience tab, on the Network Configuration tab, under Advanced Settings, there’s a Forced Timeout setting.
  17. By default, once the VPN tunnel is established, a 3-page interface appears containing bookmarks, file shares, and StoreFront. An example of the three-page interface in the X1 theme is shown below.
  18. On the Client Experience tab, the Home Page field lets you override the 3-page interface and instead display a different webpage (e.g. Intranet or StoreFront). This homepage is displayed after the VPN tunnel is established (or immediately if connecting using Clientless Access).
  19. On the Client Experience tab, there are more settings that control the behavior of the NetScaler Gateway plug-in. Hover your mouse over the question marks to see what they do.
  20. Additional VPN settings can be found by clicking Advanced Settings near the bottom of the Client Experience tab.
  21. Under Client Experience > Advanced Settings, on the General tab, there are settings to run a login script at login, enable/disable Split DNS, and enable Local LAN Access. Use the question marks to see what they do. Reliable DNS occurs when Split DNS is set to Remote.
  22. Under Client Experience > Advanced Settings, on the General tab, is a checkbox for Client Choices. This lets the user decide if they want VPN, Clientless, or ICA Proxy (StoreFront). Without Client Choices, the VPN will launch automatically
  23. On the main Client Experience tab, if you enabled Client Choices, you can set Clientless Access to Allow to add Clientless to the list of available connection methods.
  24. An example of Client Choices is shown below:
  25. The Client Experience > Advanced Settings section has additional tabs for controlling the NetScaler Gateway Plug-in. A commonly configured tab is Proxy so you can enable a proxy server for VPN users.
  26. Back in the main Session Profile, switch to the Security tab.
  27. Set the default authorization to Allow or Deny. If Deny (recommended), you will need to create authorization policies to allow traffic across the tunnel. You can later create different authorization policies for different groups of users.
  28. On the Published Applications tab, set ICA Proxy to Off. This ensures VPN is used instead of ICA Proxy.
  29. Configure the Web Interface Address to embed StoreFront into the 3-pane default portal page. Note: additional iFrame configuration is required on the StoreFront side as detailed below.
  30. From Michael Krasnove: if you configured the Session Policy to direct users to StoreFront, then placing the following code in c:\inetpub\wwwroot\Citrix\StoreWeb\custom\script.js will cause StoreFront to end the VPN tunnel when the user logs off of StoreFront. 
    var LOGOFF_REDIRECT_URL = 'https://YourGatewayFQDN.com/cgi/logout';
 
// Prevent the default "logoff" screen from being displayed
CTXS.Controllers.LogoffController.prototype._handleLogoffResult = $.noop;
 
CTXS.Extensions.afterWebLogoffComplete = function () {
 window.location.href = LOGOFF_REDIRECT_URL;
};
  31. Click Create when you’re done creating the Session Profile.

Create Session Policy

  1. In the right pane, switch to the Session Policies tab and click Add.
  2. Give the policy a descriptive name.
  3. Change the Action to the VPN Profile you just created.
  4. Add a policy expression. You can enter ns_true, which applies to all connections.
  5. Or you can add Endpoint Analysis scans. If the Endpoint Analysis scan succeeds, then the session policy is applied. If the Endpoint Analysis scan fails, then this session policy is skipped and the next one is evaluated. This is how you can allow VPN if EPA scan succeeds but all failed EPA scans will get a different session policy that only has ICA Proxy enabled.
  6. To add an Endpoint Analysis scan, use one of the Editor links on the right.
  7. Configure OPSWAT scans in the OPSWAT EPA Editor.
  8. Configure Client Security Expressions in the Expression Editor.
  9. You can combine multiple Endpoint Analysis scan expressions using Booleans (&&, ||, !). Click Create when done.

Bind Session Policy

Most of the NetScaler Gateway objects can be bound to NetScaler Gateway Virtual Server, AAA Group, or both. This section details Session Policies, but the other NetScaler Gateway objects (e.g. Authorization Policies) can be bound using similar instructions.

  1. Bind the new session policy to a NetScaler Gateway Virtual Server or a AAA group. If you bind it only to a AAA group, then only members of that Active Directory group will evaluate the expression.
  2. To bind to a NetScaler Gateway Virtual Server, edit a NetScaler Gateway Virtual Server (or create a new one), scroll down to the Policies section and click the Plus icon.
  3. In the Choose Type page, select Session, Request and click Continue.
  4. Select one or more session policies. This is where you specify a priority.
  5. To bind to a AAA Group, go to NetScaler Gateway > User Administration > AAA Groups.
  6. Add a group with the same name (case sensitive) as the Active Directory group name. This assumes your LDAP policies/server are configured for group extraction.
  7. Edit the AAA Group.
  8. On the right, in the Advanced Settings column, add the Policies section.
  9. Click the plus icon to bind one or more Session Policies.
  10. If you want these Session Policies to override the Session Policies bound to the NetScaler Gateway Virtual Server then make sure the Session Policies bound to the AAA Group have lower priority numbers.

NetScaler Gateway Plug-in Installation

Here is what the user sees when launching the VPN session for the first time.


And then the 3-pane interface is displayed.

Only administrators can install the NetScaler Gateway Plug-in. You can download the Gateway plug-in from the NetScaler at /var/netscaler/gui/vpns/scripts/vista and push it to corporate-managed machines. Or you can download VPN clients from Citrix.com. The VPN client version must match the NetScaler firmware version.

Authorization Policies

If your Session Profile has Security tab > Default Authorization set to Deny (recommended), then create Authorization Policies to allow access across the tunnel.

  1. On the left, under NetScaler Gateway, expand Policies and click Authorization.
  2. On the right, click Add.
  3. Name the Authorization Policy.
  4. Select Allow or Deny.
  5. NetScaler Gateway requires you to Switch to Classic Syntax. The other syntax option is for AAA.
  6. Enter an expression. Use the Expression Editor link to build an expression. You can specify destination IP subnets, destination port numbers, etc.
  7. Click Create when done.
  8. Authorization Policies are usually bound to AAA groups. This allows different groups to have different access across the tunnel.
  9. On the right, in the Advanced Settings column, add the Authorization Policies section.
  10. Then click where it says No Authorization Policy to bind policies.

Intranet Applications

If you enabled Split Tunnel, then you’ll need to create Intranet Applications to specify which traffic goes through the tunnel.

  1. On the left, under NetScaler Gateway, expand Resources and click Intranet Applications.
  2. On the right, click Add.
  3. Enter a name for the Internal subnet.
  4. Change the Interception Mode to TRANSPARENT.
  5. Enter an IP subnet. Only packets destined for this network go across the tunnel.
  6. Then click Create.
  7. Create additional Intranet applications for each internal subnet.
  8. Intranet Applications are usually bound to the Gateway Virtual Server but you can also bind them to AAA Groups.
  9. On the right, in the Advanced Settings column, add the Intranet Applications section.
  10. On the left, click No Intranet Application to bind Intranet Applications.

DNS Suffix

Specify a DNS Suffix for Split DNS to function with single label DNS names.

  1. On the left, under NetScaler Gateway, expand Resources and click DNS Suffix.
  2. On the right, click Add.
  3. Enter the DNS Suffix and click Create. You can add multiple suffixes.

Bookmarks

Bookmarks are the links that are displayed in the 3-pane interface. They can point to file shares or websites.

  1. Under NetScaler Gateway, expand Resources, and click Bookmarks.
  2. On the right, click Add.
  3. Give the bookmark a name and display text.
  4. Enter a website or file share. For file shares you can use %username%.
  5. The other fields are for Single Sign-on through Unified Gateway. Click Create.
  6. Bookmarks (aka Published Applications > Url) are usually bound to AAA groups so different groups can have different bookmarks. But it’s also possible to bind Bookmarks to NetScaler Gateway Virtual Servers.
  7. If NetScaler Gateway Virtual Server, add the Published Applications section to bind Bookmarks.
  8. For AAA Group, it’s the Bookmarks section.
  9. On the left, find the Published Applications section and click No Url to bind Bookmarks.

VPN Client IP Pools (Intranet IPs)

By default, NetScaler Gateway VPN clients use NetScaler SNIP as their source IP when communicating with internal resources. To support IP Phones or endpoint management, you must instead assign IP addresses to VPN clients.

Any IP pool you add to NetScaler must be reachable from the internal network. Configure a static route on the upstream router. The reply traffic should be routed through a NetScaler SNIP. Or the NetScaler can participate in OSPF.

When a client is assigned a client IP, this IP address persists across multiple sessions until the appliance reboots or until the appliance runs out of IPs in the pool.

  1. Edit a NetScaler Gateway Virtual Server or a AAA group.
  2. On the right, in the Advanced Settings section, click the plus icon next to Intranet IP Addresses.
  3. On the left, click where it says No Intranet IP.
  4. Enter a subnet and netmask. Click Bind.
  5. To see the Client IP address, on the client side, right-click the NetScaler Gateway Plug-in and click Configure NetScaler Gateway.
  6. Switch to the Profile tab to see the Client IP address.
  7. To see the client IP on the NetScaler, go to NetScaler Gateway and on the right is Active user sessions.
  8. Select one of the views and click Continue.
  9. The right column contains the Intranet IP.

StoreFront in Gateway Portal

  1. If you want to enable StoreFront to integrate with NetScaler Gateway’s default portal, edit the file C:\Inetpub\wwwroot\Citrix\StoreWeb\web.config.
  2. On the bottom, there are three sections containing frame options. Change all three of them from deny to allow.
  3. Also change frame-ancestors from none to self.
  4. In NetScaler, go to NetScaler Gateway > Global Settings and click Configure Domains for Clientless Access.
  5. Change the selection to Allow Domains, enter your StoreFront FQDN and click the plus icon.
  6. Click OK.
  7. In a Session Policy/Profile, on the Client Experience tab, make sure Single Sign-on to Web Applications is enabled.
  8. On the Published Applications tab, configure the Web Interface Address to point to the StoreFront Receiver for Web page.
  9. Configure the Single Sign-on domain to match what’s configured in StoreFront.
  10. The Applications page of the 3-page portal should automatically show the StoreFront published icons.

Quarantine Group

NetScaler Gateway can be configured so that if Endpoint Analysis scans fail, then the user is placed into a Quarantine Group. You can bind session policies, authorization policies, etc. to this quarantine group. Policies bound to other AAA groups are ignored.

  1. Go to NetScaler Gateway > User Administration > AAA Groups.
  2. Add a new local group for your Quarantined Users. This group is local and does not need to exist in Active Directory.
  3. Create a new Session Profile.
  4. On the Security tab, check the box next to Advanced Settings.
  5. Check the box to the right of Client Security Check String.
  6. Use the Editor links to add an Endpoint Analysis expression.
  7. Just below the Client Security Check String, select the previously created Quarantine Group.
  8. Click Create when done.
  9. Create a Session Policy and select the Session Profile you just created.
  10. Enter ns_true as the expression. Then click Create.
  11. Edit your Gateway Virtual Server and bind the new session policy.
  12. Bind session policies, authorization policies, etc. to your quarantine group. These policies typically limit access to the internal network so users can remediate. Or it might simply display a webpage telling users how to become compliant.
  13. To troubleshoot Quarantine policies, use the command nsconmsg –d current –g pol_hits.
  14. Another option is to use the session policy bound to the Quarantine Group for SmartAccess configuration.
  15. Gateway Insight (Insight Center 11.0 build 65 and newer) shows users that failed EPA scans and their quarantine status.

Related Pages

AppDisks

Last Modified: Nov 7, 2020 @ 6:34 am

82 Comments

Navigation

Planning

AppDisks are available in all editions of XenApp/XenDesktop 7.8 and newer. AppDNA is only available in Platinum Edition.

AppDisks can be created on vSphere (5.1 and newer) and XenServer only. No support for Hyper-V.

Delivery Groups used with AppDisks can contain machines from Pooled Random Machine Catalogs containing Server OS or Desktop OS machines. You cannot use AppDisks with machines from other catalog types, such as pooled static or dedicated (assigned).

In Provisioning Services environments, AppDisks are stored on hypervisor storage, not Provisioning Services storage. Also, additional data might be written to the write cache.

AppDisk must be on the same hosting resource as the linked clones it is attached to. If you have multiple hosting resources, then you’ll need to import the AppDisk to each hosting resource containing linked clones that you want to attach the AppDisk to.

According to the AppDisk FAQ, Citrix has tested up to 16 AppDisks attached to a single virtual machine. To minimize the number of AppDisks, you should combine multiple applications into a single AppDisk.

AppDisks are stored on a datastore with a GUID in the folder name, thus it’s difficult to know what’s in the .vmdk file. Use PowerShell commands (Get-AppLibAppDisk) to determine the AppDisk-to-.vmdk mapping. If you intend to backup and recover these files, periodically run the PowerShell commands and export to a file so you can know which disk is which. Or, when you import the AppDisk, Studio will tell you which applications are installed in the AppDisk and you can then rename the imported AppDisk.

Links:

vCenter Preparation

Citrix has instructions for creating a XenDesktop role in vCenter. AppDisks requires an additional permission: Virtual Machine > Configuration > Modify device Settings.

For AppDisks, the read only role must be applied to the vCenter level. See Mark New at discussions.citrix.com for details.  ?

AppDNA Preparation

  1. If you intend to use AppDNA to analyze your AppDisks, build a separate AppDNA server.
  2. In Studio, go to Configuration, right-click AppDNA, and click Create AppDNA connection before creating an AppDisk.
  3. The dialog box has an example for the Connection address. It should be in http://appdnaserver:8199/appdna format.
  4. Enter the AppDNA SQL server name and database name. Click Save.

Create AppDisk

  1. Antivirus will slow down the AppDisk creation process. Add CtxPvD.exe and CtxPvDSvc.exe to the exclusion list of your antivirus program. More details in Known Issues.
  2. According to CTX211853 AppDisk Creation Task Stuck At “Creating…” In Studio, Shadow Copy and Microsoft Software Shadow Copy Service Provider services must be enabled on the machines.
  3. You need a Machine Creation Services or Provisioning Services catalog of type Random. Make sure at least one machine in the catalog is not assigned to any Delivery Group.


  4. For Provisioning Services, the machine must boot from a Maintenance (Private Image) version. After the AppDisk is created, the Maintenance version can be discarded.
  5. In Studio, right-click AppDisks and click Create AppDisk.
  6. In the Getting started with AppDisks page, click Next.
  7. In the Create AppDisk page, select a size for the disk. These are thin provisioned so size probably doesn’t matter. Just make sure it’s big enough to hold the application.
  8. Note: If PvS, if the AppDisk is bigger than the cache disk, then PvS might try to put the cache on the AppDisk and will fail to server. See Formatted drive still goes to Server for cache with PVS 7.9 at Citrix Discussions.  💡
  9. Click Next.
  10. In the Preparation Machine page, select an MCS or PVS random catalog that has an available machine not assigned to a Delivery Group. Click Next.
  11. In the Summary page, give the AppDisk a name. Include the datastore or hosting resource name since you need different AppDisks for each hosting resource. Click Finish.
  12. The new AppDisk is prepped. This takes a while.
  13. If you look in your hypervisor storage, you’ll see a new folder named AppDisk-VirtualID. It’s not obvious which AppDisk this .vmdk file belongs to. You can run a PowerShell command like get-applibappdisk | ? virtualdiskid -eq 0cac15d0-55db-4931-848e-de6ee79dddf8 to determine the AppDisk name.
  14. Once prep is done, Studio says Ready to install applications. If you look on the bottom it will show you which machine was used for AppDisk preparation.
  15. You can also right-click the AppDisk, click Install Applications, and it will tell you which machine should be used for application installation.

  16. Access the console of the prep machine and install the application(s).
  17. When done, go back to Studio, right-click the AppDisk, and click Seal AppDisk.
  18. Click Yes to seal it. This will cause the prep machine to reboot.
  19. Preparation will take some time. If it seems stuck, you might have to login to the prep machine so it continues the process.

  20. Windows Defender might interfere with the sealing process. In that case, turn off Defender’s Real-time protection.
  21. If you added AppDNA to Studio, then it will ask AppDNA to analyze the AppDisk.
  22. When done you can View report.
  23. Once the AppDisk is created and sealed, you can click the Applications tab in the bottom half of the window to see what the AppDisk contains.

Import AppDisk

AppDisks can only be attached to machines on the same hosting resource the AppDisk is located on. You can easily copy/import the AppDisk to multiple hosting resources (datastores).

Also, if you added AppDNA after creating AppDisks, then you can only analyze them by re-importing them.

To import an AppDisk:

  1. You will need an available prep machine in a MCS or PvS Random Catalog that is not assigned to any Delivery Group. The Catalog must be on the same Hosting Resource where the imported AppDisk will be placed.


  2. When you look at a datastore containing AppDisks, it’s not obvious which .vmdk goes with which AppDisk. Run the PowerShell command Get-AppLibAppDisk <AppDiskName> to see the VirtualDiskId.
  3. In vSphere Web Client, edit a non-linked clone virtual machine. Any non-MCS/PVS machine should work. This import machine is different than the linked clone machine that Studio will use to prepare the AppDisk.
  4. Make sure the import machine is currently powered off. If the machine is powered on, then vSphere might complain about the disk being currently in use.
  5. Add an Existing Hard Disk (AppDisk).

  6. When browsing the datastore with the existing AppDisk, select the folder name that matches the VirtualDiskId and then select the disk that’s in the folder.
  7. In Studio, right-click AppDisks and click Create AppDisk.
  8. In the Create AppDisk page, select Import existing AppDisk.
  9. Select a Hosting Resource where you want to copy the AppDisk to. Studio always copies the AppDisk, even if to the same datastore as the source.
  10. In the Import Disk page, browse to the virtual machine and click the arrow to expand it.
  11. Then select the attached AppDisk and click Next.
  12. In the Preparation machine page, select a random linked clone catalog with a machine that hasn’t been added to any Delivery Group and click Next.
  13. In the Summary page, give the AppDisk a name. Include the hosting resource (datastore) name. Click Finish.
  14. The AppDisk will be copied to the new datastore and analyzed if AppDNA is configured.
  15. You can then assign the imported AppDisk to Delivery Groups.
  16. Once the AppDisk is imported, click the Applications tab in the bottom half of the Windows to see what’s in the AppDisk.
  17. You can rename the AppDisk by right-clicking it and clicking Properties.

Assign to Delivery Group

AppDisks are assigned to Delivery Groups, not Catalogs.

  1. If you want to assign an AppDisk to an existing Delivery Group, right-click the Delivery Group and click Manage AppDisks.
  2. Or you can create a new Delivery Group.
  3. On the AppDisks page, click Add.
  4. Select one or more AppDisks and click OK. Notice that you can only select AppDisks on the same hosting resource as the Catalog.
  5. You can prioritize the AppDisks by using the arrow buttons on the right. Or click Auto Order to let AppDNA do it for you.
  6. If you are changing AppDisks assigned to an existing Delivery Group, choose a Rollout Strategy (reboot schedule). This is identical to Machine Creation Services Rollout Strategy. Then finish the wizard.
  7. If you chose Auto Order when assigning the AppDisks then AppDNA will need to do some analysis.
  8. If you highlight a Delivery Group, the AppDisks tab on the bottom shows the currently assigned AppDisks.

Update AppDisk

  1. In Studio, right-click an AppDisk and click Create New Version.
  2. Give the new version a name.
  3. Select a linked clone machine that is not currently in a Delivery Group.
  4. Click Create new version. This copies the AppDisk and links it to the prep virtual machine.
  5. Proceed through the normal Create AppDisk process. This includes installing applications and sealing the AppDisk.
  6. Then assign the new AppDisk to a Delivery Group. This process will include removing the old AppDisk and assigning the new AppDisk.

StoreFront 2411 through 3.5 – Tweaks

Last Modified: Jan 9, 2025 @ 2:37 am

192 Comments

Navigation

This article applies to StoreFront versions 2411, 2402 LTSR, 2203 LTSR, 1912 LTSR and all other versions 3.5 and newer.

💡 = Recently Updated

Change Log

CRL Checking – Disable

When the StoreFront server checks certificate revocation for its locally signed files, a delay can occur before the StoreFront logon page is displayed.

  1. Run the following PowerShell commands: 
    Add-PSSnapin Citrix.DeliveryServices.Framework.Commands
Set-DSAssemblyVerification $false
  2. Another potential tweak to speed up StoreFront is to disable NetBIOS. Right-click the Start Menu and click Network Connections.
  3. Right-click the NIC and click Properties.
  4. Highlight Internet Protocol Version 4 and click Properties.
  5. Click Advanced.
  6. On the WINS tab, change the selection to Disable NetBIOS over TCP/IP and click OK twice and Close once.
  7. Repeat on the other StoreFront servers.

Note: According to Microsoft, it is no longer necessary to configure generatePublisherEvidence in C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet.config.

Receiver Shortcuts

You can use StoreFront to control placement of shortcuts on Receiver machines.

  1. Run Notepad elevated (as administrator).
  2. Edit the file C:\inetpub\wwwroot\Citrix\Roaming\web.config.
  3. Search for <account id. Find the Store name in the name attribute.
  4. Scroll down to the first <properties> section located under <annotatedServices>.
  5. See Using StoreFront account settings to customize app shortcut locations at Citrix Docs for a list of properties. Add the properties as detailed at Citrix Docs. The properties should be added after the clear tag.
  6. Note: if subscriptions are enabled in StoreFront then only Favorites are added to the Start Menu and Desktop. If subscriptions are disabled then all applications are placed on the Start Menu or Desktop.
  7. Close and save the file.
  8. Then Propagate Changes.

PNAgent Authentication and Default Store

Default Store

If you point your browser to https://storefront.corp.com/Citrix/PNAgent/config.xml, which is the typical path for PNAgent, you’ll get a 404.

To fix this, in the StoreFront console, right-click the store, and click Configure XenApp Services Support.

In the bottom of the window, select the Default store, and click OK.

Now PNAgent can point to StoreFront without needing to specify a custom path. Note: this only works for /Citrix/PNAgent/config.xml.

Single Sign-on

From Configure authentication for XenApp Services URLs at Citrix Docs: XenApp Services URLs support explicit, domain pass-through, and pass-through with smart card authentication. Explicit authentication is enabled by default. You can change the authentication method, but only one authentication method can be configured for each XenApp Services URL. To enable multiple authentication methods, create separate stores, each with a XenApp Services URL, for each authentication method. To change the authentication method for a XenApp Services URL, you run a Windows PowerShell script.

  1. On the primary StoreFront server in your deployment, use an account with local administrator permissions to start Windows PowerShell.
  2. At a command prompt, type the following command to configure the user authentication method for users accessing the store through the XenApp Services URL.
    & "C:\Program Files\Citrix\Receiver StoreFront\Scripts\EnablePnaForStore.ps1" –SiteId 1 -ResourcesVirtualPath /Citrix/Store –LogonMethod sson
  3. Propagate changes.

Remember my password

If you leave PNAgent authentication set to Prompt, you can enable the Remember my password box by doing the following:

  1. Run Notepad as Administrator and edit the file C:\inetpub\wwwroot\Citrix\Store\Views\PnaConfig\Config.aspx.
  2. Near line 74 is EnableSavePassword. Change it to true.
  3. When PNAgent connects, there should now be a Remember my password checkbox.

Hide Applications

You can hide all icons of a particular type (Applications, Desktops, Documents). Or you can hide icons with a specific keyword.

Go to Stores > MyStore > Configure Store Settings > Advanced Settings, and look for the Filter options.

Filter resources by type lets you hide all Applications or all Desktops. If you are running Receiver inside a published desktop, then you probably don’t want desktop icons to be delivered by Receiver. In that case, create a new Store and filter the Desktop icons. Then only the application icons will be delivered.

Filter resources by excluded keywords lets you filter published icons that match a custom keyword.

Once the ExcludeKeyword has been defined, add the keyword to a published application or published desktop description, and that application/desktop will no longer display in Receiver. This works for both Receiver for Web and Receiver Self-Service (non-browser).

In XenDesktop 7.9 and and newer and Citrix Virtual Apps and Desktops, to assign a description to a Desktop, you edit the Delivery Group, go to the Desktops page, and edit one of the Desktops. Citrix CTX220429 Configure Resource Filtering to Allow Desktops to be filtered on Storefront.

Desktop Autolaunch

By default, if only a single desktop is published to the user, Receiver for Web will auto-launch it. You can change this behavior by going to Stores > MyStore > Manage Receiver for Web Sites > Configure > Client Interface Settings and uncheck the box next to Auto launch desktop.

Full Screen Desktop

Citrix CTX139762 How to Configure StoreFront to Start Published Desktops in Full Screen Mode: This article describes how to configure StoreFront to start published desktops in Full Screen Mode.

  1. Open the file C:\inetpub\wwwroot\Citrix\Store\App_Data\default.ica on the StoreFront server(s) with notepad (as Administrator)
  2. Add the line: 
    [Application]
DesktopViewer-ForceFullScreenStartup=On
  3. In older versions of StoreFront, it should be true instead of On.
  4. Save the file.
  5. Open the command prompt (cmd) and run iisreset.

Autolaunch Application

See CTX572543 How to auto launch published app while logon Storefront Web URL. Add the following code to the end of C:\inetpub\wwwroot\Citrix\<StoreName>Web\custom\script.js.

var ctxAppName = "AppName";
CTXS.Extensions.noteApp = function (app) {
  if(app.name == ctxAppName){ 
    CTXS.ExtensionAPI.launch(app);
  }
};

See the script.js code posted by Michael Bednarek at Citrix Discussions.

Store for Anonymous

If you intend to publish applications to anonymous users, then you can create a StoreFront store that does not require authentication. Note: anonymous stores only work internally (no NetScaler Gateway).

  1. On the VDAs, create and configure anonymous accounts.
  2. In Citrix Studio, configure a Delivery Group to accept unauthenticated (anonymous) users.
  3. In the StoreFront Console, right-click Stores, and click Create Store.
  4. In the Store Name and Access page, enter a new store name.
  5. Check the box next to Allow only unauthenticated users to access this store.
  6. Then click Next and finish the wizard like normal.
  7. By default, Anonymous stores are hidden (not advertised). When performing discovery in Receiver you’ll need to enter the full path to the store (e.g. https://storefront.corp.com/Citrix/Anon/discovery).

Workspace Control

Workspace Control reconnects user sessions. It can be disabled. Or configure various reconnection options.

Citrix Blog Post Workspace Control: When You DON’T Want to Roam details complete session reconnection configuration instructions for XenApp, Remote Desktop Services, StoreFront, and Receiver.

Receiver for Web

Go to Stores > MyStore > Manage Receiver for Web Sites > Configure > Workspace Control page.

Receiver Self-Service

Citrix Blog Post – How to Disable Workspace Control Reconnect: For Receiver for Windows, Workspace Control can be managed on client devices by modifying the registry. Please see this Knowledgebase Article for how to implement it. This can also be done for domain-joined client devices using Group Policy.

In StoreFront Console, go to Stores > MyStore > Configure Store Settings > Advanced Settings, and there’s a setting for Allow session reconnect.

Treat Desktops as Applications

From Treating All Desktops as Applications at Citrix Blog Post What’s New in StoreFront 3.0: Desktops are treated differently from applications in StoreFront/Receivers. They are placed in a separate Desktop tab and in the case of Receiver for Web, they are not reconnected with workspace control. In some use cases, it is desirable to treat desktops as applications so that they are placed together with applications and get reconnected as part of workspace control. With StoreFront 2.x, you have to add the TreatAsApp keyword to all published desktops to achieve this effect. StoreFront 3.0 enables you to configure treating all desktops as applications at the store level without the need of adding the TreatAsApp keyword to all the published desktops. This is configurable using a PowerShell cmdlet.

& "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"

Set-EnhancedEnumerationOptions -siteId 1 -storeVirtualPath /Citrix/Store `
-treatDesktopsAsApps $true

Also see Citrix CTX223817 How to Configure “TreatAsApp” in XenDesktop 7.8.

Special Folder Redirection

From Configure special folder redirection at Citrix Docs: With Special Folder Redirection configured, Citrix maps Windows special folders for the server, to those on their local computers. Special folders refer to standard Windows folders, such as \Documents and \Desktop.

In StoreFront Console, go to Stores > Configure Store Settings > Advanced Settings and there’s an option for Allow special folder redirection.

Receiver Self-service – Disable “Remember My Password”

By default, when Receiver Self-Service connects internally to StoreFront, the user is able to check the box next to Remember my password. Note: When connecting through NetScaler Gateway, this checkbox is never available.

This can be disabled by making a change on the StoreFront server. This procedure is documented by John Ashman at Citrix Discussions and Prevent Citrix Receiver for Windows from caching passwords and usernames at Citrix Docs.

  1. Note that this procedure seems to prevent Receiver for iOS from adding accounts.
  2. On the StoreFront server, run a text editor elevated (as administrator).
  3. Open the file C:\inetpub\wwwroot\Citrix\StoreAuth\App_Data\Templates\UsernamePassword.tfrm.
  4. Go to line 20, which should start with @SaveCredential.
  5. To comment out the line, wrap it in @* and *@. Save the file when done.

  6. Now the Remember My Password checkbox is gone.

“Activate” Option in Web Page – Disable

From Citrix Discussions: to disable the “activate…”; function for Citrix receiver for windows that is visible when a user clicks their username in the upper right hand corner of Receiver for Web, in StoreFront Console, go to Stores > MyStore > Manage Receiver for Web Sites > Configure > Client Interface Settings page. There’s a checkbox for Enable Receiver configuration.

Logoff Receiver for Web Seconds after Icon Launch

From Citrix Blog Post Logging Off Receiver for Web after an Application/Desktop Launch: Simply add the following code snippet to script.js in the custom folder for the Receiver for Web site (typically C:\inetpub\wwwroot\Citrix\StoreWeb\custom\) you would like to customize:

var delayLogoffInSeconds = 10;

CTXS.Extensions.beforeWebLogoffIca = function(action) {
    return 'none';
};

CTXS.Extensions.postLaunch = function(app, status) {
    if (! CTXS.Device.isNativeClient()) {
        if (status == CTXS.LAUNCH_SUCCESS) {
            function logoff() {
                CTXS.Environment.logOff();
            }
            window.setTimeout(logoff, delayLogoffInSeconds * 1000);
        }
    }
};

Customize Receiver UI in StoreFront 3.x

StoreFront 3.x customizations are visible in both Receiver for Web and in Receiver Self-Service.

Note: these customizations might not work in StoreFront 1811 and newer, which has a different user interface.

If you are load balancing StoreFront and want to put the server name on the webpage (or Receiver), see Citrix Blog Post How To: Add a Server Identifier to the StoreFront Page Footer. This works in StoreFront 1811 and newer.

George Spiers Insert Client IPs into the StoreFront logon page.

John Billekens Hide or change “domain\user or username@domain.com” text in Storefront: In C:\inetpub\wwwroot\Citrix\<Store>Web\custom\style.css, add the following to hide the text:

.credentialform span.pseudo-input.show {
 visibility: hidden;
}

For StoreFront older than version 1811, Citrix Blog Post Dynamic Subscription Icons in StoreFront explains how to change the Details link to a star icon based on subscription status. The star icons are not clickable like they are in StoreFront 1811 and newer.

Trentent Tye at Citrix Storefront – Adventures in customization – Add a help button to your Storefront UI uses CTXS.ExtensionAPI.addHelpButton() and CTXS.ExtensionAPI.openUrl() to add a help button which opens a help page URL. This also works in StoreFront 1811 and newer.

CTP Sam Jacobs and Rich Minichiello Adding an EULA Checkbox to StoreFront logon page

From CTP Sam Jacobs at StoreFront: Add Application Categories to Favorites Tab at CUGC. It’s a simple matter to get it to again appear. Back up the file \inetpub\wwwroot\citrix\<store>Web\custom\style.css, and add the following to the bottom of the file:

.largeTiles .myapps-view .storeapp-category {
display: block;
}

Nicolas Ignoto Lab: Part 22 – Ultimate StoreFront 3 customization guide contains many StoreFront customizations including:

  • Add disclaimer
  • Change logo/background
  • Add header
  • Add text
  • Change colors
  • Etc.

 

Citrix Blog Post Citrix Customization Cookbook contains a collection of customizations including:

  • Add Static or dynamic (read from file) text to the header and/or footer of the login page.
  • Click-through disclaimer before or after login page
  • Footer for every page
  • Default to Folder view when visiting the Apps tab
  • Change default text
  • Change background images for featured categories
  • Background image

 

Citrix Blog Post Storefront 3 Web Customization: Branding Your Deployment describes how to modify the following CSS to customize the appearance of StoreFront 3.x

  • Background images
  • Logon button
  • Colors for page and text
  • How to view the mobile version of the page
  • CSS for mobile pages

 

Jason Samuel Upgrading Citrix StoreFront 2.6 to StoreFront 3.0 – Things to Know details how to change the StoreFront logo to a Receiver logo.

 

Citrix Blog Post StoreFront Message Customization describes how to add a scrolling message to the top of the screen. This is displayed in both Browsers and Receivers. This post contains a new version of the executable that supports StoreFront 3.0 and newer.

 

Migrate Web Interface features to StoreFront at Citrix Docs details how to configure Web Interface features in StoreFront. This includes:

  • Enable return to last folder
  • Header logo
  • Pre-logon welcome message
  • Logon screen customization
  • Footer text

The code for pre-login message is already included in C:\inetpub\wwwroot\Citrix\StoreWeb\custom\script.js. Just remove the comment. Source = Citrix CTX227805 StoreFront 3.11 >>How to get the login banner on Storefront page

 

Rody Kossen and his colleague Leon Koppel built a customisation layer that reads the state of the resources presented to the end-user. If a desktop is under maintenance, inform the user so he knows before he tries to access the resource. Get the code from Citrix Blog Post Putting the Experience First, Where it Belongs.  💡

 

StoreFront 3.0 Receiver Customization APIs are detailed at Citrix Developer. Use the Receiver Customization API to brand or customize your end users’ app and desktop selection experience beyond capabilities provided in the StoreFront admin console. Customizations apply to latest Web, Chrome, Windows, Mac and Linux clients, and will be extended to mobile devices in future releases.

 

CTX221097 How to rename items on StoreFront? describes the strings that can be changed.

  1. Go to C:\inetpub\wwwroot\Citrix\<StoreName>Web\custom
  2. Open strings.en.js file
  3. See below for an example of overriding one of the built-in strings. See the article for the full list of strings.
  4. AppStore defines the title of the website. (Source = CTX236110 How to customize the storefront website title)

 

Citrix Blog Post Receiver X1 APIs describes the following:

  • Overview of the CSS classes that can be customized.
  • Override Citrix’s JavaScript functions to modify behavior – exclude or restyle apps, change a sort order, add a warning message etc.
  • How to force X1 UI to display in either phone or larger mode.

 

Citrix Blog Post X1 Customization: Going deeper with CSS describes the following:

  • Use CSS (/custom/style.css) to style the three custom regions (#customTop, #customBottom, #customScrollTop). Shown below in red, blue, and pink.
  • Marker classes for showing/hiding or highlighting parts of the UI: large display, small display, high DPI, Favorites view, Desktops view, Apps view, appinfo view.

 

Citrix Blog Post Scripting X1 describes the following:

  • JavaScript code to display an Acceptance dialog box before users can login.
  • Use JQuery to add HTML code to custom regions (e.g. #customScrollTop) including using CSS to hide the HTML code unless a specific tab is selected by the user.

Citrix Blog Post – Rewriting the Session ClientName from StoreFront: I would like to offer the following customisation DLL which can apply client name rewrites based on a template. The customisation template can be any string, but where that string contains a particular token, the token will be replaced by some information from the User Context. If the intent was just to replace the ClientName with the user name, the template is then just “$U”. More details and the .dll file are in the blog post.

StoreFront Store Customization SDK at Citrix Developer: The Store Customization SDK allows you to apply custom logic to the process of displaying resources to users and to adjust launch parameters. For example, you can use the SDK to control which apps and desktops are displayed to users, to change ICA virtual channel parameters, or to modify access conditions through XenApp and XenDesktop policy selection. Key Customization Points:

  • Post-Enumeration
  • Post-Launch ICA File
  • Post-Session Enumeration
  • Access Conditions (pre-launch and pre-enumeration)
  • Provider List
  • Device information

Citrix Blog Post Adding a Language to StoreFront 3.0: A new language pack is comprised of a culture definition file, a string bundle file and a custom string bundle file. See the Blog Post for more details.

To force StoreFront to only use English, add the following to c:\inetpub\wwwroot\Citrix\StoreWeb\custom\script.js as detailed at Set default language to EN at Citrix Discussions:
CTXS.Environment.getPreferredLanguages = function () { return null; }

 

To change the StoreFront page title, see Sam Jacobs How to Change the Page Title in Citrix Receiver 3.x at mycugc.org.

 

Customizations detailed at topic Modify Receiver for Web site at Citrix Discussions:

  • Add Featured App Groups to Categories View
  • Increase the number of Featured applications beyond the default of 3.

 

StoreFront SDKs

Most of the StoreFront SDK documentation can be found at https://developer-docs.citrix.com/projects/storefront-sdk/en/latest/

StoreFront Store Customization SDK – Use the Store Customization SDK to apply custom logic to the process of displaying resources to users and to adjust launch parameters.  For example, you can use the SDK to control which apps and desktops are displayed to users, to change ICA virtual channel parameters, or to modify access conditions through XenApp and XenDesktop policy selection.

StoreFront Web API – Receiver for Web is a component of Citrix StoreFront that provides access to applications and desktops using a Web browser. It consists of a User Interface tier and a StoreFront Services Web Proxy tier.

StoreFront Authentication SDKs – With StoreFront 3.0, we have introduced a new Unified UI that is delivered from StoreFront to Receiver on all client platforms. Use the Receiver Customization API to brand or customize your end users’ app and desktop selection experience beyond capabilities provided in the StoreFront admin console. Customizations apply to latest Web, Chrome, Windows, Mac and Linux clients, and will be extended to mobile devices in future releases.

StoreFront PowerShell SDK – Citrix StoreFront provides an SDK based on a number of Microsoft Windows PowerShell version 3.0 modules. With this SDK, you can perform the same tasks as you would with the StoreFront MMC console, together with tasks you cannot do with the console alone.

Related Pages

StoreFront 2411 – Configuration for Citrix Gateway

Last Modified: Jan 9, 2025 @ 2:38 am

319 Comments

Navigation

This article applies to StoreFront versions 2411, 2402 LTSR, 2203 LTSR, 1912 LTSR, and all other versions 3.5 and newer.

Changelog

StoreFront Configuration for Citrix Gateway

See the Citrix Gateway ICA Proxy for instructions to create a Citrix Gateway Virtual Server for ICA Proxy and StoreFront. You then must configure StoreFront to enable the Gateway.

  1. In the StoreFront Console, in the middle, right-click your Store, and click Manage Authentication Methods.
  2. Ensure Pass-through from Citrix Gateway is selected and click OK.
  3. In the StoreFront Console, right-click the Stores node, and click Manage Citrix Gateways.
  4. If StoreFront 3.6 or newer, notice the imported from file link on top. This is a new feature of NetScaler 11.1 and newer. An example configuration that uses this feature can be found in the StoreFrontAuth page.

  5. If you’re not using the Gateway config file from NetScaler 11.1 and newer, click Add.

    1. In the General Settings page, enter a display name. This name appears in Citrix Receiver or Citrix Workspace app, so make it descriptive.
    2. In the Citrix Gateway URL field, enter the Citrix Gateway Public URL that resolves to the Citrix Gateway VIP.
      • The URL entered here must match what users enter into their browser address bars.
      • This URL can be a GSLB-enabled DNS name.
      • The Gateway URL usually does not need to be reachable from StoreFront unless you need the Callback for SmartAccess or non-password authentication (e.g. Smart Cards or Citrix Federated Authentication Service).
    3. Click Next.
    4. In the Secure Ticket Authority page, click Add.
    5. Enter the URL to a Delivery Controller. This can be http or https.
      • STA is installed automatically on Delivery Controllers.
      • There is no relationship between STA and CVAD farms. Any CVAD farm can use any STA server.
      • StoreFront chooses the STA server. Citrix Gateway must be configured to use the same STA servers that StoreFront chose.
    6. Click OK.
    7. Continue adding Secure Ticket Authorities (Delivery Controllers). Whatever Secure Ticket Authorities you add here must also be added to the Citrix Gateway Virtual Server on the Citrix ADC appliance. Click Next.
    8. In the Authentication Settings page, the VServer IP Address field is typically left blank. You only use this field if you have multiple Gateways (on separate appliance pairs) connecting to one StoreFront server. See below for details.
    9. If you need SmartAccess or non-password authentication (e.g. Smart Cards or Citrix Federated Authentication Service), then enter the Callback URL.
      • The Callback URL must resolve to any Citrix Gateway VIP on the same appliance that authenticated the user. Edit the HOSTS file on the StoreFront server so the Callback URL resolves correctly.
      • If you are configuring Single FQDN, then the Callback URL must be different than the Single FQDN.
      • The Gateway Virtual Server that the Callback URL resolves to must have a trusted and valid certificate that matches the FQDN you are entering here.
      • The Gateway Virtual Server that the Callback URL resolves to must not have client certificates set to Mandatory.
      • See CTX399424 Gateway Callback and / or XML Communication fails after upgrade to Storefront 2203 for a workaround.
    10. If you don’t need SmartAccess or non-password authentication, then leave the Callback URL field empty.
    11. If you enabled two-factor authentication (LDAP and RADIUS) on your Citrix Gateway, change the Logon type to Domain and security token. Otherwise leave it set to Domain only.
    12. Click Create.
    13. Then click Finish.
  6. You can add more Gateways depending on your design. Multiple datacenters typically requires multiple Gateways. Click Close when done.
  7. To enable the store to use Citrix Gateway, in the middle, right-click your store, and click Configure Remote Access Settings.

    1. Check the box next to Enable Remote Access.
    2. Leave it set to No VPN tunnel.
    3. Check the box next to the Citrix Gateway object you just created. This binds the Gateway to the Store.
    4. If you have multiple Gateways, select one of them as the Default appliance.
      • Note: when you point Receiver to a Citrix Gateway URL for Discovery, after Discovery is complete, the Default appliance selected here is the Gateway that Receiver uses. In other words, Receiver ignores the Gateway you entered during discovery.
    5. Click OK to close the Configure Remote Access Settings dialog box.
  8. In the StoreFront Console, right-click the Stores node, and click Manage Beacons.
  9. In the top half of the window, make sure the Internal beacon is set to a URL that is only reachable internally.
    1. If you are configuring Single FQDN, then the Internal beacon must be different than the Single FQDN.
    2. Service URL = the StoreFront Base URL. If you’re not configuring Single FQDN, then the Base URL is usually not accessible externally and is acceptable as an Internal Beacon.
    3. The Internal beacon must never go down. If it’s down, then internal native Receivers will stop working. One option is to configure a Citrix ADC Responder HTML page as detailed at Julian Mooren Citrix ADC – How to create a High Available Beacon Point for Citrix StoreFront. 💡
    4. Click OK when done.
  10. Right-click the Server Group node, and click Propagate Changes.

Citrix Gateway Logon Page Theme

To make the Citrix Gateway logon page look like Receiver 3.0 and newer, see Citrix Gateway 12 Portal Theme. The Citrix Gateway X1 theme has the fewest issues and the most readily available documentation for customization. The Citrix Gateway RfWebUI theme has less documentation for customizations.

Single FQDN

Overview

Links:

You can either define separate FQDNs for StoreFront Load Balancing (internal) and Citrix Gateway (external). Or, you can define a Single FQDN for both.

Single FQDN has the following requirements:

  • Receivers:
    • Receiver for Windows 4.2 or newer. Or upgrade to Workspace app.
    • Receiver for Mac 11.9 or newer. Or upgrade to Workspace app.
    • Mobile Receivers
  • StoreFront 2.6 or newer
  • Split DNS – different DNS resolution for internal vs external
    • Internal DNS should resolve the Single FQDN to the StoreFront Load Balancing VIP
    • External DNS should resolve the Single FQDN to the Citrix Gateway VIP (public IP)
  • NetScaler 10.1 or newer
  • The FQDN for Internal Beacon must be different than the Single FQDN.
    • The Internal Beacon URL must not be externally resolvable or accessible.
    • If Internal Beacon is down, then internal Receiver Self-Service clients will not function correctly.
    • Internal Beacon URL can be http instead of https.
    • If Internal Beacon URL is https, then the machine hosting the IP address for the Internal Beacon must have a certificate that matches the Internal Beacon FQDN.
  • The FQDN for Citrix Gateway Callback must be a different FQDN than the Single FQDN. Callback is only needed for SmartAccess and SAML.
    • Callback FQDN can resolve tot he same Gateway VIP used by external users. Or, you can create a new Gateway VIP on the same appliance that authenticated the users.
    • The Gateway Virtual Server for Callback must have a certificate that matches the Callback FQDN.

DNS caching interferes with Single FQDN – Note: if you have laptops that move from internal to external and back again, then DNS caching will interfere with Single FQDN. The DNS response for Single FQDN needs to change whenever the device moves from internal to external and back again. However, Receiver uses the same DNS cache as Internet Explorer, which caches DNS responses for 30 minutes. To clear the DNS cache, you have to close Receiver and re-open it. The DNS response you see when you ping the Single FQDN does not necessarily match the DNS response used by Internet Explorer and Receiver.

Configure Single FQDN without email-based discovery

If you don’t care about email-based discovery, then the configuration of Single FQDN is fairly simple. Sample DNS names are used below. Make sure the certificates match the DNS names.

  1. Internal DNS name = the Single FQDN (e.g. storefront.corp.com). Internally, the DNS name resolves to the internal Load Balancing VIP for StoreFront. Set the StoreFront Base URL to this address.
  2. External DNS name = the Single FQDN (e.g. storefront.corp.com). Externally, the DNS name resolves to a public IP, which is NAT’d to Citrix Gateway VIP on DMZ Citrix ADC. Set the Citrix Gateway object in StoreFront to this FQDN.


  3. If you need SmartAccess, then the Callback URL = any DNS name (e.g. callback.corp.com) that resolves to a Citrix Gateway VIP on the same DMZ Citrix ADC appliance that authenticated the user. The Callback URL cannot be the Single FQDN.

    • Callback URL can be omitted if you don’t need SmartAccess features, or SAML authentication.
    • The callback DNS name must be different than the Single FQDN.
    • The callback DNS name must resolve to a Citrix Gateway VIP on the same appliance that authenticated the user. This could be the same DMZ Gateway VIP used by external users. Or you can create a separate internal Gateway VIP on the same appliance.
    • The Citrix Gateway vServer for callback must have a certificate that matches the Callback DNS name.
  4. Internal Beacon = any internal website URL that is not externally accessible. You can’t use the Single FQDN as the Internal Beacon. Note: if the internal beacon is down, then internal Receiver Self-service will not work correctly.

    • Make sure the Internal Beacon is not resolvable externally.
    • The Internal Beacon URL cannot be the Single FQDN. It must be different.
    • Ideally, the Internal Beacon should be a new DNS name that resolves to a StoreFront Load Balancing VIP.
    • If the internal beacon is https, then the certificate must match the internal beacon DNS name. However, http URLs also work.
    • See CTX218708 How to Configure Internal Beacon for Single FQDN on StoreFront.
  5. Make sure the DMZ Citrix ADC resolves the Single FQDN to the internal StoreFront Load Balancing VIP. You typically add internal DNS servers to the Citrix ADC. Or you can create a local Address Record on Citrix ADC for the Single FQDN.

  6. In the Citrix Gateway Session Profiles, on the Published Applications tab, set the Web Interface Address, and the Account Services Address to the Single FQDN.


  7. That’s all you need to implement Single FQDN. If you made changes to an existing StoreFront deployment, then you might have to remove accounts from Receiver, and re-add the account.

If you need email-based discovery, then here’s an example configuration for ICA Proxy Citrix Gateway

DNS:

  • Sample DNS names:
    • Single FQDN = citrix.corp.com
    • Callback FQDN = callback.corp.com
    • Internal Beacon FQDN = internalbeacon.corp.com
  • External DNS:
    • citrix.corp.com resolves to a public IP, which is NAT’d to a Citrix Gateway VIP on a DMZ Citrix ADC.
    • If email-based discovery, SRV record for _citrixreceiver._tcp.email.suffix points to citrix.corp.com. Create this SRV record in every email suffix DNS zone.
  • Internal DNS:
    • citrix.corp.com resolves to the Load Balancing VIP for StoreFront
    • callback.corp.com resolves to a Citrix Gateway VIP on the same Citrix ADC that authenticated the user. Usually only needed for SmartAccess and/or SAML.
    • For the internal beacon, FQDN of any internal web server. Make sure this name is not resolvable externally.
    • If email-based discovery, SRV record for _citrixreceiver._tcp.email.suffix points to citrix.corp.com. Create this SRV record in every email suffix DNS zone.

Certificates:

  • External, publicly-signed certificate for Citrix Gateway:
    • One option is wildcard for *.corp.com. Assumes email suffix is also corp.com. If you more than one email suffix, then wildcard will not work.
    • Another option is the following Subject Alternative Names:
      • citrix.corp.com
      • callback.corp.com – for callback URL. Only accessed from internal.
        • Or you can create a separate internally-facing Gateway vServer for callback with a separate certificate.
      • If email-based discovery, discoverReceiver.email.suffix for each email suffix. If you have multiple email suffixes, you’ll need multiple SAN Names.
  • Internal certificate for StoreFront Load Balancing:
    • Publicly-signed certificate is recommended, especially for mobile devices and thin clients.
    • Since you have the same DNS name for internal and external, you can use the external certificate for internal StoreFront.
    • One option is wildcard for *.corp.com. Assumes email suffix is also corp.com. If you have more than one email suffix, then wildcard will not work.
    • Another option is the following Subject Alternative Names:
      • citrix.corp.com
      • If email-based discovery, discoverReceiver.email.suffix for every email suffix. If you have multiple email suffixes, then you will have multiple SAN names.

StoreFront Configuration:

  • Base URL = https://citrix.corp.com
  • Internal beacon = https://internalbeacon.corp.com. Make sure it’s not resolvable externally.
  • Gateway object:
    • Gateway URL = https://citrix.corp.com
    • Callback URL = https://callback.corp.com

Receiver for Web session policy:

  • Policy expression = REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver
  • Client Experience tab:
    • Clientless Access = Allow or Off
    • Plug-in Type = Java
    • Single Sign-on to Web Applications = checked
  • Security tab:
    • Default authorization = ALLOW
  • Published Applications tab:
    • ICA Proxy = On
    • Web Interface address = https://citrix.corp.com/Citrix/StoreWeb
    • Single Sign-on Domain = Corp

Receiver Self-Service session policy:

  • Policy expression = REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver
  • Client Experience tab:
    • Clientless Access = Allow or Off
    • Plug-in Type = Java
    • Single Sign-on to Web Applications = checked
  • Security tab:
    • Default authorization = ALLOW
  • Published Applications tab:
    • ICA Proxy = On
    • Web Interface address = https://citrix.corp.com
    • Single Sign-on Domain = Corp
    • Account Services address = https://citrix.corp.com

Multiple Datacenters / Farms

Multi-datacenter Citrix Gateway and StoreFront Design

HTTP vs ICA

There are two connections from every Citrix client:

  • HTTP (SSL required) – goes to StoreFront
    • HTTP is usually proxied through Citrix ADC load balancing
    • If external, HTTP is proxied through Citrix Gateway, which proxies it through Citrix ADC load balancing.
    • HTTP traffic is initiated by either a web browser, or by Receiver Self-Service
  • ICA (SSL optional) – goes to Virtual Delivery Agent
    • ICA can go direct (internal) to a VDA
    • Or ICA can be proxied through Citrix Gateway ICA Proxy
    • ICA traffic is handled by Workspace app’s ICA engine – either locally installed Workspace app, or HTML5 Workspace app

The FQDN for the HTTP connection can be the same or different than the FQDN for the ICA connection.

The HTTP connection is easily handled by GSLB, HTTP/SSL load balancing, etc.

  1. DNS name – Users connect to a DNS name that resolves to StoreFront and/or Citrix Gateway.
    1. StoreFront is usually proxied through Citrix ADC Load Balancing.
    2. If Citrix Gateway, the HTTP connection is proxied to StoreFront, usually through Load Balancing.
  2. Separate VIP per datacenter – For multiple datacenters, each datacenter has its own StoreFront and/or Citrix Gateway VIP.
  3. GSLB resolves the DNS name to one of the datacenter VIPs.
    1. This can be active/active, or active/passive.
  4. Proximity and persistence – For active/active, since StoreFront traffic (HTTP) is so minimal, it usually doesn’t matter which datacenter is selected. But you can optionally enable one of the Proximity GSLB load balancing algorithms so the closest datacenter is selected.
    1. Enable one of the GSLB Service cookie-based persistence methods. Connection Proxy is the easiest to configure.

The ICA connection is dictated by StoreFront.

  1. .ica file – When a user clicks an icon in StoreFront, StoreFront generates an .ica file containing an address.
    1. If the user is internal, then the .ica file usually contains the private IP address of the Virtual Delivery Agent. Receiver connects directly to the VDA’s private IP.
    2. If the user is connecting through Citrix Gateway, or if HDX Optimal Routing is enabled, then the .ica file usually contains the FQDN of a Citrix Gateway that can proxy the ICA connection.
  2. Receiver engine for ICA protocol – The StoreFront provided .ica file is given to a Receiver engine. Receiver engine (locally installed Receiver, or HTML5 Receiver), uses ICA protocol to connect to the address contained inside the .ica file.
  3. One public IP – For external users, an advantage of Citrix Gateway is that you only have to expose one public IP address per datacenter no matter how many VDAs you have.
  4. FQDN for Gateway – For Citrix Gateway, StoreFront inserts a FQDN into the .ica file. This FQDN can be one of the following:
    1. Active/active GSLB
    2. Datacenter-specific – If you have two datacenters, each datacenter has a unique FQDN that resolves to a specific Citrix Gateway VIP in a specific datacenter. GSLB active/passive handles failover if the datacenter-specific VIP is down.
  5. ICA Routing – ICA traffic is heavier and more latency sensitive than StoreFront. Thus you typically want to control which datacenter is used for the ICA connection. There are two common designs:
    1. Proxy ICA traffic through a Citrix Gateway that’s in the same datacenter as the VDA.
    2. Proxy ICA traffic through the Citrix Gateway that’s closest to the user. The idea here is that back haul WAN connections are faster than Internet connection to a remote datacenter.
  6. HDX Optimal Routing – For proxying ICA through Citrix Gateway in the same datacenter as the VDA, StoreFront has two methods for identifying the Citrix Gateway that’s closest to the VDA:
    1. Different Citrix Virtual Apps and Desktops site/farm in each datacenter. If a VDA is launched from a particular site/farm, then provide the Citrix Gateway FQDN that is associated with that site/farm. This is configured using HDX Optimal Routing.
    2. Different Citrix Virtual Apps and Desktops zone per datacenter. If the VDA is launched from a particular zone, then provide the Citrix Gateway FQDN that is associated with that zone. This is configured using HDX Optimal Routing.
  7. Proximity and Persistence – For proxying ICA through a Citrix Gateway that is closest to the user, StoreFront returns an FQDN that is GSLB Active/Active load balanced using a Proximity load balancing algorithm.
    1. ICA is usually a long-lived TCP connection to the Citrix Gateway VIP.
    2. You can enable Source IP persistence on the active/active GSLB Virtual Server.
    3. Another method of proximity load balancing ICA is to configure Citrix ADC to insert a header to StoreFront indicating the Citrix Virtual Apps and Desktops zone the user is connecting from. See the GSLB Powered Zone Preference whitepaper.

Internal Citrix Gateway ICA Proxy? – Internal users typically have direct connectivity to VDA Private IP addresses, so you usually don’t need to use Citrix Gateway ICA Proxy internally. However, an advantage of using Citrix Gateway ICA Proxy internally is that now all ICA traffic is going through a Citrix Gateway, which makes it easy to enable AppFlow (HDX Insight) reporting to Citrix Application Delivery Management (ADM).

  • ICA Proxy through Citrix Gateway wraps ICA traffic in SSL, increasing the packet size.
  • SSL-Encrypted ICA packets cannot be optimized by normal WAN optimization products.

StoreFront and Multiple Sites/Farms

A Citrix Virtual Apps and Desktops Site/Farm is a collection of Delivery Controllers that share a single Site SQL Database. Multiple Citrix Virtual Apps and Desktops Sites/Farms implies multiple Site SQL databases, each configured separately. Note: farm is the old name for Citrix Virtual Apps and Desktops Site.

  • If you stretch a single Citrix Virtual Apps and Desktops Site/Farm across datacenters, then you have to deal with replication and recovery of the single SQL database.
  • Citrix Virtual Apps and Desktops Zones and Local Host Cache make it more feasible to stretch a farm. See XenDesktop Site Failover – how do you do it? at CUGC for an excellent discussion on multi-datacenter zone design.
  • VDAs can only register with one Citrix Virtual Apps and Desktops Site/farm.

Multiple Citrix Virtual Apps and Desktops Sites/Farms – StoreFront can enumerate icons from multiple Citrix Virtual Apps and Desktops Sites/Farms. If there are identical icons in multiple farms, then the icons can be aggregated so that only a single icon is displayed to the user. When the user clicks the icon, StoreFront then needs to select a site/farm.

  • CVAD 2311 and newer have multiple site management in Web Studio in the Settings node.

    • Use the Site selector at the top right of the page.
  • In StoreFront, Sites/Farms can be prioritized (active/passive) for different Active Directory groups. This allows you to specify a “home” site for specific users. Typically, you set the preferred site/farm to be in the same datacenter that contains the user’s home directory and roaming profile.
  • Or sites/farms can be active/active load balanced. This works best for applications that have synchronized active/active back-end data.

Icon aggregation – There are two methods of configuring icon aggregation in StoreFront:

  • StoreFront Console GUI – The most common multi-site/farm configurations can be done in the StoreFront Console GUI, including configuration of “Home Sites” (different AD groups prioritizing different sites/farms).
  • XML files – for more complex multi-site configurations. See Citrix Docs – Set up highly available multi-site store configurations

Note: if you have existing subscriptions/favorites, then enabling icon aggregation will cause the existing subscriptions to be ignored. You can migrate the existing subscriptions by exporting, modifying, and importing. See Subscriptions Missing after Enabling Aggregation at Citrix Discussions.

StoreFront in Multiple Datacenters

Stretching – Citrix does not support stretching a single StoreFront Server Group across multiple datacenters. Each datacenter is expected be a different StoreFront Server Group.

  • Citrix provides scaling guidance for up to 6 servers in a single StoreFront Server Group.

Management – Each StoreFront Server Group is managed separately.

  • Subscriptions/Favorites can be replicated between the two StoreFront Sever Groups.

Receiver Roaming – When Citrix Receiver switches between different StoreFront Server Groups in multiple datacenters, it’s possible for each datacenter to be treated as a separate Store, causing multiple Store entries in Receiver. This can be prevented by ensuring the following configurations are identical in both datacenters. Source = Juan Zevallos at Citrix Discussions:

  • Match the SRID – in StoreFront, if you use the same Base URL in the 2 separate installations, then the SRID should end up being identical. If the Base URL is changed after the initial setup, the SRID doesn’t change. The SRID can be safely edited in the \inetpub\wwwroot\Citrix\Roaming\web.config file. It will be replicated into the discovery servicerecord entry in the Store web.config, which can be edited as well, or refreshed from the admin console by going into Remote Access setup for the store, and hitting OK. Make sure to propagate changes to other servers in the group.
  • Match the Base URL
  • Match the Delivery Controller names under “Manage Delivery Controllers” – The XML brokers can be different, but the actual name of the Delivery Controller/Farms must be identical.

Typical Multi-Datacenter Configuration

Here’s a typical active/active Citrix Virtual Apps and Desktops configuration using separate sites/farms in each datacenter. Another option is zones.

  • Citrix Virtual Apps and Desktops Sites/Farms: Separate Citrix Virtual Apps and Desktops sites/farms in each datacenter.
    • The Delivery Controllers for each site/farm point to a SQL database in the local datacenter. There usually is no need to enable SQL failover across datacenters.
    • Each datacenter is managed separately. But Citrix Policies in a GPO can apply to both sites/farms.
    • An advantage of separate sites/farms is that you can upgrade one datacenter before upgrading the other.
  • StoreFront Server Groups: Separate StoreFront Server Groups in each datacenter.
    • Citrix doesn’t support stretching a single StoreFront Server Group across a WAN link.
    • Each Server Group is configured identically. You can export the config from one Server Group, and import it to the other. Or configure each of them separately, but identically. Identical means: same Base URL, same farms (Manage Delivery Controllers), same SRID, same Gateways, and same Beacons.
    • If subscriptions/favorites are enabled, use PowerShell commands to configure subscription replication between the two Server Groups.
  • StoreFront Load Balancing: Separate StoreFront load balancing VIP in each datacenter
    • Each Load Balancing VIP can be active/passive. Active = the StoreFront servers in the local datacenter. Passive = the StoreFront servers in the remote datacenter.
      • Create two Load Balancing vServers: one for local StoreFront, one for remote StoreFront. In the Active (local) Load Balancing vServer, add the Protection section, and configure the Backup (remote) vServer.
      • When the active StoreFront is down, Citrix Gateway will use StoreFront in the remote datacenter. However, the remote datacenter has its own Citrix Gateway, thus there will be two different Citrix Gateways connecting to one StoreFront Server Group. If you use SmartAccess or SAML and need the Callback URL, then you’ll need a special StoreFront configuration to handle the Callback URL from multiple Gateway appliances.
  • Icon aggregation: Configure StoreFront to aggregate icons from the two farms.
    • Use AD groups to specify a user’s home datacenter, which contains the user’s roaming profile and home directory.
    • Configure farm priority based on AD groups. For an aggregated icon, the AD group and farm priority determines which farm the icon is launched from.
  • External Citrix Gateways: Externally-accessible Citrix Gateway ICA Proxy VIPs in both datacenters.
    • The main Citrix Gateway DNS name is active/active GSLB. For example: citrix.company.com)
    • Each datacenter has a datacenter-specific GSLB active/passive DNS name for Citrix Gateway. For example: citrix-a.company.com, and citrix-b.company.com
    • The Gateway SSL certificate needs to match all three DNS names: the main active/active DNS name, and the two datacenter-specific active/passive DNS names.
  • Internal Citrix Gateways: Internally-accessible Citrix Gateway ICA Proxy VIPs in both datacenters for AppFlow reporting.
    • For AppFlow/Insight reporting, Citrix Gateway ICA Proxy is typically used internally too. If you don’t need AppFlow, then you don’t need internal Citrix Gateway.
    • To handle Single Sign-on from Receiver, internal Receivers will connect HTTP directly to StoreFront Load Balancing instead of proxied through Citrix Gateway.
      • This implies that you have separate DNS names for StoreFront and Citrix Gateway.
    • HDX Optimal Routing will force the ICA connection to go through Citrix Gateway instead of directly to the VDA.
    • HDX Optimal Routing is a global setting that applies to both internal and external users. The DNS name used by HDX Optimal Routing must be valid for both internal and external. If this is not the case, then you can deploy separate StoreFront servers for internal and external.
    • DNS:
      • The main Citrix Gateway DNS name is active/active GSLB. For example: citrix.company.com.
      • Each datacenter has a datacenter-specific GSLB active/passive DNS name for Citrix Gateway. For example: citrix-a.company.com, and citrix-b.company.com
      • The Gateway SSL certificate needs to match all three DNS names – the main active/active DNS name, and the two datacenter-specific active/passive DNS names.
  • Main StoreFront and Gateway FQDNs: separate FQDNs for StoreFront and Citrix Gateway.
    • Externally,  citrix.company.com resolves to a Citrix Gateway VIP.
    • Internally,  storefront.company.com resolves to a StoreFront Load balancing VIP.
    • Single FQDN usually causes more problems than it’s worth. If you don’t do Single FQDN, then you can hide the StoreFront DNS name by pushing the store configuration to Receiver using Group Policy. Browser users would only need to know the Citrix Gateway DNS name.
  • DNS Delegation for GSLB: multiple DNS names are delegated from internal DNS and public DNS to Citrix ADNS (internal and external) for GSLB.
    • Internal GSLB and public GSLB need to resolve citrix.company.com differently. Public GSLB should resolve it to public IPs. Internal GSLB should resolve it to internal IPs.
    • Combining internal and public GSLB on the same Citrix ADC is not recommended. Public GSLB should be handled by DMZ Citrix ADC appliances. Internal GSLB should be handled by Internal Citrix ADC appliances.
    • If you only have one Citrix ADC appliance for both internal and public, then see One appliance resolving a single DNS name differently for internal and public at GSLB Planning.
    • citrix.company.com is configured as Active/Active GSLB with Proximity Load Balancing, and Site Persistence equal or greater than StoreFront RfWeb timeout.
    • citrix-a.company.com is configured as Active/Passive GSLB with Datacenter A as the Active service.
    • citrix-b.company.com is configured as Active/Passive GSLB with Datacenter B as the Active service.
    • storefront.company.com is configured as Active/Active GSLB with Proximity Load Balancing, and Site Persistence equal or greater than StoreFront RfWeb timeout.
  • HDX Optimal Routing: Use HDX Optimal Routing to route ICA traffic through the Citrix Gateway that is closest to the destination farm. This requires datacenter-specific DNS names (e.g. citrix-a.company.com, citrix-b.company.com)
    • You can use one of these DNS names to connect to StoreFront in a specific datacenter, which is helpful for testing.
  • STAs: each StoreFront Server Group uses STAs in the local datacenter. Since ICA Traffic could end up on either Citrix ADC, all STAs must be added to all Citrix Gateways.
  • Beacons: the internal beacon is critical. If the internal beacon is down then Receiver Self-service won’t be able to determine if the client device is internal or not. GSLB can be used for the internal beacon DNS name.
  • Roaming Profiles: If you are running Citrix Virtual Apps and Desktops in multiple datacenters, you must design roaming profiles and home directories correctly.

Icon Aggregation and Home Sites

To configure icon aggregation using PowerShell, see CTA Dennis Span at Citrix StoreFront Multi-Site Aggregation with PowerShell at CUGC. The PowerShell cmdlets include the following:

  • New-STFEquivalentFarmset
  • Add-STFUserFarmMapping

To configure icon aggregation using the StoreFront Console:

  1. In StoreFront Console, go to Stores.
  2. In the middle, right-click your Store, and click Manage Delivery Controllers.
  3. Add multiple sites/farms. Typically, each datacenter is a separate farm.
  4. After adding multiple farms, the Configure button becomes available. Click it.
  5. If you are publishing identical resources from multiple farms, click the link to Aggregate resources.
  6. In the Aggregate Resources dialog box, do the following:
    1. Select the farms with identical resources that you want to aggregate.
    2. Notice the checkboxes on the bottom. If your goal is to configure home sites, then make sure you uncheck Load balance resources across controllers.
    3. Click the Aggregate button to move them up to the Aggregated section.
    4. Note: if you have existing subscriptions/favorites, then enabling icon aggregation will cause the existing subscriptions to be ignored. You can migrate the existing subscriptions/favorites by exporting, modifying, and importing. See Subscriptions Missing after Enabling Aggregation at Citrix Discussions.
    5. Click OK when done.
  7. Back in the Configure User Mapping and Multi-Site Aggregation window, click Map users to controllers.
  8. In the Create User Mapping wizard, do the following:
    1. If you want the same farm failover order (active/passive) or farm load balancing settings for everyone, then leave the User Groups page set to Everyone. Or if you intend to have different home sites for different users, add a user group that contains the users that will be homed to a particular datacenter. You can run this wizard multiple times to specify different home sites for different user groups. Click Next.
    2. In the Controllers page, click Add.
    3. Select the farms that these users will have access to, and click OK.
    4. If you configured farm aggregation without load balancing, then use the up and down arrow buttons to put the active site/farm for this group of users on top. The lower priority sites will only be accessed if the primary site is down. You can run this wizard multiple times to specify different active sites for different users.
    5. If farm aggregation is configured for load balancing, then there are no arrows to prioritize the farms.
    6. Click Create.
  9. You can click Add to add more user mappings. If you add multiple user groups, you can assign different primary sites/farms to each Active Directory group. This is how you configure “home sites”. Click OK twice when done.

Shaun Ritchie Citrix StoreFront High Availability and Aggregation – A dual site Active Active design has a sample multi-site configuration using XML Notepad and explains how to use the Primary and Secondary keywords to override farm priority order.

Citrix Blogs StoreFront Multi-Site Settings: Some Examples has example XML configurations for various multi-datacenter Load Balancing and failover scenarios.

HDX Optimal Routing

The Optimal Gateway feature lets you control the Citrix Gateway used for ICA connections. Here are some scenarios where this would be useful:

  • Multi-site Load Balancing. If the icon selected by the user is published from Citrix Virtual Apps and Desktops in Datacenter A, then you probably want the ICA connection to go through a Citrix Gateway Virtual Server in Datacenter A.
    • If the main DNS name for accessing Citrix Gateway is GSLB load balanced across datacenters, then you need additional datacenter-specific DNS names so you can control which datacenter the ICA connection goes through.
    • Note: Optimal Gateway is configured at the farm/site level, or zone level.
  • Citrix Gateway for internal connections (AppFlow). If you want to force internal ICA connections to go through Citrix Gateway so AppFlow data can be sent to Citrix Application Delivery Management (ADM), then you can do that using HDX Optimal Gateway, even if the user originally connected directly to the StoreFront server. See CTX200129 How to Force Connections through NetScaler Gateway Using Optimal Gateways Feature of StoreFront for more information.
  • The Citrix Gateway Virtual Server requires user certificates. If ICA traffic goes through a Citrix Gateway Virtual Server that requires user certificates (e.g. Smart Card), then each session launch will result in a PIN prompt. To prevent these extra prompts, build a separate Citrix Gateway Virtual Server that doesn’t have user certificates as Mandatory. Use Optimal Gateway to force ICA connections through the other Citrix Gateway Virtual Server. Note: SmartAccess Callback URL also cannot use a Citrix Gateway Virtual Server where client certificates are set to Mandatory, so the extra Citrix Gateway Virtual Server would be useful for that scenario too.

HDX Optimal Gateway can be configured in the StoreFront Console:

  1. Right-click the Stores node, and click Manage Citrix Gateways.
  2. Add more Citrix Gateways: one for each datacenter.
  3. When adding a Gateway, you can designate a Usage or role.
    1. The Gateway accessed through the active/active GSLB DNS name must be set to Authentication and HDX routing.
    2. The Gateways for Optimal Routing could be set to HDX routing only. Or if test users will use these datacenter-specific DNS names to connect to Gateways in specific datacenters, leave them set to Authentication and HDX routing. There’s no harm in leaving all of the Gateways set to Authentication and HDX routing.
  4. Go to Stores, right-click your store in the middle pane, and click Configure Store Settings.
  5. Go to the Optimal HDX Routing page.
  6. Highlight one of the datacenter-specific Gateways, and click Manage Delivery Controllers.
  7. Select the farms that should use this gateway, and click OK.
  8. Repeat for the other datacenter-specific Gateways.
  9. The Gateway for the active/active GSLB-enabled DNS name doesn’t need any farms associated with it.
  10. If you want to use Citrix Gateway internally for AppFlow reporting, then uncheck the External only checkbox.

    1. Another option for Optimal Gateway selection is zones. In XenApp/XenDesktop 7.7 and newer and Citrix Virtual Apps and Desktops, you can stretch a farm across datacenters (zones), and use a different Gateway for each zone. Highlight a Gateway. Click Manage Zones, and add the zone name. This assumes the zone name has also been specified in the Manage Delivery Controllers dialog box > Advanced Settings.
  11. Click OK when done.
  12. In summary, users will connect to the active/active GSLB-enabled Gateway and login. After clicking an icon, HDX will be routed through one of the datacenter-specific Gateways based on the farm the icon was launched from.

Multiple Gateways (GSLB) to One StoreFront Server Group

This section applies to SmartAccess, or SAML, and the Callback URL. If you don’t need the Callback URL for SmartAccess or SAML, then skip this section.

The Callback URL must go to the same Citrix ADC appliance that authenticated the user. If you have multiple Citrix ADC appliance pairs communicating with a single StoreFront server, then StoreFront needs to identify which Citrix ADC appliance pair the request came from, so it can perform a callback to that particular appliance pair.

If each of the Citrix Gateways uses the same DNS name (e.g. GSLB), then you can’t use the DNS name to distinguish one appliance from the other. Instead, StoreFront can use the Gateway VIP to distinguish appliances so the callback goes to the correct appliance.

  1. Create datacenter-specific callback DNS names. For example: callback-a.corp.com and callback-b.corp.com.
  2. The datacenter-specific callback DNS name must match the certificate on the Citrix Gateway Virtual Server that is handling the callback. Here are some options to handle the certificate requirement:
    • On the main Citrix Gateway Virtual Server, assign a wildcard certificate that matches both the GSLB name, and the datacenter-specific callback name.
    • On the main Citrix Gateway Virtual Server, assign an SSL certificate with Subject Alternative Names for both the GSLB name, and the datacenter-specific callback name.
    • Create an additional Citrix Gateway Virtual Server on the appliance. Bind a certificate that matches the datacenter-specific callback name.
  3. In the StoreFront console, create multiple Citrix Gateway appliances, one for each datacenter.
  4. Give each of the gateway objects unique Display names. You can’t have two Gateway objects with the same display name.
  5. Enter the same Citrix Gateway URL in all of the gateway appliances.

  6. In the Authentication Settings page, in the VServer IP address field, enter the Gateway VIP for this particular appliance pair. StoreFront will use this VIP to distinguish one Citrix ADC appliance from another.
    • When users use HTTP to connect to a Citrix Gateway for authentication and icon enumeration, when Citrix Gateway communicates with StoreFront, Citrix Gateway inserts its VIP into a HTTP Header field named X-Citrix-Via-VIP. StoreFront reads this VIP header, and compares it to the Gateway objects bound to the Store. If there’s a match, StoreFront uses the Callback URL configured for that Gateway object.
  7. The callback URL must be unique for each Citrix ADC appliance pair (e.g. callback-a.corp.com). The callback URL must resolve to a Citrix Gateway VIP on the same appliance pair that authenticated the user.

  8. When enabling Remote Access on the store, select both Gateway appliances. Select one as the default appliance. It shouldn’t matter which one is default.

Related Pages