Desktop close to the user, app close to the data

Picture a global organization with:

• Centralized applications: engineering, finance or line-of-business apps hosted in one primary datacenter, close to their databases and file stores.
• Users distributed globally across several regions.
• Local datacenter presence in each major region.

The design question is how to keep users close to their desktops for a responsive experience, while each application still runs in its own defined location, close to its data. The App Farm also has to stay unreachable from anywhere except the virtual desktop.

If you publish apps directly to every user from the central site, distant users get high latency. If you replicate the apps into every region, you get data-latency problems, licensing overhead and operational sprawl.

The architecture: double hop

Layer	Purpose	Location	Access URL
Desktop Farm	User's daily virtual desktop	Regional datacenter, near the user	desktop.<company>.cloud.com
App Farm	Centrally hosted published apps	Defined app location, near the data	apps.<company>.cloud.com (dedicated)

The flow:

1. The user opens the desktop Workspace URL from any endpoint and launches the desktop from the nearest Desktop Farm.
2. Inside the desktop, the user opens the dedicated app Workspace URL and signs in with SSO.
3. The application launches from the App Farm as a second hop, over the private datacenter-to-datacenter network.
4. If the user opens the app URL directly from a laptop or an external network, no apps are shown.

Figure 1: The double-hop path, and the direct path that is blocked

Restricting the App Farm to the Desktop Farm

I first tried filtering only on the Workspace URL with SmartAccess conditions. Broker simulation looked right, but live enumeration didn't behave consistently. Adding network-location-based Adaptive Access to the same rule gave a reliable result: the app URL and the Desktop Farm's network location must both match.

Step 1: Enable Adaptive Access in Citrix Cloud.

Step 2: Create a Network Location for the Desktop Farm's public egress IP range. Give it a meaningful tag such as DESKTOPFARM and set the connectivity type to Internal, so the launch bypasses the gateway.

Figure 2: Network location for the Desktop Farm egress IP, tagged DESKTOPFARM and set to Internal

Step 3: Configure the access policy on the App Farm delivery group. Select Match all and add both criteria:

• Filter Citrix.Workspace.UsingDomain, with the app Workspace URL as the value.
• Filter Workspace, with the location tag as the value: LOCATION_TAG_DESKTOPFARM.
• Disable or remove any default rule that allows connections without these criteria. Otherwise the restriction can be bypassed.

Figure 3: App Farm access policy, with the URL and location tag combined under Match all

Part of the location tag appears in mixed case in Figure 3. Citrix documents the value in upper case, so use upper case in your own policy. With Adaptive Access on, Citrix treats Workspace requests as Gateway connections, so these criteria belong on the Citrix Gateway connections rule. Also manage users for these delivery groups through Studio policies, which Citrix requires when enumeration depends on network location.

Step 4: Publish each farm to its own URL: the App Farm only to the dedicated app Workspace URL, and the Desktop Farm only to the desktop URL.

Before you widen the scope, validate the rules and check the tags on a live session:

Get-BrokerAccessPolicyRule -DesktopGroupName "<App Farm>"
Get-BrokerSession -DesktopGroupName "<App Farm>" | Select-Object UserName, SmartAccessTags

Validation results

#	Scenario	Path	Result	Network latency	ICA RTT
1	Endpoint → desktop URL → desktop	Endpoint → Gateway Service → Desktop Farm VDA	Allowed	~247 ms*	~290 ms*
2	Inside desktop → app URL → app (SSO)	Desktop VDA → App Farm VDA, same private network	Allowed	~1 ms**	~2 ms**
3	Endpoint → app URL → app	Outside the defined network location	Not enumerated	–	–
4	Endpoint → desktop URL → App Farm apps	Wrong Workspace URL	Not visible	–	–

*The PoC endpoint connected to a distant test resource location. Of the 247 ms, 30 ms was client to Gateway POP and 217 ms was Gateway POP to VDA. With the Desktop Farm in the user's region, the larger segment should drop.

**Both VDAs were on the same private network in this PoC. Treat this as a best case: across regions, hop 2 will rise to the latency between those datacenters.

Figure 4: Hop 1, desktop launched through Gateway Service from the Desktop Farm

Figure 5: Hop 2, app launched from inside the desktop, with the Desktop VDA shown as the endpoint

In monitoring, the published app ran from inside the user's desktop session, which confirms the double-hop launch works. The session topology showed the Desktop VDA as the endpoint connecting directly to the App VDA, with no extra gateway traversal.

Benefits

• Better user experience. The desktop is near the user and the app is near its data.
• Network-restricted app tier. Apps can't be enumerated from outside the defined network location or from other URLs.
• Clean separation. Desktop images and app images can be patched, scaled and lifecycle-managed independently.
• Dedicated app URL. The app tier gets its own front door, policies and authentication controls.
• Regional desktops. Users work from a desktop in their own region, while each app stays in its defined home location.

Wrapping up

Network location gave this design its boundary: the desktop can be used from anywhere, while the App Farm answers only when the request comes from the Desktop Farm through the right URL. The trade-off is a second hop to test and operate.

Have you solved this with double hop, regional app replication or something else? I'd like to hear what worked in your environment.

References

• Adaptive access based on the user's network location
• Resource filtering in Citrix Workspace
• Connectivity to DaaS resources
• Double hop in Citrix DaaS

About Me

 On 10th of January 2023 my existing organization told me that in they have evolved into a new business model and they let go many talents and in that one was me. 

I had anticipated it but thought let it happen then we will plan. <--- Looking at current circumstances and market situation, I should had a "Plan B" ready.

It's important to maintain a positive attitude and believe that everything happens for a reason. However, it can be difficult to shift careers, especially at an older age and in the context of India's strong family and social structures. It is especially important to be selective when considering new job opportunities at this stage in your career, as you likely have limited time left before retirement.

What kind of job am I looking for ? 

Before I answer this let me provide you my brief career background

I started my IT career in 2000 with Sonkh Technologies then worked with UV Infotech , Computer Associates , Tata Consultancy Service , Infosys and recently with Citrix.

Technical : How Technical am I?

I began my consulting career at Infosys, providing VMWare consulting services to various customers across different industries for nearly 5 years. I assisted Infosys clients in selecting the appropriate VMWare products (SRM/ESXi) and developing solutions based on their needs. During this time, I also designed solutions using HP Blades and worked with storage products such as NetApp. I also helped many customers with the process of converting their critical physical application servers to a virtual platform hosted on ESXi. (Check  Linkedin recommendation section)

I was hired Citrix by my Guruji Girish Gupta (even now he is my guru) in 2010 and joined as a Principal Consultant for End User Computing .This was direct customer facing role where I use to understand customer business requirements and then design Citrix solution around it. I was a single man army who needs to have knowledge around Hardware (Blade, PC , Printer) /Storage /Active Directory / Networking / Database (SQL) /Anti Virus/ Cloud (AWS/Azure /OCI /GCP)

Throughout my career, I progressed from a consultant to an Architect and eventually a Senior Architect. During this time, I gained experience across a range of industries, including ITeS, Manufacturing, Telecom, Pharma, Retail, Government, Public Sector, Education, KPO-BPO, and Public and Private Banks. As I moved into higher-level roles, my responsibilities broadened beyond technical expertise to include leading teams of technical consultants, conducting webinars for partners, and assisting presales engineers with solution positioning. I remained in this technical role until 2021. My technical testimony is available on my blogs and if required reference can also be provided. 

 In 2021 , I decided to move beyond technical role. I joined team of Enterprise Architect under the leadership of Daniel Watson . We become part of customer success organization under the leadership of Gregor Preidl. 

We started helping customer success organization by helping customers and sales organization:

• Establishing and aligning architectural direction and principles within customer organizations.
• Providing strategic roadmap recommendations based upon existing data sets or analysis of a customer's current platform(s).
•  Providing guidance and advisory services to Service Delivery Organization to ensure successful outcomes in multi-vendor / multi - organization programs.
• Provide technical guidance ,validate technical concepts ,perform quality check and validate leading practice for all the consulting projects.
• Position premium support service offering based on customer needs.
• Prepare RFP response. 

Recognization : In the year 2021

 

Training : Attended TOGAF training in 2021 -2022

Business : Do I understand Business ?

I have been provided additional responsibilities of Service Relationship Manager to help and drive business for customer success organization for India region. 

• Identify new revenue generating opportunities and programs by leveraging internal resources including Marketing, Technical Relationship Managers, Consulting, Account Managers.
• Write Statement of Work on behalf of Citrix Professional Service 
• Use a “medium-to-long range” planning horizon sales strategy, ensuring that day-to-day tasks are being carried out effectively, while anticipating and planning for long-term growth.
• Manage and build Consulting, Support and Education sales pipeline and accurately forecast quarterly revenues using SalesForce 
• Work with Citrix Sales, Citrix Presales, CSA and SI partners and others to qualify, manage and close Consulting opportunities
• Develop and deliver Consulting and Education presentations at Executive Briefings, and client sites
• Schedule and conduct quarterly account reviews with Enterprise Relationship Managers to identify Consulting and Education opportunities.
• Successfully meeting 100 percentage target quote of 2 Million for last two year (2021 - 2022) 

Switching back to previous question : What kind of job I am looking for ?

• If your organization is planning digital transformation, I can help you with Digital Transformation journey.
• If you are an ITeS organization , I can play business development architect and align with your various transformation unit during pre and post sales activities
• If you are OEM , I can help you drive business around customer success portfolio.
• If you are consulting organization, I can help you drive this business for you
• If need someone to drive premium support business , I can help you with that

If you need resume in  PDF or PPT format then drop me a note on my email ID

Restrict AGEE users from specific IP

Writing after Feb 2016 . What I am going to write about ? Today I am going to show the way to restrict set of Internet users accessing AGEE URL  
Here is the use case behind it. There are set of users  who need to be restrict to access AGEE URL over internet so that they access it when trying from specific subnet . At the same time other users should be allowed to access from anywhere. How can we achieve this?
We thought of using AAA group and restricting it using session policy. We created two AAA group matching AD group, one which needs to be restricted and other unrestricted.

Now we created two policies . One which has AD group allowed only from specific set of IP . So how it’s expression looks like ?

And if you look at the session profile , we have bind this AD group under Gateway session profile –>security –>Advance –>

For the other set of we mapped the other profile with no IP is defined and profile is tagged to different set of session policy

Once this is created we have to check if the policy is getting hit when user try to access we will use following command  “ nsconmsg -g pol_hits -d current “

Please provide feedback so that we can improve incase needed.

StoreFront HighAvilibility and Application aggregation

Warning :Hold your breath and read this maxi post . I am planning to get little bit about the design as well. Lets start the requirement and how to achieve the same.

Requirement  :I wanted to aggregate resource from two site and show single icon to the users. I started with following KEYWORD option suggested but it just make the published application as primary and secondary. It will not aggregate the application as single icon. To get application aggregated we have to follow below steps .

We have two sites one in Mumbai and other in Chennai . Both site have their own farm but  HighAvailability (and not the loadbalancing) is required between  two sites. It would have been easier if we had single farm setup across the site as explained in my previous blog. In order to get that we have to create two resource group or delivery group at both the site and map users to those two delivery group .

What is the problem in doing it ?

If we map same set of users to both the site then user will see two icon for same resource and will unsure which one to click for Mumbai or Chennai.

What is the plan ? Plan is to get HSD/Paint/Calculator/Notepad published for both Mumbai and Chennai users. Below diagram represent that we have two separate farm with two separate SF server group .

                                                                                                                                   Figure

Plan A To make simpler for the users , show one icon from both the site (HSD) and only icon from the respective site. Above figure shows for PlanA user in Mumbai see icon of paint and user in Chennai will see icon of Calculator though user have access to both the app.  When users hit https://mumbai.company.com they will land on StoreFront of Mumbai and will get aggregated resource from Mumbai/Chennai . When XDC of Mumbai is down , they will get failover to Chennai .

Prerequisite for it : Citrix suggest to make changes in web.config file located under the store  C:\inetpub\wwwroot\Citrix\storename\ directory, where storename (not the storeweb ) is the name specified for the store when it was created. There will be section within Web.config find out following section

Now file which needs to be included between above selection should look like this  . But how do I get all these detail?

Make sure you gather it before hand and then start making changes.

To get  value for name= domain\usergroup and sid=“Securityidentifier” use AD power shell. I would suggest map “EveryOne” or “Domain Users” so that latter you don’t have to make changes every now and then

equivalentFarmSet name="setname"                          :    This can be Mumbai or Chennai based on which location I am specifying

loadBalanceMode="{LoadBalanced | Failover}          : I have chosen Failover mode as I want to configure users to failover to other site

aggregationGroup="aggregationgroupname"           :  You can provide any name for the convenient . This can be same for both the site.

farm name="primaryfarmname"                                      :Most of the time people make mistake to understand what exactly it is and how to get it. If you  check storefront configuration for delivery controller it is the name of   that set. And this is how it looks like. For Mumbai aggregationgroupname is “MumbaiController” and for Chennai it is “ChennaiController”, also this is case sensitive .

Note: StoreFront at both the site will have entry for all the XDC as shown below . MumbaiController will have XDC entry for Mumbai and ChennaiControler will have XDC entry for Chennai.

So what editior should I use it edit web.confi? I have tried many other editor like XML notepad but then found Oxygen XML editor very helpful .

The other reason I would suggest oXygen is because it will help you with tagging .

Wrong tagging

So here is the config file for Plan1.  Changes need to made on both the site StoreFront and flip the order so that first site should be local site and second site will be remote site. Also note the change in this line

<resourcesWingConfigurations>
  <resourcesWingConfiguration name="Default" wingName="Default">

VS

<resourcesWingConfigurations>
  <resourcesWingConfiguration name="Default" wingName="Default"  /> While making changes make sure you remove  “/”

For Mumbai                                                                                              For Chennai

Plan B To make simpler for the users , show one icon from both the site and all the published application for the users.  When users hit https://mumbai.company.com they will land on StoreFront of Mumbai and will get aggregated resource from Mumbai/Chennai  and all the other resources which user has been assigned. Referring to above figure, user at both the site can see all the application (HSD/Notepad/Paint/Calculator)irrespective of the sites he/she belongs to.

  For Mumbai                                                                                                 For Chennai

Once the configuration is completed , StoreFront will point to both the XDC and changes can not be made. So it is important to make necessary changes prior to editing the web.config

To achieve this I have refer various blogs,article and to name few:

1 Citrix Blog and here

2. euc.consulting

3. LalMohan

4. vhorizon.co.uk

Meanwhile vhorizon.co.uk has published latest blog for  StoreFront 3.1 . Currently SF3.1 is TP and is not supported under LTSR release.

Preparing Lotus Notes for Hosted Shared Desktop (XenApp)

To start with Lotus Notes instalaltion use following  command                                                        
D:\Lotus\setup.exe /v"SETMULTIUSER=1 MULTIUSERBASEDIR=H:\notes\data MULTIUSERCOMMONDIR=C:\SharedNotesData CITRIX=1

Choose next
 



After installation right click on the shortcut of lotus notes and add the line "=H:\Notes\Data\notes.ini"

• After this User NSF file is required to be copied to <<MultiUserBaseDir>> path given during installation.
• Also require copying all the content given in <<MultiUserCommonDir>> to <<MultiUserBaseDir>>
• There is logon script which we can use to simplify last step

Inputs for this blog is from Vipul Tripathi