Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
TABLE OF CONTENTS
Overview ..................................................................................................................... 2 Conceptual Architecture ............................................................................................ 3 Detailed Architecture ................................................................................................. 4 Next Steps ................................................................................................................. 12 Glossary .................................................................................................................... 13 Appendix: Remote PC .............................................................................................. 14 Appendix: XenClient ................................................................................................ 15 Appendix: Profile Policy Details ............................................................................. 16 Appendix: Session Policy Details ........................................................................... 18
Overview
Creating a virtual desktop design is often considered to be a complex activity where hundreds of decisions must be made that directly and indirectly impact other decisions leading to confusion. However, when focusing on the common use cases, which typically accounts for the largest percentage of users, many of the decisions simply follow best practices, which are based on years of real-world implementations. The Citrix XenDesktop 7 Blueprint provides a unified framework for developing a virtual desktop and application solution. The framework provides a foundation to understand the technical architecture for the most common virtual desktop/application deployment scenarios. At a high-level, a virtual desktop solution is based on a unified and standardized 5-layer model. 1. User Layer Defines the unique user groups and overall requirements 2. Access Layer Defines how a user group will gain access to their resources. Focuses on secure access policies and desktop/application stores. 3. Resource Layer Defines the virtual desktops and applications assigned to each user group 4. Control Layer Defines the underlying infrastructure required to support the users accessing their resources 5. Hardware Layer Defines the physical implementation of the overall solution The XenDesktop 7 blueprint details the recommended architecture for the three most common scenarios: 1. A standardized desktop environment 2. A fully customizable desktop environment 3. Applications Even though the blueprint focuses on these three common scenarios, XenDesktop 7 supports additional models, including: 1. Remote access to a users physical desktop, explained in Appendix: Remote PC 2. Improved management of traditional desktops, explained in Appendix: XenClient
User Layer
User Layer
User Layer
Access Layer
Access Layer
Access Layer
Resource Layer
Resource Layer
Resource Layer
Control Layer
Hardware Layer
Conceptual Architecture
When put into practice, the 5-layer virtual desktop model results in a conceptual architecture like the following:
User Layer Remote Executives
SSL
Access Layer Factory Line Remote Access Image OS: Windows 2012 Delivery: MCS
HDX
Hardware Layer
Personalization Personal vDisk: No User Profile: Citrix PM Server-Based OS Pool Physical Servers: Virtual Machines: Pools: Storage Type: Storage Space: Storage IOPS:
Personal Device
Executives Image OS: Windows 2012 Delivery: MCS Applications Installed App Inventory:
Office, FinApp, InvestTrack
Corporate Device
Physical Servers: Virtual Machines: Pools: Storage Type: Storage Space: Storage IOPS:
Control Layer Enumeration Traffic Access Controllers HDX Traffic StoreFront: 2 NetScaler Gateway: 2 Delivery Controllers XenDesktop: 2 Infrastructure Controllers Database Servers: 2 License Servers: 1 Infrastructure Server Pool Physical Servers: Virtual Machines: Pools: Storage Type: Storage Space:
Based on the conceptual architecture, the following can be discerned: Factory Line users utilize thin clients and directly access the desktop and app store where they receive a shared desktop based on Windows 2012, delivered with Machine Creation Services having a set of pre-installed applications appropriate for their role. Engineers, using corporate owned devices, directly access a Windows 7 personal desktop with a standard set of applications and the ability to install their own applications. Executives use multi-form factor devices (smartphones, tablets, etc) to access the environment remotely through NetScaler Gateway, which delivers their resources via the store, which are ondemand apps.
As can be seen, each user group has a specific set of requirements that XenDesktop 7 delivers, some that goes beyond the traditional VDI solution, but all integrated into a single architecture. Note: The three virtual desktop models identified within the conceptual architecture do not constitute the complete scope of XenDesktop. Additional virtual desktop models are defined within the Appendix.
Detailed Architecture
The high-level design for a standard virtual desktop solution is fairly straightforward by following the 5layer model, which guides an organization to define the user groups before determining how they will access their resources. Once these aspects are defined, the design is finalized by detailing how the solution is controlled and managed and how the hardware will support the defined solution.
User Layer
Aligning the user requirements with an appropriate virtual desktop is the initial step in creating a virtual desktop solution. Most environments typically have more than one type of user group with different requirements that must be met. However, even though there are many user groups within an organization, a large majority often fit into one of the three distinct scenarios, which are identified in the following table:
Users need access to A standardized desktop environment Users include Endpoints include Common location(s) include Local, trusted network IT Delivers
Factory line workers Retail clerks Bank tellers Nurses station users Call centers Office Workers Consultants Engineers Road Warriors Executives
Thin clients PCs (new and old) Laptops Tablets Smartphones Laptops
Local, trusted network or Remote, untrusted network Local, trusted network or Remote, untrusted network
On Demand Apps
Access Layer
Providing access to the environment includes more than simply making a connection to a resource. Providing the proper level of access is based on where the user is located as well as the security policies defined by the organization. In most environments, tougher security policies are put into place when users access the environment from a remote, untrusted network as compared to a local, trusted network. This often includes tougher authentication policies (like multi-factor authentication) and greater protocol protection with encryption and encapsulation. It is important to note that users might access the environment from different locations, requiring policies to be intelligent enough to detect and respond appropriately. Based on the locations defined for each user group, the following are the most common access layer recommendations.
Users connecting from Authentication Point Authentication Policy Session Policy Session Protocol (Profile)
Local, trusted network StoreFront Simple authentication (username and password) Not applicable ICA
Remote, untrusted network NetScaler Gateway Multi-factor authentication (username, password and token) Mobile and Non-Mobile ICA Proxy
Note: For Remote, untrusted network two different session policies are used to provide the correct user experience based on being on a mobile device (smartphone or tablet) versus a non-mobile device (laptop or desktop). The details for the session policies are detailed in Appendix: Session Policy Details.
Resource Layer
Users need access to their resources, whether those resources are desktops or applications. The configuration of the resources must align with the overall needs of the user groups. In order to align each resource with each user group, the resource is defined across three separate but integrated layers:
Image
The first part of the image definition is selecting the right operating system, which is based on the type of desktop IT delivers to the user as well as the standards for the organization. Shared Remote Desktop Services: Windows 2012 or Windows 2008R2 Virtual Desktop Infrastructure: Windows 8 or Windows 7 Apps on Demand: Windows 2012 or Windows 2008R2
The second aspect of the image definition is the delivery fabric, which is independent of the selected operating system. XenDesktop 7 includes two integrated solutions focused on providing different benefits to an organization. These options are: Machine Creation Services (MCS): Utilizes the hypervisor and storage infrastructure (local or shared storage) to create unique, thin provisioned clones of a master image, which can either be a desktop-based OS or a server-based OS. Due to the focus on simplicity, MCS requires no extra hardware and utilizes functions within the hypervisor. Due to the simplicity of MCS, it is the recommended option for deployments that do not require desktop delivery to physical targets. Provisioning Services (PVS): Utilizes the network infrastructure to deliver required portions of an image, just-in-time, to a physical or virtual machine with either a desktop-based OS or a server-based OS. Although PVS does require additional virtual servers to host the PVS technology, it can save on storage costs reducing read IOPS across any hypervisor.
Applications
The most important aspect of the resource layer is the applications, which is what the users are trying to access. In order to have a successful application delivery solution, the appropriate applications must be Installed: The applications are installed in the master image. Even though this option can result in a greater number of master images if the application sets between user groups greatly differ, it is the recommended approach due to its simplicity and familiarity. Streamed: The applications are dynamically delivered to the virtual/physical desktop/server when requested, with a solution like Microsoft App-V. This solution requires new
Personalization
The first part for defining the levels of personalization allowed for each user group is to define the need for Personal vDisk, which should only be used for those users who have the requirements of installing and managing their own set of applications. Users who are granted use of the Personal vDisk still rely on a standard master image except all user changes are stored in a dedicated, persistent virtual disk. This technique allows an administrator to update and maintain the master image while user-level changes persist. The second part of the personalization definition is deciding on the profile policy for each user group. Ideally, each user group should have the same policy in order to make management and troubleshooting easier, but different policies can be used if required. The recommended base profile policy is as follows:
Profile Management Policy Basic Settings: Enable Profile Management Basic Settings: Path to User Store Basic Settings: Process logons of local administrators File System: Exclusion list directories File System: Directories to Synchronize File System: Files to Synchronize File System: Folders to Mirror Profile Handling: Local profile conflict handling Streamed User Profiles: Profile streaming Folder Redirection: AppData(Roaming) Folder Redirection: Contacts Folder Redirection: Desktop Folder Redirection: Documents Folder Redirection: Downloads Folder Redirection: Favorites Folder Redirection: Music Folder Redirection: Pictures Folder Redirection: Videos Setting Enabled Select path (organization specific) Enabled See Appendix: Profile Policy Details See Appendix: Profile Policy Details See Appendix: Profile Policy Details See Appendix: Profile Policy Details Delete local profile Enabled Path
The final portion of the personalization definition is the assignment of user/computer policies. The user/computer policy helps define how the session is configured based on the users end point device, location or accessed resource. Recommended policies are as follows:
Once defined, each policy must be properly applied to the right set of objects and scenarios. These policies are applied as follows:
Policy Name Unfiltered Remote access policy Local access policy Mobile device policy Settings or Template Not applicable Template: Optimized for WAN Template: High Definition User Experience Mobile Experience Automatic keyboard display: Allowed Launch touch-optimized desktop: Allowed Remote the combo box: Allowed Assigned to Not applicable Access Control With NetScaler Gateway Access Control Without NetScaler Gateway User group name
Control Layer
Every major design decision made for all user groups in the User, Access and Resource layers are used as a whole to help design the control components of the overall solution. The design decisions for each user group are met by incorporating the correct control layer components, which includes access controllers, delivery controllers and infrastructure controllers.
Access Controllers
Access controllers are responsible for providing the connectivity to the resources as defined by the Access Layer. In order to provide access to the environment for users who are internal and external, two components are required: StoreFront: Internal users access a StoreFront store either directly through Citrix Receiver or via the StoreFront web page. StoreFront not only provides a complete list of available resources for each user, but it also allows users to favorite certain applications, which makes them appear prominently. The subscriptions are synchronized to the other StoreFront servers automatically. Upon successful authentication, StoreFront contacts the Delivery Controller to receive a list of available resources (desktops and/or applications) for the user to select. Redundant StoreFront servers should be deployed to provide N+1 redundancy where in the event of a failure, the remaining servers have enough spare capacity to fulfill any user access requests. NetScaler Gateway: Remote users access and authenticate to the NetScaler Gateway, which is located within the networks DMZ. Upon successful validation against Active Directory, NetScaler Gateway forwards the user request onto StoreFront, which
Delivery Controllers
The delivery controllers manage and maintain the virtualized resources for the environment. The delivery controllers receive the authentication information from the access controllers and enumerate a list of resources granted to the user. As users make requests to a resource, the delivery controller brokers the connection between the user and resource. The authentication, enumeration and launching process is as follows:
User Layer Remote Executives Remote Access
1, 9, 14
Hardware Layer
Server-Based OS Pool
16 15 2 3, 9
Executives Applications
Physical Servers: Virtual Machines: Pools: Storage Type: Storage Space: Storage IOPS:
Thin Client
Image
Local Engineers
13 4 5, 10
Corporate Device 14
Physical Servers: Virtual Machines: Pools: Storage Type: Storage Space: Storage IOPS:
Control Layer
7, 11
Infrastructure Server Pool Infrastructure Controllers Physical Servers: Virtual Machines: Pools: Storage Type: Storage Space:
2. 3.
4.
5. 6. 7. 8.
StoreFront forwards the user credentials to the Delivery Controllers (80 or 443), which could be a virtual address hosted by a load balancer. The Delivery Controller validates the credentials against Active Directory (389). Once validated, the XenDesktop Delivery Controller identifies a list of available resources by querying the SQL Database (1433). The list of available resources is sent to StoreFront (443), which populates the users Citrix Receiver or browser (80 or 443). A resource is selected from the available list within Citrix Receiver or browser. The request is sent to StoreFront (443). The list of available resources is sent to StoreFront (443), which populates the users Citrix Receiver or browser after passing through NetScaler Gateway (80 or 443). A resource is selected from the available list within Citrix Receiver or browser. The request is sent to StoreFront through NetScaler Gateway (443).
9.
StoreFront forwards the resource request to the Delivery Controller (80 or 443). The Delivery Controller queries the SQL Database to determine an appropriate host to fulfill the request (1433). The Delivery controller sends the host and connection information to StoreFront (443). StoreFront creates a launch file, which is sent to the user (443). StoreFront requests a ticket by contacting the Secure Ticket Authority (80 or 443), which is hosted on the Delivery Controller. The STA generates a unique ticket for the user, which is only valid for 100 seconds. The ticket identifies the requested resource, server address and port number thereby preventing this sensitive information from crossing public network links. StoreFront generates a launch file, including the ticket information, which is sent to the user through NetScaler Gateway (443).
Citrix Receiver uses the launch file and makes a connection to the resource (1494 or 2598).
Citrix Receiver uses the launch file and makes a connection to the NetScaler Gateway (443). NetScaler Gateway validates the ticket with the STA (80 or 443) NetScaler Gateway initiates a connection to the resource (1494 or 2598) on the users behalf.
In addition to the authentication, enumeration and launching process, the delivery controllers manage and maintain the state of the XenDesktop site to help control desktop startups, shutdowns and registrations. The controllers constantly query and update the Microsoft SQL Server database with site status, allowing controllers to go offline without impacting user activities. Redundant delivery controllers should be configured to ensure availability of the site should a single controller fail.
Infrastructure Controllers
In order to have a fully functioning virtual desktop environment, a set of standard infrastructure components are required. These components include: Network Services, like DNS and DHCP, for name resolution and IP address assignment. Active Directory for user authentication
Hardware Layer
The hardware layer is the physical implementation of the virtual desktop solution. It includes decisions on the storage fabric and server footprint, which are often decisions made based on relationships organizations have with different vendors. The selection of a type of storage directly impacts the recommend type of server just like the type of server selected directly impacts the recommended storage.
Storage Fabric
Storage is often considered one of the most important and complex decisions in a virtual desktop solution. In addition to impacting the cost of the solution, the selected storage fabric also impacts the available options for physical server footprint, which is why selecting a storage solution is the first step in the hardware layer design.
Storage Type Local Storage Benefits Inexpensive Simple to deploy Concerns Virtual machines are inaccessible if physical server is offline Limited number of disk spindles (based on server design) Longer operational processes as each local store must be updated Failure on DAS array can impact multiple physical servers DAS interconnects consume valuable space in a blade chassis Limited number of connections to a DAS array Expensive Complex Often requires storage tiers to control costs Appropriate for Rack servers
Rack servers
Centralized Storage
Shared master image across physical servers Virtual machine migration when physical server is offline Simple expansion Advanced features to help offset costs
Blade servers
Regardless of the storage fabric selected, an appropriate amount of storage resources (space and IOPS) must be available in order to provide an acceptable user experience.
Server Footprint
At the hardware layer of the virtual desktop design, organizations must decide on the hardware footprint, which generally is a decision between blade servers and rack servers.
Benefits Higher density within same amount of rack space Consolidated network cabling requiring fewer core switch ports Large amount of local storage Adding network capacity simply requires new network card
Concerns Upfront costs are generally higher Limited amount of internal storage Greater power requirements Uses more switch ports Less density within a rack
Appropriate for Large deployments with shared storage Large or small deployments with local storage
Rack Servers
Next Steps
The XenDesktop 7 blueprint is the first step towards delivering a virtual desktop solution within an organization. Based on the unified infrastructure of XenDesktop 7, there are few decisions that fundamentally impact the overall architecture. In fact, the two decisions that are unique for each organization are contained within the Hardware layer and are based solely on the organizations anticipated deployment size and existing relationships with storage and server vendors. To learn more about the potential a solution like XenDesktop 7 can provide, it is recommended to follow the prescribed roadmap in order to gain knowledge and firsthand experience. XenDesktop 7 Blueprint: A layered solution for all successful designs & deployments, focusing on the common technology framework and core decisions. Getting Started Guide: Prescriptive guide for getting 5-10 users deployed quickly and easily in a non-production environment. Key Project Design Guides: Recommended designs, with hardware layer planning numbers, for commonly used implementations, which can be combined together to form a more complete solution.
Glossary
Hosted Shared Desktop: A type of virtual desktop based on a Windows server operating system. This type of virtual desktop is sometimes referred to as Remote Desktop Services (RDS) or Hosted Server Virtual Desktops (HSVD). With Hosted Shared Desktop, multiple users share the same desktop but their sessions are separated through session virtualization. Machine Creation Services: An image delivery technology, integrated within XenDesktop that utilizes hypervisor APIs to create unique, read-only and thin provisioned clone of a master image where all writes are stored within a differencing disk. On Demand Apps: A type of virtual desktop based on Windows server operating system. This type of virtual desktop is sometimes referred to as virtual applications, published applications or seamless applications. On Demand Apps are similar in approach to Hosted Shared Desktops, except that the physical desktop interface is hidden from the user. When a user uses an On Demand App, they only see the application and not the underlying operating system, making On Demand Apps a powerful solution for mobile devices. Personal VDI: A type of virtual desktop based on a Windows desktop operating system. This type of virtual desktop provides a unique Windows desktop to each user either for the duration of the session or indefinitely. Personal vDisk: A technology used on conjunction with Personal VDI desktops allowing for complete personalization while still utilizing a single, read-only master image. Any changes made the master image are captured and stored within a virtual hard disk attached to the virtual machine. Changes are cataloged in order to allow an administrator to update the master image without impacting user-level changes. Provisioning Services: An image delivery technology, integrated within XenDesktop, which utilizes PXE booting and network streaming. A target device requests and receives appropriate portions of the master image from the provisioning server when needed. Any changes made during the duration of the session are stored in a temporary write cache. Profile Management: A user profile solution, integrated with XenDesktop, that overcomes many of the challenges associated with Windows local, mandatory and roaming profiles through proper policy configuration. Profile Management improves the user experience by capturing user-based changes to the environment and by improving user logon/logoff speed.
Appendix: Remote PC
Citrix Remote PC provides the flexibility associated with VDI, where users can work from any location or on any device, without the upfront hardware, storage and licensing costs. Remote PC utilizes the same underlying infrastructure required to support XenDesktop 7, except that no additional hardware is required to support the desktops because the desktop still exists on the users physical endpoint, which is depicted in the following diagram.
User Layer Remote User
SSL
Access Layer
Resource Layer
Hardware Layer
Personal Device
HDX
Engineers Image
HDX
XML
Control Layer Enumeration Traffic Access Controllers HDX Traffic StoreFront: 2 NetScaler Gateway: 2 Delivery Controllers XenDesktop: 2 Infrastructure Controllers Database Servers: 2 License Servers: 1 Infrastructure Server Pool Physical Servers: Virtual Machines: Pools: Storage Type: Storage Space:
Remote PC essentially provides a secure, remote access solution to the users physical desktop, w hether that location is a meeting room within the same building, a home office or at a conference halfway around the world.
Users need access to Their physical desktop Users include Endpoints include Common location(s) include Local, trusted network or Remote, untrusted network IT Delivers
Remote PC
Remote PC utilizes the following components: NetScaler Gateway to provide secure, remote access to the users physical desktop StoreFront to provide the users with a list of resources, which includes their physical desktop Desktop Delivery Controller to enumerate and connect users to the appropriate desktop Database server to store the configuration and connection information for the user and desktop License server to provide the necessary access license to the users desktop
Appendix: XenClient
Citrix XenClient extends the benefits of desktop virtualization to corporate laptops so users can work from anywhere and at any time, whether they have slow, intermittent or no network access. In addition, with Citrix XenClient, IT is better able to manage and secure the distributed desktop environment while continuing to use a traditional endpoint device, like corporate laptops or desktops. As XenClient requires a minimal infrastructure, the costs associated with a XenClient solution are significantly lower than traditional VDI solutions.
User Layer Remote User
SSL
Access Layer
Resource Layer
Hardware Layer
Synchronizer
Control Layer Synchronization Traffic Access Controllers NetScaler Gateway: 2 Delivery Controllers Synchronizer: 2 Infrastructure Controllers Database Servers: 2 License Servers: 1 Infrastructure Server Pool Physical Servers: Virtual Machines: Pools: Storage Type: Storage Space:
XenClient provides a solution for IT to better manage desktops that cannot be centralized due to connectivity limitations or datacenter server and storage costs. Based on the user requirements and configuration, a user can either receive a standard desktop with limited personalization or a completely personal desktop experience utilizing Personal vDisk technology.
Users need access to A personalized local desktop Users include Endpoints include Common location(s) include Remote locations with limited connectivity Training centers Distributed offices IT Delivers
Road Warriors
Laptops
XenClient
Desktops
XenClient
XenClient utilizes the following components: NetScaler Gateway to provide secure, remote access to Synchronizer Synchronizer to deliver and manage the distributed local virtual machines Database server to store the configuration and delivery information for the user and desktop License server to provide the necessary license to the users desktop
Synchronized Directories
Synchronized Files
Mirrored Folders
AppData\Roaming\Microsoft\Windows\Cookies
The copyright in this report and all other works of authorship and all developments made, conceived, created, discovered, invented or reduced to practice in the performance of work during this engagement are and shall remain the sole and absolute property of Citrix, subject to a worldwide, non-exclusive license to you for your internal distribution and use as intended hereunder. No license to Citrix products is granted herein. Citrix products must be licensed separately. Citrix warrants that the services have been performed in a professional and workman-like manner using generally accepted industry standards and practices. Your exclusive remedy for breach of this warranty shall be timely re-performance of the work by Citrix such that the warranty is met. THE WARRANTY ABOVE IS EXCLUSIVE AND IS IN LIEU OF ALL OTHER WARRANTIES, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE WITH RESPECT TO THE SERVICES OR PRODUCTS PROVIDED UNDER THIS AGREEMENT, THE PERFORMANCE OF MATERIALS OR PROCESSES DEVELOPED OR PROVIDED UNDER THIS AGREEMENT, OR AS TO THE RESULTS WHICH MAY BE OBTAINED THEREFROM, AND ALL IMPLIED WARRANTIES OF MERCHANTIBILITY, FITNESS FOR A PARTICULAR PURPOSE, OR AGAINST INFRINGEMENT. Citrix liability to you with respect to any services rendered shall be limited to the amount actually paid by you. IN NO EVENT SHALL EITHER PARTY BY LIABLE TO THE OTHER PARTY HEREUNDER FOR ANY INCIDENTAL, CONSEQUENTIAL, INDIRECT OR PUNITIVE DAMAGES (INCLUDING BUT NOT LIMITED TO LOST PROFITS) REGARDLESS OF WHETHER SUCH LIABILITY IS BASED ON BREACH OF CONTRACT, TORT, OR STRICT LIABILITY. Disputes regarding this engagement shall be governed by the internal laws of the State of Florida.
954-267-3000
http://www.citrix.com
Copyright 2013 Citrix Systems, Inc. All rights reserved. Citrix, the Citrix logo, Citrix ICA, Citrix XenDesktop, and other Citrix product names are trademarks of Citrix Systems, Inc. All other product names, company names, marks, logos, and symbols are trademarks of their respective owners.