A mobile workspace provides consistent, seamless and secure mobile access to applications, content and communications on any user or corporate device, anywhere. Learn more: http://www.cisco.com/c/en/us/solutions/enterprise-networks/mobile-workspace-solution/index.html

1. Mobilize Employees with the
Cisco Mobile Workspace
Solution
Mike Jessup, Engineering Tech Lead, Systems Development Unit, Cisco Systems
Marcelo Brosig, Solution Architect, Americas Strategic Alliances, Citrix Systems
John Monaghan, Consulting Systems Engr., EMEAR Enterprise Networking, Cisco Systems
June 4 2014

2. Security
Infrastructure
What is a Mobile Workspace?
MOBILE EXPEREINCESMOBILE DEVICES MOBILE APPLICATIONS
COMPLETE END-TO-END
MOBILITY SOLUTION
SIMPLIFIED DEPLOYMENT
AND SUPPORT
LINKED INFRASTRUCTURE
AND MOBILE APP POLICY
INFRASTRUCTURE AND
MOBILE APP EXCELLENCE
Native | Virtual | HTML5 | SAAS| Voice | Video
OFFICE | MOBILE | TELE
A mobile workspace provides consistent, seamless and secure mobile access to
applications, content and communications on any user or corporate device,
anywhere.

3. Cisco Confidential 3© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Sources: *Accenture CIO 2013 Survey ** Gartner Research *** IDC Research **** Nemertes 2013
Customer Challenges with BYOD and Mobility
Application Support
• How to provide access to Legacy
applications (Windows, Office,
others)?
• App and Desktop Virtualization
shifting to Mobile use cases
• Mobile App Lifecycle including
Portability, Development Costs
Complexity and Confusion of
Solutions in the Market
• Should I use an MDM? Which one?
• How do I secure it?
• Which security technologies?
• How will HTML5 affect my strategy?
• Cloud vs On-premise?
BYOD is just a subset
• CYOD – Choose Your Own Device,
corporate assets
• Ownership is less important, its
about managing/securing data
Data Loss Prevention Strategy
• Compliance with industry/government
regulations (HIPAA, PCI, S-Ox, etc.)
• Balancing Security with User Experience
WiFi Growth and Reliability
• Number of devices, 40-100% Y/Y growth
• Mobile applications driving higher bandwidth
requirements 802.11ac (and LTE)
• Ubiquitous wired-like service expectation

4. Cisco Confidential 4© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Cisco Mobile
Workspace
with Citrix
Solution
Differentiators
• Simplified integrated solution – customers do not have to
select/integrate many technologies
• Modular building-block approach provides insertion for
different buying centers: network, security, desktop,
mobility, application
• Seamless zero touch BYOD onboarding (ISE and
XenMobile integration)
• Mobile data protection for security/compliance for
Healthcare, Finance, Retail, etc.
• Flexible support for all application delivery models (native,
virtual, HTML5, SaaS, collaboration)
• Improved Mobile User Experience (Cisco WLAN prioritizes
Citrix protocol/traffic)
• Validated designs mitigate deployment risk with proven
reference architectures

5. Cisco Confidential 5© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Architecture and Components
The Mobile Workspace Solution Components
Mobile Productivity
Application Delivery
Any Device Applications and
Content
Core Infrastructure + SecurityUnified Access, Secure Access
Mobile Networking
Unified Data Center, Security Services
Cloud Infrastructure
ISE, AnyConnect
Network Policy Control
XenMobile
Mobile Device Management
XenMobile, Storefront
Unified App Store
XenApp, XenDesktop
App/Desktop Virtualization
Mobile Collaboration
Unified Comms, Jabber, WebEx
Mobile Data Security
Worx Mobile Apps, ShareFile,
Receiver
BYOD Solution
Components
Desktop Virtualization
Solution Components
Mobile Workspace
Solution Components
Mobile Policy

6. Cisco Mobile Workspace Solution With Citrix: Benefits
Complete Best-in-Class B2E Mobile Solutions and Services
Best for
BUSINESS
Best for
IT
Best for
END USERS
§ Single architecture
accelerates, enabling mobile
workstyles, apps
SIMPLE
§ Integrated modular, validated
solution for faster risk-free
deployments
§ Easy, seamless mobile
device on-boarding and
app experience
§ Protecting access, data, and
applications for maximum risk
mitigation
SECURE
§ Centralized, multilayer policy
management, and
enforcement: users, access,
devices, data, apps
§ Worry-free secure access
for any app on any device,
anywhere
§ Flexible architecture to
support broad set of use
cases and workstyles
SMART
§ Built on scalable, intelligent
Cisco Unified Access, and
HDX for great mobile user
experience
§ Choice and flexibility to roam
between devices, networks,
locations

7. Cisco Confidential 7© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Mobile Workspace
Solution Demo
John Monaghan, Consulting Systems Engr.
EMEAR Enterprise Networking

8. Cisco Confidential 8© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Core Infrastructure and
Security

9. Cisco Confidential 9© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Cisco Mobile Workspace with Citrix
Starts with Unified Access / BYOD Foundation
• Secure network access
anywhere, anytime…
• AAA Services provided by
Cisco Identity Services
Engine.
• Authentication with PKI,
AD, and OTP (RSA)
• Role based assignment
with access restrictions
• Access Control Lists
• TrustSec – Security Group
Tags.
• ISE MDM integration for
mobile device policy.

10. Cisco Confidential 10© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Cisco High Density Experience Technology
Enabling the Mobile Workspace
CleanAir 80 MHz
Optimal performance for high
throughput, high density environments
RF interference detection & mitigation
optimized for 802.11ac’s wider channel
bandwidths.
Performance, Mitigation, Scalability and Roaming Optimized for High Client Density WiFi Networks
ClientLink 3.0
Increase performance & range by up to
60%
Cisco patented implicit beamforming
technology for 802.11ac clients,
complementing Explicit BF. Also extend
capabilities to 802.11a/g/n clients.
RF Noise Reduction
Enables higher density AP deployments to
support client density and increased
bandwidth
Increase spectrum usage efficiency to
improve co-channel performance
Smart Roam
Intelligently assist client roaming
Right size WiFi cell to better assist client
handoff in a dense network.
RF Turbo Performance
Support highly dense clients without
performance degradation
Scale seamlessly to 60+ 802.11ac clients
using interactive video & multimedia
traffic.

11. Cisco Confidential 11© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Mobile Traffic and the need for QoS
• Assuring voice quality from wireless applications meets enterprise VoIP
requirements
• Ensuring video applications are delivered to/from wireless devices with a high
Quality of Experience
• Provisioning preferred services for business-critical applications running on
wireless devices
• De-prioritizing "background" business application traffic
• Identifying and de-prioritizing (or dropping) non-business applications
Intelligently Managing Mobile Traffic

12. Cisco Confidential 12© 2013-2014 Cisco and/or its affiliates. All rights reserved.
• Provides Deep-Packet Inspection (DPI)
capabilities
• Identifies applications via Layer 7 stateful
signatures
• Leverages the IOS Network-Based
Application Recognition (NBAR2) Engine
• Over 1000 applications
• Available on Cisco Wireless Controllers, Routers,
and Switches
• Introduced for WLANs in AireOS 7.4
• AireOS 7.6 added “Protocol Pack”
support
• Application signatures can be added to the
engine without requiring a system-software
update
Cisco Application Visibility and Control for WLCs

13. Cisco Confidential 13© 2013-2014 Cisco and/or its affiliates. All rights reserved.
BYOD - Cisco Validated Designs
q Security and Policy
• 3rd Party MDM Integration
• ISE Logical Profiles
• Personal/Corporate devices
• TrustSec/SGA Enforcement
q UA/Mobility Infrastructure
• Converged Access
q User Experience
• App Visibility & Control (AVC)
• Bonjour Application Gateway
q Mobile and Remote Access
for Jabber
q FQDN
q Scalability Testing
q Security and Policy
• TrustSec for Converged Access
• IOS XE 3.3.2SE
q Location Awareness
• Cisco Mobility Services Engine
q Converged Access
• Wireless QoS, AVC
q Updated Hardware/SW
• 802.11ac via 3600 AP
• CUWN release 7.6
• ISE 1.2 Patch 6
Aug 2013
v2.5 v2.6 v2.7
Mar 2014 June 2014
http://www.cisco.com/c/en/us/solutions/
enterprise/data-center-designs-cloud-computing/
own_device.html#~overview

14. Cisco Confidential 14© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Mobile Policy

15. Cisco Confidential 15© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Cisco Identity Services Engine (ISE)
• All-in-One Enterprise Policy Control
Who What Where When How
VM client, IP device, guest, employee, remote user
Wired Wireless VPN
Business-Relevant
Policies
Security Policy Attributes
Identity Context

16. Cisco Confidential 16© 2013-2014 Cisco and/or its affiliates. All rights reserved.
BYOD Use Cases
ENHANCED ADVANCEDLIMITEDBASIC/GUEST
Differentiated Services,
On-Boarding Securely
Personal Devices
Deny Some Devices
Focus on Basic
Services,
Guest Access
Broader Device Types
Internet Only
Posture from Mobile
Device Management
Any Device, Any
Ownership
MDM Compliance
Environments
with Tight Controls
Only Corporate Devices
IT Whitelist

17. Cisco Confidential 17© 2013-2014 Cisco and/or its affiliates. All rights reserved.
ISE and MDM Integration
• ISE has limited awareness of device posture.
E.g. ISE can’t detect if PIN-lock is enabled, the
device has been jailbroken/rooted ,etc.
• While Mobile Device Managers (MDM) provide
posture information, their capacity to enforce
network policies is limited
• With the REST API Integration, ISE 1.2 is able
to :
• Receive device compliance information from the
MDM in order to make network access policy
decisions
• Push administrative device actions (such as
remote-wiping) via the MDM
Better together…

18. Cisco Confidential 18© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Enrollment: ISE-orchestrated to simplify user
experience
• Non registered clients redirected to MDM
registration page
• Non compliant clients will be given restricted
access
Daily Access: network+device
• Update data from endpoint which can be tied
into access policy
De-enrollment: Ability to Initiate Device Action
from ISE
• Device stolen è need to wipe data on client
ISE 1.2
ISE and MDM Integration
Critical Foundation for Mobile Workspace

19. Cisco Confidential 19© 2013-2014 Cisco and/or its affiliates. All rights reserved.
MDM Policy Compliance
• Is the device compliant with MDM
policy?
• Has the device registered with
MDM?
• Has the device been jail-broken/
rooted?
• Is PIN-lock enabled?
Dictionary Attributes

20. Cisco Confidential 20© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Application Delivery

21. Cisco Confidential 21© 2013-2014 Cisco and/or its affiliates. All rights reserved.
It’s All About the AppsFUTURE
Key capabilities are currently extended to Smartphones more than Tablets
Email/
Calendar
73%
66%
Collaborations
Apps
50% 47%
Productivity
Apps
37% 47%
Custom Business
Apps
32% 32%
UC/ IP
Telephony/ VoIP
35% 27%
Virtualized
Desktops
14% 20%
Key capabilities will be extended to Tablets more than Smartphones in the future and device form will influence the
types of apps and resources extended
Email/ Calendar
96% 96%
Virtualized
Desktops
75%
86%
UC/ IP
Telephony/ VoIP
84% 87%
Custom Business
Apps
82%
89%
Productivity Apps
83%
92%
Collaborations
Apps
86%
91%
2014
Source: Cisco Strategic Marketing Organization/2014 Mobility Landscape Survey – 1000 large and mid-sized
companies

22. Cisco Confidential 22© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Unified App Store
Unified Application Store offering
• Integrated with XenDesktop StoreFront
• Native & Enterprise Mobile Apps
• Web and SaaS apps
• Seamless delivery of Windows apps
WorxHome client for secure access to corporate
applications
• Apps launched from within WorxHome requiring user
authentication
• Optional application containerization
• Apps and data easily wiped in event device is lost or
stolen.
XenMobile AppController and WorxStore delivers secure access to mobile and
native Windows Apps to Mobile Devices

23. Cisco Confidential 23© 2013-2014 Cisco and/or its affiliates. All rights reserved.
XenDesktop providing access to Windows apps on mobile devices
• Native, in-house, mobile application development may be delayed or
impractical and hence access to Windows app must be made available.
XenDesktop and Receiver improves mobile user experience
• Incorporates integrated optimizations for mobile devices
• Use of mobile device controls
• Automatic keyboard display in editable field
• Touch-optimized desktop
• SDK available for developing Window apps with capabilities and
behaviors typical of a mobile device.
• Button usage definition
• Screen orientation
• On-screen keyboard activation
• Access device’s telephone, SMS, and camera
• Local interface controls instead of Windows
Desktop Virtualization
Mobile worker must be able to access corporate
apps from any device…

24. Cisco Confidential 24© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Before…

25. Cisco Confidential 25© 2013-2014 Cisco and/or its affiliates. All rights reserved.
After…

26. Cisco Confidential 26© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Mobilizing Windows Apps
High Definition Experience (HDX) Mobile
Translates
keyboard /
mouse tasks to a
touch
environment
Edit box
Keyboard Pop-up
Combo Box
Picker Pop-up

27. Cisco Confidential 27© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Mobile SDK for Windows Apps
HDX Mobile: Autosense and refactors hosted apps
Optimized for screen resolution
and orientation

28. Cisco Confidential 28© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Mobile SDK for Windows Apps
HDX Mobile: Local device features translated for virtual apps
Citrix Mobility Pack permits:
• GPS data access
• Camera access

29. Cisco Confidential 29© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Mobile Productivity

30. Cisco Confidential 30© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Cisco Mobile
Workspace Solution
for Mobile Workers
• Have secure remote access to corporate
network
• Have access to corporate Unified
Communications and reachable via
corporate number or messaging anywhere
• Have ability to attend meetings via web
with rich, collaborative, capabilities.
• Have access to corporate apps regardless
of device they are using
• Have access to work files anywhere
without having to download everything to
the device.

31. Cisco Confidential 31© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Cisco AnyConnect Secure Mobility Client
• IPsec/SSL full-tunnel VPN client
• Always-on connectivity & superior user experience
• Posture for desktops and mobile
• Broad desktop and mobile OS platform support
• Pushed transparently by XenMobile Device Mgr along with
connection profile to mobile devices.
Clientless SSL VPN Portal on the ASA
• Granular access control
• Users presented with defined resources
• Secure vault
• Virtual desktop access for Citrix Receiver as ICA Proxy
• Broad browser and application support
Remote Access and Cisco AnyConnect
Mobile worker must have secure, consistent
access anywhere…

32. Cisco Confidential 32© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Unified Communications and Collaboration
Mobile workers must be able to
work anywhere… with anyone… on
any device...
• Upon MDM registration, XenMobile Device
Manager and AppController redirect clients to
download Cisco Jabber Client and Webex.
• Jabber communications to Cisco UC, IM, and
Video services enabled while on or off Campus.
• AnyConnect not required while remote through
use of Cisco Expressway
• Seamless interoperability with AnyConnect when
deploying Expressway at the Edge
• AVC on WLC classifies voice and video traffic
• QoS on Cisco wireless controllers enables a
great overall user expoerience

33. Cisco Confidential 33© 2013-2014 Cisco and/or its affiliates. All rights reserved.
XenDesktop delivers Secure access to corporate
applications
• Provides a consistent and secure virtual workspace for
contractors and employees with personal devices.
• Allows for role-specific access to applications based on
user credentials
• Data securely stored in the data center.
• Desktop and user preferences customizable by Citrix
Policies as well as Microsoft GPO.
Desktop Virtualization
Mobile workers must be able to securely access
Windows apps and associated data from any
device…

34. Cisco Confidential 34© 2013-2014 Cisco and/or its affiliates. All rights reserved.
• Access, share and sync files from any device
• Apps for mobile devices
• Sync for Windows and Mac for laptops and MacBooks
• Mobile-optimized ShareFile web site
• Data stored in cloud or locally in “StorageZone”
• Local data stored in NAS, CIFS Shares, & SharePoint
• AD integration incorporating SAML authentication
• Built-in mobile editor for rich content editing on-the-go
• PDF annotation
Secure File Sharing and Storage
Mobile workers must be able to access and share
files securely anywhere…
Control Plane
Data Plane
SaaS

35. Cisco Confidential 35© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Mobile Workspace Solution
with Citrix 1.0
CVD Overview

36. Cisco Confidential 36© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Cisco Identity Services Engine 1.2
• Policy management for device on-boarding and network
access for wired or wireless device while on network.
• RADIUS AuthC/AuthZ for remote access VPN.
• EM-BYOD v2.6 policies used as foundation.
• Policy enforced through ACLs and TrustSec (SGT)
• Integrated With XenMobile Device Manager for visibility into
mobile device policy compliance; quarantined if non-
compliant.
Cisco UCS Servers
• Providing Microsoft AD, DNS/DHCP, and CA services
• Supporting all Citrix infrastructure and built on VMware
ESXi 5.1
• Scaling guidance provided in Desktop Virtualization
Solutions with Citrix CVD
http://www.cisco.com/c/en/us/solutions/enterprise/data-
center-designs-virtualization/landing_vdi_citrix.html
Cisco ISE integrated with Citrix XenMobile Device
Manager and AppController – Device & App Management
Cisco ASA Edge Firewall & VPN Edition
• Providing Remote access to Network.
• AnyConnect Client used for access to corporate
applications and Citrix infrastructure.
• Clientless (WebVPN) access for case where ONLY access
to XenDesktop is required.

37. Cisco Confidential 37© 2013-2014 Cisco and/or its affiliates. All rights reserved.
AD Mail ISE CA
Cisco UCS
StoreFront 2.1
XenDesktop 7.0
Cisco UCS
Core
6500
I-Edge
6500
Remote Users
ASA-In
& SSLVPNASA-Out
Data
Center
Nexus
7000
AD Mail ISE CA
Cisco UCS
StoreFront 2.1
XenDesktop 7.0
Cisco UCS
Core
6500
I-Edge
6500
Remote Users
ASA-In
& SSLVPNASA-Out
Data
Center
Nexus
7000
XM-MDM
Clientless WebVPN
AnyConnect SSL or IPsec
AnyConnect Client
• AC Client required on
device
• Access to AppC Mobile
apps via Worx and
XenDesk HSD via
Receiver after AC
launched.
Clientless WebVPN
• AC Client not required.
• Only access to XenDesk
HSD
• Receiver clientless
WebVPN access to
XenDesk HSD .
ASA VPN Remote Access
XenMobile 2.10
App Cntl

38. Cisco Confidential 38© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Citrix XenMobile Device Manager 8.7
• Role-based restrictions of mobile device features; i.e.
password/PIN lock, Camera, applications, clipboard, etc.
• Role-based deployment packages with policies and apps
such as Cisco AnyConnect Client, AC Profile, Jabber and
Webex .
• MDM serves as SCEP Proxy for certifcates required for
MDM and AnyConnect Client.
• Users can register with MDM either on or off network.
• Integrated with XenMobile App Controller.
Citrix XenMobile App Controller
• Provides Unified App Store with Citrix Receiver and
ShareFile as well as other mobile applications.
• Reciever configuration profile pushed transparently to
mobile device based on user’s AD credentials.
• Provides support for the WorxHome client from which apps
can be securely launched using AD credentials.
Cisco ISE integrated with Citrix XenMobile Device Manager
and AppController – Mobile Device & App Mgmnt
Citrix XenMobile App Controller Cont’d
• Supports selective wipe of corporate applications launched
from within WorxHome.
• Provide SAML Federation Services required for ShareFile
AD integration.
• Integrated with XenDesktop StoreFront.

39. Cisco Confidential 39© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Citrix XenDesktop 7
Application and Desktop Virtualization
Citrix XenDesktop 7
• XenDesktop – Server OS Machine Catalogs
providing Hosted Shared Desktops based on
Server 2008 R2.
• Implement StoreFront to provide access to
XenDesktop HSD and Windows applications.
• Hosted Shared Desktops enumerated by
Machine Creation Services
• Fills requirement for shared desktop addressing
tablet and laptop users without intensive graphic
or computing requirements.
• Machine Catalogs and Delivery Groups
dedicated for each user “role”.
• Desktops customized for specific user roles
based on Active Directory credentials.
• ShareFile Sync for Windows available on
shared desktops

40. Cisco Confidential 40© 2013-2014 Cisco and/or its affiliates. All rights reserved.
Citrix ShareFile
Mobile Information Management
Citrix ShareFile
• Providing enterprise-grade file sharing
• Split control and data plane
• Control plane resident in Citrix cloud
• User authentication
• Resource List; ie files, folders
• Files can be stored in cloud storage or in a local
“StorageZone” for regulatory compliance of sensitive
files. NAS, CIFS, Sharepoint support.
• Ubiquitous access regardless of device as a mobile
app, Outlook plug-in, and Sync app for Windows and
MacOS.
• AD-SSO via SAML services deployed on XenMobile
App Controller.
• Sync for Windows deployed on XenDesktop HSD

41. Cisco Confidential 41© 2013-2014 Cisco and/or its affiliates. All rights reserved.
In Summary…
The Mobile Workspace Solution Components
CMWS 1.0 CVD - http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/CMWSwC.html
BYOD 2.6 CVD - http://www.cisco.com/c/en/us/solutions/enterprise/data-center-designs-cloud-computing/own_device.html
Desktop Virtualization CVD - http://www.cisco.com/c/en/us/solutions/enterprise/data-center-designs-virtualization/landing_vdi_citrix.html

42. Q & A

43. Thank you.