This presentation is from Citrix Synergy 2010, where I presented the session titled: Optimize FlexCast performance and security – Just add Branch Repeater and Access Gateway. We used the story of the proposed new San Francisco 49ers stadium as our case study to explore how FlexCast would be used by the architecture firm designing the stadium.

1. Welcome to our Synergy session about how you can optimize your XenDesktop Flexcast
performance and security by adding Branch Repeater and Access Gateway. During this
session you will learn how to configure the vast array of capabilities in Branch Repeater and
Access Gateway to effectively deliver virtual desktops to every user in your organization.
Access Gateway to effectively deliver virtual desktops to every user in your organization.
1

2. But first let’s talk about what’s buzzing in San Francisco. How many people are fans of
American Football? Any 49ers fans in the audience? Excellent – we’re big fans of our local
San Francisco 49ers team. Did you know….
2

3. …that we’re building a brand new stadium for the 49ers a block away from Citrix’s Santa
Clara office? This could be Citrix’s next big revenue stream – we can sell spaces in our
parking lot for the games! Seriously, though – this session shows you how this massive
project is enabled by Citrix technologies: XenDesktop, Branch Repeater and Access
project is enabled by Citrix technologies: XenDesktop, Branch Repeater and Access
Gateway
We’ll start with a quick review and decoding of Flexcast to set up the context, then quickly
move into the stuff you came for – how to configure BR and AG to serve your entire user
population while maintaining appropriate levels of security and performance.
3

4. Let’s consider this massive project:
•How many and what types of people are part of the project?
•And how would they all share and access their data and apps day to day?
4

5. Flexcast is our new favorite word in the Citrix dictionary. How many times did you hear
Mark T say FlexCast during his keynote? We counted 8.
5

6. Clearly FlexCast is a very important concept for you to understand within the XenDesktop
context.
By now we’ve probably all heard of FlexCast, you might have seen a demo of it, but you
probably still have some questions.
probably still have some questions
6

7. So let’s have some fun with those questions ‐ if you have the answers you can win some
fabulous prizes – here we go!
7

8. Answer: Choice of delivery models for XD
FlexCast is a feature of XenDesktop that provides an organization with the choice and
flexibility to deliver the right solution to their end‐users
FlexCast is not a new technology – it’s simply a term to describe a set of existing delivery
technologies
8

9. Answer: 4
Let’s talk about why we’ve established 4 distinct delivery models for XenDesktop and 3 for
XenApp, and why this alone makes Citrix the clear leader in virtual desktops.
9

10. VDI alone only offers you one option, one “flavor” of desktop virtualization, but that just
isn’t enough to enable broad adoption of desktop virtualization in the enterprise. The truth
is that in order to meet all your users needs, you need a variety of tools and options – many
different flavors of desktop virtualization. That s exactly what XenDesktop 4 offers.
different flavors of desktop virtualization. That’s exactly what XenDesktop 4 offers.
10

11. 11

12. Hosted Shared Desktops provide a locked down, streamlined and standardized environment with a
core set of applications, ideally suited for task workers where personalization is not needed – or
allowed.
Hosted Shared Desktops provide a locked down, streamlined and standardized environment with a
core set of applications, ideally suited for task workers where personalization is not needed – or
allowed.
Hosted Blade PC Desktops enable technical workers and power users to run professional graphics
applications such as CAD/CAM, GIS, etc., which typically require more processing resources.
Local Streamed Desktops leverage the local processing power of rich clients, while providing
centralized single‐image management of the desktop. These types of desktops are often used in
computer labs and training facilities, and when users require local processing for certain
applications or peripherals.
Physical Desktops with On‐Demand Apps ‐ FlexCast™ allows any Windows® application to be
virtualized, centralized and managed in the datacenter and instantly delivered as a service to users
anywhere. Whether online or offline, virtual application delivery is optimized for each user’s device,
network and location to ensure a high definition experience.
Local VM‐based Desktops ‐ Local VM‐based virtual desktops extend the benefits of centralized,
single‐instance management to mobile workers that need to use their laptops offline. When they
single instance management to mobile workers that need to use their laptops offline When they
are able to connect to a suitable network, changes to the OS, apps and user data are automatically
synchronized with the datacenter.
12

13. In football the difference between winning and losing is oftentimes the Special Teams. I’m a
Cal grad, so my favorite special teams play of all time was the final play of the 1982 Big
Game between Cal and Stanford. How many of you have seen that play? For those who are
unfamiliar, that incredible special teams play won the game for Cal.
unfamiliar, that incredible special teams play won the game for Cal.
Similarly, in the world of XenDesktop the difference between ‘winning’ with high user
satisfaction and ‘losing’ with dissatisfied users and huge increases in help desk calls is your
usage of the FlexCast special teams: Access Gateway and Branch Repeater. Flexcast is about
how users get their work done – usage of AG and BR is about where they do their work.
13

14. How many of you use XenApp with Secure Gateway today? About ##% ‐ and SG has
certainly done a great job providing remote access to XA. That said, you should all create
plans to shift from SG to AG for the following reasons:
1) XenApp 6 includes the final feature release for SG; there will be no further
6 includes the final feature release for SG; there will be no further
enhancements going forward and it is going into maintenance mode. All of Citrix’s
secure remote access resources are focused on AG, and AG is the only secure access
mechanism integrated into Receiver and Merchandising Server to provide that seamless
self‐service user experience;
2) Our new AG VPX software form factor allows you to easily transition from SG to AG,
and is priced at under $1,000 to fit every budget;
and is priced at under $1 000 to fit every budget;
3) The new licensing model provides no‐cost secure access for XenDesktop and XenApp,
which means you can make the transition with no additional licensing costs. Less than
$1,000 – that’s it
4) AG has unmatched secure access capabilities for XenApp and XenDesktop, including
SmartAccess, data acceleration and high availability. AG is the undisputed champion of
secure access to XA and XD, and easily provides that same secure access to the rest of
secure access to XA and XD and easily provides that same secure access to the rest of
your corporate resources as well – no need to maintain a separate SSL VPN
Bottom line? Access Gateway is the way you will deliver virtual desktops to remote and
mobile users – regardless of which flexcast model applies. It’s critical to addressing that
huge percentage of your workforce.
14

15. You need to consider Branch Repeater for every branch office and every remote and mobile
user – especially when deploying XenDesktop. By definition when you transition from
simply delivering individual virtual apps to delivering full‐fledged virtual desktops you will
significantly increase the data moving between your datacenter and your end users. Branch
significantly increase the data moving between your datacenter and your end‐users. Branch
Repeater is the best solution to accelerate and optimize Citrix XenDesktop and XenApp to
assure a high‐definition experience for branch office and mobile users. Our HDX WAN
Optimization technologies compress, cache, and prioritize traffic to reduce bandwidth
consumption and provide a LAN‐like experience. We are the only solution that can reach
inside the XenDesktop data stream to optimize across specific ICA channels (versus treating
the ICA traffic as a single entity). Performance testing and customer testimonials show 2‐6x
better performance and bandwidth reduction up to 99%.
b f d b d id h d i 99%
15

16. http://www.istockphoto.com/stock‐photo‐8376066‐blank‐blackboard‐with‐white‐chalk‐
eraser‐smudges.php
This represents branch workers, tele‐workers, mobile workers. In fact, how many of you are
checking e‐mail on your handheld right now?
checking e mail on your handheld right now?
Answer: 90%
Source: Nemertes
16

17. We all know that most companies have a diverse and distributed workforce, and our
IT lives are far more complex as a result.
To deliver on the potential a distributed global workforce brings, IT organizations
must find ways to provide the same or better service levels and ensure high
levels,
productivity and ease-of-use. IT must deliver high performance virtual desktops to
workers anywhere over any network connection. And at the same time, protect
corporate data and meet security obstacles while avoiding complexity or expense in
the face of ever-tightening budgets.
17

18. Now that we understand what FlexCast is and how it can be used, lets take a close look at
how HNTB could use FlexCast for the 49rs stadium.
18

19. 19

20. Here is a high level look at the HNTB network. HNTB has a central data center, which
includes their domain servers, Citrix XenApp and XenDesktop farms. The data center also
includes Access Gateway in the DMZ and a Repeater appliance inside the LAN.
The data center location is in close proximity to the corporate headquarters.
The data center location is in close proximity to the corporate headquarters
Close to HQ and the data center are the HNTB training labs, where employees attend
training sessions on new applications and procedures.
g y
A number of branch offices are located throughout the country. Branch offices have local
printers and Branch Repeater appliances.
A number of HNTB employees work remote. These users connect to the network using
Access Gateway.
20

21. Hosted Shared Desktops provide a locked down, streamlined and standardized
environment with a core set of applications, ideally suited for task workers where
personalization is not needed – or allowed.
•Task workers
•Task workers
•Locked down environment
•Simple, small application set
•Personalization is not required
•Best desktop virtualization ROI
•Server OS
•Server OS
21

22. The billing, procurement, and accounts receivable/payable employees work from their
home. These employees have a narrow job function and typically only work on a few tasks
and use a specific set of applications.
Because these employees work from home using their own computer, HNTB must ensure
that the workstation is free of viruses and malware before connecting to the network.
These users should not be saving any data to their local device or printers, so the desktop
must be locked down to prevent these action.
Citrix SmartAccess can address both of these requirments.
22

23. Citrix Receiver provides three plug‐ins to the billing, procurement, and accounts
receivable/payable employees.
The secure access plug‐in is used to establish a secure connection to the HNTB network.
The secure access plug‐in is also responsible for scanning the users computer before
The secure access plug in is also responsible for scanning the users computer before
connecting.
The accelerator plug‐in (Repeater Plug‐in) connects to the Repeater Signaling IP address
through the secure tunnel. Once connected, the hosted shared desktop session will be
accelerated.
The OnlinePlug‐in/Desktop Receiver Plug‐in is used to launch the desktop session.
23

24. SmartAccess policies are used to scan a clients device before (pre‐logon) or after logon
(post logon). The policies can use a set of pre‐configured endpoint scans or a custom set
can be created.
24

25. Once SmartAccess has been configured on Access Gateway, the results of a scan can be
sent to XenApp or XenDesktop to SmartAccess filtering.
SmartAccess can filter virtual applications or desktops. In this example, we see how
SmartAccess policies are configured to filter access to a virtual application. The procedure
SmartAccess policies are configured to filter access to a virtual application The procedure
for XenDesktop is the same, but done at the Desktop Group level.
25

26. SmartAccess can also be used in XenApp and XenDesktop policies. This enables
SmartAccess to dynamically disable ICA virtual channles such as drive mapping, printer
mapping, audio, and clipboard mapping.
26

27. Add editions of Access Gateway are compatible with Repeater and support integrated
acceleration.
27

28. Transparent vs. Redirector Mode. There are two variations on the way connections
are handled by the Client and Appliance: transparent mode and redirector mode.
• Transparent mode for Client‐to‐Appliance acceleration is very similar to Appliance‐
to‐Appliance acceleration. The Appliance must be on the path taken by the
packets when traveling between the Client and the server. As with Appliance‐
to‐Appliance acceleration, transparent mode operates as a transparent
proxy, preserving the source and destination IP address and port numbers from
one end of the connection to the other.
• Redirector mode uses an explicit proxy. The Client re‐addresses outgoing packets
to the Appliance’s redirector IP address. The Appliance in turn re‐addresses
the packets to the server, while changing the return address to point to itself
rather than the Client. In this mode, the Appliance does not have to be physically
inline with the path between the WAN interface and the server (though this is the
ideal deployment).
• Best practices: Use transparent mode when you can, and redirector mode when
you must.
28

29. What to Accelerate. Acceleration is most effective when the Appliance is close to
the server. Acceleration can be harmful if the client forwards traffic to an Appliance
that is distant from the server, especially if this “triangle route” introduces a slow or
unreliable link. Thus, we recommend that acceleration rules be configured to allow a
given Appliance to accelerate its own site only. This task is performed on Appliance
via the “Configure Settings: WANScaler Client: Acceleration Rules” tab.
Rules are evaluated in order, and the action (“Accelerate” or “Exclude”) from the first
matching rule is taken. For a connection to be accelerated, it must match an “Accelerate”
rule. Otherwise, the connection is made directly with the target server.
• In general, narrow rules (usually exceptions) should be listed first, then general
rules.
• Press the “Save” link. Changes will not be saved if you navigate away from this
page without saving.
• The default action is to not accelerate; only addresses/ports that match
29

30. In order to accelerate VPN traffic using Access Gateway and Branch Repeater, a full VPN
connection is required. This enables to Repeater Plug‐in to communicate with the Repeater
appliance through the VPN tunnel. Without a VPN connection, the plug‐in would not have a
path to the Repeater appliance in the data center.
path to the Repeater appliance in the data center.
30

31. Hosted VM‐based VDI Desktops offer a personalized Windows desktop experience,
typically needed by office workers, which can be securely delivered over any network to
any device.
•Knowledge workers
•Secure desktop environment
•Rich, desktop experience
•Full personalization
•Higher TCO than shared desktops
•Higher TCO than shared desktops
•Client OS – Windows 7, XP
31

32. The Office Managers, Contracts, Legal, Finance employees handle a variety of job function,
change locations, and use a number of different applications. These users need a
customizable desktop environment where their settings can be saved. These user groups
tend to be more sophisticated IT users. The work in branch offices but also work from
tend to be more sophisticated IT users. The work in branch offices but also work from
home at times.
32

33. When the Office Managers, Contracts, Legal, and Finance employees work in a branch
office, they connect to the data center using a fixed WAN connection, so no VPN is
required. During these situations, only the Online Plug‐in is used by Receiver to connect to
their Windows 7 desktop.
their Windows 7 desktop.
When the user moves to a remote location (home/hotel) they will use the secure access
and accelerator plug‐in to connect to their desktop just like the billing/AR/AP employees.
33

34. Access Gateway can use the same set of features and configurations as the Office
Managers, Contracts, Legal, Finance
34

35. Use Inline Mode When Possible
The Appliance can be placed inline with your WAN link. The
Appliance uses an accelerated bridge (two Ethernet ports) for inline mode; packets
enter one Ethernet port and exit through the other. This allows the Acceleration unit
to be placed between your WAN router and your LAN. As far as the rest of the network
is concerned, it is as if the Appliance weren’t there at all; its operation is completely
i d i i if h A li ’ h ll i i i l l
transparent.
Inline mode has the following advantages over the other deployment modes:
• It provides maximum performance.
• It can be installed by people who are not IT professionals.
• It requires no reconfiguration of your other network equipment.
Other modes (WCCP, virtual inline, redirector) are less convenient to set up,
Inline mode. Highest‐performance, most transparent mode. Data flows in one
accelerated Ethernet port and out the other. Requires no router reconfiguration of
any kind.
• Inline with dual bridges. Same as inline, but two independent accelerated
bridges are used.
• WCCP mode. WCCP is recommended when inline mode is not practical. Supported
by most routers. Requires only three lines of router configuration. To use
WCCP mode on a Cisco router, it should be running at least IOS version 12.0(11)S
or 12.1(3)T. (WCCP stands for “Web Cache Communications Protocol,” but the
protocol was greatly expanded with version 2.0 to support a wide variety of network
devices.)
• Virtual Inline mode. Similar to WCCP mode. Uses “policy‐based routing.” Generally
requires a dedicated LAN port on the router. Not recommended on units without
an Ethernet bypass card. To use virtual inline mode on a Cisco router, it should
be running IOS version 12.3(4)T or above.
• Redirector mode. Used by the Repeater Plug‐in to forward traffic to the Appliance.
Can be used as a stand‐alone mode or combined with one of the other
deployments. Requires no router configuration.
• Group mode. Used when two or more inline Appliances are used, one per link,
within a site.
35

36. Branch Repeater supports ICA acceleration by default, without any modifications.
ICA acceleration is controlled by two built in components. The Service Class defines which
specific types of traffic should be accelerated and the Service Class policy defines if the
policy is enabled, what type of compression is used, and what QoS queue is used.
policy is enabled what type of compression is used and what QoS queue is used
36

37. 37

38. 38

39. Talk about the performance benefits of BR for XD and XA
Insert some charts/numbers
Pull from solutions center report
39

40. Hosted Blade PC Desktops enable technical workers and power users to run professional
graphics applications such as CAD/CAM, GIS, etc., which typically require more processing
resources.
• Engineers, designers, power users
• CAD/CAM, 3D, GIS, etc
• Dedicated blade server hardware
Dedicated blade server hardware
• Full personalization
• Highest desktop TCO
• Client OS – Windows 7, XP
40

41. Designers and engineers use VM hosted desktops running on blade PCs. Blade PCs provide
dedicated CPU and graphics processing to support the demanding applications they use,
such as AutoCAD and 3D apps. These users also send large print jobs to plotters over the
network, which can really slow down the WAN.
network, which can really slow down the WAN.
41

42. The setup for designers and engineers is essentially the same as the Office Managers,
Contracts, Legal, and Finance employees. They work in a branch office, and connect to the
data center using a fixed WAN connection, so no VPN is required. During these situations,
only the Online Plug in is used by Receiver to connect to their blade PC desktop..
only the Online Plug‐in is used by Receiver to connect to their blade PC desktop..
42

43. 43

44. 44

45. Repeater compresses using disk (DBC)
Second pass of the same print job
Second pass of the same print job
~70:1 compression
Small modifications followed by a print‐job resend
Compresses well (35 40:1)
Compresses well (35‐40:1)
Server limited throughput
Natural limits of hardware and software
Administrator defined limits through XenApp
Administrator defined limits through XenApp
policy.
Native server‐side print compressor is
disabled during the negotiation of
capabilities.
45

46. Local Streamed Desktops leverage the local processing power of rich clients, while
providing centralized single‐image management of the desktop. These types of desktops
are often used in computer labs and training facilities, and when users require local
processing for certain applications or peripherals.
processing for certain applications or peripherals.
• Computer labs, training centers
• Shared workstations
• Specialized local hardware or apps
• Centralize, streamed desktop OS
• Best ROI for existing PC hardware
46

47. 47

48. Desktop provisioning (PVS) uses UDP and is not accelerated
Data inside the desktop is accelerated
Local Streamed Desktops not suited for WANs or remote access
48

49. 49

50. Local VM‐based Desktops ‐ Local VM‐based virtual desktops extend the benefits of
centralized, single‐instance management to mobile workers that need to use their laptops
offline. When they are able to connect to a suitable network, changes to the OS, apps and
user data are automatically synchronized with the datacenter.
user data are automatically synchronized with the datacenter.
• Road warriors, execs, field services
• Centralized management and security
• Flexibility and power for mobile users
• Online and offline access
• This is XenClient!
50

51. 51

52. •Will show AG/BR Plug‐in inside corp VDI
•Switch to personal for iTunes/Skype
52

53. 53

54. 54

55. The Giants or Steelers of course!
55

56. 56

57. 57

58. Promotion:
‘buy 1 get 2 free’
For both new and existing XD customers
For both new and existing XD customers
Buy 1 datacenter‐level BR device (VPX‐45, 85xx or 88xx) and receive 2
free VPX‐10 licenses
Starts June 1, runs through end of 2010

60. 60