Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... ·...

85
610: Providing application visibility to Citrix applications using NetScaler Insight Center and CloudBridge Hands-on Lab Exercise Guide David Jimenez May 2014 Make money selling Field Services Stop by the Education and Consulting booths in the Solutions Expo to find out how! We're here to help.

Transcript of Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... ·...

Page 1: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

610: Providing application visibility to Citrix applications using NetScaler Insight Center and CloudBridge

Hands-on Lab Exercise Guide

David Jimenez May 2014 Make money selling Field Services Stop by the Education and Consulting booths in the Solutions Expo to find out how! We're here to help.

Page 2: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 1 |

Contents Contents .................................................................................................................................... 1

Overview .................................................................................................................................... 2

Exercise 1 .................................................................................................................................. 6

Testing external access to XenApp/XenDesktop ........................................................................ 6

Exercise 2 .................................................................................................................................. 9

Configuring NetScaler Insight Center and Web Insight policies .................................................. 9

Exercise 3 .................................................................................................................................27

Configuring AppFlow policies for ICA traffic visibility – HDX Insight ...........................................27

Exercise 4 .................................................................................................................................42

Analyzing NetScaler Insight Center metrics to identify potential issues .....................................42

Exercise 5 .................................................................................................................................51

Configure additional deployment types for HDX Insight .............................................................51

Exercise 6 .................................................................................................................................62

XenDesktop 7.x Integration with HDX Insight ............................................................................62

Exercise 7 .................................................................................................................................65

External authentication support in NetScaler Insight Center ......................................................65

Exercise 8 .................................................................................................................................69

Gain more application visibility with CloudBridge ......................................................................69

Exercise 9 .................................................................................................................................75

CloudBridge AppFlow support ...................................................................................................75

Page 3: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 2 |

Overview Hands-on Training Module Objectives

• Provide hands-on experience with AppFlow for ICA and how to use this new component to provide application visibility for Web application deployments and ICA traffic.

• Highlight some of solutions that can be accomplished by the new features included in NetScaler 10.1

• Learn how to use NetScaler Insight Center for troubleshooting and capacity planning

Prerequisites Basic NetScaler administration experience

Audience Primary: Citrix Sales Engineers, Consultants, and Support Team members

Page 4: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 3 |

Lab Environment Details Describe the lab environment. The system diagram of the lab is shown below:

Topology diagram:

RemoteSite192.168.20.0/24

MainSite192.168.10.0/24

Public Network

Router1 Router2

AD

Public Bond

Win7Client

Exchange

@SharePointSQL NS Insight

Splunk

NetScaler1 NetScaler2

WAN emulator

SoftLayer DNS: mycitrixtraining.net1-2-3-4.mycitrixtraining.net -> 1.2.3.4

PublicIP #1PublicIP #2PublicIP #3

PublicIP #4PublicIP #5

XenDesktop VDAStoreFront

CloudBridgeCloudBridge

Site1 Intranet Site2 Intranet

Site1 Public Site2 Public

External Client

Private Subnet192.168.25.0/24

VDA

Page 5: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 4 |

External access:

Public Network

Router1 Router2

Public Bond

WAN emulator

SoftLayer DNS: mycitrixtraining.net1-2-3-4.mycitrixtraining.net -> 1.2.3.4

PublicIP #1PublicIP #2PublicIP #3

PublicIP #4PublicIP #5

Site1 Intranet Site2 Intranet

Site1 Public Site2 Public

External Client

Link configuration:

Router1 Router2

Public Bond

WAN emulatorSite1 Intranet Site2 Intranet

Site1 Public Site2 Public

eth2

eth1 eth0

eth3

eth4

The Student Desktop is accessed remotely using Citrix Receiver running on your laptop. All windows applications such as XenCenter, (the XenServer GUI management tool), are accessed from the Student Desktop.

Lab Guide Conventions This symbol indicates particular attention must be paid to this step

Special note to offer advice or background information

reboot Text the student enters or an item they select is printed like this

VMDemo Filename mentioned in text or lines added to files during editing

Start Bold text indicates reference to a button or object

Focuses attention on a particular part of the screen (R:255 G:20 B:147)

Page 6: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 5 |

Shows where to click or select an item on a screenshot (R:255 G:102 B:0)

List of Virtual Machines Used VM Name IP Address Description / OS

XenServer Hosts virtual machines Site1-AD.training.lab 192.168.10.1 Active Directory Domain Controller for Site1 Site1-CloudBridge 192.168.10.40 CloudBridge appliance on Site 1 Site1-NS1 192.168.10.50 NetScaler 1 in Site1 Site1-NS_Insight 192.168.10.60 NetScaler Insight Center in Site1 Site1-SharePoint 192.168.10.30 SharePoint server in Site1 Site1-Exchange 192.168.10.26 Exchange Server in Site1 Site1-SQLServer1 192.168.10.28 SQL Server in Site1 Site1-XenDesktop 192.168.20.21 XenDesktop Server in Site1 Site1-Win7 192.168.10.27 Windows 8 Client in Site1 Site1-Splunk 192.168.20.23 Linux Apache Web Server Site2-NS1 192.168.20.50 NetScaler 1 in Site2 Site2-VDA 192.168.25.2 Windows 7 VDA Site2-CloudBridge 192.168.20.40 CloudBridge appliance in Site 2

Required Lab Credentials The credentials required to connect to the environment and complete the lab exercises.

VM Name Username Password

XenServer root Site1-AD.training.lab TRAINING\Administrator Citrix123 Site1-CloudBridge admin password Site1-NS1 nsroot nsroot Site1-NS_Insight nsroot nsroot Site1-SharePoint TRAINING\Administrator Citrix123 Site1-Exchange TRAINING\Administrator Citrix123 Site1-SQLServer1 TRAINING\Administrator Citrix123 Site1-XenDesktop TRAINING\Administrator Citrix123 Site1-Win7 TRAINING\Administrator Citrix123 Site1-Splunk root Citrix123 Site2-NS1 nsroot nsroot Site2-VDA TRAINING\Administrator Citrix123 Site2-CloudBridge admin password Site2-XenDesktop7 TRAINING\Administrator Citrix123

Page 7: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 6 |

Exercise 1 Testing external access to XenApp/XenDesktop Overview In order to generate some key metrics, our lab environments are preconfigured to be externally accessible. In our deployment, we will simulate a dual-site configuration in order to manipulate network parameters and generate sample data that will allows us to identify any issues at the web application and ICA traffic levels.

In this exercise, we will test correct access to an ICAPROXY deployment and launch published resources from an external device.

Step by step guidance Estimated time to complete this lab: 10 minutes.

Step Action 1. First, let me get you familiar with our current deployment. Observe the following network

topology diagram to understand the pieces that make up our environment:

RemoteSite192.168.20.0/24

MainSite192.168.10.0/24

Public Network

Router1 Router2

AD

Public Bond

Win7Client

Exchange

@SharePointSQL NS Insight

Splunk

NetScaler1 NetScaler2

WAN emulator

SoftLayer DNS: mycitrixtraining.net1-2-3-4.mycitrixtraining.net -> 1.2.3.4

PublicIP #1PublicIP #2PublicIP #3

PublicIP #4PublicIP #5

XenDesktop VDAStoreFront

CloudBridgeCloudBridge

Site1 Intranet Site2 Intranet

Site1 Public Site2 Public

External Client

Private Subnet192.168.25.0/24

VDA

All certificates, NetScaler, StoreFront, and XenApp/XenDesktop configuration was automated with the proper information for you to start exploring the NetScaler Insight Center solution.

After reviewing the diagram carefully, continue to the next step.

Page 8: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 7 |

2. First, let’s try to connect to the NetScaler Gateway vserver located in site # 1.

From your external workstation, open the browser of your choice and navigate to the external FQDN corresponding to Public IP # 1 listed in the student portal.

http://your-dashed-fqdn.mycitrixtraining.net/ (IP# 1)

You browser should be able to display the Access Gateway login.

3. Login with the following credentials:

Username: user1 Password: Citrix123

4. You should be able to login successfully and see your applications and desktops. Launch an application and/or desktop to test correct functionality.

5. Close any published apps or desktops you have opened. Wait until the session disconnects.

6. Now, let’s test the NetScaler Gateway vserver in Site # 2.

Open a new tab in your browser and navigate to the FQDN for Public IP # 3.

https://your-dashed-fqdn.mycitrixtraining.net/

7. You should see the NetScaler Gateway login page. Login with the following credentials:

Username: user1 Password: Citrix123

8. Launch an application and/or desktop to test correct functionality. Close any resource when you are done.

Congratulations! You environment is configured for external access for XenApp and XenDesktop. Continue to the next exercise.

Page 9: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 8 |

Exercise Summary In this exercise, we verified external connectivity to the XenApp / XenDesktop infrastructure included in the lab. There are several steps needed to finalize this configuration; however, this process was pre-configured for your environment.

Page 10: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 9 |

Exercise 2 Configuring NetScaler Insight Center and Web Insight policies Overview NetScaler Insight Center is part of a set of tools that will allow you to gain visibility of the applications delivered by Citrix NetScaler. In previous releases, NetScaler provided support for AppFlow records for specific protocols (HTTP/SQL). In this new release, we have extended this support to allow additional visibility for published resources deliver using the ICA protocol and provide the visibility required troubleshoot any application delivery issues.

In this exercise, we will get hands-on experience with NetScaler 10.5 and the AppFlow protocol. Also, we will integrate NetScaler Insight Center with NetScaler appliance to collect and process the application information encapsulated in AppFlow records.

This exercise focuses on Web Application visibility. The NetScaler appliance can report on key metrics to evaluate the correct functionality of a web application delivered by NetScaler.

Step by step guidance Estimated time to complete this lab: 30 minutes.

Step Action 1. We are now ready to begin our configuration. First, let’s gain access to our environment.

We have two choices to establish a connection:

- Connect using Remote Desktop Connection Manager.

- Connect natively using XenCenter.

Select the option that works best for you. You will find a shortcut for either application on the Desktop:

Page 11: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 10 |

2. If you selected RDP Connection Manager, connect to all VMs by right-clicking on the Training_Lab group and select Connect group:

If you elected to use XenCenter, please use the hypervisor credentials in the Student portal to connect to the XenServer.

<insert pic for student portal>

TIP: Switch to an RDP connection for better performance by using the button on the top right

3. Login to the Site1-Win7 VM using the following credentials, if prompted:

Username: TRAINING\Administrator Password: Citrix123

4. Next, we are going to connect to the NetScaler Insight Center UI. Open Internet Explorer and navigate to http://192.168.10.60

Use the following credentials when prompted:

Username: nsroot Password: nsroot

5. On the Welcome Screen, click Click Started.

Page 12: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 11 |

6. Next, we need to add the details of the NetScaler appliances to be monitored by NetScaler Insight Center. Since we have preconfigured external access to SharePoint and Outlook Web Access on Site2-NS1, we will add this NetScaler appliance to the configuration.

In the NetScaler Insight Center Inventory Setup, enter the following information:

NetScaler IP Address: 192.168.20.50 Username: nsroot Password: nsroot

Then click Add.

7. We should see two Load Balancing virtual server listed. Right click the Exchange_vserver and select Enable AppFlow.

Page 13: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 12 |

8. In the Enable AppFlow window, we are prompted to select an expression for the data collection to occur. Since we are interested in all traffic processed by this virtual server entity, we will select the following expression:

HTTP.REQ.LB_VSERVER.NAME.EQ("Exchange_vserver")

9. Replace the entity name MyLB with the name of the virtual server. In this case, Exchange_vserver.

10. For this web application, we are also interested in additional metrics to measure Page Render Times. Select the HTML Injection checkbox to leverage the EdgeSight Monitoring.

Click OK to continue.

Page 14: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 13 |

11. Repeat the same configuration to enable AppFlow and HTML Injection for the SharePoint_vserver entity.

Use the following expression:

HTTP.REQ.LB_VSERVER.NAME.EQ("SharePoint_vserver")

12. Verify the Insight feature is enabled for both virtual servers.

Page 15: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 14 |

13. Next, we will generate some traffic to populate some data. From your external workstation, navigate to the external FQDN for IP# 2.

https://your-dashed-fqdn.mycitrixtraining.net (IP# 2)

Please note the protocol is HTTPs as this is a secure connection

Enter the following credentials when prompted:

Username: TRAINING\user1 Password: Citrix123

The default SharePoint Site should now load.

Since this is the first time we access the SharePoint portal, it might take around 20 seconds for the site to load completely.

14. Once the site loads and all objects on the page are displayed, click on a few links navigate the site in order to generate some relevant stats for NetScaler Insight Center.

Continue to the next step when finished.

15. On the Site1-Win7 VM, return to the NetScaler Insight Center tab. Login again if your session expired. Click on the Dashboard option and click the refresh icon.

Page 16: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 15 |

16. You should now see the relevant statistics as reported by the NetScaler. Click on a few links to generate traffic and then go back to the NetScaler Insight Center UI and refresh the data. Click on the Bar Chart representing the appliance generating the data.

17. While in Web Insight -> Devices, click on the bar chart that represents the device reporting statistics (Site2-NS1). You should now see the number of hits, bandwidth, Response time, cache statistics, active URLs, client/server stats, as well as other HTTP data. Explore the tool and get familiar with the statistics and other metrics.

Page 17: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 16 |

How is this information processed? NetScaler Insight Center uses the NetScaler Nitro API to enable the necessary features, configure HTML injection and AppFlow policies and complete all bindings to the selected virtual server.

When a new request is received by the NetScaler and this request matches the expression defined in the AppFlow policy, an AppFlow record is sent to NetScaler Insight Center using UDP port 4739.

Additionally, information about Page Render times and other metrics are collected through JavaScript inserted dynamically on the page via HTML injection. Inspect the HTML source to verify the relevant JavaScript code is inserted in the page:

18. From your external workstation, navigate to the FQDN for IP # 4. This is the external entry point for the Exchange/OWA virtual server.

https://your-dashed-fqdn.mycitrixtraining.net/ (IP# 4)

Page 18: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 17 |

19. On the authentication page for Outlook Web Access, login with the following credentials:

Username: TRAINING\user1 Password: Citrix123

After login, click on a few links to generate some traffic.

20. Return back to the NetScaler Insight Center UI and navigate to Web Insight -> Applications.

Do you see the new entry for the Exchange_vserver appliacation?

21. Click on Web Insight -> URLs, observe the data reported. Drill into the reports to visualize how information is presented. Asked questions if you would like to get more information on the web analytics being displayed. Continue to the next step when finished.

22. Click on Web Insight -> Clients. Observe the IP address for the client. This should be the external IP where the request is coming from as the NetScaler sees it in the incoming request.

23. Drill into the reports and observe the metrics being reported. Perform a similar observation on the Servers section. Continue to the next step when finished.

24. Next, we will inspect live AppFlow traffic. On the Site1-Win7 VM, open an SSH session using PuTTY. A shortcut should be on the desktop.

Login to the Site2-NS1 appliance using the following credentials:

IP: 192.168.20.50

Username: nsroot Password: nsroot

Page 19: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 18 |

25. Go to the shell and execute the following command to display the active AppFlow traffic:

> shell # nstcpdump.sh udp port 4739

26. From your workstation, refresh the SharePoint site or click on a few links. Take note of the new output in the SSH (PuTTY) session, you should see UDP datagrams being sent on UDP port 4739 sourced from the NetScaler IP destined to the NetScaler Insight Center IP.

Keep track of this information in case your environment is protected with a firewall. You will need to open UDP port 4739 in order for NetScaler Insight Center to receive traffic from all the NetScaler appliances.

27. Hit Control + C on the SSH (PuTTY) session to terminate the TCPDUMP. Type Exit twice to terminate the session.

Page 20: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 19 |

28. Next, we will explore the Web Insight specific graphs. Go back to the NetScaler Insight Center UI on the Site1-Win7 VM. Click on Dashboard and then on the refresh icon.

29. The Devices reporting AppFlow data should appear on the graph. Drill into the Bar Chart for our NetScaler Appliance.

30. Explore the reports for Client and Server latency. Since we are connecting to the SharePoint_vserver directly, you should see your external IP address in the Clients graphs. Verify that this is the case.

Page 21: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 20 |

31. On the Clients graph, sort by Client Network Latency. Select the By Client Network Latency option. Take note of you Client Latency, this is the average time it takes to send a full HTTP request and process the response sent by the NetScaler. In the example below, it is around 70-75ms round trip.

32. Take a look at the Servers graph. Sort By Server Network Latency. Note the reported value. In the example below is virtually 0 ms.

Page 22: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 21 |

We are going to “modify” the network parameters to inject some latency and other network conditions to our inbound links. For this, we will use a WAN emulator which controls the network characteristics for each link configured in the environment. In this exercise, we will modify the Site2-Public and the Site2-Intranet links to control network flows, not only from the client to the NetScaler, but also from the NetScaler to the backend servers.

Here is a simple diagram to illustrate the changes we will make in the next section. After analyzing the diagram, continue to the next step.

Router1 Router2

Public Bond

WAN emulatorSite1 Intranet Site2 Intranet

Site1 Public Site2 Public

eth2

eth1 eth0

eth3

eth4

33. From the Site1-Win7 VM, open a new Internet Explorer tab and navigate to the WAN emulator UI:

http://192.168.30.3

34. Click on basic mode:

Page 23: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 22 |

35. We will be injecting 200ms delay on the interface eth0. Under eth0 enter 200 into Delay time (ms). Click Apply Settings to commit the changes.

36. On your external workstation, refresh the SharePoint site. Hit Control + F5 a few times to refresh all objects.

37. Go back to the NetScaler Insight Center UI and refresh the data in the dashboard by clicking on the Refresh icon.

Page 24: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 23 |

38. Inspect the Servers graph. Sort By Network Latency. Did the value reported increase?

Is it close to 200ms? In the case that it is not, why do you think this is the case?

39. The metrics are calculated on a 5 min average. Since the latency on our previous attempts was minimal (in our example, around 3ms), the average value will take a few minutes to raise to the configured value: 200ms. Keep navigating the SharePoint site for a couple of minutes. Refresh the data in the Dashboard and make sure it keeps increasing until it settles around 200ms.

Page 25: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 24 |

OPTIONAL: Verify the Server latency by sending an ICMP probe from the NetScaler CLI. Use the existing PuTTY connection to PING the SharePoint server. Exit out of the shell. IP: 192.168.10.30

With this data, you have a good indication that the problem is internal and you should not involve your network team, not your ISP ;-)

40. Now we will increase the latency externally. Navigate to the WAN emulator UI and add 300ms to eth3. Click Apply Settings to commit the changes.

41. From your external browser, refresh the SharePoint home page a few times. Click on a few links. Does the page feel sluggish?

It should as we are experiencing 500 ms of overall latency :-)

Page 26: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 25 |

42. Go back to the NetScaler Insight Center UI and refresh the data in the dashboard. Check the Clients graph, sort By Client Network Latency and look at the value. Did it increase?

OPTIONAL: Verify the Client Latency by pinging the external FQDN from your workstation. Was the external latency greater than 300ms?

The connection in XenCenter via RDP might feel a little “sluggish” and “sticky”. Since our management VMs uses one of the links we manipulated, we might feel the effects of this added latency. Switch back to Default Desktop if this affects your connectivity to the VM. Clear the values in order to regain performance. Continue to the next step to complete this activity.

Page 27: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 26 |

43. Go back to the WAN emulator UI. Click on the Reset settings button to set the values for eth0 and eth3 back to zero.

44. Save your NetScaler configuration. Go back to the NetScaler Configuration utility and click on Configuration and then the Save icon on the top right corner.

45. This concludes with this exercise. Next, we will explore ICA visibility using NetScaler Insight Center.

Exercise Summary In this exercise, we configured Web Insight policies in order to get Web analytics information about applications serviced by the NetScaler. When using NetScaler Insight Center, we now have a complete set of metrics to analyze our web application delivery. Some of the data provided by NetScaler Web Insight includes Client and Server latency, processing time, hit count, user-agent and OS type reporting, URL hits, HTTP request and response methods, codes and status.

Page 28: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 27 |

Exercise 3 Configuring AppFlow policies for ICA traffic visibility – HDX Insight Overview In this exercise, we will configure the NetScaler appliance to send AppFlow records for ICA traffic to NetScaler Insight Center through the NetScaler Gateway functionality (ICAPROXY).

Step by step guidance Estimated time to complete this lab: 30 minutes.

Step Action 1. Return to the Site1-Win7 VM. Navigate to the NetScaler Insight Center UI.

http://192.168.10.60

If prompted, login with the following credentials:

Username: nsroot Password: nsroot

2. Click on Configuration.

3. Click on the IP address link: 192.168.20.50

4. On the Applications List, select VPN:

Page 29: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 28 |

5. Right Click on the Access Gateway Virtual Server and select Enable AppFlow.

6. Next we need to enable AppFlow for ICA. On the Enable AppFlow window, use a TRUE expression.

Click OK to commit the changes.

7. Verify the AppFlow status is ENABLED. Scroll to the right and inspect the Insight column.

8. Verify that the policies were bound correctly. Go back to the NetScaler configuration utility and navigate to Configuration -> NetScaler Gateway -> Virtual Servers. Double-click on the Site2-VPN-vserver

Page 30: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 29 |

9. Scroll down to the policies section. Select the AppFlow policy in the ICA Request flow:

10. The AppFlow policy settings window should be displayed. Click on the Edit Action button.

11. Make sure the AppFlow action is configured with the correct collector for the 192.168.10.60 NetScaler Insight Center appliance:

Click Close twice to return to the virtual server properties. Then click on Done to save the configuration.

Page 31: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 30 |

12. Now it is time to test our configuration. From your workstation, login to the external FQDN # 3 for your NetScaler Gateway Virtual Server. Use the provided credentials:

Username: user1 Password: Citrix123

https://your-dashed-fqdn.mycitrixtraining.net (IP# 3)

13. Launch the Win2K8R2 desktop. Wait until the session initializes completely.

14. Go back to the NetScaler Insight Center UI and click on Dashboard.

15. Expand HDX Insight and select Users. Click on the Refresh icon.

It might take a couple of minutes for the data to appear

Page 32: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 31 |

16. Data should start to populate. Inspect the column on the left containing information about the current session. This should display some metrics about the current session and application / desktops launched. Some of the metrics include WAN/Data Center latency, ICA RTT, Bandwidth usage, # Sessions and # of active applications launched. Inspect these metrics.

Continue to the next step.

17. Click on the Desktops node. Scroll down to the Desktops section. You should see the session for user1. Click on the hyperlink.

Page 33: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 32 |

18. This will bring the details for the published desktop session currently open and active. This pane contains information about the VDA, session count, duration bandwidth, latency, Client/Server IP address, ICARTT.

Also, note the NetScaler Insight Center appliance displays additional information about the existence of a CloudBridge unit optimizing the path. This can give you clues in case the session is not optimized at the protocol level. We will explore additional integration for the CloudBridge appliance with NetScaler Insight Center.

Inspect these metrics and then continue to the next step.

19. Next, we will launch another application to continue generating relevant data in NetScaler Insight Center. In your workstation, return to Receiver for Web, click on the Apps button and launch VLC Media Player.

Wait until the application loads completely.

Page 34: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 33 |

20. We will use one of the videos locally on the server to generate more traffic through the ICA session. In VLC, click Media -> Open File.

21. Then select the XDvideos avi file and click Open. A 9 min video should start playing.

Continue to the next step.

22. When the video starts playing, click on the loop icon in order to continuously play the video.

Page 35: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 34 |

23. Go back to the NetScaler Insight Center UI. In the HDX Insight section, select Applications and then click on the refresh button on the top right.

You should see the data appear in the line chart and application list.

It might take up to two minutes for the data to start appearing in the dashboard.

Observe the number of active sessions and active applications. Does this correlate to the current session count?

Since we have a published desktop and a published application running, the number of active sessions is 2, but the active application count is 1. Try to launch another application. Did this number change?

24. Scroll down to the Applications section at the bottom of the page. VLC media player should appear listed. Click on the VLC media player hyperlink to drill into specific statistics for this user.

You should see similar metrics as in the Desktops session. Inspect these data points. Does the data correlate with what you are observing?

Page 36: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 35 |

25. Return to the HDX Insight -> Users section. Click on the refresh on the top right. After the video has been playing for a few minutes, observe the bandwidth and RTT values.

Are these increasing?

Verify this is the case and continue to the next step.

Observe the WAN and DC latency values. Since these values have not increased, but the ICA RTT continues to raise, this indicates heavy load at the application layer as opposed to the network layer. At this time, the administrator has a better understanding of the issue and can start troubleshooting the appropriate component.

26. While the HDX Insight -> Users node is selected, scroll down the page. You should see additional information on the dedicated Users section. Click on the user1 to drill into additional metrics for this particular user account.

Page 37: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 36 |

NetScaler Insight Center displays by default the last 5mins statistics. Additionally, the summary chart for each user will record the 95th % average, high, and low data points, as well as the time

which these events occurred.

Each additional section at the bottom of the page can be sorted by the relevant metric to display in

the graph.

27. Scroll down to the Applications and Gateways graphs. You can see the current application list and gateways this user is coming from.

By default, the data is sorted by Active applications count; however, you can also sort by Total Session Launch counter, and App Launch count Duration for this particular time interval.

Sort by other values to observe how the graph changes. This will provide the administrator visibility of application launch duration and the origin for the connection.

Continue to the next step when done.

Page 38: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 37 |

28. In the same page, you should see the session information: Current and Terminated sessions and metrics for each one: id, state, start time, uptime, latency, ICA RTT for this session, and bandwidth used among others. Scroll to the right to see the full range of metrics reported for this application.

29. Continue scrolling to the bottom of the page. You should see the Virtual Channels related statistics for this particular user (User1). Since we have launched published Internet Explorer and we used this session to play a video, most of the traffic was related to screen refreshes and audio.

Verify this is the case.

30. Close VLC media player and the published desktop to stop the flow of ICA traffic before continuing to the next step.

Page 39: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 38 |

31. Let’s launch another application for a different user. Close the Receiver for Web page.

Re-open your browser and navigate to the NetScaler Gateway FQDN # 3. Login with the following credentials:

Username: user2 Password: Citrix123

https://your-dashed-fqdn.mycitrixtraining.net (IP# 3)

32. Launch FoxIt reader. Wait until it fully loads.

Page 40: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 39 |

33. Using the published FoxIt Reader application, allow drive mapping to occur and open any PDF document located on your workstation. If Citrix Receiver prompts you for access to the file system, select Allow Read Only Access.

If you do not have a PDF document handy, you can download the NetScaler Administration Guide from the following location: http://support.citrix.com/article/CTX132357

Page 41: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 40 |

34. Go back to the NetScaler Insight Center UI. Navigate to the Dashboard -> HDX Insight -> Users. At the bottom of the page, click on user2.

35. Scroll down to the virtual channel information. Inspect the graph.

Do you see an increment in Client Drive mapping traffic when compared to the previous session?

While on the user2 statistics page, refresh the Dashboard by clicking on the refresh icon on the top right.

Validate your findings and then continue to the next step.

Page 42: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 41 |

36. Finally, the last graph is related to the ICA client type used to launch the session. Verify that the client type reported matched the device you are using to launch the application.

Validate the correct Citrix Receiver version for the platform you are using is displayed, then continue to the next step.

37. Close any published application or desktop that is currently opened.

Feel free to explore the different reports and options we have available. Launch a few applications and analyze the metrics. Ask questions if a concept is not clear or you are having problems understanding any of the metrics.

Familiarize yourself with the NetScaler Insight Center UI. In the next section, we will use the WAN emulator to alter the network conditions in order to analyze the relevant metrics for ICA traffic

Congratulations! You have concluded this exercise.

Exercise Summary NetScaler Insight Center is an AppFlow consumer for HTTP and ICA related information contained within the AppFlow records sent by the NetScaler appliance. Multiple metrics related to the type of traffic being analyzed can be found in NetScaler Insight Center. By having real-time access to this information, it is easier to pinpoint the cause for a performance problem in order to start focusing on certain areas.

In this exercise, we inspected many of the metrics and reports available in NetScaler Insight Center.

Page 43: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 42 |

Exercise 4 Analyzing NetScaler Insight Center metrics to identify potential issues Overview In this exercise, we will explore the powerful reporting engine for NetScaler Insight Center to understand some of the key metrics that allows you to pin-point the cause of application delivery issues. Also, we will use NetScaler Insight Center as a capacity planning tool to keep track of Concurrent User Licenses being consumed at the gateway.

Step by step guidance Estimated time to complete this lab: 30 minutes.

Step Action 1. Let’s first start with license information. On the Site1-Win7 VM, return to the NetScaler

Insight Center UI. If you closed Internet Explorer, navigate to: http://192.168.10.60

Login with the following credentials:

Username: nsroot Password: nsroot

2. Navigate to Dashboard -> HDX Insight -> Licenses

How many license do you see available? In use?

The system should report that only 5 licenses are available and 0 are being used. This information is being pulled from the NetScaler appliance. Since this appliance is licensed at the Platinum level and the Virtual Server is configured for Basic Mode, the number ICA users allowed is unlimited.

Inspect the Virtual Server mode configured on the NetScaler Gateway appliance. You can see this information by opening the properties of the NetScaler Gateway vserver and checking for the ICAONLY

setting.

If you want to see license consumption in NetScaler Insight Center, edit the virtual server configuration and set the mode to Smart Access, then launch a published application.

Page 44: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 43 |

3. As our next step, we will enable remote access using another NetScaler gateway located on Site 1 to simulate an environment with multiple entry points. In the NetScaler Insight Center UI, click on Configuration.

4. Next, click on the Add button and add the new NetScaler appliance using the following parameters:

NetScaler IP address: 192.168.10.50 Username: nsroot Password: nsroot

Click Add.

Page 45: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 44 |

5. In the Application List, select VPN from the View menu. Right click on the Site1-VPN-Vserver and enable AppFlow.

6. Select a true expression. Click OK.

7. From your external workstation, navigate to the external FQDN for IP# 1.

https://your-dashed-fqdn.mycitrixtraining.net/ (IP# 1)

Login with the following credentials:

Username: user1 Password: Citrix123

8. Launch Excel. Wait until it fully loads.

Page 46: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 45 |

9. Go back to the NetScaler Insight Center UI. Click on Dashboard and navigate to HDX Insight -> Gateways and verify the new gateway is reporting AppFlow statistics.

It may take between 1-2 minutes for the data to appear.

Continue to the next step.

10. In NetScaler Insight Center, navigate to HDX Insight -> Users. Scroll down the page and click on the user1 hyperlink.

Page 47: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 46 |

11. Inspect the metrics being reported for user1.

12. Scroll down the page and verify the correct applications and Gateways are listed:

Page 48: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 47 |

13. Close all applications and then logoff from Receiver for Web.

Gracefully exiting published applications trigger a session logoff on the VDA. This process might take a few moments while all processes started during the session are terminated. You can verify if the user is logged off by logging to the Site1-VDA VM and inspecting the list of Active sessions.

In the VDA, use task manager to see the User list. Logoff any user session to visualize the reports correctly.

14. Let’s inject some latency and jitter on the internal segment in order to simulate a lossy link. On the Site1-Win7 VM, use IE to navigate to the to the following URL to access the WAN emulator configuration:

http://192.168.30.3

Page 49: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 48 |

15. Select Advanced mode. In order to control network settings for the link between the WAN emulator and the Router1, select eth1 and click Start. Refer to the diagram below to understand where we are manipulating the network conditions.

The green arrows show how traffic will flow in this configuration:

Router1 Router2

Public Bond

WAN emulatorSite1 Intranet Site2 Intranet

Site1 Public Site2 Public

eth2

eth1 eth0

eth3

eth4

ICA TRAFFIC FLOW

We are manipulating this segment

To VDA

16. In the delay section, enter the following parameters:

Click Apply Settings.

Page 50: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 49 |

17. From your external workstation, open your browser and navigate to the FQDN for IP # 3, which resides on Site 2.

https://your-dashed-fqdn.mycitrixtraining.net (IP # 3)

Username: user1 Password: Citrix123

18. Login and launch Word as user1.

19. Go back to the NetScaler Insight Center UI and refresh the data for user1. Wait until the data starts populating for the new published app launched. Compare the WAN and Data Center latency.

Does it correlate with the network changes we introduced? Is this useful when troubleshooting performance issues?

20. Observe the graph and see the fluctuation in performance. Note how the server-side jitter is affected the most. This is the variance in latency on the connection between the NetScaler Gateway appliance and the application server (XenDesktop). At this point, the session should feel a bit sticky and very laggy. Attempt to type and click on the menus.

From the statistics being reported, we know that this issue is not related to available bandwidth as the consumption is very low. Compare these results with your own testing.

Does it correlate with your observations?

Continue to the next step when finished.

Page 51: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 50 |

21. Feel free to modify the network parameters and launch applications to observe the results. Explore the different metrics and the effects of these changes. Spend some time navigating the different options and charts.

Please don’t inject too much latency or packet loss as you might feel the effects of these changes when connecting to the lab.

Switch to a Default Desktop connection if the RDP session becomes too slow.

22. When finished, close any published applications/desktops and revert the values for the WAN emulation to zero in order to regain normal performance.

To reset all interfaces to default values, click on Basic Mode and then on Reset Settings

Congratulations! You have completed this exercise.

Exercise Summary NetScaler Insight Center provides the NetScaler and XenApp/XenDesktop administrator with additional tools to troubleshoot performance problems. In this exercise, we injected additional network conditions and use the data provided by NetScaler Insight Center to verify and correlate ICA session performance.

Page 52: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 51 |

Exercise 5 Configure additional deployment types for HDX Insight Overview The NetScaler Gateway component already has ICA awareness as it is the device that provides external access. The HDX insight solution provides additional capabilities as it allows to inspect ICA traffic, not only in ICAPROXY modes, but also transparently for internal clients launching published resources directly from the XenApp/XenDesktop environment.

In this exercise, we will configure a NetScaler appliance in transparent mode in order to collect and aggregate the AppFlow data in NetScaler Insight Center.

Step by step guidance Estimated time to complete this lab: 30 minutes.

Step Action For this exercise, we will use Site2-NS1 appliance which was preconfigured to route traffic between an additional VDA (Site2-VDA) already registered with the XenDesktop controller. All the routing and networking infrastructure is ready and all hosts have IP connectivity with the additional subnet behind the NetScaler appliance. We will use this network setup to enable transparent mode and report AppFlow statistics to NetScaler Insight Center for deployments that do not use a gateway appliance in ICAPROXY mode.

Page 53: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 52 |

1. Refer to the diagram below and continue to the next step when understanding the network topology:

RemoteSite192.168.20.0/24

MainSite192.168.10.0/24

Public Network

Router1 Router2

AD

Public Bond

Win7Client

Exchange

@SharePointSQL NS Insight

Splunk

NetScaler1 NetScaler2

WAN emulator

PublicIP #1PublicIP #2PublicIP #3

PublicIP #4PublicIP #5

XenDesktop VDAStoreFront

CloudBridgeCloudBridge

Site1 Intranet Site2 Intranet

Site1 Public Site2 Public

Private Subnet192.168.25.0/24

VDA

2. On the Site1-Win7 VM, access Site2-NS1 configuration utility. Open a new tab in IE, and navigate to the following URL:

http://192.168.20.50

Use the following credentials:

Username: nsroot Password: nsroot

Page 54: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 53 |

3. We will set the port numbers for ICA traffic to be inspected on the NetScaler. Navigate to Configuration -> System -> Settings -> Change Global System Settings.

Scroll down to the bottom of the page and add the corresponding ports for ICA traffic:

1494,2598

You can also perform the same action from the CLI by connecting via SSH and using the following command:

> set ns param -icaPorts 1494 2598

4. Next, we need to verify the AppFlow feature is enabled. Navigate to Configuration -> System -> Settings -> Configure Advanced Features. Verify AppFlow is enabled and click Close.

Page 55: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 54 |

5. Next, we need to make sure the NetScaler appliance is sending AppFlow information to the right collector. In the NetScaler Configuration utility, navigate to Configuration -> System -> AppFlow -> Collectors.

Check for a collector entity already defined. This should have the following settings:

Name: af_collector_192.168.10.60 IP Address: 192.168.10.60 Port: 4739

Page 56: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 55 |

6. Next, we need to create an AppFlow policy that will send analytics for transparent ICA traffic to the NetScaler Insight Center VM.

There are other policies already created; however, these are bound at the vserver level. Since we need to generate AppFlow records for all traffic that traverses the appliance, we need to create a new policy and bind at the global level.

Navigate to Configuration -> System > AppFlow > Policies > Add.

Use the following parameters:

Name: appflow_pol_ica_global Action: af_action_192.168.10.60 Expression: true

Click Create.

7. Next, we will bind the policy globally. Click on Policy Manager.

Page 57: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 56 |

8. Select Default Global for the Bind Point and ICA as the Protocol.

Click Continue.

9. Click Insert and then select the appflow_pol_ica_global policy.

Click on the Insert button to continue.

Page 58: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 57 |

10. Click OK to commit the changes.

Then Done to return to the Policy list.

You can also perform the same action from the CLI by using the following command:

> bind appflow global appflow_pol_ica_global 100 END -type ICA_REQ_DEFAULT

11. While on the NetScaler configuration utility, save your running configuration by clicking on the save button on the top right:

Click Yes on the confirmation prompt.

12. Before we test, we need to disable Traffic Process on both CloudBridge appliances. Open a new tab in IE and login to the Site1-CloudBridge appliance using the following credentials:

IP: 192.168.10.40 Username: admin Password: password

This is only necessary due to a bug in this pre-release version. This is already being addressed for the general availability release.

Page 59: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 58 |

13. Navigate Configuration -> Appliance Settings. Disable Traffic Processing:

14. We need to perform the same operation on the remote appliance. Login to Site2-CloudBridge using the following parameters:

IP: 192.168.20.40 Username: admin Password: password

Disable traffic processing:

15. Now that we have all the pieces in place, let’s test our configuration. From the Site1-Win7 VM, open up a new tab in Internet Explorer and navigate to:

https://storefront.training.lab/Citrix/StoreWeb/

Login with the following credentials:

Username: TRAINING\user3 Password: Citrix123

Page 60: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 59 |

16. Since we need to launch applications through the Site2-NS1 appliance in transparent mode, a few applications were published to Site2-VDA which uses the NetScaler as a next hop. In this network topology, the NetScaler appliance is acting as default gateway for the subnet: 192.168.25.0/24.

Launch Wordpad_PrivateSubnet app. Wait until it fully loads.

17. Go back to the NetScaler Insight Center UI. Login if the session expired. Use the following credentials:

http://192.168.10.60

Username: nsroot Password: nsroot

18. Navigate to Dashboard -> HDX Insight -> Users. Click on user3. Scroll down to the Applications section. You should see the details of the internal session launched.

Success! We have the NetScaler forwarding the layer 3 traffic to the XenDesktop VDA and sending analytics on the ICA traffic that passes through.

Page 61: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 60 |

19. To verify this on the NetScaler, go back to the CLI session to 192.168.20.55 in PuTTY. The following command will show the connection table and filter using the grep command for the IP address of the Windows 8 client. We should see an ICA connection to the Site2-XenApp2 server.

> show connectiontable -detail FULL | grep 192.168.25.2

20. Congratulations! You have finished this lab. We hope that the information contained in this session was valuable to gain additional visibility of your XenApp and XenDesktop environments.

Exercise Summary Transparent is another deployment option for internally based XenApp/XenDesktop farms via Web Interface or Storefront. In this exercise, we configured an additional NetScaler appliance to provide HDX analytics on non-Gateway XenApp/XenDesktop deployments.

Page 62: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 61 |

Page 63: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 62 |

Exercise 6 XenDesktop 7.x Integration with HDX Insight Overview In this exercise, we will configure a XenDesktop director to integrate with NetScaler Insight Center to provide a single pane of glass for all session analytics data. This feature is only available in XenDesktop 7.x.

Step by step guidance Estimated time to complete this lab: 15 minutes.

Step Action 1. Login to Site1-XenDesktop VM

2. Open the PowerShell console. A shortcut is on the task bar.

3. Navigate to the following directory: c:\inetpup\wwwroot\Director\tools

Page 64: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 63 |

4. Execute the Director Configuration utility by using the following command.

DirectorConfig.exe /confignetscaler

Make sure you specify the /confignetscaler switch. Provide the following information:

Machine Name: 192.168.10.60 - This is the IP or FQDN for NetScaler Insight Center: Username: nsroot - The username for NetScaler Insight Center Password: nsroot – Password for NetScaler Insight Center:

Since we do not have a valid certificate on the NetScaler Insight Center management address, select 0 for an HTTP connection to avoid any certificate prompts:

5. On the Site1-Win7 VM, open a new tab in Internet Explorer and navigate to the following URL:

http://xendesktop.training.lab/Director

Use the following credentials:

Username: Administrator Password: Citrix123 Domain: TRAINING

Click Log on.

Page 65: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 64 |

6. Click on Trends -> Network. You can now see the data about the network being collected by NetScaler Insight Center. Explore the reports.

Congratulations! You have concluded with this exercise.

Exercise Summary XenDesktop Director integrates seamlessly with NetScaler Insight Center. In this exercise, we configured XenDesktop Director to pull network-related data from the NetScaler Insight appliance.

Page 66: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 65 |

Exercise 7 External authentication support in NetScaler Insight Center Overview In this exercise, we will configure NetScaler Insight Center to request authentication from an LDAP directory service to allow certain users based on group membership read or read/write access to the administration interface.

Step by step guidance Estimated time to complete this lab: 15 minutes.

Step Action 1. On the Site1-Win7 VM, use Internet Explorer to login to the NetScaler Insight Center UI.

Use the following credentials:

IP: 192.168.10.60 Username: nsroot Password: nsroot

2. Click on Configuration.

3. Navigate to System -> Authentication -> LDAP. Click on Add.

4. Create an LDAP server configuration using the following parameters:

Name: AD_LDAP IP Address: 192.168.10.11 Type: AD Port: 389 Base DN: dc=training,dc=lab Administrative Bind DN: [email protected] Administrative Password: Citrix123 Confirm Administrative Password: Citrix123

Leave other settings with the default values.

Click Create.

Page 67: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 66 |

5. Enable LDAP Authentication and Local Fallback. Navigate to System -> Authentication. Click on Authentication Configuration.

6. Select LDAP as the Server Type and AD_LDAP as the Server Name. Make sure the Enable fallback local authentication checkbox is enabled.

Click OK.

7. Navigate to System -> User Administrator -> Groups. Click on Add.

8. Create two groups. ITstaff and give it admin permissions and Contractors and give it a readonly permission.

Page 68: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 67 |

9. Logout of the NetScaler Insight Center UI by clicking Logout on the top right.

10. The domain account user4 is a member of the Contractors group. Attempt to logging to NetScaler Insight Center using the following credentials.

Username: user4 Password: Citrix123

11. Navigate to Configuration -> System. Click on Modify Time Zone and attempt to change it to UTC-0400 EDT America/New_York

Click OK.

Since this account was assigned a readonly profile, any attempt to delete or modify any configuration will receive a message stating that this operation is not authorized.

Page 69: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 68 |

12. Logout of the NetScaler Insight Center UI.

Congratulations! You have concluded with this exercise.

Exercise Summary NetScaler Insight Center is now capable of configuring an external authentication source to allow administrative access to members across the organization. Group extraction and readonly / read and write profile mapping allows administrative control delegation.

Page 70: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 69 |

Exercise 8 Gain more application visibility with CloudBridge Overview Another Citrix product that allows additional visibility for your remote users is CloudBridge. Using the advanced capabilities and deep understanding of the ICA protocol you can now leverage the CloudBridge appliance to control how ICA traffic flow across your infrastructure. Providing optimizations at the protocol level, the administrator will have more visibility and control of ICA flows.

In this exercise, we will explore some of the QoS, visibility, and reporting capabilities of the CloudBridge appliance to provide additional visibility on optimized traffic.

Step by step guidance Estimated time to complete this lab: 20 minutes.

Step Action 1. First, observe the following diagram and familiarize yourself with the network topology.

Since this is an inline deployment, all traffic crosses the corresponding CloudBridge appliance on each site.

RemoteSite192.168.20.0/24

MainSite192.168.10.0/24

Router1 Router2

AD

Public Bond

Win7Client

Exchange

@SharePointSQL NS Insight

Splunk

NetScaler1 NetScaler2

WAN emulator

PublicIP #1PublicIP #2PublicIP #3

PublicIP #4PublicIP #5

XenDesktop VDAStoreFront

CloudBridgeCloudBridge

Site1 Intranet Site2 Intranet

Site1 Public Site2 Public

Private Subnet192.168.25.0/24

VDA

In this exercise, we will launch published applications across the internal Site-to-Site connection. Since traffic traverses the entire network, CloudBridge will be able to optimize ICA and provide additional visibility for these connections.

Page 71: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 70 |

2. From the Site1-Win7 VM, open Internet Explorer and navigate to the Receiver for Web site:

https://storefront.training.lab

Login with the following credentials:

Username: TRAINING\user3 Password: Citrix123

3. Launch Wordpad_PrivateSubnet. Wait until the applications fully loads.

4. In IE, open a new tab. Login to the CloudBridge appliance on Site1:

http://192.168.10.40

The appliance is configured with the default credentials.

Username: admin Password: password

5. After logging in, you should be presented with the dashboard which displays a summary of all the traffic crossing through the appliance. This shows how much traffic was optimized, the bandwidth savings, and an overview of the number of connections that are currently accelerated.

Explore the graphs before continuing to the next step.

6. Since we are interested in the ICA traffic, let’s explore some of these features. Click on Monitoring.

Page 72: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 71 |

7. Navigate to Optimization -> Citrix (ICA/CGP)

8. In the ICA Connections tab, you should see the active ICA sessions flowing through this appliance. In this view, you can see the name of the application, client computer name, IP address, protocol used (ICA/CGP), the amount of data transferred, and most importantly, the Acceleration Status.

9. Click on the ICA Statistics tab. Here you can observe cumulative metrics for the different traffic types flowing through the session as well as session count, ICA stream count, and type of session. Inspect the output.

Continue to the next step when done.

10. Finally, navigate to the ICA Advanced option under Optimization. Observe the additional detail provided.

Page 73: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 72 |

Next, we will explore how CloudBridge allows granular control over the ICA traffic. Leveraging the advanced processing capabilities and deep understanding of the ICA protocol, CloudBridge is able to dissect virtual channel information and apply specific settings at the application level for QoS, traffic priority and available bandwidth for critical resources.

11. Click on the Configuration tab and navigate to Optimization Rules -> Application Classifiers

12. From the Application Group menu, select Citrix Protocols:

13. Since the Auto-discover Citrix published applications setting is enabled, scroll down the list and you should see all the published apps that we have launched through this CloudBridge appliance.

Page 74: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 73 |

14. Next to ICA:Wordpad, click on the Edit button and verify the Application Group and Classification Type for this auto-discovered application.

Since this is automatically detected as an ICA published app, CloudBridge keeps statistics on this particular applications and different priorities and QoS settings can be set for critical apps.

15. The CloudBridge appliance already assigns the correct priority and categorizes published applications with the recommended settings.

Click Cancel to return to the Application Classifiers list.

16. Next, to visualize the native reporting for published applications, navigate to Monitoring -> Optimization -> Top Applications.

In the Top Applications Graphs, verify the Wordpad app is listed. Type a few words or click on the menus in the app to generate some traffic.

Is your application listed? Are these statistics relevant?

Page 75: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 74 |

17. Click on the refresh button on the top right to get new data.

18. While logged in as User3, launch a desktop now. Navigate around the CloudBridge Reporting Graphs. Explore the data and ask questions if you need any clarification.

19. Close any opened published app or desktops.

20. Congratulations! You have concluded with this exercise.

Exercise Summary CloudBridge provides additional and optimization visibility for ICA deployments. By leveraging a deep understanding of the ICA protocol, the CloudBridge appliance is able to optimize at the protocol level giving us a performance boost for those users connecting through loosy link and high latency links.

CloudBridge is the best optimization platform for a Citrix delivery infrastructure and the default configuration already allows you to visualize and optimize your ICA deployments.

Page 76: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 75 |

Exercise 9 CloudBridge AppFlow support Overview CloudBridge now natively supports the AppFlow protocol and it is able to generate key statistics to known collectors. In this exercise, we will configure AppFlow reporting and integrate with common collectors for additional application visibility.

Step by step guidance Estimated time to complete this lab: 20 minutes.

Step Action 1. From the Site1-Win7 VM, access the Site1-CloudBridge appliance. Re-login if

necessary:

http://192.168.10.40

Use the default credentials:

Username: admin Password: password

2. Click on the Configuration tab and expand Appliance Settings -> AppFlow.

3. In the Choose a Data Set section, enable the HDX option and click Save.

Page 77: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 76 |

4. Finally, add a new AppFlow collector. In the Collectors section, click on Add. Provide the following information:

Collector Name: Splunk IP Address: 192.168.10.23 Port: 4739 Status: Enable

5. Verify that the collector was added to the list.

6. Finally, enable the AppFlow feature.

That is it! As soon as we enable configure the correct parameters and enable the feature, the necessary template and record information is sent to Splunk. Next, we will explore the data being parsed by the collector in order to leverage and use it for monitoring and troubleshooting purposes.

Page 78: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 77 |

7. To generate some key metrics, launch a few applications that traverse this CloudBridge appliance. This works for internal and internal applications as both of these traffic flows pass through the in-line deployment we have configured.

We will test the setup internally. Open a new tab in IE, and navigate to the Receiver for Web Address:

https://storefront.training.lab/Citrix/StoreWeb

Login with the following credentials:

Username: TRAINING\user3 Password: Citrix123

8. Launch the published desktop. Wait until it fully loads.

Next, we will generate some ICA and MAPI traffic by launching published Outlook. The Exchange profile has been already preconfigure and traffic should traverse both CloudBridge appliances. We are not only generating ICA traffic reporting, but also MAPI traffic statistics.

9. Return to Receiver for Web. Subscribe to Outlook as user3, then launch it.

Wait until it fully loads and the mailbox for the user is displayed.

Page 79: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 78 |

10. Ahh! You’ve got mail. Reply to the message to generate some additional MAPI traffic.

11. The next step is to access the Splunk UI. Open a new tab in IE and navigate to the following URL:

http://192.168.10.23:8000/

Use the following credentials:

Username: admin Password: Citrix123

Click on Sign In.

Page 80: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 79 |

12. On the Splunk Home page, Click on the Splunk for Citrix CloudBridge app.

13. You will immediately start visualizing the data as Splunk will collect vital information from the CloudBridge appliance. No additional configuration is needed in Splunk as the app natively consumes and parses AppFlow, providing you with the information you need to know about your deployment.

If you do not see any data in the graphs, this is an indication that the AppFlow templates were not processed correctly by the Splunk server. Return to the CloudBridge UI, navigate to Appliance Settings -> AppFlow and disable then re-enable the AppFlow feature.

After re-enabling the feature, close your published applications and launch them again.

14. Inspect the metrics and click on the charts to drill into the data.

Page 81: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 80 |

15. In the Bandwidth Savings for Top Applications bar chart, observe how ICA traffic for the specific apps we launched and also MAPI traffic is reported.

16. In the bar chart, click on MAPI and drill in to see additional stats:

17. On the top menu bar, you can see many useful reports that will allow you to have more visibility over the traffic. For example, let’s explore client side traffic. Click on Clients -> Client Traffic Overview.

Page 82: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 81 |

18. You should see additional detail on Client IPs, WAN throughput per client, as well as a list of the top talkers. Feel free to drill into the data to get more granularity.

19. Perform a similar exploration for the Partners section. This will display additional information about the branch office CloudBridge appliance acting as a partner for the unit reporting AppFlow to Splunk.

Page 83: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 82 |

20. In addition to common protocols, the CloudBridge appliance will report additional statistics on HDX traffic as it process it.

Click on HDX -> HDX Overview to visualize the data.

21. In this section, you will see information about the number of applications running, number of connections, and throughput used.

Continue to the next step after analyzing the data.

Page 84: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 83 |

22. More information is available at the bottom of the page. This includes additional metrics on WAN latency and categorizes this data by Top user and applications. Scroll down to see these graphs:

Drill into the data to by clicking on any of the bars.

23. Feel free to continue the exploration. The Spluk for CloudBridge app contains important metrics that can help you troubleshoot a performance problem. Navigate the app and drill into the data.

24. Congratulations! We hope that you have enjoyed this lab.

Exercise Summary CloudBridge now fully supports AppFlow reporting for WAN optimization and HDX traffic flows. It provides additional visibility at the network level that can help you visualize and troubleshoot performance problems in your environment.

Page 85: Hands-on Lab Exercise Guidedocs.citrixvirtualclassroom.com/events/SYNLA2014/syn2014-ns... · Hands-on Lab Exercise Guide . ... Lab Guide Conventions ... Site1-CloudBridge admin password

| 84 |

Revision: Change Description Updated By Date

2.0 New version! Includes more exercises on new features David Jimenez 4/9/2014

Please complete this survey

We value your feedback! Please take a moment to let us know about your training experience by completing the brief Learning Lab Survey

About Citrix Citrix Systems, Inc. designs, develops and markets technology solutions that enable information technology (IT) services. The Enterprise division and the Online Services division constitute its two segments. Its revenues are derived from sales of Enterprise division products, which include its Desktop Solutions, Datacenter and Cloud Solutions, Cloud-based Data Solutions and related technical services and from its Online Services division's Web collaboration, remote access and support services. It markets and licenses its products directly to enterprise customers, over the Web, and through systems integrators (Sis) in addition to indirectly through value-added resellers (VARs), value-added distributors (VADs) and original equipment manufacturers (OEMs). In July 2012, the Company acquired Bytemobile, provider of data and video optimization solutions for mobile network operators.

http://www.citrix.com