SLAC Remote Access and Citrix XPe Brian Scott

SLAC Remote Access and Citrix XPe Brian Scott SLAC May 2004

Windows Remote Access Solutions l Citrix – l VPN/PPTP – l Allows access to a full Windows desktop and/or various applications Provides encrypted tunnel between remote system and SLAC internal network Remote Desktop Protocol – Unencrypted access to Windows XP system l Requires use of VPN before using RDP

File Access l l l Citrix provides access to all internal resources to which you have permissions VPN access available to central Windows file servers No longer allowing access to Windows file sharing to desktops via VPN

E-mail l Microsoft Outlook access available via several mechanisms – – Citrix (full thick client access) Outlook Web Access (OWA), new version coming with Exchange 2003 migration this summer l l – Old version https: //www-mail. slac. stanford. edu New version coming soon VPN and use of Outlook thick client

Citrix XPe l April 2004 - Finished rollout of Citrix XPe farm – – – l Farm running Windows 2000 with Citrix XPe Support for Windows Systems and Linux (private build to support Secure ICA over SSL) 900+ accounts May 2004 - Shutdown Citrix Metraframe 1. 8 farm – Farm ran Windows NT TSE with Citrix Metaframe 1. 8

Secured Communication Protocols l 128 -bit SSL encryption. – – l Citrix SSL Relay Service. – l Initial communication between Web Portal servers (Citrix Meta. Frame NFuse) & client. Subsequent communication between Application servers (Citrix Meta. Frame Presentation server) & client. Server-to-server communication. Citrix Secure ICA - RSA RC 5 128 -bit encryption. – – ICA session between Application servers & client. Enforceable to client as minimum requirement.

Redundancy within Citrix Servers l 2 Citrix NFuse Web Portal servers. – – l l l http: //slaccitrix 1. slac. stanford. edu http: //slaccitrix 2. slac. stanford. edu 2 Independent Management Architecture (IMA) Citrix Control servers. N+2 Citrix Presentation servers in excess of peak capacity in Silo-1 (General Apps). N+2 Citrix Presentation servers in excess of peak capacity in Silo-2 (Restricted Apps).

2 Silo’s l Silo 1 – l The purpose of the Silo 1 servers is to provide access to the common set of applications to all SLAC Citrix users. Silo 2 – The purpose of Silo 2 is to provide metered access to applications with certain licensing restrictions. For example: Certain applications are only licensed to be run by members of certain SLAC departments. Other applications are only licensed to be executed by a limited number of concurrent users.

Server Configuration l Web Portal Servers – l Citrix SSL Relay – l – – – – – The data collectors manage server farm dynamic data and client enumeration/resolution. Meta. Frame XP server farm administrator permissions Citrix Meta. Frame XP product licenses Meta. Frame server configuration settings Published application configuration settings Application load balancing configuration settings Printer management information settings Meta. Frame XP server farm policies Meta. Frame Resource Manager configuration settings Citrix Installation Manager settings MS SQL Server – l The Citrix SSL Relay is a service that runs on the Meta. Frame XP servers and secures communications between the Web portal servers, the IMA servers, the Meta. Frame XP application servers and ICA client PCs. IMA Servers (Data Collectors) – l The Web servers host the Web Interface for Citrix Meta. Frame XP. The Web interface consists of Java objects and Web server-side scripts that reside on the web servers. Data store for IMA servers WTS Licensing Server – The WTS Licensing service on the AD domain controllers is responsible for providing WTS licensing tokens for WTS clients (including ICA client PCs).

CITRIX DEMO