godok.id

hh You can optionally configure the APM with smart card authentication or with two-factor authentication using RSA SecurID.»» I f deploying two factor authentication using SecurID, you must have an existing SecurID AAA Server object on the BIG-IPAPM to use this option. This AAA Server must include your SecurID Configuration file. You must also configure the BIG-IPsystem as a standard authoritative agent on the RSA Authentication server. For specific information on configuring theRSA server, consult the appropriate RSA documentation.»» I f deploying smart card authentication, be sure to see Appendix A: Citrix server changes required to support smartcard authentication on page 42. Note we currently do not support smart card authentication with StoreFrontversion prior to 2.5; only Web Interface server 5.4 and StoreFront 2.5 and later are supported.hh I n the configuration described in this guide, domain pass-through is required if using smart cards with Kerberosauthentication. Domain pass-through is only supported in StoreFront 2.5 and later, therefore previous versions ofStoreFront are not supported for this scenario.hh I f using Web Interface servers, Citrix Session configuration must be set to Direct mode (see Figure 1). For specificinformation on configuring the Citrix Session mode, see the Citrix documentation.hh T he iApp template now supports using the BIG-IP Manager role to deploy the iApp template for LTM and some APMfeatures. When deploying with the Manager role, the iApp does not show any APM two-factor authentication options.hh I f your SSL key is password protected, it will not appear as a selectable option in the iApp template. To use a passwordprotected key, you must manually create a Client SSL profile outside the iApp template and then select it from the list. SeeLocal Traffic Profiles SSL Client to create an Client SSL profile. You can add the passphrase while creating the profile.hh In BIG-IP v13.1 and later, full StoreFront replacement mode is supported and configurable in the iApp template.Service ports used by Citrix with the BIG-IP systemUse the following table for guidance on which ports should be open on your Firewall to allow traffic to and from the BIG-IP system.This table is provided for reference only; consult your firewall administrator for details.Firewall Port tableConfigurationStorefront or Web 5.4 serverreplacement using APMStorefront or Web 5.4 serverintegration using APMLoad Balancing only using LTMService or Protocol NameSourceDestinationSecure Web Connections443Citrix Receiver Client NetworkBIG-IP Virtual Server Address forClient ConnectionsWeb Connections (secure orinsecure)443 or 80BIG-IPCitrix XML or DDC serversICA Display Protocol1494 or2598 (if sessionreliability enabled)BIG-IPApplication and Virtual DesktopResourcesSecure Web Connections443Citrix Receiver Client NetworkBIG-IP Virtual Server Address forClient Connections443 or 80StoreFront or Web 5.4 ServersBIG-IP XML VS address443 or 80BIG-IPCitrix XML or DDC servers443 or 80BIG-IPStoreFront or Web 5.4 ServersICA Display Protocol1494 or2598 (if sessionreliability enabled)BIG-IPApplication and Virtual DesktopResourcesSecure Web Connections443Citrix Receiver Client NetworkBIG-IP Virtual Server Address forClient Connections443 or 80StoreFront or Web 5.4 ServersBIG-IP XML VS address443 or 80BIG-IPCitrix XML or DDC servers443 or 80BIG-IPStoreFront or Web 5.4 Servers1494 or2598 (if sessionreliability enabled)Citrix Receiver Client NetworkApplication and Virtual DesktopResourcesWeb Connections (secure orinsecure)Web Connections (secure orinsecure)ICA Display ProtocolF5 Deployment GuidePort4Citrix XenApp and XenDesktop

Deployment ScenariosThis section describes the three main scenarios described in this document.Using the BIG-IP APM with Dynamic Webtops to replace Web Interface or StoreFront serversIn this scenario, the BIG-IP APM Dynamic Presentation Webtop functionality is used to replace the Citrix Web Interface or StoreFronttier. With BIG-IP APM, a front-end virtual server is created to provide security, compliance and control. The iApp template configuresthe APM using Secure ICA Proxy mode. In secure ICA proxy mode, no F5 BIG-IP APM client is required for network access. The BIGIP system uses SSL on the public (non-secure) network and ICA to the servers on local (secure) network.Through the setup of a secure proxy that traverses APM, remote access for user sessions originating from desktops or mobile devicesis possible. Secure proxy mode has many benefits to both users and administrators. For administrations, APM user authentication istied directly to Citrix’s Active Directory store allowing for compliance and administrative control. For users, TCP optimization andapplication delivery, plus the need for only the Citrix client, creates a fast and efficient experience.InternalCitrix clientsClientsLTMInternet or WANAPMProxyICA TrafficBIG-IP PlatformInternal NetworkCitrix ApplicationServers (ICA) orVirtual DesktopsCitrix XML Brokeror DDC ServersFigure 1:Using the BIG-IP APM to replace the Web Interface or StoreFront serversUsing the BIG-IP APM and Web Interface or StoreFront serversThis scenario is very similar to the previous one. However, in this example, the BIG-IP APM, while still proxying ICA traffic andauthenticating users, is not replacing the Web Interface or StoreFront devices.Citrix Web Interface orStoreFront ServersInternalCitrix clientsClientsLTMInternet or WANAPMProxyICA TrafficInternal NetworkBIG-IP PlatformFigure 2:Citrix ApplicationServers (ICA) orVirtual DesktopsCitrix XML Brokeror DDC ServersUsing the BIG-IP APM with Web Interface or StoreFront serversF5 Deployment Guide5Citrix XenApp and XenDesktop

Using the BIG-IP LTMThis configuration example describes the typical configuration of the BIG-IP LTM system to monitor and manage the criticalcomponents of a Citrix XenApp or XenDesktop environment, namely the Web Interface or StoreFront servers and the XML Broker orDDC servers.In this implementation, traffic to the Citrix Web Interface or StoreFront servers and the Citrix XML Broker or DDC servers is managedby the F5 BIG-IP LTM system, and when necessary, ensures that each client connects to the same member of the farm acrossmultiple sessions using persistence on the BIG-IP LTM. The F5 BIG-IP LTM system is also setup to monitor the Citrix Web Interfaceservers and Citrix XML Broker servers to ensure availability and automatically mark down servers that are not operating correctly. Theability to terminate SSL sessions in order to offload this processing from the Citrix devices is also available with a simple addition of theClient SSL profile to the web interface virtual server referred to in this guide.InternalCitrix clientsClientsLTMInternet or WANLTMInternal NetworkBIG-IP PlatformFigure 3:BIG-IP PlatformCitrix XML Brokers hostingpublished applicationsorCitrix XenDesktopDelivery Controllers (DDC)Citrix Web Interface orStoreFront ServersLogical configuration exampleF5 Deployment Guide6Citrix XenApp and XenDesktop

Downloading and importing the new iApp templateThe first task is to download and import the new Citrix XenApp and XenDesktop iApp template.To download and import the iApp1. Open a web browser and go to downloads.f5.com.2.Click Find a Download.3.In the BIG-IP F5 Product Family section, click iApp Templates.4.On the Product Version and Container page, click iApp-Templates.5.Accept the EULA, and then download the iapps zip file to a location accessible from your BIG-IP system.6. Extract (unzip) the f5.citrix vdi.v latest version .tmpl file.7.Log on to the BIG-IP system web-based Configuration utility.8.On the Main tab, expand iApp, and then click Templates.9.Click the Import button on the right side of the screen.10. Click a check in the Overwrite Existing Templates box.11. Click the Browse button, and then browse to the location you saved the iApp file.12. Click the Upload button. The iApp is now available for use.Upgrading an Application Service from previous version of the iApp templateIf you configured your BIG-IP system using a previous version of the downloadable iApp template, we strongly recommend youupgrade the iApp template to this current version.When you upgrade to the current template version, the iApp retains all of your settings for use in the new template where applicable.You may notice new questions, or questions that have been removed. For example, in v2.4.0 and later, the SNAT Pool questions nolonger appear.To upgrade an Application Service to the current version of the template1.On the Main tab, expand iApp and then click Application Services.2. From the list, click the name of the Citrix Application Service you created using the previous version of the template.3.On the Menu bar, click Reconfigure.4.In the Template Selection area, from the Template row, click the Change button.5. From the Template list, select the new Citrix iApp template you downloaded.6. eview the answers to your questions in the iApp. You may modify any of the other settings as applicable for yourRimplementation. Use the inline help and this deployment guide for information on specific settings.7.Click Finished. The upgrade is now complete and all applicable objects appear in the Component view.F5 Deployment Guide7Citrix XenApp and XenDesktop

Configuring the BIG-IP iApp for Citrix XenApp or XenDesktopUse the following guidance to help you configure the BIG-IP system for XenApp or XenDesktop using the BIG-IP iApp template.Getting Started with the iAppTo begin the iApp Template, use the following procedure.To start the iApp template1.Log on to the BIG-IP system.2.On the Main tab, expand iApp, and then click Application Services.3.Click Create. The Template Selection page opens.4.In the Name box, type a name. In our example, we use Citrix-XenApp-.5. From the Template list, select f5.citrix vdi.v latest version . The Citrix template opens.Advanced optionsIf you select Advanced from the Template Selection list, you see Sync and Failover options for the application. This feature, newto v11, is a part of the Device Management configuration. This functionality extends the existing High Availability infrastructure andallows for clustering, granular control of configuration synchronization and granular control of failover. For more information on DeviceManagement, see the Online Help or product documentation.1. Device GroupTo select a specific Device Group, clear the Device Group check box and then select the appropriate Device Group from the list.2. Traffic GroupTo select a specific Traffic Group, clear the Traffic Group check box and then select the appropriate Traffic Group from the list.F5 Deployment Guide8Citrix XenApp and XenDesktop

GeneralThis section of the iApp template asks general questions about the deployment and iApp options.1. Do you want to see inline help?Select whether you want to see informational and help messages inline throughout the template. If you are unsure, we recommendleaving the default, Show inline help text.Important and critical notes are always shown, no matter which selection you make. es, show inline help textYSelect this option to show inline help for most questions in the template. o, do not show inline help textNSelect this option if you do not want to see inline help. If you are familiar with this iApp template, or with the BIG-IP system ingeneral, select this option to hide the inline help text.2. W hich configuration mode do you want to use?Select whether you want to use F5 recommended settings, or have more granular, advanced options presented. asic - Use F5’s recommended settingsBIn basic configuration mode, options like load balancing method, parent profiles, and settings are all set automatically. The F5recommended settings come as a result of extensive testing with Citrix applications, so if you are unsure, choose Basic. dvanced - Configure advanced optionsAIn advanced configuration mode, you have more control over individual settings and objects, such as server-side optimizationsand advanced options like Slow Ramp Time and Priority Group Activation. You can also choose to attach iRules you havepreviously created to the Citrix application service. This option provides more flexibility for advanced users.Advanced options in the template are marked with the Advanced icon:settings, you can skip the questions with this icon.Advanced. If you are using Basic/F5 recommended3. U se APM to securely proxy application (ICA) traffic and authenticate users into your Citrix environment?Select whether you are using BIG-IP APM to securely proxy application traffic and authenticate users. es, proxy ICA traffic and authenticate users with the BIG-IPYIf you select Yes, you must have APM fully licensed and provisioned on this system. Later in the iApp, you have the option ofconfiguring this BIG-IP system to proxy ICA traffic and authenticate users and then send traffic directly to the Citrix servers.While not a part of this iApp template and outside the scope of this document, you could alternatively configure the system tosend traffic to a separate BIG-IP system running LTM. To accomplish this, you would configure the APM device with a singlepool member: the IP address of a BIG-IP running LTM. o, do not proxy ICA traffic and authenticate users with the BIG-IPNIf you select No, the iApp configures the BIG-IP system for intelligent traffic direction and high availability for the Citrix servers.Later in the iApp you have the option of directing all ICA traffic through this BIG-IP system for security, logging, or networktopology purposes.4. W hat is the Active Directory NetBIOS Domain Name used for your Citrix servers?Type the Active Directory Domain name in NetBIOS format. This is the Windows domain used to authenticate Citrix user accounts.BIG-IP Access Policy ManagerIf you chose to proxy ICA traffic and authenticate users with the BIG-IP system, in this section you configure the BIG-IP APM options.If you do not see this section, continue with Virtual Server for Web Interface or StoreFront Servers on page 18.1. Should the BIG-IP APM support smart card authentication for Citrix access?The BIG-IP APM supports clients authenticating to the Citrix Web Interface or StoreFront servers using smart cards. Selectwhether your Citrix clients will use smart cards to access the Citrix implementation. Smart card authentication is not supportedwhen using StoreFront versions prior to 2.5; only Web Interface server 5.4 and StoreFront v2.5 and later are supported.iImportant B e sure to see Appendix A: Citrix server changes required to support smart card authentication on page 42for important guidance on configuring your Citrix and Active Directory devices.If you are using smart card authentication, go directly to Yes, BIG-IP APM should support smart card authentication on page 12.F5 Deployment Guide9Citrix XenApp and XenDesktop

No, BIG-IP APM should not support smart card authenticationSelect this option if you do not require the BIG-IP system to support smart card authentication. If you want the BIG-IP systemto support smart card authentication, continue with Yes, BIG-IP APM should support smart card authentication on page 12.a. D o you want to replace Citrix Web Interface or StoreFront servers with the BIG-IP system?You can use the BIG-IP system to eliminate the need for the Citrix Web Interface or StoreFront servers altogether. o, do not replace the Citrix Web Interface or StoreFront serversNSelect this option if you do not want to use the BIG-IP system to replace the Web Interface or StoreFront servers fromyour environment. es, replace Citrix Web Interface or StoreFront servers with the BIG-IP systemYSelect this option if you want the BIG-IP system to replace the need for Citrix Web Interface or StoreFront servers.This configures the BIG-IP system with APM and uses a single HTTPS (port 443) virtual server to provide proxyauthentication and secure remote access to XenApp or XenDesktop services without requiring the use of an F5 EdgeClient. It also provides the option of using BIG-IP Dynamic Presentation Webtop functionality to replace Citrix WebInterface or StoreFront servers in the Virtual Server for Web Interface or StoreFront servers section.For this scenario to work properly, the BIG-IP system must have connectivity to a Citrix XML Broker or DDC server.a. Select the type of Citrix Access Method you want to useChoose whether you want the Citrix Receiver clients to use PNAgent (XenApp Services) or StoreFront-basedaccess protocol for publishing applications from Citrix XML Broker or DDC server. Use Citrix PNAgent based accessSelect this option if you want Citrix Receiver clients to use PNAgent-based access protocol for publishingapplications from Citrix XML Broker or DDC server. Use StoreFront based accessSelect this option if you want Citrix Receiver clients to use StoreFront-based access protocol for publishingapplications from Citrix XML Broker or DDC server. Selecting this option enables the BIG-IP APM to act as afull StoreFront replacement.b. C reate a new AAA object or select an existing one?The AAA Server contains the authentication mechanism for the BIG-IP APM Access Policy.Select whether you want to the template to create a new BIG-IP APM AAA Server object, or if you have already created anAAA object for XenApp or XenDesktop on the BIG-IP system. elect the AAA Server you created from the listSIf you have previously created an AAA Server for your Citrix implementation, select that object you created from the list.Continue with c. Do you want the BIG-IP system to proxy RSA SecurID for two-factor authentication? on page 11. reate a new AAA Server objectCSelect this default option for the template create a new Active Directory AAA Server object for the Citrix environment.a. W hat is the Active Directory FQDN for your Citrix users?Type the Active Directory domain name for your XenApp or XenDesktop implementation in FQDN (fully qualifieddomain name) format.b. W hich Active Directory servers in your domain can this BIG-IP system contact?Type both the FQDN and IP address of all Active Directory servers in your domain that this BIG-IP system cancontact. Make sure this BIG-IP system and the Active Directory servers have routes to one another and thatfirewalls allow traffic between the two. Click Add to include additional servers.c. D oes your Active Directory domain allow anonymous binding?Select whether anonymous binding is allowed in your Active Directory environment. Yes, anonymous binding is allowedSelect this option if anonymous binding is allowed. No further information is required. o, credentials are required for bindingNIf credentials are required for binding, you must specify an Active Directory user name and password for use inthe AAA Server.a. W hich Active Directory user with administrative permissions do you want to use?Type a user name with administrative permissions.b. W hat is the password for that user?Type the associated password.F5 Deployment Guide10Citrix XenApp and XenDesktop

d. Which monitor do you want to use?Choose the type of health monitor you want to use for the pool of Active Directory servers. Specify whether youwant the template to create a new LDAP monitor or a new ICMP monitor, or if you select an existing monitor. Do not monitor Active DirectorySelect this option if you do not want the BIG-IP system to create a health monitor for your Active Directoryimplementation. elect an existing monitor for the Active Directory poolSSelect this option if you have already created a health monitor, with a Type of LDAP or External, for the ActiveDirectory pool that will be created by the template. If you want to create a health monitor, but have not alreadydone so, you must exit the template and create the object before it is available in the list.Go to c. Do you want the BIG-IP system to proxy RSA SecurID for two-factor authentication? se a simple ICMP monitor for the Active Directory poolUSelect this option if you only want a simple ICMP monitor for the Active Directory pool. This monitor sends aping to the servers and marks the server UP if the ping is successful.Go to c. Do you want the BIG-IP system to proxy RSA SecurID for two-factor authentication? on this page. reate a new LDAP monitor for the Active Directory poolCSelect this option if you want the template to create a new LDAP monitor for the Active Directory pool. Youmust answer the following questions:a. W hich Active Directory user name should the monitor use?Specify an Active Directory user name for the monitor to use when logging in as a part of the health check.This should be a user account created specifically for this health monitor and must be set to never expire.b. W hat is the associated password?Specify the password associated with the Active Directory user name.c. W hat is the LDAP tree for this user account?Specify the LDAP tree for the user account. As noted in the inline help, ADSI editor, an tool for ActiveDirectory LDAP administration, is useful for determining the correct LDAP tree value. For example, if theuser name is ‘user1’ which is in the organizational unit ‘Citrix Users’ and is in the domain ‘citrix.company.com’, the LDAP tree would be: ou Citrix Users, dc Citrix, dc company, dc com.d. D oes your Active Directory domain require a secure protocol for communication?Specify whether your Active Directory implementation requires SSL or TLS for communication, or does notrequire a secure protocol. This determines the port the health monitor uses.e. H ow many seconds between Active Directory health checks? AdvancedSpecify how many seconds the system should use as the health check Interval for the Active Directoryservers. We recommend the default of 10 seconds.f. W hich port is used for Active Directory communica

F5 Deployment Guide Deploying F5 with Citrix XenApp or XenDesktop Welcome to the F5 deployment guide for Citrix VDI applications, including XenApp and XenDesktop with the BIG-IP system v11.4 and later. This guide shows how to configure the BIG-IP Local Traffic