CITRIX PRESENTATION SERVER 4

Citrix Presentation Server is the foundation of the Citrix Access Suite. Presentation Server can be purchased as a part of the suite, or as a stand-alone product available with two platform choices, Windows and UNIX, and three version choices, Standard, Advanced, and Enterprise. Table 3-2 shows the Citrix Presentation Server 4 feature matrix comparing previous versions and showing the feature options of the current edition choices.

Table 3-2: Citrix Presentation Server 4 Feature Matrix

	MetaFrame XPs	MetaFrame XPa	MetaFrame XPe
UNPARALLELED MANAGEABILITY AND SCALE
Advanced Shadowing
Cross-server shadowing	X	X	X
Many-to-one shadowing	X	X	X
One-to-many shadowing	X	X	X
Shadowing indicator	X	X	X
Shadowing taskbar	X	X	X
Application Management
Anonymous user support	X	X	X
Application publishing	X	X	X
Content publishing	X	X	X
Program Neighborhood	X	X	X
TCP-based browsing	X	X	X
Application Packaging and Delivery
Centrally install and uninstall applications			X
Create logical server groups			X
Customizable project details			X
Delivery verification			X
Distribute service packs , updates, and files			X
MSI support			X
Package applications, files, and service packs			X
Package inventory			X
Packager rollback			X
Schedule package delivery			X
Server reboot support			X
Support for unattended installs			X
Centralized Administration
Active Directory support	X	X	X
Novell NDS support	X	X	X
User policies	X	X	X
Administrator toolbar	X	X	X
Centralized Data Store	X	X	X
Citrix administrative accounts	X	X	X
Citrix Management Console	X	X	X
Plug-in for Microsoft Operations Manager (MOM)	X	X	X
Citrix Web Console	X	X	X
Connection control	X	X	X
CPU prioritization	X	X	X
Windows Installer Support	X	X	X
Centralized License Management
Centralized license activation	X	X	X
Enterprisewide license pooling	X	X	X
Plug-and-play licensing	X	X	X
Client Management
Auto client update	X	X	X
Business Recovery	X	X	X
ReadyConnect	X	X	X
Web-based client installation	X	X	X
Network Management
Access CMC from third-party management consoles			X
SNMP monitoring agent			X
Printer Management
MetaFrame Universal Print Driver version II	X	X	X
Support for color and high-resolution printers with Universal Print Driver	X	X	X
Printer auto creation log	X	X	X
Printer driver access control	X	X	X
Printer driver replication	X	X	X
Printing bandwidth control	X	X	X
Resource-Based Load Balancing
Instant load-balancing feedback		X	X
Load balancing reconnect support		X	X
Schedule application availability		X	X
Specify client IP range		X	X
Scalability
Enterprise-class scalability	X	X	X
Cross-subnet administration	X	X	X
System Monitoring and Analysis
Application monitoring			X
Customized reporting			X
Summary database and reporting			X
Perform system capacity planning			X
Real-time graphing and alerting			X
Server farm monitoring			X
Track user access to applications			X
User-definable metrics			X
System Monitoring and Analysis
Watcher window			X
ICA session monitoring			X
TOTAL "NET" LEVERAGE
Web Application Access
Web Interface for MetaFrame	X	X	X
Federal Information Processing Standards (FIPS) 140 security compliance	X	X	X
Support for RSA Secure ID and Secure Computing Premier Access second factor authentication solutions	X	X	X
Multiple server farm support	X	X	X
Application filtering and caching	X	X	X
Support for MetaFrame Secure Access Manager	X	X	X
Web Interface Extension for MetaFrame XP			X
Access to Local System Resources
Auto printer creation	X	X	X
Automatic drive redirection	X	X	X
Client drive mapping	X	X	X
Clipboard redirection	X	X	X
COM port redirection	X	X	X
Performance
Instant mouse-click feedback	X	X	X
Persistent bitmap caching	X	X	X
Priority packet tagging	X	X	X
Performance
SpeedScreen browser acceleration	X	X	X
SpeedScreen 3	X	X	X
Text-entry prediction	X	X	X
Seamless User Experience
High-/true-color depth and resolution	X	X	X
16-bit audio support	X	X	X
Application save position	X	X	X
Auto client reconnect	X	X	X
Client printer management utility	X	X	X
Client time zone support	X	X	X
Content redirection	X	X	X
Multimonitor support	X	X	X
Panning and scaling	X	X	X
Pass-through authentication	X	X	X
Roaming user reconnect	X	X	X
Seamless windows	X	X	X
Win 16 multi-session support	X	X	X
Universal Connectivity
Universal client access	X	X	X
Support for direct asynch dial-up	X	X	X
Support for TCP/IP, IPX, SPX, and NetBIOS	X	X	X
User Collaboration
User collaboration	X	X	X
END-TO-END SECURITY
Security
MetaFrame Secure Gateway	X	X	X
Delegated administration	X	X	X
SSL 128-bit encryption	X	X	X
TLS encryption	X	X	X
Smart card support	X	X	X
SecureICA 128-bit encryption	X	X	X
SOCKS 4 and 5 Support	X	X	X
Ticketing	X	X	X

Platform Choices

Although Citrix's primary solution set has always been Windows-based, Citrix has offered a UNIX-based solution for five years now, and has a strong contingent of customers that use the solution. Now, with Citrix allowing customers to use either platform without a requirement to purchase additional or separate licenses, we expect many customers to take advantage of both platform options.

Citrix Presentation Server for Windows

Citrix currently has three main versions, Standard (S), Advanced (A), and Enterprise (E). There is also a separate package specifically designed specifically for small businesses, called Citrix Access Essentials.

All three versions of Presentation Server are Active Directory compliant. Thus, Active Directory groups may be used to configure permissions and users. Citrix does not change or add to the schema of Active Directory, and Presentation Server allows single sign-on for Active Directory, Novell NDS, and Novell eDirectory environments.

Web Interface for Presentation Server is provided by Citrix, with all Presentation Server versions to publish Windows applications to Web pages on intranets and the public Internet. This tool also allows customization so that a number of applications can be combined into an "application portal." Additionally, the Secure Gateway software component of Presentation Server Secure Gateway provides a secure method of application access delivered directly to the end user via a browser, over SSL, providing increased security while reducing problems with firewall and VPN configurations.

In addition, all three versions of Citrix Presentation Server support both 32-bit and 64-bit versions of Windows Server 2003. Citrix worked closely with industry partners Microsoft, Intel, AMD, IBM, HP, Dell, and Unisys to ensure compatibility with the Microsoft Windows Server 2003 x 64 Editions.

Note 

Following the release of Feature Release 1 of Version 1.8, Citrix stopped adding any additional features or enhancements to Presentation Server for Windows NT 4.0 TSE. Additionally, Presentation Server version 1.8 has been declared end-of-life.

Citrix Access Essentials Citrix Access Essentials is a cost-effective bundled package that contains the Microsoft Windows Server Terminal Services licenses, as well as Citrix Presentation Server licenses, packaged as a solution for up to 75 users. Web Interface and Secure Gateway components are included. Because Citrix Access Essentials supports only one server, it is generally used to create remote access solutions or application deployment solutions for smaller companies.

Citrix Presentation Server, Standard Edition The Standard Edition is intended for standalone, point, or departmental solutions with one to five servers. Standard Edition feature highlights include Web Interface, user shadowing, Secure Gateway, Universal Print Driver, client time zone support, Novell NDS support, client device support, and full Citrix client support.

Although more than one server can be used with the Standard Edition, it is rare, as applications cannot be load-balanced across servers and any application publishing will have to be done separately on each server with different names .

Citrix Presentation Server, Advanced Edition The Advanced Edition includes all of the Standard Edition features, with the addition of Load Management. This edition is designed for use in farms with 2 to 100 servers. The Advanced Edition provides small to medium- sized organizations deploying multiple servers with additional scalability, manageability, and application availability to meet growth requirements for deploying applications. Advanced Edition is available for Windows Server 2003 and Windows 2000 Server.

Citrix Presentation Server, Enterprise Edition The Enterprise Edition contains all the features included with the Advanced Edition, as well as some additional features required for enterprise management. These extended features include Resource Manager, Installation Manager, a plug-in for Microsoft Operations Manager (MOM), and Network Manager. The Enterprise Edition is designed for 20 or more servers and can accommodate multiple Citrix Server farms. The Enterprise Edition is also the only version that includes Presentation Server for UNIX.

Citrix Presentation Server for UNIX

Although this book is primarily focused on Citrix Presentation Server 4 for Windows 2003, UNIX-based applications continue to be a mainstay of many large enterprise environments, and Windows and UNIX users alike can benefit from seamless, single-point, web access to these applications. Because of the overall value of the Citrix Access Platform in providing Web-based seamless access to all applications from any device, for all users, the authors felt strongly that Presentation Server for UNIX should be covered in this book. A large majority of the features and infrastructure discussed in these pages will apply equally to Presentation Server for UNIX and Presentation Server for Windows 2003 Server. Features and tools such as Web Interface, Secure Gateway, Load Management, and any-device access are further promoted by bringing the UNIX applications to the Citrix Access Platform fold.

Although some longtime UNIX administrators argue that UNIX has supported multiuser functionality for years through the X Window System, and thus Presentation Server for UNIX is not needed, they are missing out. X is a tremendous bandwidth hog (even compressed X) and thus is totally useless over WAN connections. Additionally, the X Window System does not support Citrix features such as shadowing, copy and paste between windows, and most importantly, Web Interface integration with Windows and Web applications.

Based in part on the success and popularity of Presentation Server in the Windows application hosting environment, Citrix recently announced the latest version of the Presentation Server product line aimed at the hosting of UNIX, X Window, and Java applications: Presentation Server for UNIX Version 4.0. The product, which at present supports IBM AIX, Sun Solaris, and HP-UX platforms, as well as virtually any custom or commercially packaged UNIX applications, offers the same value as Presentation Server, but with a UNIX/Java twist: low-bandwidth, universal client access over any network connection to any UNIX or Java application.

At the core of the Presentation Server for UNIX product is a modified X11R6.3 server. This does not replace the X11 server supplied with most UNIX operating systems but is specifically used to enable ICA-connected sessions running on Presentation Server for UNIX. Presentation Server for UNIX runs all standard X11 applications using the modified X server rather than the native X11 server.

In operation, the modified X11 server talks to a UNIX-ported ICA stack (Winstation Driver, Protocol Driver, and Transport Driver), which performs an X-to-ICA conversion. This is key to delivering applications seamlessly to clients from all Presentation Server platforms.

In addition to the modified X11 server and ported ICA stack, Presentation Server for UNIX also provides an ICA browser for use in load balancing and client browsing, a "listener" to intercept incoming ICA connections, and a "Frame Manager," which manages all the sessions currently running on the server.

The same core functionality used by Presentation Server Presentation Server for UNIX to deploy X11 and other applications hosted on UNIX servers can also be applied to Java applications. At first, this capability may seem redundant: in theory, Java applications are already portable to any device. In reality, however, Java client-side application deployments still confront numerous challenges.

Downloading Java applications entails the use of the available client/server network protocol, which is often not optimized for low-bandwidth connections. This results in the major complaint about Java applications that they are sometimes incredibly slow to download for operation. Operating the Java application, which is executed locally on a server, over a bandwidth-optimized ICA connection provides a higher-performance solution to this issue.

Java applications also fall prey to peculiarities in the Java Virtual Machine that runs on the client system. Not all JVMs are the same, and it is often the case that a Java application that runs perfectly in one JVM behaves very differently in another. Presentation Server for UNIX solves this problem by executing Java applications within the server's JVM environment.

Utilizing a single, server-based JVM also saves time and money when developing and testing Java applications developed in-house. Once the application is working in the server JVM, it can be deployed instantly to any ICA client device.

It should also be noted that the Java Virtual Machine is typically a large piece of software. While the development of an embedded JVM is under way, ultra -thin client devices lack the capacity to run a JVM that offers sufficient features or performance. This issue is removed through the use of the Presentation Server for UNIX solution.

In summary, Presentation Server for UNIX operating systems can be an important adjunct to Windows-based Presentation Server servers in heterogeneous server environments. Presentation Server for UNIX can be included in server farm and load-balancing schemes, and applications hosted on Presentation Server for UNIX systems may be published individually or as part of integrated Web Integration portals for integrated access by end users. Citrix Presentation Server for UNIX currently supports Sun Microsystems' Solaris 8, 9, and 10; Hewlett-Packard's HP-UX 11 and 11i; and IBM's AIX 5.1, 5.2, and 5.3. See the Citrix web site for up-to-date information.

Application Support

Many applications were not originally designed for server-based deployment. Some conflict with others when installed on the same server, while others require dedicated IP addresses to run. Presentation Server helps overcome all these challenges through new features, including application isolation environments and virtual IP address support. Now IT can deploy more applications on fewer servers, reducing IT costs and simplifying deployment and management.

Application Isolation Environment

Citrix's Application Isolation Environment provides a virtualized environment for access to files, Registry settings, and named objects, allowing applications that are incompatible with each other to safely run side by side. It allows applications that are not compatible with a multiuser environment to run on Citrix Presentation Server.

Virtual IP Address Support

Using virtual IP addresses, an administrator can publish applications that require separate IP addresses per session, whether for technical or licensing reasons. Administrators can use the Citrix management console to set aside a block of IP addresses for use by sessions that require them.

End-User Experience

Presentation Server 4 can leverage Citrix's Independent Computing Architecture protocol (ICA) or Microsoft's Remote Desktop Protocol (RDP). A large majority of the Presentation Server benefits are still only available with the Citrix ICA client, so we strongly recommend utilizing the Citrix Presentation Server client. As depicted in Figure 3-1, the Citrix ICA presentation services protocol transports only keystrokes, mouse clicks, and screen updates to the client. The protocol has been demonstrated to operate consistently with 20 kilobits per second of network bandwidth and provide real-time performance with 30 kilobits per second for office automation applications. This enables even the latest 32-bit and 64-bit applications to be operated remotely across low-bandwidth links while delivering performance comparable to local execution on existing PCs, Windows-based terminals, network computers, and a host of evolving business and personal information appliances.

Figure 3-1: Citrix ICA presentation services

Citrix enables us to deploy Windows applications to our students in both a very cost-effective and expeditious manner. This is true whether they are working on a PC or Windows terminal on campus, or working offsite using an Internet connection.

Tony Holland, Director of Computing Services, Stanford Business School

 

The Citrix ICA protocol was designed with low-bandwidth connections in mind, making it a robust performer on both large-and small-capacity links. Moreover, the ICA protocol responds dynamically to changing network, server, and client operating conditions. It takes advantage of available network and server resources and adapts automatically when conditions are more restrictive , often without generating any noticeable changes in the end user's experience. Much of the performance of the ICA protocol can be attributed to the use of intelligent caching and data compression techniques, and to technologies such as SpeedScreen. ICA is a nonstreaming protocol, meaning that if a user's screen has not changed and they have not moved the mouse or keyboard, no traffic will be passed. This feature can substantially help larger environments operating over a WAN link, as many users will not be using any bandwidth at certain instances, allowing much better utilization of the bandwidth as a whole.

The Citrix Client Environment

In addition to the contributions of Presentation Server and the ICA protocol to application delivery performance, Presentation Server also enhances the basic multiuser client/ server environment. Presentation Server embodies numerous innovations designed to facilitate a broad range of hosted application environments. Considerable effort has been invested by Presentation Server designers to enable all applications, whether remote or local, to operate and interoperate as though they were local to the end user. This approach increases the user's comfort level and decreases the required training time.

The Presentation Server Desktop

The Presentation Server desktop is designed to provide a user experience that is on par with a Windows PC running locally installed and executed applications. Presentation Server enables complete access to local system resources, such as full 16-bit stereo audio, local drives , COM ports, USB ports, and local printers, if available.

The mapping of local resources can be performed automatically or by means of administrative utilities. Specialized client capabilities such as modem dial-up are also supported.

Additionally, mapped resources can be shared with the Presentation Server, if desired. Configuration of these mappings is built into the standard Windows device redirection facilities. The client mappings appear as another network that presents the client devices as share points to which a drive letter or printer port can be attached.

Seamless Windows

Not all Presentation Server implementations utilize a full-fledged "remote desktop" model (one in which there are no applications locally installed on the client). In many environments where Presentation Server is deployed, clients are themselves Windows PCs configured to provide a mixture of some locally installed applications and some remotely hosted applications. Seamless Windows is a feature of Presentation Server designed to accommodate this scenario.

Seamless Windows is a shorthand expression referring to the capability of the Citrix ICA Win32 client to support the integration of local and remote applications on the local Windows 95, Windows 98, Windows NT 4.0, Windows 2000, or Windows desktop. When configuring a connection to the Presentation Server server, an administrator or user can simply select the Seamless Windows option to enable this function.

With Seamless Windows, the user can gain access to hosted applications without having to load a remote desktop environment. While connected in a Presentation Server server session, the user can gain access to local applications using the Windows taskbar. Icons for both local and remote applications can be installed on the local Windows desktop, and both local and remote application windows can be cascaded on the local desktop.

Multiple Keyboards The Seamless Windows environment supports the definition of multiple keyboards to facilitate command entry in local and remote application environments. This prevents specially mapped key combinations used by Presentation Server (such as ALT-TAB) from interfering with similar key combinations used by locally executing applications.

Windows Clipboard Seamless Windows supports the use of the Windows clipboard in conjunction with both local and Presentation Serverhosted applications. Users can cut, copy, and paste information between applications running remotely on the server or locally from the desktop. Rich text format cut-and-paste is fully supported.

Note 

The local/remote clipboard is part of the Presentation Server overall solution set. It can be used independently of Seamless Windows or Program Neighborhood.

Program Neighborhood

Building on the concept of a Seamless Windows environment, Presentation Server also delivers an easy-to-use method for accessing remotely hosted applications. Similar in concept to the Microsoft Windows Network Neighborhood, Presentation Server pushes links to published applications into a client-based Program Neighborhood facility.

In operation, Program Neighborhood presents application sets to Presentation Server client users. An application set is a user's view of the applications published on a given Presentation Server server or server farm, which that user is authorized to access. A single user-authentication operation (usually initiated when the user launches Program Neighborhood or a Presentation Serverhosted application displayed in the Start menu or as an icon on the local desktop) identifies the user to all Presentation Server servers. Based on the user's individual or group account parameters, the Program Neighborhood is populated with an application set containing each application configured for the specific user account or user group. Published applications appear as icons and are preconfigured with such properties as session window size , color depth, and supported level of encryption, as well as audio and video appropriate to the user and his or her client device.

Program Neighborhood technology is especially useful as a means to quickly publish hosted applications that are intended for use by groups of users. Users can click the Program Neighborhood icon on their Windows desktop (or click the corresponding entry in their Windows Start menu) to review a list of hosted applications available for use. No special client configuration is required to launch and use these published applications.

SpeedScreen

SpeedScreen is a technology for improving the performance of application delivery across low-bandwidth and/or high-latency (modem, satellite, 56K Frame Relay, or congested WAN) links. It improves performance by reducing the amount of data that must traverse connection as an end user interacts with a Presentation Server server-based application. SpeedScreen targets the repainting function of a hosted application. With many applications, entire screens are repainted with each keyboard entry (or mouse click) made by the end user. SpeedScreen uses an intelligent agent technology to compare information previously transmitted to the Citrix client with information that is about to be transmitted; then it transmits only the changed information. This is visually represented in Figure 3-2. By limiting repaint operations to specific sections of a screen affected by user interaction, the amount of traffic that must traverse the connection is dramatically reduced. Citrix's latest release of SpeedScreen technology, called SpeedScreen Browser Acceleration, specifically focuses on major performance and usability improvements for end users connecting to published applications that embed JPEG and GIF images within Microsoft HTML pages. Supported applications include Internet Explorer, Microsoft Outlook, and Microsoft Outlook Express.

Figure 3-2: How SpeedScreen improves link performance

With some applications, bandwidth consumption may be reduced by as much as 30 percent through the implementation of SpeedScreen, while total packets transmitted may be reduced by 60 percent. The result is lower latency in the network and better application performance for the end userespecially across low-bandwidth connections.

Another component of SpeedScreen technology is the SpeedScreen Latency Reduction (SLR) manager. The technology enhances the end-user experience in two ways. First, local text echo can be enabled to give immediate feedback by having the local client render the text. The normal way text is transferred when using Presentation Server is by sending the keystroke to the server, which is processed and then rendered back to the client. Local text echo is convenient for users that type quickly, as even the slightest delay can be annoying. Second, SLR can provide for instant feedback for mouse-button clicks.

Application Publishing

Application publishing refers to the installation and configuration of applications on a multiuser server (or server farm) so that they can be accessed readily by users. Presentation Server enhances the basic application publishing capabilities of TSE by providing a Published Application Manager to facilitate the process of fielding an application.

The objective of the Published Application Manager is not only to ease the burden of administrators, but also to shield users from the complexities of setting up applications for use on their clients. When an application is published using the Published Application Manager utility, user access is simplified in three ways:

• – Application addressing Instead of connecting to a Presentation Server server by its IP address or server name, users can connect to a specific application by whatever name has been assigned to the application itself. Connecting to applications by name eliminates the need for users to remember which servers contain which applications.

• – Application navigation With applications published under Citrix Presentation Server, the user does not need to possess knowledge of the Windows NT 4.0, Windows 2000, or Windows Server 2003 desktop (Windows NT Explorer or Program Manager) to find and start applications after connecting to Presentation Server servers. Instead, published applications present the user with the desired application in an ICA session.

• – User authentication Instead of their logging on and logging off multiple Presentation Server servers to access applications, Program Neighborhood allows users to authenticate themselves a single time to all servers and obtain immediate access to all applications configured for their user group or specific username. Also, publishing applications for the special Anonymous user group allows user authentication processes to be eliminated completely. This can be a useful time-saver when publishing applications for general use by all users on the network.

User Accounts Presentation Server application publishing provides ICA session access to two types of user accounts: anonymous and explicit. Before publishing an application, it is important to first consider who the users will be, what they will be doing when they run the application, and where they will be connecting from. This will define whether the users should be anonymous or explicitly defined (named users with full authentication).

The total number of users, whether anonymous or explicit, who can be logged on to the Presentation Server server at the same time is contingent upon an organization's licensed user count and on server and bandwidth limitations. These limitations need to be clearly understood before proceeding with application publishing (Chapter 11 discusses server and farm sizing in detail).

Application Publishing Security In addition to considering the user population for an application, administrators also need to consider the security requirements of the applications they are planning to publish. Presentation Server provides additional methods , beyond those of Microsoft operating systems, for securing access to applications published on the Presentation Server server.

Users of a specific connection type (dial-up, for example) can be restricted to running published applications only. By allowing users to solely access predefined applications, unauthorized users are prevented from obtaining access to the Windows desktop or a command prompt as their initial application. This type of security may be obtained by using the Advanced Connection Settings dialog box in the Connection Configuration utility supplied with Citrix Presentation Server.

It is important to note, however, that many applications and utilities have major security holes (for example, some applications permit a user to launch other applications [explorer.exe or cmd.exe] from within them). Thus a significant amount of time must be spent putting in place policies, profiles, and Registry changes to more securely lock down the operating system and applications. Enterprise environments should consider a lockdown application (two popular lockdown application companies that are certified to work in a Terminal Services environment are Appsense and RES PowerFuse, covered in more depth in Chapter 11) to specifically automate the lockdown tasks .

In addition to connection-type security, the Citrix Management Console allows an administrator to restrict an application to specified users or groups of users, assuming they have been given explicit user access.

As long as explicit user accounts are specified, Presentation Server supports a large number of authentication approaches. For starters, strong password authentication is essential for security (see Chapter 8 for a more detailed password discussion). Even better, consider a second-factor authentication approach using not only something a user knows , but a second authentication method such as something unique that only a specific user has (for instance, a smart card, token, or biometric). Presentation Server FR-3 is fully integrated with RSA and Secure Computing's second-factor authentication, as are a large variety of authentication tools (biometric, smart card, and so on) that integrate with RSA and Secure Computing's authentication software. Additionally, companies like Secure Computing provide a method to integrate the second-factor authentication with Web Integration access, Program Neighborhood access, and Windows 2000 Active Directory access, to make authentication seamless to the user community. See Chapter 8 for more detail and discussion on security.