Agenda. NetScaler 10.5 Overview and Features Update 5min break CloudBridge 7.3 and the Windows Server appliances Citrix

Transcription

1 Agenda NetScaler 10.5 Overview and Features Update 5min break CloudBridge 7.3 and the Windows Server appliances

2 NetScaler Release 10.5 Overview and Features Update Simeon Bosshard, Systems Engineer Citrix Systems International GmbH

3 Overview NetScaler major release, 2014 Over 100 features in Beta 1 New feature highlights ᵒ NetScaler MobileStream ᵒ Core Policy Variables, TCP Optimizations, Traffic Domains, Link Redundancy ᵒ Load Balancing

4 Citrix NetScaler 10 Release 10.5 NetScaler MobileStream TM Network Virtualization Datacenter Enhancements

5 Announcement Highlights MPTCP SPDY v3 AAA External Support SSL Enhancements OWA Force Session Timeout Minification Lazy Image Loading Mobile Micro VPN RISE Integration ACI Integration SVM Managed API Gateway Enhancements Dynamic routing Enhancements BIC and CUBIC TCP SSL Elliptical Curve Optimization Link redundancy HTML Views (not Java) Simplified File Operations Traffic Domains Domain Sharding Forms Based SSO Enhancements AAA Session Stickiness Client Cert Passthrough LLDP Support Ethernet Jumbo Frames

6 New Licensed Features Feature Platinu m NetScaler MobileStream Enterprise Policy Variables Traffic Domains LLDP Link Redundancy Application Firewall * Cisco: RISE* Cisco: vpath* Standard * Note: Only RISE or vpath can be enabled at one time per NetScaler instance * Available as an a-la-cart feature NetScaler MobileStream SPDYv3, MPTCP, BIC TCP, CUBIC, TCP Westwood Domain Sharding, Prefetch, Image Opt, CSS & JS Opt, Lazy loading MicroVPN for Mobile Devices (NetScaler Gateway) Platinum Enterprise Standard

7 NetScaler MobileStream Front End Optimization (FEO)

8 Importance Of Mobile User Acceleration Optimization historically focused on optimizing and reducing load at the backend. Screen size different Retina displays Web browser different With current trend of Mobility NetScaler Focuses on faster and efficient web content delivery by optimizing the web page components most dependent on client side processing. Firmware different Every device unique FEO Connectivity location different Network speed different Mobile Acceleration Improves Your Mobile Clients Experience

9 What is MPTCP? Transport layer protocol Application/Session HTTP Coexist with TCP Presentation SSL Provides fault tolerance and path failover Increase throughput by using multiple paths Availability ᵒ RFC 6824 ᵒ Linux distribution (Standard & Android) ᵒ BSD in development Transport TCP-1 MPTCP TCP-2 TCP-n TCP Options MP_CAPABLE Establish secure token on first subflow (SF #1) Subsequent subflows use the secure token from SF #1 to connect

10 High-Speed Enablement SPDYv3 BIC TCP CUBIC Next Generation HTTP Proposed as HTTP 2.0 For High Speed Variable Latency Networks For High Speed Unreliable & Lossy Networks Send large amounts of data quickly over long distances Simplified window control RTT window size

11 How NetScaler Optimizes The Front-End Domain Sharding Change embedded URLs to use sub-domains and trick the browser to open more connections Minimize & Optimize Order of CSS & JS Remove unnecessary characters & space Simplify processing & reduce download time to client device Move CSS & JS objects to end of HTML body Inline Download Image Optimization JPG optimize, Convert GIF to PNG, Image Lazy load, Image shrink to display attributes of the user-device

12 Core

13 Conversion from Java to HTML5 1000s of Views now only in HTML5 Load time reduced by over 50% Improved user efficiency Following areas will be converted in a 10.5 maintenance release AppFW, Visualizer, Diagnostics

14 Core Feature Policy Variables ᵒ Store a token (data) from the request or response in a system variable ᵒ Reference stored data for Fully customized session persistence Internal computation Policy processing Watch This

15 LLDP Support Allow stations attached to an IEEE 802 LAN to advertise System Information. Helps to create network topology. System information advertised ᵒ Capabilities ᵒ Management addresses ᵒ Connectivity information LLDP Info consist of multiple TLVs TLVs must be in following sequence Dst MAC C E Src MAC Ether Type 88-CC LLDP Info

16 Ethernet jumbo frames Big Payloads Fewer Packets Reduced Protocol Processing Less Packet switching Reduced Network I/O Increased Throughput and Goodput Lowered CPU Usage

17 What is Admin Partition? Logical separation of NetScaler into multiple units Functions like an independent Netscaler. Provides isolation of configuration and data/traffic Provides multi-tenancy, but without separation of system resources, like., CPU, Memory, etc. Consists of Application resources (services, vservers, policies, monitors, etc.)

18 Highlights of Admin Partition (Contd ) Separate GUI/CLI/Monitoring/Report IP overlapping External Auth - AAA No inter partition routing No read/write access to others Overall System security HA Connection Mirror

19 Admin Partition Workflow Partition Definition Partition Admin System Expectation Manageability Expectation System admin defines partition Associates partition admins Defines IP space for partition Vlan and other Network config Defines the App Service creation Vserver creation Policies/Profiles Access common resources Creates SNIPs Networking resources Config file Sh run Save config Clear config SSL cert/keys Config UI Reporting Dashboard SNMP AppFlow/Insight

20

21

22

23

24

25

26

27

28 Link Redundancy LR Trigger for LACP channels ᵒ Set a minimum bandwidth for dynamic channels. When throughput falls below threshold, a link failover is triggered to make another channel. ᵒ For HA pair, when all channels reach threshold, trigger HA failover. LR Trigger for generic channels ᵒ Fail to another channel (to a redundant switch) when threshold reached At any point of time only one channel will be active. When one of the active link fails, and lrminthroughput is hit, we select a subchannel with high throughout and make it active by reseting all other interfaces Switch X How it works? Key 1 Key 2 Key 3 Switch X Switch Y LCAP Key 4 Switch Z One of the active link fails Min threshold is hit Switch Y Key 1 Key 2 Key 3 LCAP Key 4 Switch Z

29 Orchestration Python SDK NITRO API SDK in Python for better server side scripting. Python SDK will be available and supported with python 2.7 and 3+. Dynamic Routing NITRO API support for routing protocols. Changes sync to all peers. File Operations NITRO APIs for Upload, Download, Write and Read methods. Key functional requirements like SSL certkey will be able to get the benefits. Other Commands NITRO APIs and commands for better system manageability Tech Support, batch, source, show nstrace, start nstrace, stop nstrace

30 Service Supporting Features Content Switching ᵒ Multi-port CS Configure a CS vserver on a combination of ports ᵒ DNS_TCP Support DNS_TCP protocol is now supported with a Content Switching Vserver Audit Logging ᵒ Ability to distinguish whether the command is executed from CLI or the GUI AAA Session Stickiness ᵒ LDAP, RADIUS, & TACACS: We now stick to the server where last session was successful.

31 Service Supporting Features (cont) AAA-TM ᵒ Custom error strings ᵒ Backend HTTP Web-Form Authentication ᵒ Strong Encryption Support in KCD/Kerberos (AES-256, RC4-HMAC) OWA Force Session Timeout ᵒ Forced timeout on long-lived connections that are open for monitoring Client Certificate Pass-through ᵒ In XenMobile deployments, a client-certificate is required to be passed to Storefront. Now send the client-certificate any Application server. No configuration needed. Forms Based SSO Relative URLs ᵒ NS can take relative URL and processed for Form based SSO

32 SDX SVM Manageability & 3 rd Party Software CLI Support File management via NITRO AAA Support ᵒ Use LDAP/TACACS/RADIUS for SVM access ᵒ Authorization & Audit log support ᵒ Password expiration support ᵒ For more details refer : AAA edocs Ethernet Jumbo Frames Support with SR-IOV Central SSL Cert & Key Management Open service delivery platform for 3 rd party services

33 Load Balancing

34 TM & DNS LB: Increased number of service groups to 8000 DNS LB: CNAME record caching in Proxy mode NetScaler to use DNS caching module to cache CNAME record and send it from NS than fetching it every time DNS: NAPTR NAPTR support on NS along with SRV records. GSLB: Static proximity sync Auto sync of static proximity db

35 SSL ECC Cipher Support ᵒ More secure & faster ciphers available on N3-based MPX, SDX, & VPX ECDHE-RSA-RC4-SHA, ECDHE-RSA-DES-CBC3-SHA, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA Common Name Check Server Auth configuration is enhanced to accept commonname check. This check will be performed on SSL certificates received from backend server SSL Profiles ᵒ SSL profiles added for frontend and backend communication SSL Cert Chain ᵒ Helps identify the certificates belonging to a chain and suggest if a cert is missing in the chain.

36 Q&A

37

38 CloudBridge 7.3 and the Windows Server Appliances Simeon Bosshard, Systems Engineer Citrix Systems International GmbH

39 Release 7.3 Visibility Enhanced Optimization Usability & Manageability Field-enabler tools

40 Visibility with CloudBridge Exporter Collectors AppFlow CloudBridge HDX Insight XenDesktop Director

41 HDX Insight for CloudBridge Provide HDX insight support for branch users Insignificant load on CB appliance Roadmap: hop-by-hop information, support of multiple protocols Virtual Channels Client/ Server IP DC & WAN Latency ICA Analytics Active /Inactive Session Data ICA RTT Host Delay

42 HDX Insight value proposition: Scenario 1 Issue Identified: Host Delay

43 HDX Insight value proposition: Scenario 2 Issue Identified High App Launch Duration

44 Default protocol with Exchange 2013 Optimize RPC over HTTPS Configure SSL certificate and service class Compression benefits similar to MAPI

45 Deploying XD 7.5 on AWS? Optimize with CloudBridge! Storage Authentication Seamless, Secure, Optimized Traditional Datacenter

46 Video Caching enhancements Video caching Scheduled Pre-population Centralized management

47 Auto-Configuration using Command Center Configuration profile 1 Configuration profile 2

48 Hardware installation IP DHCP-based address, Netmask configuration & gateway Create configuration profiles DNS Command look-up Center for CC alias IP Registration request Map configuration profiles to SN or IP Push configuration for CloudBridge

49 Usability enhancements Factory image updated to 7.2.2: Pay-grow new CB 4000 & CB 5000 with just license change Eliminated need for loopback cable CloudBridge 4000 CloudBridge 5000 Interfaces: LOM 0/1 Mgmt 0/2 10/1 10/3 1/1 1/5 Interfaces: 0/1 0/2 LOM 10/1 Mgmt AUX 10/3 10/5 10/7 10/2 10/4 1/2 1/6 10/2 10/4 10/6 10/8 LOM MGMT Network Loopback cable 1/3 1/7 1/4 1/8 LOM MGMT Network Loopback cable

50 Catalog of Validated Designs: PBR & WCCP Validated Design

51 The CloudBridge - Windows Server Platforms New

52 CloudBridge 2000WS and 1000WS Branch Platforms 6 to 50 Mbps of accelerated throughput Windows Server 2012 R2 Standard Edition fully installed, licensed configured and supported by Citrix 60 to 300 concurrent HDX sessions Up to 200 Mbps QoS throughput 10,000 to 20,000 TCP sessions Beta response score 8.5 out of % would recommend

53 Configurations: CloudBridge 2000 CloudBridge 1000 CPU E core, 3.4 GHz Memory 24 GB 32 GB Storage Intel 600 GB SSD (WAN opt) 2 x 1 TB HDD (Windows) E3-1105C v2 4 Core 1.8GHz Intel 300GB SSD (WAN opt) Seagate 1TB HDD (Windows) Recovery Disk boot partition 16GB Internal eusb Network Interface 2 pair w/bypass 10/100/1000 Cooling Fans 4 high speed N+1 redundant) 2 pair w/bypass 10/100/ low speed(n+1 redundant)

54 Citrix Extensible Appliance Architecture Hypervisor-based architecture Mgmt VM Windows Server 2012 R2 Std. WAN Optimization VM Secure: all VMs fully isolated from the others Interface 0/1 Mgmt AUX Windows XenServer Hypervisor apa LAN Acceleration apa WAN Acceleration apb LAN Acceleration apb WAN Acceleration /16 Local Network Guaranteed acceleration bandwidth WAN

55 License levels: 6 / 10 / 20 Mbps Pay Grow available HDX Sessions: 60 / 100 / 200 TCP Sessions: 10,000 Full-featured, advanced WAN optimization Full Windows Server domain controller / server functionality ᵒ ᵒ AD, DNS, DHCP, RODC, LDS File & Print Up to 200 ICA sessions CloudBridge 1000WS

56 CloudBridge CSX

57 CloudBridge CSX: Extend the cloud to the branch WAN Optimization Services XenServer Storage Video XD-Print

58 ThinPrint + CloudBridge = Easy Branch Office Printing Full ThinPrint print optimization and innovation in the branch CloudBridge replaces all ThinPrint related hardware in the branch Remote Print Server on CloudBridge adds flexibility for branch offices Simple, centralized management of all ThinPrint components Print Optimize Manage Deliver > > > > > > > > Virtual Desktops ThinPrint on Central Print Server ThinPrint on Remote Print Server on Citrix Cloud Bridge 2000WS Branch Printers

59 Branch Consolidation

60 The morphing branch Marketing & Merchandising Video Collaboration and File Sharing Traditional DC Apps and Data Video and Egocasting Helper Apps

61 Branch storage convergence Citrix approach ᵒ Fully installed, configured and licensed Windows Server 2012 R2 ᵒ Supported by Citrix ᵒ Everything s included ᵒ Supports standard MS file handling including DFS ᵒ Key partners for Printer management Video stream splitting File Collaboration Others approach ᵒ Preconfigured virtual machines Riverbed 5, Cisco 2 ᵒ Customer installs, configures and manages ᵒ Cisco & Riverbed charge for VM support ᵒ Cisco Office-in-a-box ᵒ or you can use Granite now called SteelFusion

62 Q&A

63