Citrix MetaFrame Secure Access Manager Voice and Video Solutions v 2.0

Transcription

1 Citrix MetaFrame Secure Access Manager Voice and Video Solutions v 2.0 Prepared by: Roddy Rodstein, MCSE, CCEA Enterprise Systems Engineer, Western Region Citrix Systems, Inc. roddy.rodstein@citrix.com NOTICE The information in this publication is subject to change without notice. This is not an official Citrix document. THIS PUBLICATION IS PROVIDED AS IS WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON- INFRINGEMENT. CITRIX SYSTEMS, INC. ( CITRIX ) SHALL NOT BE LIABLE FOR TECHNICAL OR EDITORIAL ERRORS OR OMISSIONS CONTAINED HEREIN, NOR FOR DIRECT, INCIDENTAL, CONSEQUENTIAL OR ANY OTHER DAMAGES RESULTING FROM THE FURNISHING, PERFORMANCE, OR USE OF THIS PUBLICATION, EVEN IF CITRIX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES IN ADVANCE. 1

2 This publication contains information protected by copyright. Except for internal distribution, no part of this publication may be photocopied or reproduced in any form without prior written consent from Rnetworkx, Inc. The exclusive warranty for any Citrix products discussed in this publication, if any, is stated in the product documentation accompanying such products. Citrix does not warrant products other than its own. Product names mentioned herein may be trademarks and/or registered trademarks of their respective companies Rnetworkx, Inc. All rights reserved. WARNING: The information found in this document was gathered from many different sources in the computing world. It is provided for informational purposes only. The authors assume no responsibility for its usage. Use common sense in applying these concepts and tips. Screen shots may vary from environment to environment. Please verify correctness and applicability in a test environment first and then deploy to your production environment(s). Use the information found in this document at your own risk. Document Revision History Please send any and all suggestions and or comments to: roddy.rodstein@citrix.com Date Version Updated By Description of Changes December 3, Roddy Rodstein February Roddy Rodstein Macromedia Flash Communication Server June 17, 2003 Roddy Rodstein MSAM update Important: Procedures and settings in this guide may not be appropriate for enterprise deployment and scalability. Preface Citrix Web technologies are undoubtedly one of the Internets best kept secrets. MetaFrame Secure Access Manager 2.0 offers administrators and webmasters the ability to quickly install, configure, brand and deploy a secure corporate portal. 2

3 Like so many words in the information technology vocabulary, the word portal has numerous meanings. The dictionary defines Access Center this way: Access Center (pôrtl) noun: - A doorway, an entrance, or a gate, especially one that is large and imposing. - An entrance or a means of entrance: the local library, a Access Center of knowledge. The term Access Center continues to change as quickly as the technology itself and any attempt to provide an exact definition will undoubtedly lead to disagreement. Throughout this document we will try to explain Citrix Web technologies and also show you how to successfully deploy MetaFrame Secure Access Manager in your customers networks. The biggest risk any portal deployment faces is lack of adoption by the end users; a Access Center is successful only if employees use it. Roddy Table of Contents Citrix MetaFrame Secure Access Manager Voice and Video Solutions v Preface... 2 Table of Contents... 3 Overview... 4 Internet Locator Server... 4 ILS Server... 4 Bandwidth...4 Client... 5 Netmeeting System Requirements... 5 Netmeeting and ILS Communication Ports... 6 ILS Server Installation... 6 Verify the Installation of the ILS Server... 8 Adding the Adapter for Windows Netmeeting to an Access Center Configuring Citrix s Adapter for Windows Netmeeting Un-docking Netmeeting Netmeeting Features Overview Locating co-workers in an ILS Directory Downloads Need to Know More Macromedia's Flash Communication Server MX and MetaFrame Secure Access Manager Macromedia Flash Communication Server MX server installation requirements (minimum) Client Requirements Security Considerations Installing Macromedia Flash Communication Server

4 Test the Macromedia Flash Communication Server Sample Applications Overview Downloads Need to Know More Overview The voice and video solutions outlined in this document include Microsoft s Internet Locator Server (ILS) (bundled with Windows 2000 server and Advanced server), with Citrix s Adapter for Windows Netmeeting, as well as Macromedia s revolutionary Flash Communication Server solution. We will cover the installation and configurations of the ILS server, Citrix Adapter for Windows Netmeeting and Macromedia s Flash Communication Server. Internet Locator Server The combination of an ILS server, MetaFrame Secure Access Manager 2.0 and the Adapter for Windows Netmeeting provides Voice over IP/IP Telephony capabilities as well as instant messaging (IM), application sharing, virtual whiteboarding and more - all within a MetaFrame Secure Access Manager 2.0 Access Center infrastructure. The ILS server provides a private corporate directory which contains a list of users that are logged into the MetaFrame Secure Access Manager 2.0 Access Center via the Adapter for Windows Netmeeting. The Adapter for Windows Netmeeting allows users to host conference calls, send instant messages, share applications, share a virtual whiteboard and collaborate with up to eight co-workers (only two users for voice and video) in realtime. ILS Server A Windows 2000 ILS server can support 2,000 simultaneous connections as well as 2,500 registered users. For small installations supporting less than 500 users, the ILS server does not tax CPU or memory. In most small deployments the ILS server is not installed on a dedicated machine. Exchange Server runs an LDAP server on the same port as ILS - to avoid conflicts Microsoft recommends changing the Exchange server s LDAP service to a different port. The ILS installation is straightforward but the target machine must have IIS installed. Just make sure that you stop IIS before starting the ILS installation. Bandwidth An uncompressed voice call over IP takes up to 64Kbps of bandwidth. A quality video stream averages from 200K to 400Kbps. In a NetMeeting call, the highest priority is set to the audio stream, followed by the data stream, and then the video stream. The bandwidth use of the audio stream is calculated on the fly from the available throughput. In most cases, bandwidth utilization is less than expected, especially for audio and video 4

5 conferencing scenarios. The numbers of participants per meeting is limited both by bandwidth and by the workstation processor speed. The NetMeeting client can be configured for four different network speeds: 14.4 kilobits per second (Kbps) modem 28.8 Kbps or faster modem Cable, xdsl, or Integrated Services Digital Network (ISDN) Local area network (LAN) Users may utilize one of the two following scenarios: Data-Only Conferencing Audio and Video Conferencing Data-only conferencing consist of Chat, program sharing, Whiteboard, and file transfer. Client To utilize the video phone capabilities, the Windows workstation that accesses the Access Center requires Netmeeting, a video capture card and a web cam that supports video for Windows. If a workstation does not have a video capture card and a web cam, the sound and/or video features will be unavailable. But instant messaging, application sharing, and virtual whiteboarding will be available to users on workstations lacking sound and video support. Workstations will need to have Netmeeting installed locally to be able to use the Citrix Secure Access Manager Adapter for Windows Netmeeting. Both Windows 2000 and XP workstations come with Netmeeting pre-installed. Legacy Windows workstations will require Netmeeting to be installed and configured to utilize the voice, video and collaboration features. Netmeeting can be downloaded at no cost from Note: While Netmeeting does not support multiple video and audio participants, there are 3 rd party solutions are available that add this capability. Netmeeting System Requirements The following are the minimum system requirements for a Windows workstation to be able to install and run Microsoft NetMeeting. As mentioned above, both Windows 2000 and XP workstations come with Netmeeting pre-installed. 90 megahertz (MHz) Pentium processor 16 megabytes (MB) of RAM for Microsoft Windows 95, Windows 98, Windows Me 5

6 24 megabytes (MB) of RAM for Microsoft Windows NT version 4.0 (Microsoft Windows NT 4.0 Service Pack 3 or later is required to enable the sharing of programs on Windows NT.) 4 MB of free hard disk space (an additional 10 MB is needed during installation to accommodate the initial setup files). A sound card with microphone and speakers is required for audio support To use the data, audio, and video features of NetMeeting, the Windows workstation must meet the following hardware requirements: For Windows 95, Windows 98, or Windows Me - a Pentium 90 processor with 16 MB of RAM (a Pentium 133 processor or better with at least 16 MB of RAM is recommended). For Windows NT - a Pentium 90 processor with 24 MB of RAM (a Pentium 133 processor or better with at least 32 MB of RAM is recommended). 4 MB of free hard disk space (an additional 10 MB is needed during installation to accommodate the initial setup files). 56Kbps or faster modem, ISDN, or LAN connection. Sound card with microphone and speakers (sound card required for both audio and video support). Video capture card or camera that provides a Video for Windows capture driver (required for video support). Netmeeting and ILS Communication Ports Port Purpose Internet Locator Server [Transmission Control Protocol (TCP)] 1002 Internet Locator Server [Transmission Control Protocol (TCP)] 1503 T.120 (TCP) 1720 H.323 call setup (TCP) 1731 Audio call control (TCP) Dynamic H.323 call control (TCP) Dynamic H.323 streaming [Realtime Transport Protocol (RTP) over User Datagram Protocol (UDP)] For outbound NetMeeting connections through a firewall, the firewall must be configured as followed: Pass through primary TCP connections on ports 1002, 389, 1503, 1720 and Pass through secondary UDP connections on dynamically assigned ports ( ). ILS Server Installation The following procedure walks through the installation of Microsoft s ILS service on a Windows 2000 server. 6

7 Step On the target Windows 2000 server open the Control Panel and select Add/Remove Programs Description From the Add/Remove Programs Window, click the Add/Remove Windows Components tab Select Networking Services and click the Details button to access the properties 7

8 From the Networking Services window select Site Server ILS Services and click OK The ILS service has been successfully installed. Verify the Installation of the ILS Server From the ILS server s desktop, open a Computer Management MMC by right-clicking the My Computer icon, then select Manage. Expand the Services and Applications in the left pane, and then click Services. In the right pane, scroll down to the Site Server ILS Service. The entry in the Status column should display Started, and the entry under the Startup Type should display Automatic. 8

9 Note: The ILS service does not have a GUI and is managed from the command prompt by using the ilscfg command. The following example shows the available switches used with the ilscfg command: C:\Documents and Settings\Administrator>ilscfg ILS Configuration Utility Copyright 1997, Microsoft Corporation Commands for server configuration: ilscfg [<server>] /port <port number> ilscfg [<server>] /sslport <port number> ilscfg [<server>] /timeout <timeout length in seconds> ilscfg [<server>] /maxresults < size of largest allowable search result set, or 0 for no limit> Commands for publishing of ILS servers in the NTDS: ilscfg /listpub ilscfg <server> /publish [<port>] ilscfg <server> /unpublish [<port>] Commands for listing conferences or users from an ILS server: ilscfg <server> /listconf [<port>] ilscfg <server> /listuser [<port>] Configure the Adapter for Windows Netmeeting to use a private ILS server: 9

10 Adding the Adapter for Windows Netmeeting to an Access Center Citrix s Adapter for Windows Netmeeting is installed by default and can be added to an Access Center via the AMC. The following procedure will run through the steps to add the CDA to an Access Center. Step Open the AMC and select the desired Access Center then highlight the page where you would like to add the Adapter for Windows Netmeeting. Access the pages properties. Description 1- From the desired pages properties select the CDA tab. 2- In the CDAs window select the Adapter for Windows Netmeeting and add it to the desired column. 3- Click OK. 10

11 Refresh your browser to view the changes. Note: If this is the first time use used Netmeeting you will be prompted to configure the Netmeeting client from your desktop. The next section will run through the steps to configure the Netmeeting Adapter. You have successfully added the Adapter for Netmeeting to an Access Center page. Configuring Citrix s Adapter for Windows Netmeeting When NetMeeting is accessed for the first time, it will prompt the user for personal information and the network name of the ILS server. (This server is referred to as a "User Location Server" within NetMeeting.). The next examples show how to configure Netmeeting. Step Once an Access Center page is accessed with the Adapter for Netmeeting the following Netmeeting window, the welcome message will appear. Description Click Next. 11

12 The next window is where the user information will be filled out. Enter your first and last name, your corporate address and geographical location. This information is used by the ILS server with the first and last name being displayed in the ILS directory. If an incorrect address is used, the user will not appear in the ILS directory nor be able to access the ILS directory. Example : 12

13 The next window is where the address of the ILS server is configured. Select Log on to a directory when Netmeeting starts. For an intranet, LAN or WAN configurations, the internal IP address of the ILS server with the port number 1002 (ILS listener port) should be entered. For external access use the public IP address or the FQDN of the ILS server on port 1002 as shown below. The FQDN can be used as well: 13

14 Unselect the following two options to avoid the creation of shortcuts to your desktop and quick launch bar.. The next window allows the configuration of audio. Note: If the workstation does not have a sound card, audio will be unavailable. The next window allows the configuration of audio for the speakers or headphone. Click the Test button to determine the correct volume. This can be modified at any time from Netmeeting s tools menu. 14

15 The next window allows the configuration of the microphone. Speak into your microphone to determine the proper setting. This can be modified at any time from the tools menu. You have successfully configured Netmeeting. Open a page that contains the Adapter for Windows Netmeeting. The following example shows the Adapter for Windows Netmeeting. 15

16 Un-docking Netmeeting The Adapter for Netmeeting Launch button allows Netmeeting to be un-docked and utilized as if it was accessed directly from the operating system. Clicking one of the Launch tabs will un-dock Netmeeting. This allows the user to access the Tools menu to configure the properties as well as maximize, minimize and move Netmeeting around the desktop. Once a Launch tab is selected, Netmeeting will un-dock as show in the next example. The user will effectually have the original Adapter for Netmeeting instance running in the Access Center page and one un-docked instance of Netmeeting running. This example shows the Adapter for Netmeeting on an Access page as well as a un-dock instance. 16

17 Netmeeting Features Overview The following list summarizes Netmeeting s features: The whiteboard allows up to eight users to collaborate in real time Chat supports up to eight users conducting real-time instant messaging The ILS Directory allow users to locate each other File transfer supports up to eight users sending one or more files during a Netmeeting conference The Program Sharing feature allows up to eight users to share multiple programs during a conference The audio and video conferencing features supports only two users that can communicate in real time with VOIP The Remote Desktop Sharing feature supports up to eight users that wish to share their desktops 17

18 It s possible to get more than eight people in a data call with a little juggling with the user groupings. If seven users call one computer then you are limited to eight users; if users branch off from other computers then it s possible to get more than eight users in a conference. The numbers of participants is limited by bandwidth and processor speed. Locating co-workers in an ILS Directory To locate and collaborate with co-workers your corporate ILS server will provide a directory which shows which users are currently logged on to the MetaFrame Secure Access Manager 2.0 Access Center. The ILS directory will provide a list of the users and will also indicate if the user has voice and/or video support. Currently Microsoft has not included support for multiple video and audio participants. There can be multiple participants in any call or conference but only two users at a time will be able to use the voice and video features. The following example shows how to access the ILS directory Click on the directory icon to access the ILS directory window. Double click the desired user(s) to place a call. Once a call is started the user(s) name will be displayed in this window 18

19 To communicate with users that are enumerated in the directory, double click the desired user(s) name to initiate a call. Once a call is initiated, the voice, video and collaboration features are available to all users participating in the call. The following example shows a directory with two users logged on the Access Center. The first user, Eric, does not have sound or video support. The second user Joss has sound support. Downloads Adapter for Windows Netmeeting Netmeeting Need to Know More Netmeeting s features: Everything you need to know about Netmeeting and ILS servers Netmeeting support page Netmeeting Zone Macromedia's Flash Communication Server MX and MetaFrame Secure Access Manager 2.0 Macromedia's Flash Communication Server MX offers advanced collaboration services by adding streaming, multi-way audio, video, and live data exchange enabling users to 19

20 share ideas and content assets in real-time. The Communication Server is built and optimized for streaming media, rich-media messaging, and real-time collaboration, these services integrate seamlessly with MetaFrame Secure Access Manager 2.0 providing an affordable, powerful, extensible collaboration and communication platform. The Communication Server ships with full featured Flash video conferencing and instant messaging sample applications that can be used as is or modified with Flash MX to suit you individual needs. Using Flash MX it's possible to develop custom applications with the Flash 6 Player that communicate with.net, J2EE servers and other Flash Communication Servers providing role based access to applications immediately via MetaFrame Secure Access Manager 2.0. The Flash Communication Server architecture is client server with the Communication Server providing the back-end collaboration and communication services and Macromedia's Flash 6 player as the client or front end embedded in a Access Center page within an MetaFrame Secure Access Manager 2.0 CDA. The Communication Server's sample applications as well as custom Flash applications can immediately deployed via MetaFrame Secure Access Manager 2.0's inthe-box CDAs like the Website Viewer and Web Favorites providing role based access to the Communication Server's services. Flash applications can be included on any page within an MetaFrame Secure Access Manager 2.0 Access Center to allow the sharing of information and ideas Enterprise wide. The Macromedia Flash Communication Server MX comes in two versions: Personal Edition ($ USD) supports communication applications for lowtraffic Internet sites, or to test applications on a local machine for development. o Supports 10 simultaneous connections with a 1 megabit-per-second transfer rate. o 100k/sec video clip to 10 users maximum. Professional Edition ($4, USD) supports workgroup, enterprise-level and ASP application deployments as well as virtual hosts, for large-scale deployments with multiple URLs. o 500 user connection licenses with a maximum bandwidth of 100 megabitper-second. o Additional 500 user Capacity Packs are available. Macromedia Flash Communication Server MX server installation requirements (minimum) Windows 2000 Advanced Server or Windows NT 4.0 Server (SP6 or later) Pentium III 500 MHz processor or greater (dual Pentium 4 or better recommended) 256 MB of available RAM (512 MB recommended) 50 MB of available disk space CD-ROM drive 20

21 Client Requirements Macromedia recommends a browser with Java player support, like Microsoft Internet Explorer 6.0 or later. Flash 6 Player. Security Considerations By default the Flash Communication Server MX uses port 1935 for the RTMP (Real- Time Messaging Protocol). RTMP is a clear text protocol therefore the use of an SSL server certificate on the Flash Communication Server is advisable to secure the RTMP data stream. If a firewall is being used, port 1935 will need to be opened on the firewall. The Flash Communication Server can be configured to use a different port by modifying the <HostPort> tag in the Adaptor.xml file on the Flash Communication Server. The Flash Communication Server Administrator runs on port 1111 and is accessed via a Web browser therefore should you wish to access the Flash Communication Server Administrator and you are behind a firewall port 1111 will need to be open. Note: Macromedia has provided a web site to test your ports: Installing Macromedia Flash Communication Server Product: FlashCom Platform: Windows 2000 Server with SP3 and all current security patches Versions: MX Workgroup: Yes Domain: No Installation: Installing the Macromedia Flash Communication Server is a simple procedure. The following examples utilize Macromedia s 30 day free Professional Edition evaluation software which can be downloaded from The evaluation version is full featured and will run for 30 days. Within the 30 day evaluation a license can be installed which will activate the Flash Communication Server. During the installation you will be required to select an administrator username and password which will be used for the Flash Communication Server s administration, monitoring, and debugging tools. There are two installation types available, Developer and Production. Developer: A Developer installation is suited for application development purposes because it puts the client and server application files in the same directory (C:\inetpub\wwwroot\flashcom\applications). This allows for quick and simple application testing. 21

22 Production: Production installations are for a production deployment as this installation method puts the client and server application source files in separate directories. This prevents script and source files from being browsed from the web server and is a security feature for protecting the source files. Step Locate the FlashComInstaller.exe file and double-click the installer icon. Description From the Welcome window click Next. 22

23 From the license agreement window click Yes. The following Choose Destination Location window allows you to select the install directory. The default location is (C:\Program Files\Macromedia\Flash Communication Server MX). Click Next to accept default or Browse to select an alternative location. Choose either the typical installation or a custom installation. (Macromedia recommends a typical installation). Click Next. 23

24 Select an administrator username and password. This will be used for the Flash Communication Server s administration, monitoring, and debugging tools. Note: A password must be selected as the server will not accept a users name with an empty password. The installer will copy your user name and password into the server s XML configuration files. The password can be manually edited via the XML file as well as from the Administration Console. Next, select the desired installation method, Developer or Production and click next. I've selected the Developer for my test environment. Next you will have to select the support file directory locations. If you have IIS installed on the target computer, the installer asks if you want to install these files into the web server s root directory. For example: C:\Inetpub\wwwroot\flashcom. Note: The Production install provides the option to install the client files into the web server s root directory and source files in a different directory. 24

25 Click Next if you are satisfied with the installation locations. Click Next to accept the program folder location and icons. Click Next to accept the installer settings and to install the Flash Communication Server. 25

26 Click Finish. You have successfully installed the Flash Communication Server. Note: This Flash Communication Server service will start automatically when the server is started up from this point on. The following window is displayed once the installation is completed. These are the icons that will be in the Windows Start menu. The following example shows the addition of the Macromedia Flash Communication Server program folder and icons. 26

27 Test the Macromedia Flash Communication Server To test your Flash Communication Server installation perform the following. Step Go to Start > Programs > Macromedia Flash Communication Server > Server Administrator. Description Note: If the server does not have the Flash 6 Player installed you will see the following. If you already have the Flash 6 Player installed jump to the next example.. Click Yes to install the Flash 6 Player. The Server Administrator will launch with the localhost selected as a default. Notice the red connection light which indicates you are not connected or logged in. Enter the Administrator Name and Password that you selected during the installation. 27

28 Once you have successfully logged into the Server Administrator Console, the connection light glows green. You have successfully accessed the Administrator Console and the green light indicates that the installation was successful. Sample Applications Overview MetaFrame Secure Access Manager s in-the-box CDAs such as Website Viewer, and Web Favorites can assist with quick and simple integration of Macromedia Flash Communication Server MX sample applications. This demonstrates how easily MetaFrame Secure Access Manager allows role-based access to Web-based applications and content without the need of any custom programming. Include the URL of a Communication Server application in the Website Viewer, Web Favorites or a custom built CDA to facilitate immediate role-based access to the desired Communication Server application. Website Viewer CDA displays the output of a URL embedded within a page, in contrast to the Web Favorites CDA, which displays links that launch applications in a separate browser window. Note: If the application requires a full page, Web Favorites is the preferred CDA. I ve successfully tested and integrated all of the in-the-box Communication Server templates with the Website Viewer, Web Favorites CDAs as well as the CDAEXCHANGE CDAs. Panel Presentation: In this example, users can access a moderated presentation while up to 3 speakers broadcast audio and video in real time. The speakers would prepare, publish, and moderate the presentation as well as field question in real time from the attendees. The following example shows the Panel Presentation application running in an Access Center. The below presentation has 15 slides which each users can view while the speakers are presenting in real time in the far right pane. Only the speakers are streaming voice and video although the users can interact with the speakers in the chat and slide panes. 28

29 Guestbook: This sample application allows users to record audio, video as well as text messages in a guestbook which can be played back by any user with access rights to the page. As new messages are recorded they are placed at the top of the page and older messages are available by scrolling down the page to the desired recorded message. The following example shows a user adding an audio and video guestbook entry. 29

30 Once the submit button is clicked the recorded message will be available to users that have access to the page as shown below. Video Conference: This sample application supports a large number of streams for dynamic video conferencing. Each user of this application establishes one stream and subscribes to everyone else stream. Note: Bandwidth usage of your server grows exponentially (with the number of streams) as the number of users increase. 30

31 Camera Snap shot: This application allows users to capture a single frame, save it on the server, and play it back. This application allows users to make audio and video recordings on the fly and allow approved co-workers to view them. Downloads Flash Communication Server MX: 31

32 Need to Know More Flash Communication Server MX homepage: 32