CloudBridge Release Notes. These release notes describe the enhancements and known issues in Citrix CloudBridge software release

CloudBridge 7.4.2 Release Notes These release notes describe the enhancements and known issues in Citrix CloudBridge software release 7.4.2.

Copyright and Trademark Notice CITRIX SYSTEMS, INC., 2015. ALL RIGHTS RESERVED. NO PART OF THIS DOCUMENT MAY BE REPRODUCED OR TRANSMITTED IN ANY FORM OR BY ANY MEANS OR USED TO MAKE DERIVATIVE WORK (SUCH AS TRANSLATION, TRANSFORMATION, OR ADAPTATION) WITHOUT THE EXPRESS WRITTEN PERMISSION OF CITRIX SYSTEMS, INC. Citrix, Citrix Systems, CloudBridge, Citrix Repeater, Branch Repeater, WANScaler, NetScaler, XenServer, Orbital Data, Orbital 5500, Orbital 6500, Orbital 6800, TotalTransport, AutoOptimizer Engine, and Adaptive Rate Control are trademarks of Citrix Systems. Citrix Systems assumes no responsibility for errors in this document, and retains the right to make changes at any time, without notice. Portions licensed under the Apache License, Version 2.0 http://www.apache.org/licenses/license-2.0. Portions licensed under the Gnu Public License, http://www.gnu.org/copyleft/gpl.html, including xmlrpc++, glibc, rpmlibs, beecrypt, Wireshark. Portions licensed under the Gnu Public License with product-specific clauses, including the Linux kernel (http://www.kernel.org/pub/linux/kernel/copying), libstdc++, and libgcc. Portions are free software with vendor-specific licensing, including zlib (http://www.gzip.org/zlib/zlib_license.html), netsnmp (http://www.netsnmp.org/about/license.html), openssl (http://www.openssl.org/source/license.html), krb5- libs (http:/ /web.mit.edu/kerberos/krb5-1.3/krb5-1.3.6/doc/krb5-install.html), tcp_wrappers (ftp://ftp.porcupine.org/pub/ security/tcp_wrappers_license), bzip2-libs (http:// sources.redhat.com/bzip2/), popt (http://directory.fsf.org/libs/ COPYING.DOC). Elfutils-libelf is licensed under the OSL 1.0 license, http://www.opensource.org JPGraph licensed under the terms given in http://www.aditus.nu/jpgraph/ proversion.php. LZS licensed from Hifn corporation, http://www.hifn.com. Iperf licensed under the terms given in http://dast.nlanr.net/projects/iperf/ ui_license.html. This product includes PHP, freely available from http://www.php.net/. Document code: October 1, 2015, 4:34 PM. 2

Contents 1 What's New in CloudBridge 7.4.2... 4 1.1 SMB 3.0 (Windows Filesystem) Acceleration... 4 1.2 Service Class Enhancements... 6 1.3 Changes to Video Caching... 7 1.4 Office 365 Acceleration for Branch Offices... 9 2 Bug Fixes... 22 3 Known Issues and Workarounds... 23 4 Limitations and Caveats... 25 5 Compatibility... 26 5.1 CloudBridge Plug-in... 27 6 Features Tables... 28 6.1 Supported Citrix CloudBridge VPX Configurations... 33 6.2 Citrix CloudBridge VPX for Amazon... 33 7 Licensing, Upgrading, and Downgrading... 35 7.1 Licensing... 35 7.2 Upgrading Existing Installations... 35 3

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 1 What's New in CloudBridge 7.4.2 CloudBridge release 7.4.2 is compatible with partner appliances running previous CloudBridge and Branch Repeater releases 5.5 and later, and Citrix Branch Repeater with Windows Server releases 2.0 and later. It can be used in a mixed environment that includes units running these older releases. New features in release 7.4.2 include: Support for Windows Filesystem SMB3. Unencrypted SMB3 connections (which are the default under Windows 8 and Windows Server 2012 and later) are now accelerated. Service class enhancements. AppFlow reporting and SSL tunneling can now be enabled or disabled on a per-service-class basis. Improved video caching. Technology preview: Branch-office acceleration for Office 365. 1.1 SMB 3.0 (Windows Filesystem) Acceleration SMB 3.0 is the default Windows filesystem protocol starting with Windows 8 and Windows Server 2012. Release 7.4.2 extends CloudBridge CIFS/SMB protocol acceleration to SMB 3.0. This means that unencrypted Windows filesystem connections will receive the same protocol acceleration benefits as previous SMB versions. This feature operated automatically and is enabled by default. No configuration is required. Joining the Windows domain allows you to create a secure peer relationship between the datacenter appliances and your remote appliances and CloudBridge Plug-ins. The following tables show CloudBridge CIFS/SMB acceleration support by feature and release. 4

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 Table 1 SMB Version CIFS acceleration features. TCP Flow Control Compression Protocol Acceleration Signing disabled SMB 1.0 Y Y Y SMB 2.0 Y Y Y SMB 2.1 Y Y Y SMB 3.0 Y Y N Signing enabled, CloudBridge has joined domain** SMB 1.0 Y Y Y SMB 2.0 Y Y Y SMB 2.1 Y Y Y SMB 3.0 Y Y Y* Signing enabled, CloudBridge has not joined domain SMB 1.0 Y N N SMB 2.0 Y N N SMB 2.1 Y N N SMB 3.0 Y N N * SMB 3.0 Support was added in release 7.4.2. ** CloudBridge does not support NTLMv2 authentication, which is the default for Windows 7 and up with SMB 1 and 2. Enabling Kerberos authentication allows acceleration. Table 2 CloudBridge Support for CIFS Servers and Clients Product Server Client Windows Server 2003-2012 Yes* Yes* Windows XP, Vista, 7, 8, 10 2000 Yes* Yes* NetApp Yes** N/A Hitachi Yes** N/A Windows NT Yes No Windows ME and earlier No No Others See Note * SMB 3.0 support was introduced in release 7.4.2. ** Operation with SMB 3.0 has not been tested as of release 7.4.2. 5

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 1.2 Service Class Enhancements As shown in the figure below, you can now include or exclude AppFlow reporting and SSL tunneling on a per-service-class basis. This is controlled on the service class definition page at Configuration > Optimization Rules > Service Classes > Edit. The controls work as follows: Enable AppFlow Reporting. When enabled, information from this service class is included in any AppFlow reports. When disabled, information from this service class is excluded. For example, reporting might be usefully disabled for service classes that handle purely local, non-wan traffic. Exclude from SSL Tunnel. By default, enabling secure peering causes all accelerated connections to be sent through a secure (encrypted) tunnel. If no tunnel is established with the remote partner, compression is disabled for the connection. 6

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 Excluding a service class from the SSL tunnel changes this behavior: Connections using this service class do not pass through the tunnel and are thus not encrypted. Connections using this service class do not have compression inhibited if there is no secure tunnel. Connections using this service class are not candidates for SSL acceleration. Note: Do not define SSL profiles for service classes that have Exclude From SSL Tunnel set. 1.3 Changes to Video Caching Video caching changed significantly in release 7.4.2. Changes include: Caching is now transparent. That is, the IP address of both the client and the server are maintained end-to-end. Before release 7.4.2, devices between the CloudBridge appliance and the server saw the CloudBridge appliance s address, rather than the server s. Video caching is now supported on CloudBridge VPX. You can specify the list of ports for caching, instead of or in addition to port 80. Caching is supported between a client and a Web proxy, or between a Web proxy and the Internet or WAN. Improved cache behavior monitoring. Instrumentation has been improved through the addition of the Monitoring > Optimization > Video Caching > HTTP State List page, which reports the state of HTTP connections in the context of video caching, as shown below: 7

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 Improved connection monitoring. The Monitoring > Optimization > Connections page has been enhanced to show cached connections on the Accelerated Connections tab. o o Both cache hits and cache misses are shown on this tab. Cached connections are shown on the Accelerated Connections tab whether they are accelerated in the usual sense or not. That is, they will appear here regardless of whether a partner CloudBridge unit is involved in the connection. A new column, Bandwidth Savings (%), shows a bar graph of how much WAN bandwidth was saved by the transaction, whether through caching or compression. While the main benefits of caching and compression are increased speed and usability, not reduced bandwidth usage, speed and usability increases are often related to bandwidth reduction. That is, a 90% bandwidth savings implies a 10x increase in speed: Latest content, guaranteed. Every time a video is shown, the cache contacts the origin server, and if the video has changed, the cached content is discarded and the new content is downloaded. 1.3.1 Configuration Changes The acceleration setting for Web (Internet) and Web (Private) must not be set to None if caching is to take place. The Domain Append field under Global Settings has been renamed DNS Suffix. This is your local domain name. It is appended to any URLs that arrive without one. The X-Forwarded-For parameter is no longer used. The video caching policy file is no longer used. Caching-specific IP-based IP exclusion is no longer supported. Instead, exclude undesired client or server addresses using service-class rules. 1.3.2 Other Notes The video cache will be cleared when you update to release 7.4.2. YouTube and Vimeo now serve all videos using encrypted HTTPS connections, which means that videos from these sites can no longer be cached. In the Diagnostics > Tracing module, video caching has been combined with HTTP. 8

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 1.4 Office 365 Acceleration for Branch Offices Note: Office 365 acceleration is provided as a technology preview in release 7.4.2. It is not recommended for production networks. In certain cases, branch-office acceleration is supported for Microsoft Office 365 products, starting in release 7.4.2: Topology: When branch-office Office 365 traffic is first sent over your WAN to a larger office, and then forwarded to Microsoft s servers on the Internet, the segment between the branch office and larger office can be accelerated. The segment between the main office and Microsoft s servers is not accelerated. Main Office Branch Office WAN Internet Office 365 Servers Use case: When the WAN segment is considerably slower than the Internet segment, and Microsoft s Office 365 servers are closer to the larger office than the branch-office. Mechanism: CloudBridge SSL acceleration can decrypt and accelerate Office 365 traffic, providing compression, CIFS, and MAPI acceleration. In short, Office 365 branch-office acceleration can be thought of as a special case of RPC-over-HTTPS acceleration, though the details are a bit different. Method: Enable secure peering, create and install certificates on your server-side appliance to allow it to handle the Office 365 traffic, and set up an appropriate SSL profile. To avoid security alerts on your users browsers, these certificates must be signed by your Windows domain s CA server, which makes them acceptable to any domain user. Caveats: Branch-office devices that are not part of the domain will show security warnings unless the users install the certificates manually. Firefox users also have to install the certificates manually, since Firefox does not honor the device s certificate store. 9

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 1.4.1 To enable Office 365 acceleration 1. Set up a secure peering relationship between the two CloudBridge appliances, as described in http://docs.citrix.com/en-us/cloudbridge/7-31.html, starting at page 790. 2. Create a new certificate. Your server-side CloudBridge appliance will serve as an intermediary between Office 365 and the clients, so these certificates will be signed by your domain controller but refer to the Office 356 domains. a. Log on to the Certificate Authority Server for your Windows domain. b. If necessary, add the snap-ins for Certification Authority, Certificate Template and Certificates. c. Navigate to Certificate Templates > Web Server Properties > Security > Give Full Control to all the options. d. Navigate to Certificates > Personal > Certificates (Computer) > All Tasks > Request New Certificate. e. In the Certificate Enrolment window, click Next. f. In Select Certificate Enrolment Policy, select Active directory enrolment policy. g. In Active directory Enrolment Policy, select Web Server > details > Properties. 10

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 3. Copy information from Office365 certificates into your new certificates. You will end up with a single certificate from three Office365 certificates. Proceed as follows: a. From a browser, such as Chrome, navigate to https://login.microsoftonline.com. Do not log in. b. Reveal the information you need as follows (these instructions are for the Chrome browser; others are similar): Click the padlock icon on the URL bar. Then select Connection > Certificate Information > Details. c. Scroll down to the Subject Alternative Name field and copy the information in the text box below it. This will reveal a list of DNS names such as login.microsoftonline.com. 11

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 d. Return to your new certificate s Certificates Properties page. Add one Alternative Names of type DNS to match each Alternative name in the Microsoft certificate e. Repeat the process of discovering Subject Alternate Names and adding them to your certificate for https://outlook.office365.com and https://*.sharepoint.com (the SharePoint URL is customer-specific). 12

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 f. Create a Common Name for your new certificate. The example above shows a common name of Office365 proxy. g. On your certificate s Private Key tab, select Make private key exportable. h. Click OK, Enroll, then Finish. 4. Export the certificate. a. Under Certificates > Personal > Certificates, select the above created proxy certificate, and then select All Tasks > Export. 13

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 b. The Certificate Export Welcome Wizard appears. Click Next. In Export Private Key, select the option to export the private key with the certificate. Click Next. 14

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 c. Accept the default values for the export file format. d. Type and confirm the password, export the private key, and save the certificate as loginportal.pfx. 5. Export your certificates. a. In the Certificate Export Welcome Wizard, click Next. In Export Private Key, select the option to export the private key with the certificate. Click Next. 15

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 b. Accept the defaults for Export File Format. c. Type and confirm the password, and export the private key and certificate, saving the file to a file to a file name such as office365_keys.pfx 6. Download the public keys of the root CA and Intermediate CAs of the Microsoft certificates. a. From the browser, navigate to https://login.microsoftonline.com. Click the padlock icon in the browser. Navigate to Connection > Certificate Information > Certification Path. b. Select the root certificate (the one at the top of the list), and then click View Certificate > Details > Copy to File. The Certificate Export Wizard appears. Click on Next. 16

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 c. Accept the default values, enter the file name, and save to the file. d. Repeat step 6 to save the root and intermediate CA s of the following domains: i. login.microsoftonline.com ii. outlook.office356.com iii. *.sharepoint.com iv. Office.live.com 7. Add all the Office 365 server CA s, proxy certificate/key pairs, and private keys to the serverside CloudBridge appliance. The CA s are added through the CA Certificates tab on the Certificates and Keys page. Certificates and certificate/key pairs are added on the Certificate/Key Pairs tab. 17

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 8. Create an SSL split-proxy profile and bind the split proxy to the Web (Internet-Secure) service class. a. Navigate to Configuration > Secure Acceleration > SSL Profile > Add Profile. b. Enter the profile name of your choice. Select Profile Enabled, Parse Subject Alternative Names, and Split Proxy. c. Under Server-Side Proxy Configuration > Verification Store, select Use all configured CA stores. d. Under Client-side Proxy Configuration > Certificate/Private Key, select the cert/private key pair you created and exported previously (the one shown in the example as loginportal.pfx). Select Build Certificate Chain. Select the CA associated with the certificate/key pair under Certificate Chain Store. 18

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 9. Bind the created SSL profile to the Internet (Web-Secure) service class by navigating to Configure > Optimization Rules > Service Classes and adding the SSL profile to the SSL profile list. 10. Enable acceleration and disk-based compression for the Internet (Web-Secure) service class. 19

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 11. Initiate an Office 365 session from your browser. Connections should be accelerated. In the browser, the certificate should display your root CA, not the actual Office 365 certificate, as the server-side appliance s CA certificate. 12. On the appliance s Monitoring > Connections page, verify that the Office 365 connections are compressed and are receiving SSL acceleration. 20

CloudBridge 7.4.2 Release Notes 1. What's New in CloudBridge 7.4.2 1.4.2 Troubleshooting Office 365 Acceleration If the connections are not shown as compressed on the Connections page, clear the browser s cache and restart. Firefox does not accept the device s certificates by default, but has its own certificate store. Therefore, credentials accepted in the normal Windows domain behavior by other browsers, and by the device as a whole, must be installed manually into Firefox. To install certificates into Firefox: o o Install the server-side appliance s proxy certificate to the Firefox certificate store by navigating to Firefox > Options Advanced > Certificate > View Certificates > Authorities, selecting the certificate, and clicking Import. Select all the options in the Downloading Certificate Wizard and click OK to accept. 21

CloudBridge 7.4.2 Release Notes 2. Bug Fixes 2 Bug Fixes These issues were addressed in CloudBridge release 7.4.2. CB-Advanced Optimization Issue #584130. A failure to set a lock could cause a restart when data changed while the data was being traversed. Issue #577434, 581722. A problem with MAPI handling sometimes caused restarts. Issue #581373. During secure CIFS acceleration, restarts were sometimes caused by a threadunsafe process running two threads instead of one. CB-Networking Issue #570394. (CloudBridge 4000/5000) The MSS value could not be set below 1200 bytes. Issue #580550. (CloudBridge 4000/5000) IPv6 acceleration could not be disabled. CB-System Issue #577106. Slow updates of internal parameters reduced performance and caused occasional restarts. 22

CloudBridge 7.4.2 Release Notes 3. Known Issues and Workarounds 3 Known Issues and Workarounds These issues are known to exist in CloudBridge release 7.4.2. CB-Advanced Optimization Issue #588360. Video caching is no longer supported for YouTube and Vimeo. These sites now force the use of uncacheable HTTPS video streams. Issue #586587, 586640, 587559. Video caching is ineffective when users play Metacafe, Youku, or Dailymotion videos on tablets such as the ipad and Samsung Galaxy Tab, because chunked encoding is not supported. Issue #578350. When an accelerated Citrix Linux Virtual Desktop connection is interrupted, reconnecting displays a blank, unresponsive screen instead of the actual desktop. Issue #579050. The new File Upload option for Citrix Receiver for HTML 1.7.0 does not work when used with the Chrome browser. CB-Config and Reporting Issue #284137: (CloudBridge 4000/5000). Detailed connection information is missing. Issue #596188. A bug in Google Chrome can cause a blank frame to be displayed during Quick Installation. For more information on the bug, see https://code.google.com/p/chromium/issues/detail?id=516808. Workaround: Refresh the page (and allow the security exception again), or configure with a different browser. CloudBridge Issue #553170: (AppFlow) The NetScaler Insight Center dashboard displays the WAN latency value as zero until the CloudBridge appliance acquires a number of traffic samples. Issue #555132: If you set GUI access from HTTPS (the default) to HTTP, Insight Center and NITRO calls will fail to connect. Workaround: Select HTTPS as the GUI protocol. Issue #561139: (AppFlow) If, in the CloudBridge application classifier, you define an application with a colon (:) in the name, the application is not exported correctly to the AppFlow collector. Issue #549679: (AppFlow) If NetScaler Insight Center does not get a connection closure update for a particular connection ID, and the ID is reused, the IP data of the previous connection might be displayed. Workaround: Disable Database Cache Settings as follows: 1. On the Configuration tab, in the navigation pane, click the System and in the right pane click Change Database Cache Settings. 2. To clear the cache, select Reset Database Cache. 3. To enable the cache, select Enable Database Cache. 4. Click OK. 23

CloudBridge 7.4.2 Release Notes 3. Known Issues and Workarounds Issue #533063: (AppFlow) On the NetScaler Insight Center dashboard, the latency values displayed on the graph and the network topology diagram might not match because of time synchronization issues. Issue #0477773: (CloudBridge 4000/5000) Installation issues might arise if two or more CloudBridge 4000 or 5000 appliances are connected to the same broadcast domain. Issue #0419760: (CloudBridge 4000/5000) The accelerator's signaling IP address cannot be changed from the CloudBridge GUI. Workaround: Change the Signaling IP address, as follows: 1. Log on to the NetScaler instance's GUI. 2. Navigate to Configuration > Load Balancing > Virtual Servers > BR_LB_VIP_SIG. 3. Modify the signaling IP address. 24

CloudBridge 7.4.2 Release Notes 4. Limitations and Caveats 4 Limitations and Caveats The following limitations should be kept in mind: CloudBridge Issue #0444976: The management service and NetScaler instance time is not synchronized with that of the NTP server after the NTP Server is configured through the management service. Workaround: Restart the management service to synchronize the time. WAN Insight Issue #554960: If you upgrade a NetScaler Insight Center appliance to release 10.5 build 55.8xxx.e, the compression ratio values will be displayed as -NA-. Issue #536696: NetScaler Insight Center takes two minutes to display the current connection details on the dashboard. 25

CloudBridge 7.4.2 Release Notes 5. Compatibility 5 Compatibility The following table lists the products and platforms supported by release 7.4.2. Table 3 Supported Products and Platforms Appliance Type Citrix CloudBridge 400 series Citrix CloudBridge 800 series Citrix CloudBridge 1000 with Windows Server, Citrix CloudBridge 2000 with Windows Server Citrix CloudBridge 2000 and Citrix CloudBridge 3000 series Citrix CloudBridge 4000 and Citrix CloudBridge 5000 series Citrix CloudBridge 600 series Citrix CloudBridge VPX (all models) Citrix CloudBridge VPX for Amazon Citrix CloudBridge VPX for XenServer platforms Citrix CloudBridge VPX for VMware ESX or ESXi platforms Citrix CloudBridge VPX for Microsoft Hyper-V Citrix CloudBridge 700 series CloudBridge Plug-in Repeater 8000 Series (Newer versions): Appliances that list SM85 Series 3 or SM88 Series 3 on the System Hardware line of the System Status page Repeater 8000 Series (Earlier versions): Appliances that list SM85 Series 2 or SM88 Series 2 on the System Hardware line of the System Status page Earlier Models Supported? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No 26

CloudBridge 7.4.2 Release Notes 5. Compatibility 5.1 CloudBridge Plug-in 5.1.1 Compatible Operating Systems The CloudBridge Plug-in is supported on desktop and laptop systems, but not on netbooks or thin clients. It is supported on the following operating systems: Windows 8 (32-bit and 64-bit versions of Enterprise Edition) Windows 7 (all 32-bit and 64-bit versions of Home Basic, Home Premium, Professional, Enterprise, and Ultimate) Windows Vista (all 32-bit versions of Home Basic, Home Premium, Business, Enterprise, and Ultimate) 5.1.2 Hardware Requirements The recommended hardware specifications for systems running the CloudBridge Plug-in are: Pentium 4-class CPU 4 GB of RAM 2 GB of disk space Minimum hardware requirements for running the CloudBridge Plug-in are: 1.5 GHz CPU 2 GB RAM 500 MB free disk space 5.1.3 CloudBridge Plug-in and Citrix Receiver The CloudBridge Plug-in is supported by Citrix Receiver 3.0 and later, and can be distributed and managed by Citrix Receiver. 27

CloudBridge 7.4.2 Release Notes 6. Features Tables 6 Features Tables Table 4 Features of CloudBridge 600 and 700 Series Appliances CloudBridge 600 series CloudBridge 700 series Product Features Video Caching Y N TCP Acceleration Y Y Compression Y Y Traffic Shaping Y Y XenApp/ XenDesktop Acceleration Y Y Windows Filesystem Acceleration Y Y SSL Acceleration Y Y Windows Outlook Acceleration Y Y RPC over HTTPS Y Y CloudBridge Plug-In Support N N Pay-As-You-Grow Support Y Y Hardware Features Network Bypass Card Y Y 10 Gbps Interfaces N N Fiber Support N N LCD Front Panel Interface Support Y Y RS-232 Serial Interface Support Y Y Support for Initial Config over Network N N Modes Inline Y Y WCCP Y Y Virtual Inline Y Y Group Mode N/R* N/R* High Availability N/R* N/R* VLANs Y N N/R = Not Recommended 28

CloudBridge 7.4.2 Release Notes 6. Features Tables Table 5 Features of CloudBridge 400, 800, 2000, and 3000 Series Appliances CloudBridge 400 series CloudBridge 800 series CloudBridge 2000 series CloudBridge 3000 series Product Features Video Caching N Y Y Y TCP Acceleration Y Y Y Y Compression Y Y Y Y Traffic Shaping Y Y Y Y XenApp/ XenDesktop Acceleration Y Y Y Y Windows Filesystem Acceleration Y Y Y Y SSL Acceleration Y Y Y Y Windows Outlook Acceleration Y Y Y Y RPC over HTTPS Y Y Y Y CloudBridge Plug-In Support N N Y Y Pay-As-You-Grow w Support Y Y Y Y Hardware Features Network Bypass Card Y Y Y Y 10 Gbps Interfaces N N N N Fiber Support N N N Y LCD Front Panel Interface Support N N N N RS-232 Serial Interface Support Y Y Y Y Support for Initial Config over Network Y Y Y Y Modes Inline Y Y Y Y WCCP Y Y Y Y Virtual Inline Y Y Y Y Group Mode Y N Y Y High Availability Y Y Y Y VLANs Y Y Y Y 29

CloudBridge 7.4.2 Release Notes 6. Features Tables Table 6 Features of CloudBridge 1000 and 2000 with Windows Server Appliances CloudBridge 1000 with Windows Server CloudBridge 2000 with Windows Server Product Features Video Caching Y Y TCP Acceleration Y Y Compression Y Y Traffic Shaping Y Y XenApp/ XenDesktop Acceleration Y Y Windows Filesystem Acceleration Y Y SSL Acceleration Y Y Windows Outlook Acceleration Y Y RPC over HTTPS Y Y CloudBridge Plug-In Support N Y Pay-As-You-Grow Support Y Y Hardware Features Network Bypass Card Y Y 10 Gbps Interfaces N N Fiber Support N N LCD Front Panel Interface Support N N RS-232 Serial Interface Support Y Y Support for Initial Config over Network Y Y Modes Inline Y Y WCCP Y Y Virtual Inline Y Y Group Mode Y Y High Availability Y Y VLANs Y Y 30

CloudBridge 7.4.2 Release Notes 6. Features Tables Table 7 Features of CloudBridge 4000 and 5000 Series Appliances, CloudBridge VPX, and CloudBridge VPX for Amazon CloudBridge 4000 series CloudBridge 5000 series CloudBridge VPX CloudBridge VPX for Amazon Product Features Video Caching N N Y Y TCP Acceleration Y Y Y Y Compression Y Y Y Y Traffic Shaping Y Y Y N XenApp/ XenDesktop Acceleration Windows File System Acceleration Y Y Y Y Y Y Y Y SSL Acceleration Y Y Y Y Windows Outlook Acceleration Y Y Y Y RPC over HTTPS Y Y Y Y CloudBridge Plug-In Support Y Y Y N Pay-As-You-Grow Support Y Y Y N Hardware Features Network Bypass Card Y Y N N 10 Gbps Interfaces Y Y * N Fiber Support Y Y * N LCD Front Panel Interface N N N N RS-232 Serial Interface N N N N Support for Initial Config over Network Y Y N N Modes Inline Y Y Y Y** WCCP Y Y Y N Virtual Inline Y Y Y N Group Mode N N N N High Availability Y Y N N VLANs Y Y Y/Y/N*** N *Depends on configuration of user-provided hardware. **See WAN Optimization for CloudBridge. ***The three values are for XenServer, VMware, and Hyper-V, respectively. In columns showing only one value, the value applies to all three hypervisors. 31

CloudBridge 7.4.2 Release Notes 6. Features Tables Table 8 Features of Repeater Appliances and CloudBridge Plug-in. Repeater 8820 Repeater 8520, 8540 CloudBridge Plug-In Product Features Video Caching N N N TCP Acceleration Y Y Y Compression Y Y Y Traffic Shaping Y Y N XenApp/ XenDesktop Acceleration Y Y Y Windows Filesystem Acceleration Y Y Y SSL Acceleration Y Y Y Windows Outlook Acceleration Y Y Y RPC over HTTPS Y Y Y CloudBridge Plug-In Support Y Y Y Pay-As-You-Grow Support Y Y N Hardware Features Network Bypass Card Y Y N 10 Gbps Interfaces N N * Fiber Support Y N * LCD Front Panel Interface Support Y Y N RS-232 Serial Interface Support Y Y N Support for Initial Config over Network N N N Modes Inline Y Y N/A WCCP Y Y N/A Virtual Inline Y Y N/A Group Mode Y Y N/A High Availability Y Y N/A VLANs Y Y N/A * = Depends on configuration of user-provided hardware. N/A = Not Applicable 32

CloudBridge 7.4.2 Release Notes 6. Features Tables 6.1 Supported Citrix CloudBridge VPX Configurations Release 7.4.2 is supported on Citrix CloudBridge VPX instances running on XenServer, VMware vsphere, and Microsoft-Hyper-V hypervisors. See the following table for the supported hypervisor versions. Table 9 Hypervisors Compatible with Citrix CloudBridge VPX Citrix XenServer XenServer 6.1, XenServer 6.02/Hotfix 602E007, XenServer 5.6.0 (but not 5.6 FP1 or 5.6 SP2), XenServer 5.5 VMware Vsphere ESXi 5.1, ESXi 5.0, ESX/ESXi 4.1 Microsoft Hyper-V Citrix CloudBridge VPX for Amazon Hyper-V under Windows 2008 R2 SP1, Hyper-V 2012 Standard and Datacenter Edition Amazon Web Services (AWS) platform For instructions for changing the TSC emulation to maximize performance, see http://support.citrix.com/article/ctx136003. 6.2 Citrix CloudBridge VPX for Amazon Citrix CloudBridge VPX for Amazon is available only in the m1.large configuration, which creates instances with 2 vcpus and 7.5 GB of RAM. The AMI is preconfigured with a 250 GB volume, which should not be resized. Citrix CloudBridge VPX for Amazon supports a single Elastic Network Interface (ENI) only. Table 10 Production Configurations, CloudBridge VPX for Amazon. Type Max. WAN Speed* Max. Accel. Conn. 10 Mbps CloudBridge License 5 mbps 1,000 200 Mbps CloudBridge License 45 mbps 10,000 *The CloudBridge Connector License is enforced on the aggregate of ingress traffic on all the interfaces hosted on the CloudBridge Connector. 33

CloudBridge 7.4.2 Release Notes Table 11 vsphere. Production Configurations, XenServer and VMware 6. Features Tables Type vcpus RAM Disk 2 GB production configuration 2 2 GB 100 GB 4 GB production configuration 2 4 GB 250 GB 4 GB production configuration 2 4 GB 250 GB 8 GB production configuration 4 8 GB 500 GB Table 12 Other Configurations (not for production networks). Type vcpus RAM Disk VPX Express 2 1 GB 60 GB 34

CloudBridge 7.4.2 Release Notes 7. Licensing, Upgrading, and Downgrading 7 Licensing, Upgrading, and Downgrading 7.1 Licensing Release 7.4.2 supports both remote license servers and locally installed licenses. For licensing information for all Citrix CloudBridge platforms, see http://support.citrix.com/article/ctx131110. 7.2 Upgrading Existing Installations Note: If you are using a standard evaluation license, you cannot upgrade to software versions that are later than your license. 7.2.1 CloudBridge VPX If you are upgrading from release 5.6, install a new virtual machine instead of upgrading the existing virtual machine, because resource requirements changed with release 6.2.0. Release and 6.2 and newer virtual machines can be updated with the CloudBridge release 7.4.2 binary. 7.2.2 Repeater 8500, Repeater 8800, CloudBridge 600, and CloudBridge 700 Acquire the software from My Account. 7.2.2.1 Installing the Update Note: If you are upgrading from a pre-6.0 release (such as release 5.3), you must update to release 6.x first, then to release 7.4.2. Note: If you are upgrading from a pre-6.0 release, acceleration will not take place until you install the new license from Citrix. From the browser based user interface (http://appliance_ip_address), go to the System Maintenance > Update Software link on the Configuration tab. In the Upgrade System Software table, click Choose File to select the patch file (the file you downloaded with FTP), and then click Upload Patch, as shown in the following screen shot. 35

CloudBridge 7.4.2 Release Notes 7. Licensing, Upgrading, and Downgrading Figure 1 Update Software Page The patch file is then copied to your appliance and tested for integrity. If you have downloaded a valid file, a Restart Unit? prompt appears. Click Yes. The settings from your current release are copied to the new one, so your configuration is retained in the new release. The process of installing the patch file continues during the restart, which might take several minutes longer than usual. The new release is now running on your appliance. Note: If your appliance still uses the old default password, it is changed to "password" when you install this upgrade. 7.2.3 CloudBridge 400, 800, 1000WS, 2000, 2000WS, 3000, 4000, 5000 The update process involves two basic steps: 1. If you are not already running release 7.1.0 or higher, download the release 7.4.2 management service, then update the management service to release 7.4.2. 2. Download and install the release 7.4.2.0 upgrade bundle. The versions of the management service and upgrade bundle corresponding to release are listed in the Compatibility section. These files can be downloaded from My Account. Note: If the #SESS_CORRUPTED error message appears at any time during these procedures, click Logout, clear your browser cache, close your browser, and open it again. 36

CloudBridge 7.4.2 Release Notes 7. Licensing, Upgrading, and Downgrading Procedure 1. To update the Management Service Note: Follow this procedure only if your appliance has a management service from a release earlier than release 7.1. Note: In this procedure, System > Configuration refers to the Configuration menu of a CloudBridge 4000 or CloudBridge 5000 appliance and the System > Configuration menu of a CloudBridge 2000 or CloudBridge 3000 appliance. 1. Update the management service. On the System > Configuration > Management Service > Software Images tab, click Upload and select and upload the new management service from the dialog box. 2. On the Configuration > Management Service page, click Upgrade Management Service. Select the management service image you just uploaded, and then click OK. The management service is upgraded. The UI becomes unresponsive during this process. 3. Clear your browser cache. 4. Once the new management service is installed, the UI starts responding again and takes you to the logon page. Log on. Go to the System > Configuration page and verify that the current version of the management service matches the version you intended to install. 5. If the pages display a Version Incompatibility Detected warning message, it just means that you need to install the upgrade bundle. Ignore the Recommendations in the warning and install the upgrade bundle, as described below. Procedure 2. To update the appliance 1. Acquire the update file. If you log on to citrix.com with your My Account credentials, the CloudBridge software is available in the Downloads section. The upgrade file has a.upg extension and is several hundred megabytes long. Download the file to a convenient system. To minimize transfer time, this system should be in the same facility as the appliance and have a fast link to it (Gigabit Ethernet rather than 54 Mbps wireless). 2. Log on to the appliance and navigate to the System > Configuration page. 3. Click the Update Software link. 4. In the text box that appears, specify the upgrade file, and then click Upload. 5. When a message announces that the upload was successful, click Install. 6. The appliance performs the upgrade, which takes about half an hour. It displays a series of status messages, starting with Preparing to upgrade and ending with Upgrade completed Successfully. 7. Click OK to display the updated user interface. Clear your browser cache to ensure successful operation. 37

CloudBridge 7.4.2 Release Notes 7. Licensing, Upgrading, and Downgrading 7.2.3.1 Troubleshooting If there is no Update Software link, you are using an earlier version of the management service. Update the management service to release 7.4.2, and then run the update process. If the graphical user interface seems dysfunctional after the update, clear your browser cache. You might also need to wait for all features to initialize. The update process is a post-provisioning process. It does not function properly on a new system or after a factory reset if you run it before running the Configuration Wizard. The update process can fail for a variety of reasons, including a corrupted or truncated update file, an appliance using versions that are not in its supported range, and other issues. If the update process fails, it displays an error message. If you need to run the update process again, you must upload the update file again. 7.2.4 Citrix CloudBridge 700 series To upgrade a Citrix CloudBridge 700 appliance, see the Citrix Branch Repeater with Windows Server User's Guide, release 3.0, chapter 3. 38

CloudBridge 7.4.2 Release Notes 7. Licensing, Upgrading, and Downgrading 7.2.5 Troubleshooting Installation Related Issues The clock face showing the estimated update time is not always 100% accurate. If the installation ends with an error page displaying some kind of HTTP timeout error, wait a few minutes, and then attempt to connect normally to the browser based management interface of the appliance. Doing so usually shows that the newly installed version is up and running. Sometimes an update fails if it spans a large number of releases, such as a jump from release 5.0 to 7.4. If this happens, installing an intermediate release first (for example, release 5.7) and upgrading in two steps usually works. Contact Citrix Support with any installation issues. 7.2.6 Downgrading to an Earlier Release 7.2.6.1 CloudBridge Advanced Appliances You cannot downgrade a CloudBridge 400, 800, 1000WS, 2000, 2000WS, 3000, 4000, or 5000 appliance to an earlier release. 7.2.6.2 CloudBridge 600, 700, 8500, 8800, and VPX Appliances Upgrading creates a new software installation. It does not remove the previous release of the software or the previous configuration settings. Therefore, an appliance can be returned to any release that it has previously used. You can revert to a previous release of the software by using the Downgrade Release feature, which is available on the System Maintenance: Update Software page. The downgrade returns the configuration to what it was for the earlier release at the time the upgrade was applied. Any configuration changes you made with the newer release are lost. The software can be downgraded to previously installed releases only. Neither the Upgrade Software nor the Downgrade Release feature supports the installation of patch files earlier than the current release, except for releases already resident on the appliance. 39