SD-WAN configuration for Citrix Virtual Apps and Desktops Standard for Azure integration

Citrix SD-WAN is a next-generation WAN edge solution that accelerates digital transformation with flexible, automated, and secure connectivity and performance for SaaS, cloud, and virtual applications to ensure an always-on workspace experience.

Citrix SD-WAN is the recommended and best way for organizations to connect to Citrix Virtual Apps and Desktops Standard for Azure with a quick and easy set-up. For more information, see Citrix blog.

Benefits

• Easy to set up SD-WAN in Citrix Virtual Apps and Desktops Standard for Azure through a guided and automated workflow
• Always-on, high performance connectivity through advanced SD-WAN technologies
• Benefits across all connections (VDA-to-DC, user-to-VDA, VDA-to-cloud, and user-to-cloud)
• Reduces latency compared to backhauling traffic to the data center

• Traffic management to ensure Quality of Service (QoS)

  • QoS across HDX/ICA traffic streams (single-port HDX AutoQoS)
  • QoS between HDX and other traffic
  • HDX QoS fairness between users
  • End-to-end QoS
• Link bonding delivers more bandwidth for faster performance
• High Availability (HA) with seamless link failover and SD-WAN redundancy on Azure
• Optimized VoIP experience (packet racing for reduced jitter and minimal packet loss, QoS, local break-out for reduced latency)
• Major cost savings and much faster and easier to deploy compared to ExpressRoute

Pre-requisites

To evaluate these new capabilities, the following pre-requisites must be adhered to:

1. You must have an existing SD-WAN network with Citrix SD-WAN Orchestrator service entitlement. If you don’t have an existing SD-WAN network then you must set up one using Citrix SD-WAN Orchestrator service. For more details, see configuring a Master Control Node (MCN).

2. You must have a subscription to Citrix Virtual Apps and Desktops Standard for Azure.
3. Currently, this integration support is only available for customers. If you are a partner or an MSP and must try this service then you must subscribe to Citrix Virtual Apps and Desktops Standard for Azure as a customer. Only then this integration can be enabled.
4. To use SD-WAN features (such as QoS for MSI, application visibility), the Network Location Service (NLS) must be configured for all the SD-WAN sites in your network.
5. You must have a DNS server and AD either deployed where the client endpoints are present (co-located in your data center environment, which would also have the MCN) or you can also utilize Azure Active Directory (AAD).
6. The DNS server must be capable of resolving both internal (private) and external (public) IPs.
7. Make sure that the FQDN sdwan-location.citrixnetworkapi.net is whitelisted in the firewall. This is the FQDN for network location service which is critical in sending traffic over the SD-WAN virtual path.

For the list of cloud services that has to be whitelisted on the firewall, see Prerequisites for Citrix SD-WAN Orchestrator service usage.

Deployment architecture

Any deployment would feature the following entities:

• An on-premises location hosting the SD-WAN appliance which can either be deployed in branch mode or as an MCN. This location contains the client machines, active directory, and DNS. However, you can also choose to use Azure’s DNS and AD. In most scenarios the on-premises location serves as an on-prem data center and houses the MCN.

• Citrix Virtual Apps and Desktops Standard for Azure cloud service: This entity provides:

  • The UI for enabling and monitoring SD-WAN connectivity for Citrix Virtual Apps and Desktops Standard for Azure.
  • Creates SD-WAN virtual machine instances in Azure.
  • Manages their lifetime.
  • Bundles SD-WAN instance costs with Citrix Virtual Apps and Desktops Standard for Azure costs for customer billing.
  • Configures the local networking environment (subnets, local routing, firewall rules and so on) for SD-WAN instances.
  • Supplies SD-WAN instance information to the Citrix SD-WAN Orchestrator service to provide and consume SD-WAN monitoring and other operational data.

• Citrix SD-WAN Orchestrator service: Citrix SD-WAN Orchestrator service provides the UI for SD-WAN management:

  • Including management of instances deployed in Citrix Virtual Apps and Desktops Standard for Azure.
  • Implements initial provisioning for Citrix Virtual Apps and Desktops Standard for Azure SD-WAN instances.
  • Implements restrictions on SD-WAN instance management to reflect the Citrix Virtual Apps and Desktops Standard for Azure configuration.
  • Integrates with Citrix Virtual Apps and Desktops Standard for Azure to provide and consume SD-WAN monitoring and other operational data.

• Virtual and physical SD-WAN appliances: Virtual and physical SD-WAN appliances run as multiple instances within the cloud (VMs), on-premises in the data center, and in the branches (physical appliances or VMs) to provide connectivity among these locations and to/from the public Internet.

  SD-WAN instance in Citrix Virtual Apps and Desktops Standard for Azure subscription is created as a single or a set of virtual appliances (if there was HA deployment) by Citrix Virtual Apps and Desktops Standard for Azure cloud service in Azure within the realms of Citrix Virtual Apps and Desktops Standard for Azure subscription. SD-WAN appliances in other locations (DC and branches) are created by the customer. All of these SD-WAN appliances are managed (in terms of configuration and software upgrades) by SD-WAN administrators through the Citrix SD-WAN Orchestrator service.

• Citrix Virtual Apps and Desktops Standard for Azure VDA, Connector - Uses the Citrix Virtual Apps and Desktops Standard for Azure SD-WAN appliance as a gateway to all resources outside of the Citrix Virtual Apps and Desktops Standard for Azure VNet, including enterprise on-prem resources, certain Azure services, and SaaS applications on the public Internet.

User roles

1. Citrix Virtual Apps and Desktops Standard for Azure Administrator: Decides to use SD-WAN connectivity and obtains the necessary networking information from the SD-WAN administrator (or another network administrator role):

   • Starts the configuration of SD-WAN connectivity through Citrix Virtual Apps and Desktops Standard for Azure UI.
   • Once SD-WAN connectivity is fully enabled, manages Citrix Virtual Apps and Desktops Standard for Azure catalogs using SD-WAN connectivity.
   • Together with the SD-WAN Administrator, monitors SD-WAN connectivity and takes more actions as necessary.

2. SD-WAN administrator: Provides SD-WAN configuration information to Citrix Virtual Apps and Desktops Standard for Azure Administrator:

• Activates SD-WAN instances in Citrix Virtual Apps and Desktops Standard for Azure to enable connectivity to other network elements, and performs extra configuration activities.
• Together with the SD-WAN administrator, monitors SD-WAN connectivity and takes extra actions as necessary.

Access management for SD-WAN Citrix Virtual Apps and Desktops Standard for Azure integration

• Both Citrix Virtual Apps and Desktops Standard for Azure and Citrix SD-WAN Orchestrator service rely on Citrix Cloud IDAM to identify users as having Read-Only or Read-Write access.
• In addition, the Citrix SD-WAN Orchestrator service has the capability to assign similar access rights to users exclusively within the Citrix SD-WAN Orchestrator service. The two authorization mechanisms are combined with the OR logic: it is sufficient to have admin access rights either in Citrix Cloud or in Citrix SD-WAN Orchestrator service to get access to SD-WAN configuration management.

Deployment and configuration

In a typical deployment a customer would have the Citrix SD-WAN appliance (H/W or VPX) deployed as an MCN in their data center/large office. The customer data center would usually host on-prem users and resources such as AD and DNS servers. In some scenarios the customer can use Azure Active Directory services (AADS) and DNS, both of which are supported by Citrix SD-WAN and Citrix Virtual Apps and Desktops Standard for Azure integration.

Within the Citrix Managed Azure subscription, the customer needs to deploy the Citrix SD-WAN virtual appliance and VDAs. The SD-WAN appliances are managed through the Citrix SD-WAN Orchestrator service. However, for the purpose of this integration the SD-WAN appliance within the Citrix Managed Azure subscription is configured via Citrix Virtual Apps and Desktops Standard for Azure UI/workflow. Once the SD-WAN appliance gets configured it connects to the existing Citrix SD-WAN network and further tasks such as configuration, visibility, and management are handled through the Citrix SD-WAN Orchestrator service. Both Citrix SD-WAN Orchestrator service and Citrix Virtual Apps and Desktops Standard for Azure communicate with each other using APIs.

The third component in this integration is the network location service which allows internal users to bypass the gateway and connect to the VDA’s directly, reducing latency for internal network traffic. For phase 1 of this integration the network location service needs to be configured manually. For more information, see Network location service (NLS).

Configuration

1. After you followed all the pre-requisites highlighted in the pre-requisites section, the first item that must be configured is the DNS. This must be configured in the Citrix SD-WAN Orchestrator service. You need admin rights to configure DNS on the Citrix SD-WAN Orchestrator service. To configure DNS, navigate to Configuration > App & DNS Settings > DNS Servers in the Citrix SD-WAN Orchestrator service GUI and click +DNS Server. Enter the primary and secondary DNS in the ensuing screen.

   

   As highlighted in the Deployment and configuration section above, the AD and DNS is present in the on-premises location acting as the data center and in a deployment featuring SD-WAN it is available behind the SD-WAN that is on the LAN network. It’s the AD/DNS IP that you must configure here. In case you are using Azure Active Directory service/DNS, configure 168.63. 129.16 as the DNS IP.

   If you are making use of an on-premises AD/DNS, check if you can ping the IP of your DNS from your SD-WAN appliance. You can do this by navigating to Troubleshooting > Diagnostics. Check the check box against Ping in the ensuing screen and initiate a ping from the LAN interface/Default interface of the SD-WAN appliance to the IP of your AD/DNS.

   

   If the ping succeeds then it signifies that your AD/DNS can be reached successfully. If not, then there is a routing issue in your network which is preventing reachability to your AD/DNS. If possible, try to host your AD and SD-WAN appliance on the same LAN segment. In case there is still an issue, reach out to your network admin. Without completing this step successfully, the catalog creation step will not succeed and you are likely got an error message stating Global DNS IP not configured.

   Note

   Ensure that the DNS is capable of resolving both internal and external IPs.

2. Log in to the Citrix Virtual Apps and Desktops Standard for Azure UI. You can view the following screen:

   

   Click Network Connections to create network connectivity between your on-prem resources and Citrix Virtual Apps and Desktops Standard for Azure subscription. Click + Add Connection.

   

   The SD-WAN option is only be enabled if you meet the following requirements:

   • You must have an existing SD-WAN network with Citrix SD-WAN Orchestrator service entitlement. If you don’t have an existing SD-WAN network then set up one using Citrix SD-WAN Orchestrator service. For more details, see Configuring a Master Control Node (MCN).

   • You must have a subscription to Citrix Virtual Apps and Desktops Standard for Azure.

   • Currently, this integration support is only available for customers. If you are a partner or an MSP and must try this service then you must subscribe to Citrix Virtual Apps and Desktops Standard for Azure as a customer, only then this integration can be enabled. Otherwise, this option remains disabled.

   In case you want to try this integration and need trial access for the Citrix SD-WAN Orchestrator service then request a trial by visiting citrix.cloud.com or sdwan.cloud.com.

3. Once you meet the conditions highlighted in the pre-requisites, click the SD-WAN tab to view the overall workflow:

   

4. Enter the following details to configure the SD-WAN:

   • Deployment mode: You can see two deployment mode options - Standalone and High Availability.

     • Standalone: The deployment mode for SD-WAN can either be standalone where a single SD-WAN instance is deployed. If the SD-WAN instance fails due to either an issue with the SD-WAN firmware or the underlying Azure infra you cannot reach out to the resources deployed behind the SD-WAN instance in Azure. In other words, the instance behaves in a fail to block mode.

     • High Availability: To guard against software failure of the SD-WAN instance you might choose to deploy the instance in high availability mode which deploys two SD-WAN instances in active standby mode. Citrix recommends deploying instances in high availability mode for production networks.

   • Enter SD-WAN site name: Enter the site name to identify a site in your SD-WAN network. Make sure that the name you choose is unique and easy to recall.

   • Throughput and number of offices: Currently, only D3_V2 option is supported. D3_V2 supports up to 200 Mbps of throughput and can establish direct connectivity to 16 sites. The connections that are not direct go through the MCN.

   • Region: Select the Azure region where you want to deploy the SD-WAN instance. This needs to be the same region where you intend to deploy your Citrix Virtual Apps and Desktops Standard for Azure resources.

   • VDA subnet: VDA subnet is the subnet where you want to deploy your VDA and other Citrix Virtual Apps and Desktops Standard for Azure resources in Azure.

   • SD-WAN subnet: SD-WAN subnet is the subnet where you want to deploy your SD-WAN appliance/s.

   Note

   This integration only supports domain joined catalogs, non-domain joined aren’t supported as of today.

5. Once you provide all the information that asked for in the previous step, the provisioning and deployment ensues and it takes around 20 odd minutes for the process to complete. During this time, the following steps take place behind the scenes:

   • A virtual SD-WAN appliance (VPX) starts to get provisioned in Azure based on the configuration chosen by you. Once provisioning succeeds, the SD-WAN VPX comes up with the chosen CPU and memory profile along with the network configuration supplied during the previous step.

   • Once provisioning succeeds, the VPX appliance reaches out to the Citrix SD-WAN Orchestrator service over public Internet to request for the configuration package.

   

6. Once the SD-WAN branch is configured, you can view the configuration details.

   

7. Once the instance is provisioned, you can see the following screen. At this point the network administrator must log into the Citrix SD-WAN Orchestrator service to allow the addition of the SD-WAN VPX appliance to the network.

   

8. The network administrator must log in to the Citrix SD-WAN Orchestrator service and navigate to Network configuration home page, where you can see a line item for the SD-WAN site in Citrix Virtual Apps and Desktops Standard for Azure.

   

9. The network administrator must deploy the sites at this stage. Click the Deploy Config/Software to deploy.

   

10. Once the Deploy Config/Software step succeeds, you can see that the status on the Citrix Virtual Apps and Desktops Standard for Azure screen changes to you can now create catalogs using SD-WAN.

Network location service

With the Network Location service in Citrix Cloud, you can optimize internal traffic to the apps and desktops you make available to subscribers’ workspaces to make HDX sessions faster.

Users on both internal and external networks have to connect to VDAs through an external gateway. While this is expected for external users, internal users experience slower connections to virtual resources. The Network Location service allows internal users to bypass the gateway and connect to the VDAs directly, reducing latency for internal network traffic.

Configuration

To set up the Network Location service, you configure network locations that correspond to the VDAs in your environment using the Network Location service PowerShell module that Citrix provides. These network locations include the public IP ranges of the networks where your internal users are connecting from.

When subscribers launch Citrix Virtual Apps and Desktops Standard for Azure sessions from their workspace, Citrix Cloud detects whether subscribers are internal or external to the company network based on the public IP address of the network from which they are connecting.

• If a subscriber connects from the internal network, Citrix Cloud routes the connection directly to the VDA, bypassing Citrix Gateway.

• If a subscriber connects externally, Citrix Cloud routes the subscriber through Citrix Gateway as expected and then redirects the subscriber to the VDA in the internal network.

Note

The public IP that needs to be configured in the network location service needs to be the public IP assigned to the WAN links.

Public IP assigned to the SD-WAN appliance

The public IP that needs to be configured in NLS needs to be the WAN link IPs of all the links used to send traffic over the virtual path. You can find this information by navigating to Site > Reports > Real time > Statistics > Access Interfaces.