Citrix continuity across two independent data centers

Context

The department’s Citrix Virtual Apps and Desktops platform ran in a single data center: pooled Windows 10 desktops for more than a thousand employees and over sixty multi-session application servers for internal users and external suppliers, with strong authentication for remote access. A data center failure would have stopped everyone’s work.

With the Citrix Consulting team I wrote the detailed design to extend the infrastructure to a second data center, starting from the production configuration and defining what to replicate, how, and with which risks.

The challenge

• Continuity without new habits. Access had to work even with the primary data center down, without changing the address or the multi-factor authentication.
• Different storage. The second data center did not have the NAS used for profiles and user data.
• Licensing. The EULA does not allow the same Citrix license pack on two active license servers.
• Different versions. The primary site ran 1912 LTSR, while the second one started on 2203 LTSR.

The architecture

I chose two independent twin farms, one per data center, instead of a single stretched farm. Each site has its own Delivery Controllers, Director, StoreFront, SQL Server Always On databases, license server and DHCP. By design, the StoreFront servers of one site do not enumerate the other site’s resources: a problem in one data center cannot spread.

Access stays as it was, with the same URL for internal and external users. The external NetScaler VPX appliances in the DMZ pass connections in SSL bridge mode to the internal gateways, which handle strong authentication with nFactor (smart card or token); internal users sign in with their domain credentials. In a DR event, public and internal DNS are updated to point to the second site: a manual, controlled step.

Key decisions

• Profiles. FSLogix for the desktops, Citrix Profile Management for published applications, which handles concurrent sessions on different servers, and folder redirection for desktop, documents and downloads.
• File servers. The shares move from the NAS to virtual Windows file servers replicated with VMware Site Recovery Manager. The design spells out the limits: consistency of profile containers, loss of data written after the last replication, and DR tests that must be isolated from production.
• Compliant licensing. Two options: split the pack between the two license servers (for example 80/20) and reallocate it in DR, or replicate the license server VM and change DNS. RDS and KMS licensing also get one server per site, assigned through GPO.
• Active Directory. A parallel OU branch for the second site and dedicated copies of the GPOs, so a DR change never touches production. DHCP scopes are replicated on different subnets with the same capacity.
• Aligned versions. The license server is upgraded to 2203 LTSR first, after checking that the Subscription Advantage date in the license file is later than the release; then the primary farm catches up with the second site.
• Capacity. The second data center must be sized at least like the first; if it is not, user VM resources are scaled down before activating it.