Context
The company delivers desktops and applications to its users with on-premises Citrix Virtual Apps and Desktops. The farm already included a second site for the control infrastructure, with NetScaler GSLB, StoreFront, Delivery Controllers and SQL Server Always On databases, but no compute capacity for desktops in case of a disaster.
I designed the extension of the farm to Microsoft Azure in the High Level Design document: architecture, access flows, profile management and operating rules.
The challenge
- Desktops available even without the primary data center, without building and running a second data center for the workloads.
- No change for users: same address, same credentials, same multi-factor authentication, inside and outside the company.
- Profiles and data in sync between on-premises and the cloud, so that in DR everyone finds their own environment.
- Reusable capacity outside DR too, when production needs more desktops.
The architecture
Azure becomes a new zone of the existing farm, connected through a hosting connection. It is not a second farm: Delivery Controllers, StoreFront and databases stay on the two existing sites, while Azure holds only the resources and the gateway for the sessions.
Every Delivery Group points to two Machine Catalogs: the on-premises one and its twin in Azure, created with MCS from the same master image replicated to the cloud. The Azure VMs stay in maintenance mode and are enabled only when needed, in DR or during a production peak.
In a disaster, NetScaler GSLB sends users to the gateway on the secondary site, which authenticates them against Active Directory with MFA; StoreFront publishes the resources available in Azure. HDX sessions go through a NetScaler VPX in Azure instead, reached through an address dedicated to that traffic only: fewer network hops between users and their desktops. If communication with the database drops, Local Host Cache keeps the resources available.
Key decisions
- One farm, three locations. The primary data center for production, the secondary site for the control infrastructure, Azure for standby desktops.
- A dedicated HDX gateway. In Azure, a NetScaler VPX in two-arm mode serves only the sessions, separate from the authentication path.
- Profiles synced by the storage. Citrix Profile Management configured through Workspace Environment Management, with SMB shares on NetApp and native replication between the on-premises and the Azure storage.
- Policies per zone. Separate organizational units for on-premises and Azure VMs: GPOs make every VDA register with the right controllers and give it the profile share of its own site.
- High availability in the cloud. The Azure zone spans two Availability Zones.
- Defined operations. Delegated admin roles, antivirus exclusions for VDAs, controllers, StoreFront and WEM, and a network flow matrix across the three sites.
01
Solution, layer by layer
Pick a layer involved to read what was done.
L1 · Secure access
NetScaler VPX with GSLB between the primary and secondary sites, with a single URL for internal and external users and multi-factor authentication. In Azure, a two-arm NetScaler VPX dedicated to HDX connections takes sessions to the VMs along the shortest path.
L2 · Digital workspace
The on-premises Citrix Virtual Apps and Desktops farm gains an Azure zone. Every Delivery Group has an on-premises Machine Catalog and a twin in Azure, both created with MCS from the same master image. Local Host Cache, Citrix Profile Management and Workspace Environment Management complete the design.
L5 · Hybrid cloud
A Microsoft Azure zone spread across two Availability Zones, with the network split into public, DMZ and private tiers. VMs stay in maintenance mode until DR or a peak; profiles stay aligned through native NetApp replication between on-premises and the cloud.
02
Results
- 1
- address for every user, in production and in DR
- 0
- client settings to change in a DR event
- 2
- twin Machine Catalogs per Delivery Group
- 2
- Availability Zones on Azure
03