From on-premises farms to Citrix Cloud, across data centers, AWS and a DR site

Context

The company published applications and desktops from on-premises Citrix farms and wanted to move to an infrastructure managed by Citrix Cloud, with resources in its own data centers and on AWS. Users are employees, call center agents and consultants: more than 350 concurrent sessions, from anywhere with an Internet connection, with the same experience inside and outside the office.

I wrote the High Level Design document, organized by layers: users, access, resources, control and infrastructure.

The challenge

• Many locations, one environment. Two on-premises data centers, an AWS tenant and a DR site, governed by the same control plane.
• The shortest path for sessions. HDX traffic has to go through the gateway closest to the resource, not through a single point.
• Complex identities. An Active Directory forest with child domains, external forests in trust and a dedicated domain in AWS, plus Azure Active Directory.
• Secure access without losing convenience. Username, password and MFA for everyone, with single sign-on all the way to the session.
• Lean, protected profiles. Profiles of controlled size, available even if a data center goes down.

The architecture

The control plane and the Workspace portal are Citrix Cloud services. The customer’s sites host only the resources and the Cloud Connectors, at least two per zone, which open an encrypted channel to the tenant and authenticate users against the corporate domain.

Resources sit in three zones: zone A with the two on-premises data centers on VMware, zone B with the AWS tenant and EC2 instances, and the DR zone. Each zone has a highly available pair of Citrix ADC with Citrix Gateway and its own optimal routing address: when a user launches a resource, the HDX session goes through the gateway of the zone where the resource lives. External users reach the ADC through the DMZ; internal users point to a private VIP and stay on the local network.

Key decisions

• Authentication delegated to Azure AD. Citrix Cloud integrates with Azure Active Directory and its MFA; Citrix FAS issues the certificates for single sign-on into the sessions.
• A DR that costs little. At the DR site only the ADCs are always on; Cloud Connectors, services and resources are a powered-off, storage-level replica of the production environment.
• Uniform provisioning. MCS creates the Machine Catalogs both on on-premises VMware and on AWS.
• Profiles under control. Citrix Profile Management with folder and file type exclusions, and folder redirection for Desktop, Documents and Downloads, for profiles of about 200 MB.
• A replicated share and a single path. The SMB profile share should be replicated between the data centers, preferably at block level, and reached through a DFS namespace, the same in normal operation and in failover.
• Centralized ADC management. Citrix ADM service in express mode, with one agent on-premises and one in AWS: notifications, firmware, certificates and configurations from a single place.