Lab: Part 41 – Configure Citrix App Layering

Step-by-step guide to learn how to configure Citrix App Layering.

More from the Lab!

 

In the previous post, we discussed how to install and upgrade Citrix App Layering. Now it is time to configure our Citrix Enterprise Layer Manager (ELM) appliance.

More from this Citrix App Layering series

• Introduction to Citrix App Layering
• Lab: Part 40 – Getting Started with Citrix App Layering
• Lab: Part 41 – Configure Citrix App Layering
• Lab: Part 42 – OS Layer with Citrix App Layering
• Lab: Part 43 – Platform Layer with Citrix App Layering
• Lab: Part 44 – Application Layers with Citrix App Layering
• Lab: Part 45 – Layered Image Deployment with Citrix App Layering
• Lab: Part 46 – Elastic deployment with Citrix App Layering
• Lab: Part 47 – User Layers with Citrix App Layering
• Lab: Part 48 – Windows 10 and PVS with Citrix App Layering
• Best Practices for Citrix App Layering

Requirements

For this lab, you need the following:

• ELM appliance up and running
• Active Directory configured and reachable from the appliance (SSL recommended)
• AD credentials for domain junction. You can use a shared account or have a dedicated AD account for authentication in ELM.
• AD group for ELM administrators
• A network share
• SSL Client (Ex: MobaXterm)
• A Certificate Authority to generate a certificate for the appliance
• OpenSSL for Windows
• Virtual Infrastructure (Ex: VMware vSphere or Microsoft Hyper-V)
• Optional: PVS infrastructure

Best practices to configure Citrix App Layering

• Multiple Network Adapters is not supported
• Configure AD authentication
• Configure HTTPS and Disable HTTP
• Increase Cache Size if you have a lot of layers
• Increase Cache Size if Hit Rate is too low
• Configure a different Storage Location for User Layers

Configure Citrix App Layering

Connect to the web console with the default credentials administrator and Unidesk1 (CTX223712 –
What is the Default Password for App Layering?)

License agreement

Accept the license agreement.

Change default password

You will be prompted to change the default passwords.

Note: we will the root account later in this post to configure HTTPS. 

Click on Change credentials to validate.

Done.

Here is the ELM web console dashboard.

Configure Citrix App Layering console timeout

Go to System > System and Configuration. Scroll down to Security Settings.

First configuration is to increase the console timeout (default 15 minutes).

Enter 60 or 90 minutes.

Create Active Directory domain junction

Go to Users > Directory Services > Create Directory Junction.

• Directory Junction Name: CitrixGuru.lab
• Server Address: 192.168.1.57
• Port: 638 (or 389 for non-SSL)
• Use SSL (recommended)

Click on Test Connection to validate the configuration.

Next step is to configure the Bind account used for authentication:

• Bind Distinguished Name: CN=elmadaccount,CN=users,DC=citrixguru,DC=lab
• Bind Password: Password

Click on Test Authentication to validate credentials.

Now we need to configure the starting point for the directory:

• Base Distinguished Name: DC=citrixguru,DC=lab

Leave all attribute mapping settings by default:

Select Create Directory Junction to create it.

Add AD group ad Administrators

Go to the ELM web console > Users > Directory. Search for your ELM admin group in Active Directory (Ex: CITRIXGURU\ELM_ADMINS).

Select the group and click on Edit Properties. Navigate to Roles.

Click on Update Group to confirm.

You can now logon with domain accounts part of this AD group.

Add Storage Location

Note: This share will be used by ELM to store User Layers. 

Go to System > Storage Locations > and Add Storage Location.

Add the share path.

Click on Add Storage Location to confirm the creation of the storage location.

Once configured, you can take a look at the configuration in System > Storage Locations.

Click on Test SMB File Share to validate that ELM can access it.

Configure Network File Share for Citrix App Layering

Note: This share will be used by ELM to store Elastic Layers configuration files, system upgrades, etc. 

Go to System > Settings and Configuration > and scroll down to Network File Shares.

Click Edit and enter the network location allocated to ELM and credentials to access it.

Click on Test SMB File Share to validate that ELM can access it.

Once configured, you can take a look at the files created in the share.

Elastic configuration in stored in the json files located in the layer repository:

• ElasticLayerAssignments.json -> This file contains the information about user and group mapping to individual application layers. This file will contain and entry for each group or user ID that has assigned applications.
• Layers.json -> This file defines the Layers in the repository and metadata about the layers used by the Citrix Elastic Layering Filter Driver.
• MachineAssociations.json -> This file defines machine associations – You can use a computer name pattern containing wildcards to associate a set of computers with any AD group.
• ShareAssignments.json -> This file contains the information about storage location assignments.
• Shares.json -> This file contains the information about storage locations.

Configure HTTPS for Citrix App Layering

Note: Carl Webster published an article about how to import a public SSL certificate (digicert).

Connect to the appliance via SSH using the root account. We configured the password at the beginning of this post.

Then type the following command:

OpenSSL will create the private key and the certificate request files.

Connect via WinSCP to the appliance and go in to /root/ folder. The highlighted items have been generated properly.

Here is the content of the .csr (Certificate Request) file:

And here is the content of the .key (private key) file:

Now take the .csr file and give it to your TLS certificate issuer.

In my case, I am using Microsoft Certificate Authority and its web enrollment.

Copy the content of the .csr file into the webpage and click submit.

Select DER and click on download the certificate.

Then use OpenSSL to convert the certificate to the .pem format.

Here is the content of the .pem file.

To be able to import the certificate in ELM, we need to concatenate the .pem file with the .key file.

Go to ELM console > System > Settings and Configuration and scroll down to HTTP Certificate settings.

Select Edit and upload the .pem file generated by OpenSSL and concatenated with the private key.

Click on Save to validate the import.

Select Yes to reboot.

Once the appliance has rebooted, navigate to the URL using HTTPS.

The SSL/TLS certificate is applied and the management console is secured.

Disable HTTP

We can now disable HTTP for the apache server running on the ELM appliance (CentOS).

Connect to the appliance via SSH with the root credentials.

Navigate to /root/httpd.

And open httpd.conf file with nano.

Navigate to Listen 80 in the second page and change it to Listen 443.

CTRL + O to save.

 

Then ENTER to erase the file

CTRL + X to exit the nano editor. Then type service httpd restart to restart Apache.

That’s it. HTTP is disabled on the management console.

Expand App Layering repository

By default, ELM is delivered with a 300GB repository for layers. The disk is thin provisioned.

To expand the disk here are few requirements:

• Disk must use the .vhdx format (default for ELM)
• Need to be attached to the virtual SCSI controller. By default ELM is configured with IDE. You will have to shutdown the virtual machine in that case.

In Hyper-V, the process is simple. Go to the Hyper-V console and Edit Disk. Select the repository disk.

Select Expand.

Enter the new size for the disk.

Validate to increase the size of the disk.

Go back to the ELM console. Go to System > Manage appliance.

Select Expand Storage.

The new increased disk should be available.

Select Expand Storage to confirm.

After few minutes, the configuration should be updated.

Install Citrix App Layering agent

If you need the App Layering agent, you then install it on the servers where is needed, depending on your specific needs for the agent.

The App Layering agent is required if you want to do any of the following:

• Publish layered images to PVS.
• Use connector configurations. to launch a script.
• Run App Layering in Microsoft Hyper-V.

If you are not using any of the above functionality, you do not need the agent.

Note: No need to install an agent for VMware vSphere but it is required for Microsoft Hyper-V, Citrix PVS, etc. 

Open the ELM package downloaded from Citrix website.

You should have citrix_app_layering_agent_installer.exe in it.

Install it on servers that need to communicate with ELM.
For example, if you plan to publish vDisks directly to PVS. Install the agent on 1 of your pvs servers.

See below the process to install the agent.

Accept license agreement.

Enter agent port (default 8016).

Click on install.

To register the agent in ELM, you need to specify the ELM server IP and credentials.

If you do not register the agent during installation, you can manually register it later. However, remember that the PowerShell scripts do not run until the agent is registered with the appliance. See Manual registration.

Click on Register.

The installation is completed.

Add Microsoft Hyper-v connector in Citrix ELM

Go to System > Connectors > Add Connector Config.

Select the connector that applies to your configuration (Ex: Microsoft Hyper-V).

This will open a new page with the connector wizard.

First step is to add a new name for the connector.

Then let’s move to the connector configuration.

You should be able to find the agent where you did the installation earlier.

Add the proper credentials and click on Check Credentials to validate them. 

Next, configure Virtual Machine settings (default 4vCPU and 8GB) and select the network card to assign the virtual machines used for layering.

You also need to configure where you will store the disks of the virtual machines used for layering.

Make sure to click on Test to validate that ELM can access the location.

Then click on Save and close the window.

In ELM, you should see the new connector.

The Cache Size and Cache hit Rate are very important for performances. Here is the default configuration for Cache Size:

• vSphere: 250GB
• XenServer: 480GB
• Hyper-V: 200GB
• Nutanix: 480GB

If you decide to disable caching (not recommended) for a connector configuration, set the cache size to zero (0). If you need to re-enable it, simply increase the Packaging cache size.

The Cache Hit Rate is the percentage of times the appliance has found a disk in the cache.

See more details in the documentation.

Add Citrix PVS connector in Citrix ELM

Note: Make sure to install Citrix App Layering agent on 1 PVS server part of your PVS farm. 

Adding a connector for PVS will allow you to publish directly from the ELM console to PVS. The disk will be automatically added into the PVS store and configured. However you will still have to manually assign it the devices. Also if you have multiple PVS servers and no central repository, you will need to manage the synchronization of your vDisks between your servers (PowerShell, DFS-R, etc).

See Citrix Documentation for connectors.

Go to System > Connectors > Add Connector Config.

Select the connector that applies to your configuration (Ex: Citrix PVS).

This will open a new page with the connector wizard.

First step is to add a new name for the connector.

Then let’s move to the PVS connector configuration.

 

You should be able to find the PVS server where you installed the agent earlier.

Add the proper credentials and click on Check Credentials to validate them. 

Note: you may need to register PVS PowerShell snapin on the server again. See https://support.citrix.com/article/CTX235079. 

Next, configure vDisk settings.  Select the PVS site and the PVS Store name in the dropdown list. Then You need to set the default configuration for the write cache, the size of the write cache and the type of license mode. You can also Enable AD machine account password management, load balancing and printer management if needed.

Make sure to click on Test to validate that the PVS connector is configured properly.

Then click on Save and close the window.

In ELM, you should see the new PVS connector.

More from the Lab!