Remote Access Using Remote Access Using Citrix Presentation ServerCitrix Presentation Server

December 6, 2006December 6, 2006

Matthew GrangerMatthew Granger

IT665IT665

Methods of Remote AccessMethods of Remote Access

Virtual Network Computing (VNCVirtual Network Computing (VNC Microsoft Terminal ServicesMicrosoft Terminal Services Citrix Presentation ServerCitrix Presentation Server

Virtual Network ComputingVirtual Network Computing

Open Source Desktop Sharing SolutionOpen Source Desktop Sharing Solution Uses RFB Protocol (Remote FrameBuffer)Uses RFB Protocol (Remote FrameBuffer) Server side and Client Side SoftwareServer side and Client Side Software Software available for multiple OS Software available for multiple OS

platformsplatforms Not a Secure PlatformNot a Secure Platform Typically run on TCP ports 5900 to 5906Typically run on TCP ports 5900 to 5906

Microsoft Terminal ServicesMicrosoft Terminal Services

Remote Desktop Protocol (RDP)Remote Desktop Protocol (RDP) Provides remote access to the full desktop Provides remote access to the full desktop

onlyonly Based on Based on T.120T.120 family of protocols family of protocols As a server, can provide for single desktop As a server, can provide for single desktop

or multi-session applicationsor multi-session applications Typically run on TCP port 3389Typically run on TCP port 3389

Microsoft Terminal Services (cont.)Microsoft Terminal Services (cont.)

Requires separate licensingRequires separate licensing Integrated to all version of the Windows Integrated to all version of the Windows

Server softwareServer software Client software shipped as component of Client software shipped as component of

all 32 bit Microsoft Desktop OSall 32 bit Microsoft Desktop OS Other OS client software availableOther OS client software available

Citrix HistoryCitrix History

Originally broke off from IBM and their OS/2 Originally broke off from IBM and their OS/2 development in 1989development in 1989

Partnered with Microsoft to create Microsoft Partnered with Microsoft to create Microsoft Windows 3.51 Terminal Services EditionWindows 3.51 Terminal Services Edition

With Microsoft Windows NT Server 4.0 split the With Microsoft Windows NT Server 4.0 split the product into its own third party entityproduct into its own third party entity

December 2003, aquired Expertcity December 2003, aquired Expertcity (GoToMyPC)(GoToMyPC)

Citrix ImplementationCitrix Implementation

Requires Microsoft Terminal Services to be Requires Microsoft Terminal Services to be running and fully licensedrunning and fully licensed

Software provides a timeshared multi-user Software provides a timeshared multi-user environment for UNIX and Windows Serversenvironment for UNIX and Windows Servers

Operates it’s own proprietary protocol known as Operates it’s own proprietary protocol known as Independent Computing Architecture Protocol Independent Computing Architecture Protocol (ICA)(ICA)

Recent versions operate on TCP port 2598 with Recent versions operate on TCP port 2598 with “session reliability” (reconnects automatically “session reliability” (reconnects automatically after disconnect)after disconnect)

Citrix Implementation (cont.)Citrix Implementation (cont.)

Requires little bandwidth (10 kb to 20 kb Requires little bandwidth (10 kb to 20 kb per session)per session)

Client operates as a “Thin Client” to the Client operates as a “Thin Client” to the Server. All processing takes place Server-Server. All processing takes place Server-sideside

Capable of operating over the Internet via Capable of operating over the Internet via “Citrix Secure Gateway”“Citrix Secure Gateway”

Capable of utilizing Secure Socket Layer Capable of utilizing Secure Socket Layer (SSL) communication(SSL) communication

Citrix Secure GatewayCitrix Secure Gateway

Citrix Secure Gateway (cont.)Citrix Secure Gateway (cont.)

Citrix MetaFrame Presentation Server Access: 1. The client utilizes the Web Interface for MetaFrame

Presentation Server or the Citrix ICA client to initiate a launch of an Internet browser published application

2. The Secure Gateway for MetaFrame Presentation Server processes this request and establishes a connection to the MetaFrame Presentation Servers, both Unix and Windows supported. Please note that the ICA traffic back through the WAN is not illustrated separately. The Secure Gateway allows the user to connect securely using SSL or TSL.

Citrix Secure Gateway (cont.)Citrix Secure Gateway (cont.) 3. When the published browser makes a request of

the browser application, this is routed through the internal network only, from the browser session running on the MetaFrame Presentation Servers to the internal (or external) web servers

4. When a server-side processing request is made, the web server may hand off the request the business application servers

5. The business application servers will access the database layer/servers as required

6. Internal clients, both terminals and workstations, can access applications seamlessly and quickly without the additional IT cost of deploying and maintaining applications to the local desktops

ICA is not HTTPICA is not HTTP(ICA/SSL is not HTTPS)(ICA/SSL is not HTTPS)

Benefits of Citrix over Terminal Benefits of Citrix over Terminal Services AloneServices Alone

Ability to publish a single application Ability to publish a single application instead of a full desktopinstead of a full desktop

Lightweight protocol (very fast Lightweight protocol (very fast performance)performance)

Wide variety of management toolsWide variety of management tools More robust printing facilitiesMore robust printing facilities Multi-Server Load balancingMulti-Server Load balancing Web Interface with SSLWeb Interface with SSL

Problems with CitrixProblems with Citrix

Very Expensive (additional cost over and Very Expensive (additional cost over and above Terminal Server licensing)above Terminal Server licensing)

New release of Windows will replace 90% New release of Windows will replace 90% of Citrix functionality (supposedly)of Citrix functionality (supposedly)

Best run on dedicated servers (additional Best run on dedicated servers (additional hardware required)hardware required)