This video is from Google Next in London 2019. I am joined by Ejal Bracha, Systems Engineer from Citrix. We talk about how the partnership between Citrix and Google have helped Oncology Venture with creating a centralized IT platform for their employees.
We also talk about we were able to scale up Oncology Venture’s cancer platform.
Citrix customer story about how Oncology Venture is able to support users across the world with a standard desktop solution. Combining Citrix Cloud and Google cloud was the perfect fit for Oncology Venture.
With a centralized Windows Desktop solution, we were able to minimize the time we needed to update our platform. In partnership with Google, Citrix developed Machine Creation Services for Google Cloud. This was a really big help for keeping our platform up-to-date. If we had changes in an application, we could easily roll it out to the users overnight.
One of the included features in Machine Creation Services is Autoscale. Autoscale will scale the number of workloads that you need. If you have a great need for resources in the middle of the day and less during the night, Autoscale will automatically boot up the workloads that are needed. This means that you do not have workloads running that you do not need and pay for.
You can read the whole customer story by clicking the button below.
When running Citrix Apps and Desktops, image management is a must. It will make it so much easier to upgrade and patch both the operating system and the applications that are installed on the workloads. Citrix offers two different image management technologies: Provisioning Services (PVS) and Machine Creation Service (MCS). Before we go into which technology to choose, let’s take a closer look at both of them.
Provisioning Services is streaming a master image to the Workload VMs In PVS terms, and workloads are called target devices. The master image is located in a file share located on the PVS server. The Workloads PXE boots on the network and downloads a boot file from the PVS server. The workload starts to stream the master image from the PVS server across the network. A cache disk is attached to the workload VM to store parts of the master image and for writes. When the VM is rebooted, the cache disk will get wiped.
When a change is made to the master image, you just need to boot the workload VMs, and the updated image will get deployed.
With PVS, you need to have full control over your network. Each workload will PXE boot and pull the image across the network. If your network doesn’t perform, neither will your workloads. Everything has to go across the network. From my point of view, this is a solution for on-prem environments. PVS is not meant for environments running workloads in a public cloud. However, PVS can deploy to physical machines.
PVS is available in the following editions of Citrix Virtual Apps and Desktops.
* Citrix Virtual Apps Advanced is available for VMHosted applications running on a desktop operating system only.
** Physical desktop support not available with the Citrix Virtual Desktops Standard Edition
Machine Creation Service is a component that is part of the delivery controller in your Citrix Apps and Desktop environment. It communicates with the hypervisor or cloud vendor, where your workload VMs are located through APIs. MCS creates VMs and adds them to your Active Directory. Your live image is created from a snapshot of the master image that you have created with your master VM.
When you create new workloads, MCS builds a linked clone from the master image you have created. It will create a differencing disk for the changes that will take place when to machine is in use. At the same time, it will also create an identity disk for the VM.
It is very easy to get started with MCS because it is part of the Studio console. PVS has a separate console. MCS is meant for virtual hosts and cannot be used for physical machines.
MCS has support for the following virtualization platforms:
If you wish to deploy your workloads to a public cloud, MCS has support for:
You can read more about running your workloads on Google Cloud Platform in these two articles:
How Citrix Machine Creation Service on GCP made managing workloads easier
Machine Creation Service for Google Cloud
MCS also gives the option to create full clones. This means that each VM gets its own disk. With this option, you can spread out your load to different storage pools, which is a good idea if you have workloads that demand a lot of IOPS.
MCS comes with every edition of Citrix Virtual Apps and Desktops.
The first thing you need to figure out is where you want to deploy your workloads. In the table below, you can see which technology you can use where.
| Deploy to | PVS | MCS – Thin | MCS – Clone |
| Physical Machines | X | ||
| On-Prem Virtualization | X | X | X |
| Public Cloud | X | X |
Each technology uses different resources. PVS stream your image across the network, so you need to make sure that there is enough capacity on your network, and you do have any latency.
MCS uses storage, so here you need to pull enough IOPS from your storage solution. As mentioned earlier, if you have high demanding workloads, you can always create full clones that you can spread across different storage pools.
Earlier, I wrote an article on the Citrix blog about Machine Creation Service on Google Cloud Platform. One of the things you also get with MCS is Autoscale.
Autoscale allows you to scale your Citrix Apps and Desktops workloads up or down, depending on the demand from your users. Autoscale will boot up new workloads, depending on demand or on a certain schedule. This means that, when no one is working and not using any resources, it will shut down workloads. When users are coming back to work, workloads will boot up to meet the demand.
With Autoscale, you can make sure, that you do not have unused resources in your data center or in your cloud environment. If you run your workloads in Azure, AWS or GCP, you can save a lot of money if you enable autoscale. All the workloads that are not being used, will be shut down and you will not pay those resources anymore. Next morning the workloads will boot up again and will be available for the users. You can scale-down in one region and scale-up in another region so the resources are always closest to the users.
You can configure Autoscale by editing your Delivery Groups in Studio. Here you can set up how you want to scale your workloads. You can configure anything from scheduling to power-off delay. If you put in a “Machine cost”, you will be able to see your savings in Citrix Director. It is also possible to force a certain number of machines to run at a certain time of day to make sure that you have enough workloads running.
If you are running your workloads in a cloud, where you are paying for time-based resource use, Autoscale is a must. It saves you a lot of money and at the same time, it also makes sure that you have enough resources for your company’s needs.
Many times I have heard the discussion which remote solution is most secure. Is VPN more secure than a remote desktop solution? Depending on who you ask, you will get a different answer. A network administrator will most likely give you the answer that a VPN is the best solution. A desktop administrator will say to you that a remote desktop solution is better.
When you create a VPN tunnel your company, the traffic flow will be encrypted. This means that it will be very difficult to read your data when it is being sent across the Internet.
The same goes for a remote desktop solution. All the data that are being sent across the Internet is encrypted. If the data flow comes in the hands of hackers, they will not get anything out of it.
The data flow from a VPN solution and a remote desktop are equally secure. so it does not mean that VPN is more secure than a Remote Desktop.
The next step we need to look at is the endpoints. When you open up a VPN tunnel from an endpoint, it will become a device on your internal network. This means that your endpoint can communicate with other hosts and machines on your network. Of course, you can limit this with firewall rules and you can also limit what kind of traffic you want to send through the VPN tunnel. For most VPN solutions, this is a big administrative task.
When it comes to remote desktop, you can set up policies on which features that are available for the user. You can control anything from access to local disks to local USB devices. It gives the administrator an easier way to control access to the local network.
The most advanced remote desktop protocol is ICA/HDX from Citrix. The ICA/HDX protocol is up by virtual channels. Some of these channels are on the picture below.
The virtual channels can be enabled and disabled. They can also be enabled with certain settings. An example could be that you want to disable USB keys, but you want to allow a certain USB scanner. That can be done through the HDX protocol.
The question of whether VPN more secure than a remote desktop depends on the use case. If you want to create a solution for your end-users, I would recommend a remote desktop solution. You can give access to the company network and company data without any of the data leaves the datacenter. At the same time, you will get a system that is easy to control in terms of giving access from the endpoint to the company network. VPN is a great solution to create a site-to-site connection between two company networks, but I do not think it is ideal for users to connect to the company network through a VPN.