Monthly Archives: June 2015

Getting started with Azure Application Gateway

Finally something Ive been waiting for to arrive!  Microsoft announced yesterday something called Azure Application Gateway, which is a layer 7 HTTP based load balacing feature. Which has many more persistency features and features like SSL offloading which makes certificate management easier. And with the SSL offloading feature we can remove SSL processing from the virtual machines or applications using SSL in the backend, since Application Gateway has enhanced SSL processing.

Important to note however is that this feature is built upon IIS/AAR.

Application Gateway

Now Azure already has some load balancing capabilities, such as Traffic Manager which is a DNS based load balancing and endpoint load balancing which is more of layer 4 load balancing and has limitied capabilities but of course is a free feature, and traffic manager is billed for amount of DNS queries.

As of now it is only available using the latest Azure PowerShell version, but moving forward it will become available in the portal and the SDK as part of ARM for instance.

To get started we need to create a Application Gateway which can done with the PowerShell command

New-AzureApplicationGateway –Name AppGW –Subnets –vNetname vNet01


And we can now see that the AppGW is created but still hasent been started


Next we need to do the configuration, this is by using an XML file where the declare all the speicifcs like external ports, what kind of protocol and if for instance cooke based persistency should be enabled

The XML file should look like this

<?xml version=”1.0″ encoding=”utf-8″?>
<ApplicationGatewayConfiguration xmlns:i=”” xmlns=””>

Note: under HTTPLoadBalancingRules there is currently only support for Basic (Which is the equivilant of Round Robin at the moment. After we have altered our XML config we can upload it.


After you have uploaded the rules we can start the gateway. Note however this might take a long time before it actually starts operating!


Now even thou this might become a nice feature it is still pretty limited, compared to the other options we have in Azure. Hopefully we have just seen the beginning of this feature and how it will integrate with Traffic Manager in the future will make it even more awesome!

What’s new with Netscaler V11

So been a hectic couple of months, with beta testing the latest V11 of Netscaler among other things. Before I post what’s new I can also say that my book, “Implementing Netscaler VPX” is getting a V.2 release which will be updated to cover specific content in V11 also based from feedback on Amazon it will also be including more stuff around GSLB, AAA, security features, optimization and so on.

Now so what’s new in V11 ?

  • Jumbo frames for VPX
  • Partition Administration (It now fully integrated)
  • TCP Nile congestion (Which is based upon TCP illinois
  • Support for TCP FACK forward acknowledgement
  • Media classification (feature under Front-end optimziation)
  • Web Front
  • Unified Gateway
  • More visualization and an authentication dashboard
  • EULA text in Gateway
  • Own Portal customization dashboard
  • DH Key Optimization
  • Support for TLS 1.1 and 1,2

So let us explore… first of, Jumbo frames is not new in Netscaler, but it is for VPX therefore in order to setup Jumbo frames (meaning higher MTU) you need to change the MTU on the physical adapter on the hypervisor layer as well.


Partition Administration is now fully integrated into the new GUI and more features are supported to be delegated using partitions. Except not Netscaler Gateway….


TCP Nile Congestion, is an TCP congestion protocol that Citrix has created based upon TCP illinois. Which gives performance gain on high-speed networks, this is defined using the TCP profiles.


TCP Fack or forward acknowledgement, is a TCP feature which is to be used with SACK, which is a feature which is used to better see how much outstanding data is from the sending end, which decreases the recovery time when packet loss occurs.


Media Classification is a feature which allows the Netscaler to show what kind of media is being sent via the netscaler. For instance it can be MP3, Applevideo, Windows media and so on. But it requires its own license apparently.


Web-front is a new web interface kinda solution, where you basically move the Storefront Website to the Netscaler is only having Stores on the Storefront server, this allows for faster SSO and authentication for native reciever users. Note it cannot be used with Unifed Gateway only native Netscaler Gateway vServers. ¨


The most existing part is the Unified Gateway feature, which in essence is a combination of the old Netscaler Gateway with clientless access activated and with a Content Switching vserver infront of it. This feature is used to deliver all types of apps be it (Saas, Citrix, and other load balanced vservers from within one URL) if you look at my other post about setting up unified gateway you can see more about it there –>




Important to note that when you are doing changes you need to be aware of that you need to change the content swtiching vserver which sits infront of the Netscaler Gateway vServer. And that the content switching vserver can only have one gateway vserver behind it.

Now there is more options to do visualizations as well for many of the services here, because frankly you can often get confused on how the different vservers are attached and how the processes are executed.

Example from a Unified Gateway visualization.


there is also now a authentication dashboard which shows different auth servers and the status of them, we can also drive into the syslog to see authentication attempts.



We can also now specify our own EULA text for people that login to our gateways.


Here I can change some of the GUI customization directly from within the managment console, but I can also still do it from within the tradisional SFTP method.


Also there is alot of new stuff in SSL/TLS, one of which is the ability to define DH key expiration in order to achieve perfect forward secrecy (PFS).

This can be done under SSL parameters of a vServer, by default this is set to 0 apposed to the previous value which was 500.


And of course TLS 1.1 and 1.2 for front end services which was also included in the latest 10.5 build.

What else is new ? There are some minor stuff, first for Image optimization which allows us to convert JPG to JXR format and from


Setting up Unified Gateway on Netscaler 11

So the fuzz for the last couple of months is, what is Unified Gateway ?

From what we can read from the Citrix blog

One URL: Provides consolidation of remote access infrastructure

something revolutionary ? not really.

It is however a combination of features that the Netscaler already has and some of it has been rewamped. It is a combination of bookmarks, content switching rules and clientless access to be able to give users access to all their applications using a single URL. So how to set it up?

First head on over to the management GUI, you should have your own Unified Gateway wizard there.


Next we have the option to choose between a regular Netscaler Gateway or a Unified Gateway deployment


Next we define the parameters of the Unified Gateway vServer (Note that this IP is being defined on the content switching vserver)


Next add the certificates, incluing the RootCA and/or intermidiate cert


Next we need to add a authentication method, like LDAP


Next we choose a portal theme, from here now I can easily choose from my own custom created from a template or choose the built-in themes.


Lastly we need to add our applications.


Now I’m going to start with adding web applications to the gateway. Now when adding a web application I have four options, either choosing (Taken from the Citrix documentation)

  • Intranet Application ( Intranet applications can be any internal network resident, web-based application which needs to be made available to VPN users.
    To provide access to intranet resident applications through the Unified Gateway URL please check the option below. NetScaler creates a custom URL for HTTP transactions to switch VPN user site requests. To create this custom URL, an application’s root relative url and site strings must be provided. These strings are derived from the application’s real URL. NetScaler uses these strings to create specific Content Switching rules that filter the web requests for each application and direct the VPN user accordingly.)
  • Clientless Access (NetScaler with Unified Gateway supports clientless access to Outlook Web Access and SharePoint web sites. The full URL for these sites must be specified.
  • SaaS (Software as a Service) applications are usually externally hosted web based applications that require authentication. This might be a service such as ShareFile, SalesForce, SAP, or NetSuite.
    NetScaler with Unified Gateway supports access through the VPN for these applications and facilitates the user authentication process with single sign-on (SSO) through SAML where available. If the SAML SSO is required, a SAML profile must be configured.
  • Unified Gateway supports VPN access to applications already configured locally as a NetScaler load balancing virtual server.
    The application’s URL must be given, along with the virtual server configured with the application. The URL must resolve in DNS to the virtual server’s IP address.
    Note if you want this application to be configured with the NetScaler to provide single sign-on authentication, an appropriate authentication setting needs to be created on the virtual server.


For instance if we were to add Office365 to the gateway, we also have the option to add SAML based authentication to the mix to allow for SSO based authentication from the Netsacler.


I can also choose Internal based application which are already load balancing using the Netscaler


Now if I want to have SSO here I need to have pre-configured the vServer with the right AAA paramteres. Now important here tha the vServer IP and the URL name resolves using DNS. And that the URL has a / at the end of the address.

Then we can also add clientless access applications like Exchange and SharePoint


And after we have added the other applications we can also integrate with XenApp / XenDesktop


(NOTE Web-front is not an option here)

Now after we are done with adding the resources, we will now be brought back to the dashboard which will show us the status of the gateway. We can also show that the applications are added under resources and bookmarks


You can also see that the vServer Gateway is defined in the content switching policy



and voila! more to come! 🙂


Is Microsoft on the road to becoming the next EMM leader?

With the movement to the cloud, Microsoft has done alot of stuff right with its Office365 offering and also done a lot with Azure, the problem that has been over the last years has been their forgotten child… Intune.

Now the concept was good, built up a fully cloud based MDM/ PC management solution as an extension to Office365, the execution how ever hasn’t been all that great at first. While Office365 and Azure got most of the focus, Intune was left behind in terms of features and focus.

But now this has changed, last year Microsoft announced their EMS (Enterprise Mobility Suite) which was a combo of Identity service with Azure AD premium, data protection with Azure RMs and MDM with Intune, Microsoft got serious with their MDM/EMM solution, and one piece that Microsoft has that none of their MDM competitors has is the identity features, which is crucial in a BYO strategy, because if people wish to use their device and using their same ID and with the strong increase of SaaS applicaitons we need a common identity provider in place (Where traditional Active Directory does not cut it, because of its limitations)

This is from the latest report from Gartner on Identity and Access Management as a service


With their offerings from within Azure AD and with many customers already using it with Office365, Microsoft has an advantage that none of their competitors have.

Gartner also released their new report on MDM/EMM as well (Where we again see Vmware, Citrix and MobileIron) note that of these 4, Microsoft is the only one that has their own mobile hardware platform and their own personal operating system which allows them go get a bit of an advantage since Microsoft is also pushing Windows 10 as a more mobile operating system and more features will be directly integrated into Intune and Azure AD.

  • Windows Update for buisness
  • Windows Store for buisness
  • Enterprise Data Protection

Figure 1.Magic Quadrant for Enterprise Mobility Management Suites

and note its been a little bit over a year ago that Microsoft launched their EMS package (even thou Intune has been available for some time, it hasn’t been until recently that Microsoft started focusing on this, and with Microsoft pushing updates to Intune almost each month it shows their are serious with this offering.

And moving forward Microsoft will continue to create more and more direct integration between Office365 (where there are about 80 mill customers) which make it a winning combo and become the natural choice for many customers, since in most cases it will just be as any other addon to Office365.

(Crappy drawning I know..)


And with the integration possibilities that Microsoft has with their on-premise solution (System Center Configuration Manager) it makes sense to get access to direct manage all regular computers and mobile devices from the same solution since a device is a device and should be managed by the same staff.

Microsoft has also stated alot of new features which are coming to Azure AD, Intune and Office365, which can be seen here on their own roadmap –>

Quick post, Netscaler Masterclass and Azure

I presented on this months masterclass from Citrix where I talked about Netscaler on Azure, the eagle has landed. Where I went trough some of the limitations and features and what other features in Azure we can use for load balancing and some guidelines on high-availability and so on.

I’ve also blogged about it earlier, which you can see here –>

You can also view the recording on Citrix TV here –>

Nutanix and .NEXT what was all the fuzz about ?

For those wandering on social media and saw some fuzz about .NEXT conference from Nutanix and wondering what that was all about, let me enlighten you.

Nutanix which is become a well known player in the hyperconverged has their first user confernce this week in Miami and has some spectacular announcements.

Nutanix Xtreme Computing Platform:

Which consists of two product familieis, Prism which is the management software and Acropolis which in essence is the core of the Nutanix fabric.

Now Acropolis consist of two things, the core fabric and the Acropolis Hypervisor, which is a custom built Hypervisor which built upon KVM. Now Nutanix has a point they want to go foward with, virtualization and storage should be invisible, which in essence is the same message that our public cloud providers are pushing out, it should just be resources and you should be able to stack them as you want (basically like lego bricks)image

So one of the coolest features I’ve ever seen was their App Mobility Fabric which is part of Acropolis. Which in essence is next generation live migration, which allows for migration of VMs between hypervisors, you can see it here (

which is a one-click conversion!

they are also coming with a new build for their Controller OS –> and if you want to read more about Acropolis and capabilities in the current build you can read more here –>

this video also goes trough some of the capabilities

So who is tagging along with this ?

Dell which has their own OEM version which is known as XC-series posted a blog about the upcoming features and the release of GPU based series –>

Citrix also tagged along, writing about the partnership and integrations with Nutanix –>

and of course Microsoft where Vijay Tewari (Which is the PM for the CPS solution as well as Private Cloud solution at Microsoft, who was one of the keynote speakers at the event. Also showing that Nutanix and Hyper-V are gaining traction –>

They also announced some new capabilities with Microsoft –>

  • Connectivity to Microsoft Azure for backup
  • Microsoft-supported in-guest iSCSI storage adapter for Exchange Server on vSphere
  • Nutanix Acropolis Hypervisor validated for Microsoft Server Virtualization Validation Program

So you want to test this out ? Well you can now, since the Nutanix Community Edition is now free and you can download it here –>

I’ve been so lucky to been part of the Community beta and I can say it works really well, and with this announcements I now why it only works with KVM Smilefjes

and don’t worry you can run it nested if you want to try it out without getting the required hardware –>

So will you tag along ?

(So on a side note, I asked them what type of stuff they are giving their developers ? )