VMware vSphere

To install the App Layering service, you deploy the appliance to a virtual machine on your hypervisor.


The App Layering appliance requires the following virtual machine settings, vSphere requirements, and vCenter permissions.

Virtual machine settings

When you create the appliance’s virtual machine, it requires:

  • 4 CPUs
  • 8 GB RAM

VMware vSphere requirements

To install the App Layering appliance in a VMware vSphere environment, you need to meet the following:

  • A supported version of VMware vSphere.

  • A virtual network in vSphere.

  • vCenter account and privileges.

    You need a vCenter account with permissions on a datacenter for:

    • Creating and removing virtual machines.
    • Creating, copying, and removing virtual machine disks.

    Additionally, the account needs this permission at the vCenter level:

    • Removing virtual machines from inventory.

    For details on the permissions, see the table below.

  • The Role for App Layering that would be applied to the datacenter.

    To set up a new role:

    1. In the vSphere Client, navigate to Home > Administration > Roles.
    2. Click Add Role.
    3. Enter a name. For example: CALAdmin.
    4. Set the privileges for the account.
  • Privileges defined for the vCenter role that you’re using for the App Layering service. You must apply the role that you just created to the DataCenter that you are going to use for App Layering. For details on the permissions, see the table below.

    1. Open the Assign Permissions window.
    2. In the vSphere Client, navigate to Home > Inventory > Hosts and Clusters.
    3. Select your DataCenter and then right-click,and select Add permission.
    4. In the Assign Permissions window, under Assigned Role, expand All Privileges.
    5. Select the permissions listed below, make sure that the Propogate to Child Objects check box is selected and then click OK.
  • The App Layering role must be assigned to the administrator account, as follows:

    1. Add the administrator account and then assign the App Layering role to it.
    2. Allow the permissions to propagate to the entire Datacenter.

      Note: If you want to restrict this user from accessing specific folders in the Datacenter, grant the user more restrictive permissions for those folders.

  • Because the Virtual Machine > Inventory > Remove permission must be assigned at the vCenter level, you must create a second role.

    1. In the vSphere Client, navigate to Home > Administration > Roles.
    2. Click Add Role, and enter a name, for example: CALAdmin-vmremove.
    3. Add only Virtual Machine > Inventory > Remove. Everything else can remain read-only.
    4. In the vSphere Client, navigate to Home > Inventory > Hosts and Clusters.
    5. Select the vCenter Permissions tab, right-click, and select Add permission (or modify the permissions on an existing account).


      Make sure this is the same account that has the Datacenter permissions set above.

    6. Select the new CALAdmin-vmremove role you just defined. Make sure the the Propagate to Child Objects check box is selected and then click OK.


      You can also set all permissions at the vCenter level if your security policy allows this, instead of splitting permissions like this.

vCenter permissions

Expand All Privileges, then each of the following permissions categories, and select the required permissions.


The Host.Configuration.System Management permission is no longer required as of release 19.11.


  • Allocate space
  • Browse datastore
  • Low level file operations


  • Create folder


  • Cancel task


  • Assign network


  • Assign virtual machine to resource pool


  • Export
  • Import

Virtual machine > Configuration

  • Add existing disk
  • Add new disk
  • Add or remove device
  • Advanced
  • Change CPU count
  • Change resource
  • Memory
  • Modify device settings
  • Remove disk
  • Rename
  • Set annotation
  • Settings
  • Upgrade virtual machine compatibility

Virtual machine > Interaction

  • Configure CD media
  • Console interaction
  • Device connection
  • Power off
  • Power on
  • Reset
  • VMware Tools Install

Virtual machine > Inventory

  • Create from existing
  • Create new
  • Remove

Virtual machine > Provisioning

  • Clone template (optional, but required to use a vSphere template as the source virtual machine)
  • Clone virtual machine

Virtual machine > Snapshot management

  • Create snapshot

Install the App Layering appliance in VMware vSphere

To deploy the App Layering appliance to vSphere:

  • Make sure that you have the vSphere requirements.
  • Familiarize yourself with the contents of the installation package.
  • Deploy the appliance.

Installation package

The installation package, citrix_app_layering_vmware_4.x.x, includes:

File Description
vmware_x.x.x.ova OVA file for the appliance VM
citrix_app_layering_agent_installer.exe App Layering Agent installer
citrix_app_layering_os_machine_tools.exe OS Machine Tools

Deploy the appliance

  1. Extract the download package, citrix_app_layering_vmware_4.x.x.zip. The files included are listed at the beginning of this topic.
  2. Extract the vmware_4.x.xx.ova to a folder on your local drive.
  3. In the vSphere Web Client you are using, navigate to the VMs and Templates page.
  4. Right-click the folder in vSphere where you want to deploy the template and select Deploy OVF Template. The Deploy OVF Template wizard appears.
  5. In the Deploy OVF Template wizard, do the following:
    1. On the Select source page, select the Local file option, and browse to the vmware_x.x.x.ova file to select it.
    2. On the Select name and folder page, designate a name and location for the deployed OVF template.
    3. On the Select a resource page, select a location to run the deployed OVF template.
    4. On the Select storage page, select the Thick Provision Lazy Zeroed setting of the Select virtual disk format option, select a storage policy, and specify a storage location.
    5. On the Setup networks page, select your vSphere virtual network in the Destination column and select the IPv4 setting of the IP protocol option.
    6. On the Ready to complete page, review the template settings and then click Finish when you are satisfied with the settings.

If the appliance needs a Static IP address

You can change the appliance’s IP address and its DNS servers. When the appliance is first deployed, the DNS settings are retrieved through DHCP. If DHCP is not available and you will be using static IP addresses, once you select Static, you are prompted to enter the IP addresses for your DNS servers.

  1. Log in to the Appliance Configuration utility, using the steps and default password described in Appliance settings.
  2. At the Action prompt, enter C (for Configure Networking), and press Return.
  3. At the next prompt, type D for Dynamic (DHCP) or S for Static. If you choose Static, you will be prompted for the IP address and Subnet mask, along with default addresses for the Gateway and DNS addresses.
  4. When prompted, enter Y to save settings.
  5. At the Action prompt, enter Q to quit.
  6. Restart the appliance.

Next steps

Once the appliance is installed and the IP address is configured as you want it to be, you can install the App Layering agent, and configure the App Layering service: