Product Documentation

Amazon Web Services virtualization environments

Sep 27, 2017

This article walks you through setting up your Amazon Web Services (AWS) account as a resource location you can use with the XenApp and XenDesktop Service. The resource location includes a basic set of components, ideal for a proof-of-concept or other deployment that does not require resources spread over multiple availability zones. After you complete these tasks, you can install VDAs, provision machines, create machine catalogs, and create Delivery Groups. 

NOTE: As an alternative to completing the setup tasks described in this article, you can use Citrix Smart Tools. See the Get Started with AWS guide. That guide takes you through the steps to:

  • Create an AWS account and create appropriate access keys.
  • Subscribe to NetScaler VPX in the Amazon Marketplace.
  • Use Smart Tools to configure and deploy machines in the new resource location.

When you complete the tasks in this article, your resource location will include the following components:

  • A virtual private cloud (VPC) with public and private subnets inside a single availability zone.
  • An instance that runs as both an Active Directory domain controller and DNS server, located in the private subnet of the VPC.
  • Two domain-joined instances on which the Citrix Cloud Connector is installed, located in the private subnet of the VPC.
  • An instance that acts as a bastion host, located in the public subnet of your VPC. This instance is used to initiate RDP connections to the instances in the private subnet for administration purposes. After you finish setting up your resource location, you can shut down this instance so it is no longer readily accessible. When you need to manage other instances in the private subnet, such as VDA instances, you can restart the bastion host instance.

Task overview

Set up a virtual private cloud (VPC) with public and private subnets. When you complete this task, AWS deploys a NAT instance with an Elastic IP address in the public subnet, which enables instances in the private subnet to access the Internet. Instances in the public subnet are accessible to inbound public traffic while instances in the private subnet are not.

Configure security groups. Security groups act as virtual firewalls that control traffic for the instances in your VPC. You will add rules to your security groups that allow instances in your public subnet to communicate with instances in your private subnet. You will also associate these security groups with each instance in your VPC.

Create a DHCP options set. With an Amazon VPC, DHCP and DNS services are provided by default, which affects how you configure DNS on your Active Directory domain controller. Amazon’s DHCP cannot be disabled and Amazon’s DNS can be used only for public DNS resolution, not Active Directory name resolution. To specify the domain and name servers that should be handed to instances via DHCP, you create a new DHCP options set. The set assigns the Active Directory domain suffix and specifies the DNS server for all instances in your VPC. To ensure Host (A) and Reverse Lookup (PTR) records are automatically registered when instances join the domain, you configure the network adapter properties for each instance you add to the private subnet.

Add a bastion host, domain controller, and Citrix Cloud Connectors to the VPC. Through the bastion host, you can log on to instances in the private subnet to set up the domain, join instances to the domain, and install the Citrix Cloud Connector.

Task 1: Set up the VPC

  1. From the AWS management console, click VPC.
  2. From the VPC Dashboard, click Start VPC Wizard.
  3. Select VPC with Public and Private Subnets and then click Select.
  4. Enter a VPC name and change the IP CIDRE block and Public and Private subnet IP ranges, if necessary.
  5. If a NAT gateway is selected, click Use a NAT Instance instead.
  6. For the NAT instance, specify the instance type and the key pair you want to use. The key pair enables you to securely connect to the instance at a later time.
  7. In Enable DNS hostnames, leave Yes selected.
  8. Click Create VPC. AWS creates the public and private subnets, Internet gateway, route tables, and default security group. Also, a NAT instance is created and assigned an Elastic IP address.

Task 2: Configure security groups

This task creates and configures the following security groups for your VPC:

  • A security group for the NAT instance.
  • A public security group, with which instances in your Public subnet will be associated.
  • A private security group, with which instances in your Private subnet will be associated.

To create the security groups

  1. From the VPC Dashboard, click Security Groups.
  2. Create a security group for the NAT instance: Click Create Security Group and enter a name tag and description for the group. In VPC, select the VPC you created earlier. Click Yes, Create.
  3. Repeat Step 2 to create a public security group and a private security group.

Configure the NAT security group

STEP 1. From the security group list, select the NAT security group.

STEP 2. Click the Inbound Rules tab and click Edit to create the following rules:

Type Source

ALL Traffic

Select the Private security group.

22 (SSH)

0.0.0.0/0

STEP 3. When finished, click Save.

Configure the Public security group

STEP 1. From the security group list, select the Public security group.

STEP 2. Click the Inbound Rules tab and click Edit to create the following rules:

Type Source

ALL Traffic

Select the Private security group.

ALL Traffic

Select the Public security group.

ICMP

0.0.0.0/0

22 (SSH)

0.0.0.0/0

80 (HTTP)

0.0.0.0/0

443 (HTTPS)

0.0.0.0/0

1494 (ICA/HDX)

0.0.0.0/0

2598 (Session Reliability)

0.0.0.0/0

3389 (RDP)

0.0.0.0/0

STEP 3. When finished, click Save.

STEP 4. Click the Outbound Rules tab and click Edit to create the following rules:

Type Destination

ALL Traffic

Select the Private security group.

ALL Traffic

0.0.0.0/0

ICMP

0.0.0.0/0

STEP 5. When finished, click Save.

Configure the private security group

STEP 1. From the security group list, select the Private security group.

STEP 2. Click the Inbound Rules tab and click Edit to create the following rules:

Type Source

ALL Traffic

Select the NAT security group.

ALL Traffic

Select the Private security group.

ALL Traffic

Select the Public security group.

ICMP

Select the Public security group.

TCP 53 (DNS)

Select the Public security group.

UDP 53 (DNS)

Select the Public security group.

80 (HTTP)

Select the Public security group.

TCP 135

Select the Public security group.

TCP 389

Select the Public security group.

UDP 389

Select the Public security group.

443 (HTTPS)

Select the Public security group.

TCP 1494 (ICA/HDX)

Select the Public security group.

TCP 2598 (Session Reliability)

Select the Public security group.

3389 (RDP)

Select the Public security group.

TCP 49152-65535

Select the Public security group.

STEP 3. When finished, click Save.

STEP 4. Click the Outbound Rules tab and click Edit to create the following rules:

Type Destination

ALL Traffic

Select the Private security group.

ALL Traffic

0.0.0.0/0

ICMP

0.0.0.0/0

UDP 53 (DNS)

0.0.0.0/0

STEP 5. When finished, click Save.

Task 3: Associate the NAT instance with the NAT security group

  1. From the AWS management console, click EC2.
  2. From the EC2 Dashboard, click Instances.
  3. Select the NAT instance and then click Actions > Networking > Change Security Groups.
  4. Clear the default security group check box.
  5. Select the NAT security group you created earlier and then click Assign Security Groups.

Task 4: Launch instances

The following steps create four EC2 instances and decrypt the default Administrator password that Amazon generates.

STEP 1. From the AWS management console, click EC2.

STEP 2. From the EC2 Dashboard, click Launch Instance.

STEP 3. Select a Windows Server machine image and instance type.

STEP 4. On the Configure Instance Details page, enter a name for the instance and select the VPC you set up earlier.

STEP 5. In Subnet, make the following selections for each instance:

  • Bastion host: Select the Public subnet.
  • Domain controller and Connectors: Select the Private subnet.

STEP 6. In Auto-assign Public IP address, make the following selections for each instance:

  • Bastion host: Select Enable.
  • Domain controller and Connectors: Select Use default setting or Disable.

STEP 7. In Network Interfaces, enter a primary IP address within the IP range of your private subnet for the domain controller and Cloud Connector instances.

STEP 8. On the Add Storage page, modify the disk size, if necessary.

STEP 9. On the Tag Instance page, enter a friendly name for each instance.

STEP 10. On the Configure Security Groups page, select Select an existing security group and then make the following selections for each instance:

  • Bastion host: Select the Public security group.
  • Domain controller and Cloud Connectors: Select the Private security group.

STEP 11. Review your selections and then click Launch.

STEP 12. Create a new key pair or select an existing one. If you create a new key pair, download your private key (.pem) file and keep it in safe place. You will need to supply your private key when you acquire the default Administrator password for the instance.

STEP 13. Click Launch Instances. Click View Instances to display a list of your instances. Wait until the newly-launched instance has passed all status checks before accessing it.

STEP 14. Acquire the default Administrator password for each instance:

  1. From the instance list, select the instance and then click Connect.
  2. Click Get Password and supply your private key (.pem) file when prompted.
  3. Click Decrypt Password. AWS displays the default password.

STEP 15. Repeat Steps 2-14 until you have created four instances: a bastion host instance in your public subnet and three instances in your private subnet that for use as a domain controller and two Cloud Connectors.

Task 5: Create a DHCP options set

STEP 1. From the VPC Dashboard, click DHCP Options Sets.

STEP 2. Enter the following information:

  • Name tag: Enter a friendly name for the set.
  • Domain name: Enter the fully qualified domain name you will use when you configure the domain controller instance.
  • Domain name servers: Enter the private IP address you assigned to the domain controller instance and the string AmazonProvidedDNS, separated by commas.
  • NTP servers: Leave this field blank.
  • NetBIOS name servers: Enter the private IP address of the domain controller instance.
  • NetBIOS node type: Enter 2.

STEP 3. Click Yes, Create.

STEP 4. Associate the new set with your VPC:

  1. From the VPC Dashboard, click Your VPCs and then select the VPC you set up earlier.
  2. Click Actions > Edit DHCP Options Set.
  3. When prompted, select the new set you created and then click Save.

Task 6: Configure the instances

STEP 1. Using an RDP client, connect to the public IP address of the bastion host instance. When prompted, enter the credentials for the Administrator account.

STEP 2. From the bastion host instance, launch Remote Desktop Connection and connect to the private IP address of the instance you want to configure. When prompted, enter the Administrator credentials for the instance.

STEP 3. For all instances in the private subnet, configure the DNS settings:

  1. Click Start > Control Panel > Network and Internet > Network and Sharing Center > Change adapter settings. Double-click the network connection displayed.
  2. Click Properties, select Internet Protocol Version 4 (TCP/IPv4), and then click Properties.
  3. Click Advanced and then click the DNS tab. Ensure the following settings are enabled and click OK:

Register this connection’s addresses in DNS
Use this connection’s DNS suffix in DNS registration

STEP 4. To configure the domain controller:

  1. Using Server Manager, add the Active Directory Domain Services role with all default features.
  2. Promote the instance to a domain controller. During promotion, enable DNS and use the domain name you specified when you created the new DHCP options set. Restart the instance when prompted.

STEP 5. To configure the first Cloud Connector:

  1. Join the instance to the domain and restart when prompted. From the bastion host instance, reconnect to the instance using RDP.
  2. Log on to Citrix Cloud. Select Resource Locations from the upper left menu.
  3. Download the Cloud Connector.
  4. When prompted, run the cwcconnector.exe file and supply your Citrix Cloud credentials. Follow the wizard.
  5. When finished, click Refresh to display the Resource Locations page. When the Cloud Connector is registered, the instance appears on the page.

STEP 6. Repeat Step 5 to configure the second Cloud Connector.

Create a connection

When you  ceate a connection using the XenApp and XenDesktop Service management console:

  • You must provide the API key and secret key values. You can export the key file containing those values from AWS and then import them. You must also provide the region, availability zone, VPC name, subnet addresses, domain name, security group names, and credentials.
  • The credentials file for the root AWS account (retrieved from the AWS console) is not formatted the same as credentials files downloaded for standard AWS users. Therefore, XenApp and XenDesktop management cannot use the file to populate the API key and secret key fields. Ensure that you are using AWS IAM credentials files.

More information