Jekyll2025-08-18T21:50:25+00:00https://leeejeffries.com/feed.xmlLeee Jeffries - Technical BlogTechnical blog covering Citrix, Microsoft, PowerShell, and enterprise IT solutions.Leee JeffriesControl Microsoft Teams MSIX Startup Launch with the Windows Registry2024-09-15T00:00:00+00:002024-09-15T00:00:00+00:00https://leeejeffries.com/control-appx-and-msix-applications-startup-launch

You’re probably in a position where you are moving to Windows 11 or a later operating system, maybe using Teams v2 and you’re wondering how to wrangle these new package formats into submission in the same way you’ve been doing for years. Specifically I’m referring to the ability to control if an application starts up on user login or not; this can be critical for a VDI admin to control what starts up when a user logs in, especially if its a published application.

Microsoft now have a couple of different application formats, namely AppX and MSIX. These two formats are fundamentally different from MSI’s and EXE’s. If you’ve moved up to the new team client, this is now published as an MSIX package, controlling the auto-run of this application on startup is no longer managed by the traditional methods that you’re used to.

• Run keys in the registry
• The startup folder in the start menu
• A scheduled task

MSIX applications can be packaged with an option to allow a startup on login action, not all applications have this, but the new teams does. There is a new way of managing the startup of teams. There is a new registry location:

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe

A new key is created under this location TeamsTfwStartupTask with the value of State either equalling 1 or 2.

• 1 = Disabled (will not run on user logon)
• 2 = Enabled (will run on user logon)

I found this by using procmon, I’m sharing the process just incase you need to do this with other applications.

Fire up procmon and start a capture. Open the new system settings dialog and navigate to the “Apps” section.

Filter down on teams.

Select “Advanced options” on the teams app, using the 3 little dots.

You are then presented with the details of the app, scroll down until you see “Runs at log-in”

Toggle the “Runs at log-in” option a few times to generate some events in procmon.

Head back over to procmon and stop the capture. Find “SystemSettings.exe” in the process list. Right click this process and add it as a filter.

That will narrow down the options for you to filter through. Now select the “filter” option.

Add a new filter for the Path column contains “Team”

This will filter down to just a few options.

You can see here that the registry value being populated is the one I referenced above.

You can take this registry value and set this with whatever management system you use to control the launch behaviour of teams v2.

]]>Leee JeffriesPublish Teams using MSIX Application Packages with Citrix Virtual Apps and Desktops2024-05-10T00:00:00+00:002024-05-10T00:00:00+00:00https://leeejeffries.com/citrix-and-msix-applications

You might have heard about a little known application packaging format called MSIX, this is the latest format for application delivery that supports isolation and virtualisation; the last incarnation was App-V and that was around for a number of years.

In my experience, organisations are sturggling with the process of adopting MSIX as the primary method for delivering applications for several different reasons.

• Knowledge of MSIX and what it means
• Time in repackaging applications
• Lack of vendor support for MSIX

If you are getting started with MSIX application deployment then you need to review this article in full, the link below which includes a good introduction to all topics and then at the end, the troubleshooting tips useful when MSIX packages are not playing nicely.

Managing Your MSIX Deployment and Troubleshooting

Citrix and MSIX

Citrix has long been a very popular application and desktop delivery technology, a lot of organisations are using Citrix to provide access securely to internal applications securely. Citrix has supported publishing App-V packages for a long time, MSIX was added relatively recently which enabled MSIX package to be published applications. With the latest release of CVAD 2402, MSIX applications can now be deployed to users utilising Citrix published desktops also.

When a user logs into the published desktop, the MSIX applications are installed and registered for the users. Citrix supports both MSIX and MSIX App-Attach also, these two formats can be stored on a network share that is visible to the virtual machines with the Virtual Delivery Agent installed (VDA).

I’ve provided a quick demo video so you can see what this looks like from an administrative standpoint and also an end-use point-of-view during the logon process.

iframe

Administrative Tasks

In order to fully publish an MSIX application the steps are as follows:

• Add the MSIX package to the network share
• Access Citrix Web Studio (If you are unsure what Web Studio is, check it out)
• Browse to App Packages
• Add a Network Share
• Scan the Network Share
• Assign the discovered application to a Delivery Group
• Apply visibility settings to the application

Open Web Studio, select “App Packages” on the left-hand navigation menu.

Select the “Sources” tab, Add a new source.

Add the name of the location, select a delivery group to assign it to, Select “Network Share”, populate the UNC path of the share, select MSIX or your appropriate package type and select “Add Source”

The network location will automatically be scanned and any packages be assigned to the delivery group selected.

By default the applications are assigned to all users, you can limit visibility to specific users if required.

Select “Applications” from the left-hand side navigation menu.

Right-Click the application and select “Properties”.

Select “Limit Visibility” on the left-hand side of the application properties window.

Select the “Limit Visibility” option and then “Add” to add a user group or selected users only.

Teams 2.0 and Citrix

The new Microsoft Teams application is now delivered as an MSIX package, this means that you must be running a supported version of Windows in order to be able to deliver Teams to users.

Currently supported Operation Systems can be found here:

MSIX Features and Support Platforms

Note: Windows Server 2016 is not supported, this is due to the fact that there is no MSIX support within this version Windows and Microsoft have not supplied an alternatve package format for installation. I did try running Teams 2.0 using MSIX Core but this unfortunately does not seem to work. What it did highlight is that I need to learn more about the MSIX format.

Using the method I detail in this article, you’re able to publish teams directly into users Desktops. Bear in mind that you still require any prerequisites, this includes the WebView2 runtime.

For instructions on manually installing Teams you can find details here:

Deploying Teams 2.0 on VDI

You might be wondering why I looked at this method? Well.. I installed teams as per MS instructions on Server 2022 and had no issues, I did the same on Server 2019 and it simply did not work. I was really please to see Citrix providing an option for their customers that enables and instant solution for delivery.

In that vein there is more good news! Citrix is ahead of the curve with regards to their Profile Management solution supporting Teams 2.0 and also the Teams 2.1 optimisation technology that will be released soon. See more information about all of this here:

Teams 2.1 Support for VDI and DaaS

Sizing and Performance

Being a techie, I now want to understand how this sort of solution for delivering MSIX Apps scales. We’re using a network location in order to store these packages, these are attached when a user logs in; my assumption here would be, if the fileshare is struggling to handle requests the application will launch more slowly or the logon will be slowed.

I’ll be performing some testing on scalability figures for this feature and trying to produce some IOPs sizing calculations. Keep your eyes peeled for this and thanks for reading.

]]>Leee JeffriesLiquidware CommandCTRL - What is it all about?2023-12-10T00:00:00+00:002023-12-10T00:00:00+00:00https://leeejeffries.com/liquidware-command-CTRL

There are many monitoring solutions within the End User Computing space with many vendors competing for a slice of the “monitoring” pie.

Liquidware’s CommandCTRL was announced as generally available on August 21, 2023. This release marked the product’s transition from a beta phase to full availability for users, signifying its readiness for wider deployment in end-user computing environments

Licensing

Liquidware offers different licensing options to cater to various needs. One notable option is the CommandCTRL Community Edition, which is a free version designed for limited personal use. This edition provides access to many of the powerful features found in the premium edition but is limited to a 5-machine license. This version is ideal for optimizing a small group of workspaces and includes a 24-hour window of Windows telemetry data retention with the CommandCTRL DVR feature. The Community Edition is particularly suitable for lab use.

For broader organizational needs or more extensive deployment, CommandCTRL offers a standard version available through a SaaS model. This version is ideal for businesses and larger environments requiring real-time metrics, diagnostics, and remediation capabilities across multiple workspaces. The standard edition is available for a 15-day trial, allowing organizations to evaluate the software before making a purchase decision.

Features

• Real-Time Metrics and Remediation
  • CommandCTRL provides real-time metrics for CPU, memory, disk, and network usage, as well as identity, location and Wi-Fi. This aids in expediting the troubleshooting of end-user experience.
• DVR-like Playback Mode
  • The DVR-like playback feature captures up to 30 days of history (24 hours for community edition), enabling administrators to review past events and metrics at specific dates and times. This is very useful in the information gathering phase of any troubleshooting.
• Process Identification with ChatGPT Integration
  • The integration with ChatGPT AI assists in identifying processes, helping users quickly understand the purpose and origin of unfamiliar processes consuming system resources.
• Protocol Mirroring
  • This feature provides the ability to view and compare metrics for the local endpoint and the cloud desktop simultaneously.
• Ease of Deployment and Use
  • Being a SaaS solution, CommandCTRL requires no additional infrastructure, is quick to set up, and can be accessed from anywhere with a browser, making it highly scalable and user-friendly.
• Non-Intrusive Operations
  • CommandCTRL enables actions like terminating rogue processes or managing services directly from the console without interrupting the end user. It also offers capabilities like opening a PowerShell, CMD, or Bash session remotely.
• Advanced Troubleshooting Tools
  • Features like built-in Quick Assist, Remote Assistance, and Teleconferencing options facilitate deeper engagement when necessary, without compromising the user’s experience.

There are a few more features to list, these are the stand-out features for me.

Getting Started

Getting started with CommandCTRL is pretty easy.

Sign Up

• Visit Liquidware and select “Sign Up”
• Fill in your email and select Register
• You’ll receive and email, just follow the prompts from there
• The process is simple and painless

Deploy the agent

The CommandCTRL agent can be deployed to any Windows or MAC endpoint. I’m focusing on Windows endpoints because I don’t own a MAC.

• Scroll to the “Miscallaneous” section on the left-hand navigation bar
• Select “Install Agent”
• Select “Download Agent”
• Select “copy” on the code snippet section
• Jump into the folder you downloaded the agent to
• Hold shift, right click in some free space, Select “Open in Terminal” (Or similar)
• Paste the command from CommandCTRL

This will install the agent and after around a minute or so, your machine will appear in the portal.

In an enterprise environment you can deploy from a file share very easily by using a scripted approach, amending the command line to point to the CommandCTRL installer on a fileshare.

Machines

To see your inventory of machines where your agent is deployed, just select “Machines” from the left-hand navigation.

I have a few lab VMs and then my laptop added here. I can click into any of these machines to see an overview of real time statistics.

Monitoring and Management

You can see, I have a nice overview of all the statistics about my laptop, CPU usage, Memory Usage, Disk Space, Battery Life, Network Bandwidth, GPU utilisation.

The cool piece, I am RDP’ed to DC-01 in my lab, CommandCTRL links the connection, as its also monitoring DC-01 and its able to give me metrics from both sides. This is the “ Protocol Mirroring” feature I talk about earlier.

Red tiles are deemed “bad” and they are the ones you need to focus on.

Selecting, “Processes” from the left-hand navigation gets you a view of all processes running on the machine. You can also kill processes from here.

Selecting “Services” from the left-hand navigation shows a list of all services on the machine, these can be started and stopped from here.

Selecting “Performance” from the left-hand navigation shows a dashboard for key performance indicators, CPU, Memory, Disk, GPU.

Selecting “Diagnostics” from the left-hand navigation shows several tools for common troubleshooting, Speedtest, Ping, Traceroute, Ipconfig, GPreport and Agent Logging. These items are particularly useful for non-intrusive user troubleshooting.

There are a few more actions for us to be able to interact with the machines being monitoring. You’ll see some icons right at the top of the screen. From left to right:

• View History

  • Lets you review the dashboard but in a historical way. You can loop back in time and review what was happening to the machine at an earlier point in time. A small animated image shows the process below.

• Shell

  • This opens a PowerShell connection so you can run commands and troubleshoot in this way also.

• Diagnostics

  • This was covered earlier, tools like ping and traceroute are available here.

• Scripts

  • Scripts will allow you to search within a library of pre-configured scripts. This will then be executed locally on the machine.

Scripts

Scripts are a huge way of managing environments in End User Computing, automation is key to building repeatable, reliable solutions. It comes as no surprise that CommandCTRL has a script library. Upload your own scripts here and then run them locally on your managed machines.

Navigate to “Scripts” in the left-hand navigation menu. You’ll be presented with the scripts library section.

You can see here, I’ve already added a “Get-ComputerInfo” script, uploading is a simple process, attach your ps1 file, fill in details and your done. The sorts of information you need to populate are, description of the scripts, instructions on how to use it, parameters that are required.

Note: Your script does need to be signed to work, alternatively - you can allow unsigned scripts

To allow unsigned scripts, navigate to “Tenant” in the left-hand side navigation menu. Select the “SITE” tab, you can then allow “Allow Agents to Hash Check if Script is Not Signed”.

Once you have uploaded a script you can run this on a Machine. All the results are stored for script runs, you can always go back to these results and review them.

To execute a script, I’ll navigate over to “Machines” using the left-hand navigation menu. Select the relevant machine, I’ve selected a VM in my lab. I’ll select scripts from the top of the screen,

You can now search for the script by starting to type the name.

You simply select “Submit” to run the script.

You can see the results of the script run.

Summary

CommandCTRL has some cool features, the ability to have this level of functionality without deploying any infrastructure and only deploying agents is a large benefit. I’m interested to see what features will be in the roadmap for the future.

]]>Leee JeffriesChecking prices for azure VMs with PowerShell2023-11-15T00:00:00+00:002023-11-15T00:00:00+00:00https://leeejeffries.com/checking-prices-for-azure-vms-with-powershell

If you are trying to add VM pricing into any of your PowerShell scripts or modules, here are a couple of PowerShell functions that will help.

PowerShell Functions

Here are two PowerShell functions that can help you get Azure VM pricing information:

Get-AzureVMPrice Function

Function Get-AzureVMPrice {
    [CmdletBinding()]
    Param(
        [Parameter(ValueFromPipeline, HelpMessage='The VM Sku to get prices for', Mandatory=$true)]
        [string]$vmSku,
        [Parameter(HelpMessage='The currency to report back', Mandatory=$true)]
        [string]$currencyCode,
        [Parameter(HelpMessage='Azure region to get prices for', Mandatory=$true)]
        [string]$region
    )

# Setup parameters
    $Parameters = @{
        currencyCode = $currencyCode
        '$filter' = "serviceName eq 'Virtual Machines' and armSkuName eq `'$vmSku`' and armRegionName eq `'$region`' and type eq 'Consumption'"
    }

# Make a web request for the prices
    try {
        $request = Invoke-WebRequest -UseBasicParsing -Uri "https://prices.azure.com/api/retail/prices" -Body $Parameters -Method Get
        $result = $request.Content | ConvertFrom-JSON | Select-Object -ExpandProperty Items | Sort-Object effectiveStartDate -Descending | Select -First 1

$vmPrice = [PSCustomObject]@{
            SKUName = $($result.armSkuName)
            Region = $($result.armRegionName)
            Currency = $($result.currencyCode)
            Product_Name = $($result.productName)
            Price_Per_Minute = if ($($result.unitOfMeasure) -match 'Hour') {$($result.retailPrice)/60 } else { 0 }
            Price_Per_Hour = if ($($result.unitOfMeasure) -match 'Hour') { $($result.retailPrice) } else { 0 }
            Price_Per_Day = if ($($result.unitOfMeasure) -match 'Hour') { $($result.retailPrice) * 24 } else { 0 }
        }

if ([string]::IsNullOrEmpty($vmPrice.SKUName)) {
            Throw
        } else {
            Return $vmPrice
        }
    } catch {
        Write-Error "Error processing request, check the SKU and region are valid"
        Write-Error $_
    }
}

Get-AzureVMSKUs Function

Function Get-AzureVMSKUs {
    [CmdletBinding()]
    Param(
        [Parameter(HelpMessage='Azure region to get prices for', Mandatory=$true)]
        [string]$region
    )

# Setup parameters
    $Parameters = @{
        currencyCode = $currencyCode
        '$filter' = "serviceName eq 'Virtual Machines' and  armRegionName eq `'$region`' and type eq 'Consumption'"
    }

# Make a web request for the prices
    try {
        $request = Invoke-WebRequest -UseBasicParsing -Uri "https://prices.azure.com/api/retail/prices" -Body $Parameters -Method Get
        $result = $request.Content | ConvertFrom-JSON | Select-Object -ExpandProperty Items | Select-Object armSkuName

$SKUs = foreach ($item in $result) {
            $item.armSkuName
        }

Return $SKUs | Select-Object -Unique | Sort-Object
    } catch {
        Write-Error "Error processing request, check the region and currency are valid"
        Write-Error $_
    }
}

There are two functions here, they can be configured to feed into each other, we’ll take a look at that. Add the functions to your existing scripts or run the above script, this will load the Functions into memory. The two functions can be called independently and also chained together.

• Get-AzureVMSKUs - Gets a list of all Azure VM SKUs in a region
• Get-AzureVMPrice - Gets a price for a given VM SKU

Example Usage

Get All VM SKUs in a Region

Get-AzureVMSKUs -region uksouth

This will return a list of all available VM SKUs in the UK South region.

Get Pricing for a Specific VM

Get-AzureVMPrice -vmSku Standard_D2_v2 -region uksouth -currencyCode GBP

This will generate pricing information for a Standard_D2_v2 VM running in the UK South region in GBP currency.

Interactive Selection with Out-GridView

You can chain these functions together to make it interactive using Out-GridView:

Get-AzureVMSKUs -region uksouth | Out-GridView -PassThru | Get-AzureVMPrice -currencyCode GBP -region uksouth

This allows you to select a VM SKU from a grid view and automatically get the pricing information.

I hope someone else finds this useful.

]]>Leee JeffriesSMTP Properties will not load on server 2022 in IIS admin mmc snap-in2023-05-17T00:00:00+00:002023-05-17T00:00:00+00:00https://leeejeffries.com/smtp-properties-in-iisadmin-does-not-load-server-2022

If you’re like me, you like to keep your lab up to date and Server 2022 is on the list for upgrade. I like to be able to relay mail out of my lab for alerting and some scripting.

If you are getting the error, “MMC has detected an error in a snap-in. It is recommended that you shut down and restart MMC.” when you edit the properties of the SMTP Service; here is your solution:

• Stop SMTPSVC service [Display Name: Simple Mail Transfer\
• Protocol (SMTP)]
• Stop IISADMIN service [Display name: IIS Admin Service]
• Edit “C:\Windows\System32\inetsrv\MetaBase.xml”
• Find: <IIsSmtpServer Location =”/LM/SmtpSvc/1”
• Add (Settings are alphabetical): RelayIpList=””
• Save file
• Start IISAdmin Service
• Start SMTPSVC service

As long as the settings “RelayIpList” is present in the file you’ll be fine.

]]>Leee JeffriesChecking VMs in Azure for Hybrid License2022-11-08T00:00:00+00:002022-11-08T00:00:00+00:00https://leeejeffries.com/checking-vms-in-azure-for-hybrid-license

If you have on-prem windows server or desktop licenses, these licenses can be utilized in Azure to save yourself some money.

Here is a link that explains about this in detail.

Explore Azure Hybrid Benefit for Windows VMs - Azure Virtual Machines | Microsoft Learn

If you’ve been creating VM’s manually you may have missed this tick box, if its terraform then this is the line you are looking for, powershell also.

Azure:

Terraform:

resource "azurerm_virtual_machine" "my_virtual_machine" {
    name = "myvm"
    location = "location"
    resource_group_name = "group"
    network_interface_ids = ["id"]
    vm_size = "Standard_F2"
    license_type = "Windows_Server"
}

PowerShell:

New-AzVm -ResourceGroupName "myResourceGroup" `
-Name "myvm" `
-Location "UK South" `
-ImageName "Win2016Datacenter" `
-LicenseType "Windows_Server"

The license type parameter in both terraform and PowerShell is used to designate that you have a pre-existing license.

That being said, you’ve got a bunch of VM’s in Azure; how do you see which ones are using hybrid license rights and which ones are not?

Here’s a script for you; this script will run through all your VM’s find ones without a hybrid license assigned and then give you the option to select the VMs and apply a hybrid license to them.

The only draw-back to this script is that it’s not always able to automatically discover which type of OS is running on the VM (depending on how the VM is built) and therefore I’ve left this section out. You need to make sure you are selecting server OSes for server hybrid licenses and Desktop Oses for client hybrid licenses.

#Loop through resource groups to find the VM
#Note - Only select server VMs when the variable for $license_type is set to server
#Note - Only select desktop VMs when the variable for $license_type is set to client
#Note - Setting $license_type to none will clear hybrid rights and make the VM PAYG

param (
    [Parameter(Mandatory)]
    [ValidateSet("server","client","none")]
    $license_type
)

#Login to Azure
if (!($azConnected)) {
    $azConnected = Connect-AzAccount
}

#Get all subscriptions available
$allSubscriptons = Get-AzSubscription
Write-Host "All subscriptions available"
Write-Host $allSubscriptons

#Loop through all subscriptions and hostpools looking for our wvd vm
$allSubscriptons = Get-AzSubscription
$vmDetails = foreach ($subscription in $allSubscriptons) {
$temp = Set-AzContext -Subscription $subscription.Name
$allResourceGroups = Get-AzResourceGroup
Write-Host "Searching subscription - $subscription"
foreach ($rg in $allResourceGroups) {
    Write-Host "Searching resource group $($rg.ResourceGroupName)"
    $vms = Get-AzVM -ResourceGroupName $($rg.ResourceGroupName) | Select Name, LicenseType, ResourceGroupName, Tags
    if ($vms) {
        foreach ($vm in $vms) {
            Write-Host "Looking at VM $($vm.Name)"
            [PSCustomObject]@{
                vmName = $vm.Name
                vmRG = $vm.ResourceGroupName
                vmSub = $subscription.Name
                vmLicense = $vm.LicenseType
                }
            }
        }
    }
}
$vmDetails | Export-Csv -Path "C:\\Temp\\VMs\_Licenses.csv" -NoTypeInformation
$selectedVMs = $vmDetails | ogv -PassThru
Switch ($license_type) {
    "server" {$licenseSet = "Windows\_Server"}
    "client" {$licenseSet = "Windows\_Client"}
    "none" {$licenseSet = ""}
}
Write-Host "License type selected and being applied to selected VM's is $licenseSet" -ForegroundColor Green
forEach ($vm in $selectedVMs) {
    Write-Host "Setting $($vm.vmName) to $licenseSet" -ForegroundColor Green
    $null = Set-AzContext -Subscription $vm.vmSub
    $tempVM = Get-AzVm -ResourceGroupName $vm.vmRG -Name $vm.vmName
    $tempVM.LicenseType = $licenseSet
    Update-AzVM -ResourceGroupName $vm.vmRG -VM $tempVM
}

]]>Leee JeffriesWindows 11 - Taskbar, Where has “Never-Combine” gone.2022-02-11T00:00:00+00:002022-02-11T00:00:00+00:00https://leeejeffries.com/windows-11-taskbar-where-has-never-combine-gone

Windows 11 is the latest and greatest desktop OS from Microsoft. We all know how Microsoft tends to inflict a good one, skip one type of mentality when it comes to adopting these OSes. That being said, I’ve jumped in as it doesn’t seem too far off Windows 10.

The Windows 10 start menu was fun enough with Tiles, and reconfiguring them, now our start menu floats in the centre of the screen by default. Do I like it? No, but as long as I can get on and be productive, I’m okay with adapting.

I’ve been using Windows 11 for about a month, and I had a spare few moments today, so I decided to check something that has been bugging me.

In Windows 10, you could do this:

All my app windows could be listed separately so that I can easily see what I’m clicking on.

In Windows 11, Microsoft has removed the option we used to have in the taskbar settings, so you cannot do this; instead, you are stuck with this monstrosity.

You have to hover over the icon to preview the windows and decide which one is the one you are looking for.

This may seem like a small thing, but in the grand scheme of things, it slows my work and brain processes down and generally irritates me a little every time I have to do it. My Garmin watch can testify to this; it records my stress levels and is higher since windows 11!

Anyway. Pay-for solutions will fix this issue for you, but I stumbled across this lovely little tool in a forum.

E xplorerPatcher

This little tool created by Gabriel Radu allows you to essentially hybrid the Windows 11 start menu and Windows 10 taskbar, so now I can have never combine again!

I thought I’d share this so that anyone with the same frustration can also return to their usual productive selves.

]]>Leee JeffriesCitrix SD-WAN - Public Cloud Network Mesh – Creating a Full Mesh (Part 6)2021-06-15T00:00:00+00:002021-06-15T00:00:00+00:00https://leeejeffries.com/citrix-sdwan-public-cloud-network-mesh-creating-a-full-mesh-part-6

So far in this series, we’ve set up the following:

• Citrix SDWAN – Public Cloud Network Mesh – Introduction (Part 1)
• Citrix SD-WAN – Public Cloud Network Mesh – Master Control Node (Part 2)
• Citrix SD-WAN – Public Cloud Network Mesh – Azure (Part 3)
• Citrix SD-WAN – Public Cloud Network Mesh – AWS (Part 4)
• Citrix SD-WAN – Public Cloud Network Mesh – GCP (Part 5)

These appliances have provided connectivity to my on-prem environment and allowed me to utilise my existing infrastructure and branch out my network. In addition, the flexibility to be able to add cloud services to your current lab setup is pretty great.

The whole point of this series was to provide a fully meshed network between your different cloud regions. In this series, I’ve selected to top 3 cloud service providers. The below diagram explains the overall layout.

Up to now, all routing would have forced communication from cloud providers through the On-Prem Master Control Node; we’re now going to make the SD-WAN appliances talk with all the other appliances in the different cloud environments.

In this blog, we’ll overview how to set up the routing, amending the SD-WAN network and testing the configuration.

Let’s take a look at our Virtual Paths under the Monitoring tab on the Master Control Node.

You can see here that connections are all up and running and in good condition. The MCN has a link to each site; it’s an intermediary node.

If we log in to the Azure appliance and check the same Monitoring tab, we see that this appliance only connects to the MCN node On-Prem.

We’re going to amend the config so that this node can talk to all the other cloud providers independently of the MCN.

I’m not going through a complete step-by-step in this guide as we’ve already covered a majority of the steps required in the previous articles.

Log in to your Master Control Node On-Prem and open the Configuration Editor; Import your very latest configuration and save it with a different revision ID.

Once you have it open – Navigate to the “Connections” tab, then select your On-Prem environment in the “Site” drop-down.

Select “Virtual Paths”.

You can see that the Home_Lab has three connections, Azure, AWS and GCP. We’re now going to change the site and add connections.

Change the “Site” drop-down to the Azure site. Then, select “Virtual Paths”.

You’ll see here that the drop-down only contains one site.

Select the “+ Virtual Path” button.

You will now be presented with a small popup showing the available options. First, select one of the other sites available.

Make sure you tick the “Reverse” box, which will make sure that the configuration is also applied in the opposite direction.

You will only see available connections. Select “Add” to create the link.

Repeat these steps for each site available to create a path from each node to each node.

All required now is to save your configuration, push it to “Change Management, “ and activate it.

The next step is routing; we need to make all the cloud providers aware of the IP ranges of all the other cloud providers.

Checking the interface on the Azure appliance after activating the config will show a path to all other cloud providers.

Azure Routing:

Hop onto your Azure portal and search for “Route Table”, find your SD-WAN LAN route table.

Select “Routes” on the left.

Select “Add” to add a route.

Here I am adding a route for the Google Cloud LAN subnet.

Note that I am sending the traffic to the LAN interface of the SD-WAN appliance in Azure.

Repeat this for the AWS subnet also.

AWS Routing:

Select “Network and Content Delivery”, “VPC” from the services drop-down.

Select “Route Tables” from the left-hand side.

Select your SD-WAN LAN route table.

Select “Edit Routes” on the right-hand side of the screen.

Add your Azure and GCP Routes – again, we direct the traffic to the LAN IP of the AWS SD-WAN appliance. Select “Save Changes”.

GCP Routing:

In the GCP portal, Select “Networking”, “VPC Network”, “Routes” from the drop-down service menu.

Select “Create Route” from the top of the screen.

Populate the relevant details and ensure it’s assigned to your SD-WAN LAN network. Select “Create” when you are done.

The below is an example for AWS. Repeat the step for Azure.

Results:

It’s essential to have some analysis on the before and after when we talk about this traffic efficiency.

Before we put the mesh in place, this is what the latency looked like.

The below depicts a traceroute from the Azure Appliance to the other locations.

You can see here that 192.168.2.10 is the intermediary hop point for all traffic, that the On-Prem SD-WAN instance.

Let’s see what it looks like when we’ve meshed the network.

You can see here that we’ve halved the time it takes for the different cloud providers to communicate with each other.

This sort of flexibility to create new pathways in your network with minimal effort is excellent. Citrix SD-WAN allows this all the be done with ease.

]]>Leee JeffriesCitrix SD-WAN – Public Cloud Network Mesh – GCP (Part 5)2021-06-14T00:00:00+00:002021-06-14T00:00:00+00:00https://leeejeffries.com/citrix-sd-wan-public-cloud-network-mesh-gcp-part-5[Citrix SDWAN – Public Cloud Network Mesh – Introduction (Part 1)](/content/citrix-sdwan-public-cloud-network-mesh-introduction-part-1/index.html) Citrix SD-WAN – Public Cloud Network Mesh – Master Control Node (Part 2) Citrix SD-WAN – Public Cloud Network Mesh – Azure (Part 3) Citrix SD-WAN – Public Cloud Network Mesh – AWS (Part 4) Citrix SDWAN – Public Cloud Network Mesh – Creating a Full Mesh (Part 6)

This post will follow on from the previous post; I already created the Master Control Node on-prem. If you’ve not yet set up the Master Control node, you will need to do this first.

Below is a diagram that shows the current progress of this blog series.

We need to do some infrastructure set-up before we can deploy SDWAN in GCP.

Firstly, we need to create a project to store our environment in.

From the top menu bar, select the little drop down arrow and then “New Project”.

Enter a name for your project and select “Create”.

We need to define our networks. Navigate through the Services drop-down and select “VPC network”, “VPC networks”.

You will need to configure the VPC in the same region to deploy the Citrix SD-WAN appliance.

Select “Create VPC Network” to get started.

We’ll need to create a VPC per type of network we want for the SD-WAN appliance. We will create a separate network for Management, LAN and then WAN traffic.

Fill in the name of the network, subnet range Mine is 12.0.1.0/24 for management, as listed above.

Select the network type as Regional. Select “Create” at the bottom of the page.

Repeat this exercise for the LAN (12.0.2.0/24) and WAN (12.0.3.0/24) subnets.

Select Regional as the network type.

Now we need to define some external addresses that will be attached to the appliance later.

Select “External IP addresses” from the left-hand menu.

Select “Reserve Statis Address” from the top menu bar.

Give the external IP address a name, we will need two. One for management and one for the WAN side of the SD-WAN appliance.

In my example this one is for WAN. Put your external IP in the same region as your VPC networks.

Select “Reserve”.

Repeat the same step for the management external IP.

We now have everything ready to create the instance. Select “VM instances” from the left-hand menu.

Select “Create Instance” from the top menu bar.

Select “Marketplace” as the option to find the machine to deploy.

Type “SD-WAN” in the search bar and then select “Citrix SD-WAN Standard Edition” as the model you wish to deploy.

You are given all the details about the template before deploying it. Make sure you double check you’re happy with the costs involved and select “Launch”.

Populare the deployment name and instance name, I went with the General-Purpose VM and google kindly calculates the cost right then in the window.

Make sure the region you select is the same and the VPC networks you deployed earlier. Attached the networks to the VPC’s you created earlier in order.

Make sure you tick “useEXNet” on each adapter.

Network 1 – Mananagement

Network 2 – LAN

Network 3 – WAN

Select “Deploy” at the bottom.

The appliance will begin to deploy. Wait for the process to proceed and take note of the details that appear on the right-hand side.

You will see here the connection details that are relevant to the appliance.

We’ll now assign our external IP to the WAN interface. Select the VM itself and we’ll edit the network adapters to assign the external IP’s we created earlier.

Select “Edit” in the top menu bar.

Scroll down to the network interface section. Select the little pencil icon for the WAN interface.

Under the “External IP” field, select the address you created earlier.

Scroll to the bottom of the screen and save your changes.

Now we’ll enable the external connectivity for the virtual tunnel service.

Select “VPC Network” from the services dropdown, select “Firewall”.

Select “Create Firewall Rule” from the top menu bar.

We are going to allow port 4980 in for Citrix SD-WAN to communicate with our MCN node.

Give the firewall rule a relevant name, fill in the same options as displayed below. Remember to assign this to the WAN Network you created earlier.

Select “Create” at the bottom of the page.

We will now add the necessary routes so that google knows where to send traffic for your MCN networks on-prem.

Select “Routes” from the left-hand side menu.

Select “Create Route” from the top menu bar.

Populate the IP range for your home network, the IP address for the next hop should be the internal IP of your LAN interface on the SD-WAN appliance.

My home networks are all contained within a 192.168.0.0/16 subnet so I am adding this here.

Select “Create”.

That concludes the setup of the virtual appliance in GCP. We’re now ready to start applying the Citrix SD-WAN configuration.

Navigating to the external address gives us the login page for the SDWAN device. https://34.78.9.184 in my example. Accept the certificate warning error.

Use the username for the device is “admin”, and the password pre-generated password that was provided once the appliance had finished provisioning (obviously, I will be changing the details of my environment as this is published publicly).

You are presented with some option now. We will need to get onto our on-prem MCN to create and download the configuration package for this node.

Before we proceed, I am going to navigate to my “Master Control Node” – in my lab I will login to the management page.

Navigate through the UI, “Configuration Tab” > “Virtual WAN – Side Menu” > “Configuration Editor”.

Select “Open” and then open the latest configuration available (should be 1.2 from the last post).

Now we will add another site – the GCP site. Select “Sites”, “+ Site”.

Fill out the details for your GCP VPX appliance. CPU and Memory, the import part is the model as that will dictate the options within the config editor.

Select “Add” once complete.

Select “Interface Groups” and then the “+” symbol to add an interface.

You will need to refer to your GCP Networking configuration for the VM during this next part of the work. Take a note of these settings.

The management interface is not shown within the UI of the configuration Editor, so interface 1 is the LAN configuration in GCP.

Select the “+” symbol in the top left to add an interface.

Select interface “1”, “Fail-to-Block”, and “Trusted” on the top row.

Select “+” next to “Virtual Interface” and give the interface a name.

Select “Apply”.

Now we will configure the WAN interface that will be used to create the secure tunnel to GCP.

Select the “+” symbol in the top left to add an interface.

Select interface “2”, “Fail-to-Block”, and “Untrusted” on the top row.

Select “+” next to “Virtual Interface” and give the interface a name.

Select “Apply”.

Select “Virtual IP Addresses” on the left-hand-side menu.

You will now assign an IP address for each of the interfaces.

Referring to the diagram above, I am using the planned IP addressing from this. I have allowed “Inband Mgmt” from the LAN interface, so I do not need the external IP in GCP all the time.

Click “Apply” when you have completed the IP configuration information.

Now select “WAN Links” on the left-hand-side menu.

We will not configure the WAN interface for the external connectivity.

Select “+ Link”, Select “Add”.

We can now specify the link speed; the WAN link can have “Autodetect Public IP” selected as it is a client node and not an MCN.

Fill in an accurate Upload and Download speed and tick “Autodetect Public IP”, select “Apply” at the bottom of the screen.

Now select “Settings” at the top of the window.

Select “Access Interfaces (IPV4)”.

Select the “+” symbol in the top left of the window.

We will now populate the details of the WAN outside and WAN inside link.

Place the same IP in as we did earlier for the WAN interface.

Select “Apply”.

The configuration should now be complete. We will run an Audit just to be sure all is well.

Select “Audit Now” at the bottom of the configuration editor.

If there are no errors or warnings, we have created the configuration for the GCP client node.

Select “Save As” at the very top of the configuration editor window.

Add V1.3 into the name; adding revision numbers to the configuration can make it easier when rolling out updates.

Select “Save”.

Now we will export the configuration to the Change Management function, this will provision a package that can be downloaded and applied to the client node.

Select “Export” at the very top of the configuration editor window.

Select “Change Management” and select “Export”.

Select the “Change Management” link that appears.

Select “Stage Appliances”

Wait until you see the completion screen. Select “Next”.

Select “Activate Staged”.

Wait for the configuration to activate. Select “Done” once this is complete.

Now we are ready to download the package for the GCP appliance.

Navigate through the UI, “Configuration Tab” > “Virtual WAN – Side Menu” > “Change Management”.

Select the “active” link on the right-hand side of the GCP-VPX row. Be patient; it can take a while for the download to start.

We now have a deployable configuration package for the GCP Appliance.

Let go back to the GCP appliance management interface.

**Remember your login address is https:// - Your login name is admin, and your password was provided on deployment of the instance.**

Select “Choose File” and upload the configuration file. Select “Upload and Install”.

Be very patient at this point; it will seem like nothing is happening as there is no progress bar. Please wait for the page to update on its own.

Depending on your plan selected, you may be using a BYOL option or a PAYG license. To license a BYOL model, just follow the necessary steps in the MCN article.

To verify connectivity; Navigate through the UI, “Monitoring Tab”.

You can see that basic connectivity is now established between my lab and GCP. I can ping the LAN IP address of the SDWAN device in GCP from my home network.

• 192.168.2.1 – Gateway of my main router
• 192.168.2.2 – Lab Router
• 192.168.1.70 – SDWAN LAB LAN IP
• 12.0.2.2 – GCP SDWAN LAN IP

That concludes the setup for the GCP SD-WAN device.

The following blog post will cover how we mesh all our network together with different cloud providers.

]]>Leee JeffriesCitrix SD-WAN – Public Cloud Network Mesh – AWS (Part 4)2021-06-09T00:00:00+00:002021-06-09T00:00:00+00:00https://leeejeffries.com/citrix-sd-wan-public-cloud-network-mesh-aws-part-4[Citrix SDWAN – Public Cloud Network Mesh – Introduction (Part 1)](/content/citrix-sdwan-public-cloud-network-mesh-introduction-part-1/index.html) Citrix SD-WAN – Public Cloud Network Mesh – Master Control Node (Part 2) Citrix SD-WAN – Public Cloud Network Mesh – Azure (Part 3) Citrix SD-WAN – Public Cloud Network Mesh – GCP (Part 5) Citrix SDWAN – Public Cloud Network Mesh – Creating a Full Mesh (Part 6)

This post will follow-on from the previous post; I already created the Master Control Node on-prem. If you’ve not yet set up the Master Control node, you will need to do this first.

Below is a diagram that shows the current progress of this blog series.

We need to do some infrastructure set-up before we can deploy SDWAN in AWS.

Firstly we need to define our networks. Login to your AWS Management Portal.

Navigate through the Services drop-down and select “VPC”.

You will need to configure the VPC in the same region to deploy the Citrix SD-WAN appliance.

Select VPCs to get started.

Select “Create VPC” in the top right.

We’ll now configure the main subnet block in AWS. This is shown in the diagram at the beginning of this article.

Enter a name and the network notation for your range in AWS. Mine is 11.0.0.0/16; we’ll then split this network into subnets for different uses.

Select “Create VPC” when you are finished.

You’ll now see your network created.

We now need an internet gateway. Select “Internet Gateways” from the left-hand-side menu.

Now select “Create Internet Gateway” from the top right.

Give this internet gateway a name and select “Create Internet Gateway”.

You’ll now see that created in the list, the next step is to attached this internet gateway to the network(VPC) we just created.

Select the “SDWAN_INTERNET” gateway and the “Actions”, “Attached to VPC”. Follow the prompts to attach it to your SDWAN subnet.

Navigate to “Subnets” on the left hand-side menu. Select “Create subnet” in the top right.

You’ll be presented with options to split the main network we created (the VPC) into smaller subnets.

I will repeat these steps to create 3 separate subnets:

• SDWAN_SN_LAN – 11.0.2.0/24
• SDWAN_SN_MGMT – 11.0.1.0/24
• SDWAN_SN_WAN – 11.0.3.0/24

As per the diagram above and previous article, 3 networks are required for the SDWAN appliance.

Now we need some route tables configured. Select “Route Tables” from the left-hand side menu.

Select “Create route table” from the top left.

A route table is required for each Subnet. Give the route table a name, in this example it’s the LAN route table. Enter the name and the VPC the route table relates to. Create all 3 route tables.

Now you should see all your routing tables, and we can apply them to Subnets. Select each route table individually in turn, select “Edit subnet associations”.

This example shows the MGMT Route table, so we’ll be selecting the “SDWAN_SN_MGMT” subnet. Select “Save” when complete.

Repeat this for each Route Table to align with each subnet.

We will come back later to add additional routes once our appliance is setup.

Select the “Services” drop-down and then “Compute” > “EC2”.

Select “Launch instance”

You can now search the Amazon Marketplace for a preconfigured appliance to launch.

Select “AWS Marketplace” on the left, Type “Citrix SD-WAN” in the search box. I am selecting “Citrix SD-WAN Standard Edition, Customer License” as I already have a license available.

Read and select “Continue” on the next screen.

I have selected the c5.xlarge instance as it’s the cheapest option for a lab environment. Select “Next: Configure Instance Details”

Now we’ll populate the options for the Virtual Machine.

• Instances should be set to 1 – we only need one appliance.
• Network – SDWAN
• Subnet – SDWAN_SN_MGMT (The management network needs to be out initial network we attach at VM creation)
• Auto-assign Public IP – Enable (This is so we can log in and manage the appliance when necessary)

An IP address should already be allocated for you. Select “Next: Add Storage” at the bottom of the screen.

Select the storage you wish to use; I went with general-purpose SSD disks. If AWS would be your master controller node, you would need to expand the hard disk up to 120GB.

Select “Review and Launch” at the bottom of the page.

Confirm all the details and select “Launch”.

Firewall rules are now displayed for review. No additions should be necessary at this stage. Select “Review and Launch”.

This next part is very important because this is how you will connect to the appliance via SSH.

Select “Download Key Pair” and keep this safe; we will come back to it later. Select “Launch Instances”.

After a little while, navigate back to your instances in AWS, and you should see your SDWAN appliance ready to rock. Select the “Instance ID” of the VM.

We have a few more steps to do now. We need to shut down the appliance, add some additional interface, assign a public IP to the WAN interface and then add additional routes for the appliance to be able to talk to our home networks.

Shut down the instance by selecting it and changing the instance state to “Stop Instance”.

Select “Network & Security” > “Network Interfaces”.

Now select “Create network interface” in the top right.

You will need to create a network interface for the LAN and WAN of the SD-WAN appliance.

Give the interface a name and assign it to a subnet; I have set a custom IP for mine to match the diagram at the beginning of the document.

Repeat for the WAN interface.

Now your interfaces are created, set the “Change source/dest check” so that AWS will allow the traffic to pass for subnets that it does not own.

Select each interface in turn and untick “Enable” on the Source/Destination check dialog box.

Now we will navigate back to “Instances” > “Instances” on the left-hand side menu. Select the SDWAN appliance, select “Actions”, “Networking”, “Attach network interface”.

Select the LAN and WAN network interfaces in order and select “Attach”.

Make a note of the WAN interface ID for later when we associate an elastic IP.

We will now allocate an elastic IP to the WAN interface of the SDWAN appliance. Select “Network & Security”, “Elastic IPs” from the left-hand side menu.

Select “Allocate Elastic IP address”.

Leave all the options as default and select “Allocate”.

Select the IP allocated and then select “Actions”, “Associate Elastic IP address”.

You will need the ID of the network adapter you remembered earlier, or you can work it out through the available IP addresses.

Select “Network interface”, Select the relevant network interface for the WAN and then the private IP Address (There should only be one available).

Select “Associate”.

We are almost complete with the setup here; we now need to add some routes to tell Amazon where to route our traffic.

Select “Route Tables” from the left-hand side menu.

You’ll see a list of all the route tables. Select the MGMT route table, select “Edit routes”.

You need to add a route to your MCN network. Mine is 192.168.0.0/16; assign this to the LAN network interface of the SDWAN device. And select “Save Routes”. Repeat this for the LAN interface also.

This will ensure, any machines in AWS on the LAN subnet will forward traffic to the SDWAN device; the virtual tunnels created between sites will then be used to route the traffic.

Navigating to the external address gives us the login page for the SDWAN device. https://3.11.187.154 in my example. Accept the certificate warning error.

Use the username for the device is “admin”, and the password is the instance id of the interface (obviously, I will be changing the details of my environment as this is published publicly).

You are presented with some option now. We will need to get onto our on-prem MCN to create and download the configuration package for this node.

Before we proceed, I am going to navigate to my “Master Control Node” – in my lab I will login to the management page.

Navigate through the UI, “Configuration Tab” > “Virtual WAN – Side Menu” > “Configuration Editor”.

Select “Open” and then open the latest configuration available (should be 1.1 from the last post).

Now we will add another site – the AWS site. Select “Sites”, “+ Site”.

Fill out the details for your AWS VPX appliance. CPU and Memory, the import part is the model as that will dictate the options within the config editor.

Select “Add” once complete.

Select “Interface Groups” and then the “+” symbol to add an interface.

You will need to refer to your AWS Networking configuration for the VM during this next part of the work. Take a note of these settings.

The management interface is not shown within the UI of the configuration Editor, so interface 1 is the LAN configuration in AWS.

Select the “+” symbol in the top left to add an interface.

Select interface “1”, “Fail-to-Block”, and “Trusted” on the top row.

Select “+” next to “Virtual Interface” and give the interface a name.

Select “Apply”.

Now we will configure the WAN interface that will be used to create the secure tunnel to AWS.

Select the “+” symbol in the top left to add an interface.

Select interface “2”, “Fail-to-Block”, and “Untrusted” on the top row.

Select “+” next to “Virtual Interface” and give the interface a name.

Select “Apply”.

Select “Virtual IP Addresses” on the left-hand-side menu.

You will now assign an IP address for each of the interfaces.

Referring to the diagram above, I am using the planned IP addressing from this. I have allowed “Inband Mgmt” from the LAN interface, so I do not need the external IP in AWS all the time.

Click “Apply” when you have completed the IP configuration information.

Now select “WAN Links” on the left-hand-side menu.

We will not configure the WAN interface for the external connectivity.

Select “+ Link”, Select “Add”.

We can now specify the link speed; the WAN link can have “Autodetect Public IP” selected as it is a client node and not an MCN.

Fill in an accurate Upload and Download speed and tick “Autodetect Public IP”, select “Apply” at the bottom of the screen.

Now select “Settings” at the top of the window.

Select “Access Interfaces (IPV4)”.

Select the “+” symbol in the top left of the window.

We will now populate the details of the WAN outside and WAN inside link.

Place the same IP in as we did earlier for the WAN interface.

Select “Apply”.

The configuration should now be complete. We will run an Audit just to be sure all is well.

Select “Audit Now” at the bottom of the configuration editor.

If there are no errors or warnings, we have created the configuration for the AWS client node.

Select “Save As” at the very top of the configuration editor window.

Add V1.2 into the name; adding revision numbers to the configuration can make it easier when rolling out updates.

Select “Save”.

Now we will export the configuration to the Change Management function, this will provision a package that can be downloaded and applied to the client node.

Select “Export” at the very top of the configuration editor window.

Select “Change Management” and select “Export”.

Select the “Change Management” link that appears.

Select “Stage Appliances”

Wait until you see the completion screen. Select “Next”.

Select “Activate Staged”.

Wait for the configuration to activate. Select “Done” once this is complete.

Now we are ready to download the package for the AWS appliance.

Navigate through the UI, “Configuration Tab” > “Virtual WAN – Side Menu” > “Change Management”.

Select the “active” link on the right-hand side of the AWS-VPX row. Be patient; it can take a while for the download to start.

We now have a deployable configuration package for the AWS Appliance.

Let go back to the AWS appliance management interface.

**Remember your login address is https:// - Your login name is admin, and your password is the instance ID in the console.**

Select “Choose File” and upload the configuration file. Select “Upload and Install”.

Be very patient at this point; it will seem like nothing is happening as there is no progress bar. Please wait for the page to update on its own.

To verify connectivity; Navigate through the UI, “Monitoring Tab”.

You can see that basic connectivity is now established between my lab and AWS. I can ping the LAN IP address of the SDWAN device in AWS from my home network.

• 192.168.2.1 – Gateway of my main router
• 192.168.2.2 – Lab Router
• 192.168.1.70 – SDWAN LAB LAN IP
• 11.0.2.230 – AWS SDWAN LAN IP

That concludes the setup for the AWS SD-WAN device.

The following blog post will cover the same process but in GCP.

]]>Leee Jeffries