To consolidate operations, some organizations deploy desktop and application virtualization solutions such as Citrix XenDesktop and XenApp in the data center. Citrix uses a proprietary protocol called Independent Computing Architecture (ICA) to provide connectivity between its clients (called receivers) and its published applications and desktops.

This chapter includes the following sections:

RiOS 6.0 and later provide these optimizations:

RiOS 7.0 and later provide these optimizations:

RiOS 7.0.4 and later provide traffic optimization for enhanced data reduction for small Citrix packets.

RiOS 6.0 and later provide support for the following Citrix software components.

Citrix Receiver or ICA client versions:

Citrix XenDesktop:

Citrix XenApp:

In addition, RiOS supports encrypted and compressed Citrix ICA traffic optimization.

For information about configuring Citrix optimization, see the SteelHead Management Console User’s Guide, the Riverbed Command-Line Interface Reference Manual, and the white paper Optimizing Citrix ICA Traffic with RiOS 8.0 (June 2013).

Citrix ICA traffic is usually transported on TCP port 1494. Citrix ICA traffic is transported on TCP port 2598 if Citrix session reliability is enabled. When you enable Citrix session reliability, the client tunnels its ICA traffic inside the Common Gateway Protocol (CGP) port 2598.

For more information about Citrix session reliability, go to http://support.citrix.com/article/CTX104147.

You must perform this configuration on both the client-side and server-side SteelHeads.

SecureICA is a Citrix ICA protocol feature that encrypts the session data transmitted between Citrix clients and servers. By default, all Citrix ICA sessions have SecureICA set to basic ICA protocol encryption. The basic ICA protocol encryption setting obfuscates data but does not provide industry standard encryption. Other settings are available to increase the level of encryption using the RC5 algorithm.

For more information about SecureICA, go to http://docs.citrix.com/en-us/xenapp-and-xendesktop/xenapp-6-5/xenapp65-w2k8-wrapper/xenapp65-admin-wrapper/ps-securing-wrapper-v2/ps-securing-incr-lev-cltsrvr-security.html.

RiOS supports optimization of Citrix ICA sessions with SecureICA set to RC5 40-, 56-, and 128-bit encryption. By default, RiOS can optimize Citrix ICA traffic with SecureICA set to basic ICA protocol encryption. You must enable SecureICA encryption to allow RiOS to optimize ICA sessions with SecureICA encryption set to RC5 on both the client-side and the server-side SteelHeads.

You must perform this configuration on both the client-side and server-side SteelHeads.

Client drive mapping (CDM) is a Citrix ICA protocol feature that enables users to access their local drives (such as floppy disk drives, network drives, USB drives, CD-ROM drives, and hard disk drives) from within an ICA session. When you use CDM to access a mapped drive within an ICA session, the end-user desktop experience can be negatively affected by the underlying network performance.

RiOS 7.0 and later support CDM latency optimization. CDM latency optimization improves the end-user desktop experience when reading and writing files on a mapped drive in the following ways:

CDM latency optimization is available when both the client-side and server-side SteelHeads are running RiOS 7.0 or later. You cannot apply CDM latency optimization to Citrix sessions that use Citrix session reliability.

To configure CDM with the CLI, use the following commands:

You must perform this configuration on both the client-side and server-side SteelHeads.

This section requires that you be familiar with the Citrix ICA protocol and how to configure your Citrix server. This section includes the following topics:

The ICA traffic within a Citrix session comprises of many categories of traffic called virtual channels. A virtual channel provides a specific function of Citrix ICA remote computing architecture, such as print, CDM, audio and video. The ICA traffic within a Citrix session is also categorized by priority, in which virtual channels carrying real-time traffic, such as audio and video, are flagged with higher priority than virtual channels carrying bulk transfer traffic such as print and CDM. The ICA priority groups are as follows:

For more information about Citrix ICA virtual channel, go to the Citrix Knowledge Base article CTX116890 at http://support.citrix.com/article/CTX116890.

By default, a Citrix session uses a single TCP connection to carry traffic for all virtual channels and all priority groups. This is referred to as single-stream ICA.

XenApp 6.5 and XenDesktop 5.5 introduced a new feature, called multi-stream ICA, that enables use of multiple TCP connections to carry traffic for a Citrix session. Multi-stream ICA is available only when you enable Citrix session reliability. Multi-stream ICA carries traffic on port 2598 and three other user-configurable ports as defined in the multi-port Citrix computer policy. Each port represents an ICA priority group and enables you to apply true network-based QoS policies to the priority groups for the virtual channel traffic that they carry.

For more information about enhanced QoS with multi-stream ICA, go to http://blogs.citrix.com/2011/08/25/enhanced-qos-via-multi-stream-ica/.

This table shows the association of Citrix ICA priority groups to the various ICA virtual channels for multi-stream ICA.

You must use these software components to enable and optimize multi-stream and multi-port ICA:

In addition, you must enable Citrix session reliability. Citrix session reliability is enabled by default in XenApp 6.5 and XenDesktop 5.5.

For more information about Citrix session reliability, go to http://support.citrix.com/article/CTX104147.

The following example shows how to configure multi-stream and multi-port ICA in XenApp 6.5.

You do not need to change your current QoS configuration if you already have rules to prioritize Citrix ICA traffic on port 2598. However, you must configure additional QoS rules if you want to prioritize Citrix ICA traffic on the user-configurable ports that you have configured in the multi-port Citrix computer policy.

RiOS 6.0 and later enable you to classify Citrix traffic using QoS to prioritize the delivery of Citrix ICA traffic according to the ICA priority groups. QoS classification for Citrix traffic is beneficial in mixed-use environments in which Citrix users perform printing and use client drive-mapping features. Using QoS to classify Citrix traffic in a mixed-use environment improves the desktop computing experience for end users.

These RiOS QoS capabilities ensure optimal delivery of Citrix traffic over the network:

For more information about configuring QoS, see the SteelHead Deployment Guide.

You can use the Riverbed Application Flow Engine (AFE) to classify Citrix ICA traffic. The AFE recognizes Citrix traffic on TCP port 1494 (Citrix-ICA) and port 2598 (Citrix-CGP). Use AFE to classify Citrix ICA traffic into a QoS class that is assigned with a higher priority than the QoS classes for other network traffic (Figure: Classifying Citrix ICA Traffic with AFE).

RiOS 9.1 and later enable you to automatically configure and negotiate multi-stream ICA with the Citrix client from the client-side SteelHead and automatically use QoS to classify the negotiated multi-stream ICA traffic for QoS enforcement by the same client-side SteelHead. This configuration works with Citrix ICA traffic on both TCP port 1494 and 2598. This feature is independent of the Citrix computer policy for multi-stream and multi-port ICA on the Citrix server and the Citrix user policy for multi-stream ICA.

The client-side SteelHead automatically negotiates multi-stream ICA with the Citrix client after it receives a connection for a new Citrix session. If the negotiation is successful, the Citrix client initiates four TCP connections to the Citrix server. Each connection represents an ICA priority group. RiOS automatically classifies the ICA priority group into an equivalent predefined Citrix application (Figure: Citrix Multi-Stream Application Definition).

Thereafter, you can configure an appropriate QoS profile for Citrix ICA traffic. This feature is relevant only if you are going to use QoS for Citrix ICA traffic.

For more details on configuring QoS for multi-stream ICA traffic, see the section QoS Classification for Citrix Traffic.

Riverbed recommends that you enable enhanced data reduction for real-time Citrix traffic that is sent in small packets, such as keystrokes, mouse clicks, and other Citrix packets that are less than 64 bytes.

Optimization for small Citrix packets is disabled by default.

To enable or disable Citrix optimization for small packets, use the following command:

To check whether or not optimization for small Citrix packets is enabled, use the following command:

You must perform this configuration on both the client-side and server-side SteelHeads.

Citrix Access Gateway (CAG) is an appliance that provides secure remote access to users of XenApp and XenDesktop over SSL VPN. CAG is also known as Access Gateway Enterprise Edition (AGEE) and Netscaler Gateway. CAG proxies the Citrix ICA traffic delivered from these applications and passes them securely over HTTPS or SSL to the end user.

Figure: Citrix ICA Client Communication Through a Citrix Access Gateway shows a CAG deployment. The user reaches the login page by entering the XenApp or XenDesktop secure remote access URL (https://<CAG URL>) in a browser. This page is hosted on the CAG. The user enters their credentials for authentication.

Upon a successful authentication, a list of published applications and desktops is displayed. When the user accesses these applications and desktops, an ICA connection is launched from the user desktop to the XenApp and XenDesktop server. The CAG functions as a gateway to intercept and proxy the user ICA connection to the XenApp and XenDesktop servers on one end, while providing secure remote access over SSL VPN to the user on the other end.

RiOS 7.0 and later can optimize ICA traffic wrapped in SSL using an SSL preoptimization policy to the in-path rule. The in-path rule has several parameters that allow for the chaining of multiple optimization features.

Figure: SteelHead Deployment with CAG shows a SteelHead deployment with CAG.

Figure: SteelHead In-Path Rule to Optimize Citrix ICA Traffic Through a CAG shows an in-path rule configuration to optimize Citrix ICA traffic wrapped in SSL.

Citrix ICA traffic optimization with CAG has the following requirements: