vCenter HTTPS Access

1. If it doesn’t already exist, create a DNS entry for your vCenter server.  Another option would be to create a host file entry on your XenDesktop Delivery Controllers and Provisioning Servers for your Virtual Center/vCenter server.

2. Using your browser connect to the FQDN of the vCenter server.  You should get a warning about the website’s security certificate.  Click continue to this website (not recommended).

3. Click the Certificate Error in the Security Status bar and select View certificates.  Once you can see the vCenter certificate, Click Install Certificate.

4. When the Certificate Import Wizard comes up, select Place all certificates in the following store and click Browse.

5.  When Select Certificate Store comes up, select Show physical stores then expand Trusted People and then select Local Computer and click Ok.

6. When the Certificate Import Wizard completion screen comes up, click Finish.

7. You will get prompted when the import is successful, click Ok.

8. Close the browser and reopen it.  You should be able to browse to your vCenter server without getting any certificate errors.

vCenter role for XenDesktop

When setting up the XenDesktop role in vCenter, the permissions listed in the Citrix eDocs are from the SDK programming guide and some permissions are not what is actually shown in the add a new role dialog box.  Differences in permissions are noted below in bold.

Create a role in vCenter with the following permissions:

• Datastore Permissions
  • Allocate space
  • Browse datastore
  • File management is listed in Citrix eDocs but it is Low level file operations in vCenter

• Network Permissions
  • Assign network

• Resource Permissions
  • Assign virtual machine to resource pool

• System Permissions – These permissions are automatically added when you create a role in vCenter.
  • Anonymous
  • Read
  • View
• Task Permissions
  • Create Task

• Virtual Machine/Configuration Permissions
  • Add existing disk
  • Add new disk
  • Change CPU count
  • Configure Resource is listed in the Citrix eDocs but it is Change resource in vCenter
  • Memory
  • Remove disk

• Virtual Machine/Interaction
  • Power Off
  • Power On
  • Reset
  • Suspend

• Virtual Machine/Inventory
  • Create is listed in the Citrix eDocs but it is Create New in vCenter
  • Create from existing
  • Delete is listed the Citrix eDocs but is Remove in vCenter
  • Register

• Virtual Machine/Provisioning
  • Clone is listed in the Citrix eDocs but it is Clone virtual machine in vCenter
  • Disk Random Access is listed in the Citrix eDocs but it is Allow disk access in vCenter
  • Get VM Files is listed in the Citrix eDocs but it is Allow virtual machine download in vCenter
  • Put VM Files is listed in the Citrix eDocs but it is Allow virtual machine files upload in vCenter

• Virtual Machine/State
  • Create snapshot
  • Revert to snapshot

If you want XenDesktop to tag the virtual machines, you must also add the following permissions:

• Global
  • Manage Custom Fields is in the Citrix eDocs but it is Manager custom attributes in vCenter
  • Set Custom Field is in the Citrix eDocs but it is Set custom attribute in vCenter

To use XenDesktop Setup Tool with Provisioning Services, you will have to add the following permissions in addition to what is listed above:

• Virtual Machine/Provisioning
  • Clone Template
  • Deploy Template

Now that we have the XenDesktop role created, assign a domain account to the role.  For this article the example domain account is Citirx_services.

One question I am always asked when using XenDesktop with VMware by customers is how to limit virtual machine creation to a certain cluster or servers within vCenter.  Follow the steps below to control where virtual machines are deployed within your VMware infrastructure.

1. Assign the XenDesktop role at the Datacenter level but do not propagate by unselecting Propagate when adding the role.
2. Assign the XenDesktop role at the Cluster level but do not propagate by unselecting Propagate when adding the role.  If you want to control virtual machine creation at the Cluster level then leave Propagate selected.  Assign the XenDesktop role to Servers within a Cluster if you want to limit virtual machine creation to certain Servers within a Cluster.
3. Assign the XenDesktop role to the Networks you want the virtual machines to have access to.
4. Assign the XenDesktop role the to Datastores you want virtual machines to be created in.
5. If you are also using folders within vCenter  in the VMs and Templates view make sure to also assign the XenDesktop role to the folders you want virtual machines created in.

You should now be able to control where the virtual machines are placed when they are created.  See the screenshot below for an example of controlling where virtual machines get created.

In the example above, virtual machines will only be created within the Citrix\Desktops folder on a single server within the VDILab cluster in a single Datacenter in vCenter.  The virtual machines will only use the VDI Network and will only be created on the LeftHand_Lab Datastore.

When you create virtual machines using Machine Creation Services or XenDesktop Setup Tool with Provisioning Services, configure the following on the Host screen:

• Host type: VMware virtualization
• Address: https://vCenter.domain.com/sdk – example vCenter name
• Username: domain\citrix_services – example service account for XenDesktop role created in vCenter
• Password: password for citrix_services account – example service account password for XenDesktop role created in vCenter

This article was created using vCenter/ESX 4.1, XenDesktop 5 with Machine Creation Services, and Internet Explorer 8.

This blog post was a collaboration with Shane Kleinert (@shanekleinert, CitrixIRC, @CitrixIRC).  I would like to give a big thanks to Shane for the team work on this article.

Previous versions of XenClient allowed you to use an existing VHD file with a virtual machine on XenClient.  With the release of XenClient 1.0 a disk encryption facility with some additional virtual hard disk headers and hard disk checking was added.  When a virtual machine is started in XenClient 1.0, XenClient checks for the additional hard disk options.  If the additional hard disk options are present, then the virtual machine fails to start with Error Code 1099.

I have used XenConvert to convert physical machines and have also used VHD files from XenServer successfully with XenClient.  Until recently I have not tried converting a VMware VMDK to VHD format using XenConvert for use with XenClient.  I thought the process would be pretty straight forward and it was until running the vhd-copy script from Citrix Knowledgebase Article CTX127075 – Attempting to use a Virtual Hard Disk on XenClient 1.0 Created Using XenConvert or From a Pre-Release XenClient System Fails with Error Code 199.  The size of the target VHD file from the vhd-copy script was a fraction of the size compared to the source VHD file.

Using XenConvert to convert from VMDK to VHD format was a successful conversion without errors.

The converted VHD file was then copied over to the XenClient machine using WinSCP.  After the VHD file and vhd-copy script were copied over to the /storage/disks directory on the XenClient machine, the vhd-copy script was executed by making an SSH connection to the XenClient machine.  You can also do it from the XenClient machine shell terminal by pressing CTRL+SHIFT+T keys.  The vhd-copy command used was ./vhd-copy –src WinXP.vhd –dest WinXPFixed.vhd.  Notice successful completion of the vhd-copy script and the size difference in the screenshot below for the WinXP.vhd and WinXPFixed.vhd files.

After running XenConvert again to convert from VMDK to VHD format and running the vhd-copy script again, we got the same results.  WinImage was also used to convert the VMDK to VHD but errors were received when running the vhd-copy script.  In the end VMDK to VHD Converter was used to convert from VMDK to VHD format.  The converted VHD file was then copied to the XenClient machine using WinSCP.  After the VHD file and vhd-copy script were copied over to the /storage/disks directory on the XenClient machine, the vhd-copy script was executed by making an SSH connection to the XenClient machine.  You can also do it from the XenClient machine shell terminal by pressing CTRL+SHIFT+t keys.  The vhd-copy command used was ./vhd-copy –src WinXPPro.vhd –dest WinXPProFixed.vhd.  Notice successful completion of the vhd-copy script and now the size of VHD files are almost the same size in the screenshot below for the WinXPPro.vhd and WinXPProFixed.vhd files.

Now that the VHD file is properly encrypted for use with XenClient 1.0 it can be used with a virtual machine on XenClient.  To use  the VHD file with a XenClient virtual machine do the following:

1. Create a virtual machine but do not start it.
2. Connect to the XenClient machine by using Putty or open a shell terminal on XenClient by pressing CTRL+SHIFT+t keys.
3. Change directory to /storage/disks.
4. Find the VHD file created by the virtual machine created in step 1 and change the name from guidofvm.vhd to guidofvhd.orig.
5. Change the name of the converted virtual machine VHD file from convertedvm.vhd (Example from above WinXPProFixed.vhd) to guidofvm.vhd.
6. Start the virtual machine.

You should now have a virtual machine running on XenClient that was converted from a VMDK to VHD.  Big thanks to Doug Brown and Shane Kleinert for the team effort on this one.

I also talk about the open architecture of XenDesktop and that they can choose between Citrix XenServer, Microsoft Hyper-V, and VMware vSphere hypervisors for the XenDesktop virtual desktops.  I talk about Hyper-V as another option and the benefits of using Hyper-V for the hypervisor in XenDesktop deployments especially when the customer is talking about deploying Windows 7 and Windows 2008 virtual machines in their XenDesktop infrastructure.   Some think that having multiple hypervisors is too much to manage or there is a big learning curve.  Most customers I have worked with that are strong in virtualization find XenServer pretty easy to learn.  With tools like System Center Virtual Machine Manager that can manage ESX/vSphere and Hyper-V from a single console make management of multiple hypervisors easy for multiple hypervisor deployments. When System Center Virtual Machine Manager supports management of XenServer, all three hypervisors will be managed from a single console. 

XenDesktop deployments on Citrix XenServer considerations:

• Included with XenDesktop, no extra cost for the hypervisor
• XenServer redundancy built-in (no management server to deploy)
  • CTX122458 – How to Integrate XenServer Redundantly into a XenDesktop Infrastructure
  • The Generation V – How XenDesktop recovers from a XenServer failed pool master
• XenCenter is easy to use for both server virtualization and desktop administrators
• Single vendor to call for technical support
• XenServer 5.6 features has made XenServer a more complete product
  • Dynamic Memory Control
  • Enhanced CPU compatibility for XenMotion
  • Enhanced snapshots, including full system state and one-click revert
  • Automation for Workload Balancing
  • Administrative Delegation, Logging and Audit Reports
• XenServer virtual machine tools have to be installed and maintained
• XenServer can direct boot VHD files to update XenServer tools and Provisioning Services tools
  • Citrix Knowledge Center Article CTX123395 – How to Update Provisioning Server Target Device Software using a Network File Share with XenServer
  • The Citrix Blogs – PVS 5.1 Direct VHD Boot using XenServer
• New option in XenServer 5.6 to select network boot when building virtual machine template
• XenServer has built-in optimizations for XenApp
• Citrix Virtual Appliances are released on XenServer first
• Having XenServer already in place makes you already prepared for Multi-GPU Passthrough for HDX 3D Pro Graphics and Distributed Virtual Switching (DVS) that are coming in tech preview/private beta soon.
  • Citrix Knowledge Center Article CTX125574 - XenServer 5.6 Multi-GPU Passthrough for HDX 3D Pro Graphics
  • The Citrix Blogs – Private beta release of XenServer distributed virtual switching (DVS) coming soon!

XenDesktop deployments on Microsoft Hyper-V R2 considerations:

• System Center Virtual Machine Manager is needed to manage hosted virtual desktops
• Server and Desktop administrators who already use System Center products will already be familiar with the look and feel of System Center Virtual Machine Manager console
• System Center Essentials 2010 could be used for smaller XenDesktop deployments (for XenDesktop deployments under 500 seats when supported)
• Management server (System Center Virtual Machine Manager or Essentials 2010) can be single point of failure for management of hosted virtual desktops
• Microsoft Hyper-V Server 2008 R2 Edition is free with features like Live Migration, Host Clustering, etc but needs System Center Virtual Machine Manager or Essentials 2010 to manage hosted virtual desktops
• System Center Virtual Machine Manager or Essentials 2010 console needs to be installed on XenDesktop Delivery Controllers and Provisioning Servers for management and for use with XenDesktop Setup Wizard
• Windows 7 virtual desktops and XenApp servers running on Windows 2008 have integration components built-in to the operating system. No need for 3rd party virtual machine tools to install and maintain.
• Hyper-V can direct boot VHD files to update Provisioning Services tools
  • The Citrix Blogs – New Way to Upgrade with PVS 5.1 and Hyper-V
• Legacy NIC needed for network boot/Provisioning Services and Synthetic NIC for all other traffic
• Network boot enabled in virtual machine settings
• Windows 7 and Windows 2008 on Hyper-V are better together
• Citrix and Microsoft relationship
  • Citrix Knowledge Center Article CTX124687 – XenDesktop with Microsoft Hyper-V Design Guide
  • The Citrix Blogs – Seven Things I Learned Testing XenDesktop with Hyper-V
  • Citrix Essentials for Hyper-V for site recovery/disaster recovery
• System Center Virtual Machine Manager for mixed vSphere and Hyper-V deployments with XenServer support coming in the future for a possibly mixed environment of all 3 hypervisors
• Having Hyper-V already in place makes you already prepared for RemoteFX and Dynamic Memory that are coming in service pack 1

XenDesktop deployments on VMware vSphere considerations:

• Added cost of VMware infrastructure
• Has per processor/core licensing (systems that have processors with over 6 cores need Advanced or Enterprise Plus licenses)
  • VMware Multi-Core Pricing & Licensing Policy
  • VMware vSphere 4 Pricing, Packaging, and Licensing Overview
• vSphere/vCenter server is needed to manage virtual desktops
• Management server (vSphere/vCenter) can be single point of failure for management of hosted virtual desktops
• VMware ESXi is free but needs vSphere/vCenter server/agents to manage hosted virtual desktops
  • Citrix Knowledge Center Article CTX124952 – Citrix Statement of Support for VMware ESXi and Citrix XenDesktop
• vSphere/vCenter has to be setup to allow HTTP access, default SSL certificate imported (VI 3.5), or SSL certificate needed (vSphere 4) for XenDesktop Delivery Controller access/management and for use with the XenDesktop Setup Wizard
  • Jarian Gibson – Using XenDesktop with VMware
  • The Citrix Blogs – Secret to getting Virtual Center to use an Enterprise CA SSL certificate
• VMware integration issues with Provisioning Services Target Devices – VMXNet3 driver issues with Windows Vista, 7, and 2008
  • Citrix Knowledge Center Article CTX125361 – ESX Target Device Fails to Boot
• VMware integration issues with XenDesktop Virtual Desktop Agent – Video driver issues with Windows Vista and Windows 7
  • Citrix Knowledge Center Article CTX124877 – Unable to Connect to XenDesktop Virtual Desktop Agent on Vista or Windows 7 with WDDM Driver
  • Citrix Knowledge Center Article CTX123952 – Unable to Connect to XenDesktop Virtual Desktop Agent on Windows 7 with VMware Tools ESX 4.0 Update 1 – also had to do this when installing XenDesktop Virtual Desktop Agent on Windows 7 or install would fail
• VMware virtual machine tools have to be installed and maintained
• VMware virtual machine has to be reversed imaged to update virtual machine tools or Provisioning Services tools – Hyper-V or XenServer instance in VMware environment could also do this
• Network boot enabled in virtual machine BIOS by editing virtual machine properties to enter BIOS on next boot
• Need at least a 1MB disk attached or Target Device will BSOD
  • Citrix Knowledge Center Article CTX119739 – Provisioning Server and VMware ESX Interoperability Guide
• Most matured hypervisor with largest data center footprint

So as you can see a number of factors come into play when choosing a hypervisor for your XenDesktop infrastructure.  Some customers I have worked with have stayed with their current hypervisor and kept a single hypervisor infrastructure all on VMware vSphere. While other customers I have worked with have gone with multiple hypervisor infrastructures having the XenDesktop infrastructure components on VMware vSphere and the virtual desktops on Citrix XenServer. I have even had one customer put everything relating to Citrix on Citrix XenServer and kept the rest of their infrastructure on VMware vSphere. I will be doing an install next month in a pure XenServer environment (They have been running Xen since long before the Citrix acquisition). The demo lab at my office and what we use for workshops is a mix of Citrix XenServer for the virtual appliances and Microsoft Hyper-V R2 for everything else. Microsoft Hyper-V R2 is getting more consideration and interest lately and I expect to start doing more and more XenDesktop deployments on Hyper-V soon.

For XenDesktop deployments do you stick with a single or have multiple hypervisors? Every environment is different and everyone has their own take on this. With the way the economy has been customers are looking at other options instead of paying a premium for what they currently have. Especially since cost for and deployment of a XenDesktop infrastructure are a huge factors these days. Citrix XenServer and Microsoft Hyper-V R2 are getting more and more interest and gaining ground every day as the feature sets become more and more comparable with VMware vSphere.  With XenDesktop having an open architecture you have options when it comes to the hypervisor.  The hypervisor is becoming a commodity anyway, right?

If you have found this article interesting or if you have any other insights, please feel free to leave comments on this article.

XenDesktop Delivery Controller and VMware Infrastructure 3 – Virtual Center 2.5

Virtual Center HTTPS Access

1. On the Virtual Center server browse to Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\ and copy the rui.crt to your XenDesktop Delivery Controller(s) and Provisioning Server(s) with the XenDesktop Setup Wizard.
2. Open an MMC and the Certificates snap-in to manage Certificates for the Computer Account on the XenDesktop Delivery Controller(s) and Provisioning Server(s) with the XenDesktop Setup Wizard.
3. Expand Certificates > Trusted Root Certificates > Certificates and import the rui.crt.
4. Create a host file entry for vmware with the IP address of the Virtual Center server on your XenDesktop Delivery Controller(s) and Provisioning Server(s) with the XenDesktop Setup Wizard.  You can also create DNS entry for vmware pointing to your vCenter server instead of editing hosts files on your servers. 
5. In the Hosting Infrastructure section when creating a desktop group on the XenDesktop Delivery Controller or on the Provisioning Server when the running the XenDesktop Setup Wizard, select VMware Virtualization for the Hosting Infrastructure and enter https://vmware/sdk for the Virtual Center address.

Virtual Center HTTP Access

1. Logon to the Virtual Center server.
2. Browse to Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\.
3. Open proxy.xml with the text editor of your choice and find the /sdk section.  Change the accessMode to httpAndHttps.
4. Restart the vCenter services.
5. In the Hosting Infrastructure section when creating a desktop group on the XenDesktop Delivery Controller or on the Provisioning Server when the running the XenDesktop Setup Wizard, select VMware Virtualization for the Hosting Infrastructure and enter http://Virtual Center Server IP address/sdk for the Virtual Center address.

XenDesktop Delivery Controller and vSphere 4 and 4.1

vCenter HTTPS Access

1. On the vCenter server browse to Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\ (Windows 2003) or ProgramData\VMware\VMware VirtualCenter\SSL\ (Windows 2008) and copy the rui.crt to your XenDesktop Delivery Controller(s) and Provisioning Server with the XenDesktop Setup Wizard.
2. Open an MMC and the Certificates snap-in to manage Certificates for the Computer Account on the XenDesktop Delivery Controller(s) and Provisioning Server(s) with the XenDesktop Setup Wizard.
3. Expand Certificates > Trusted Root Certificates > Certificates and import the trusted root certificate for the SSL certificate copied from the vCenter server in step 1.  Also import the certificate to the Trusted People Store.
4. For XenDesktop 3.0 – On the XenDesktop Delivery Controller(s) install Citrix XenDesktop hotfix XDE300PM003 and on the Provisioning Server(s) install XenDesktop Setup Wizard XDE300SW001.  For XenDesktop 4.0 – On the Desktop Delivery Controller(s) install Citrix XenDesktop hotfix XDE400PM004 and on the Provisioning Server(s) install XenDesktop Setup Wizard XDE400SWx86001 for 32 bit or XDE400SWX64001 for 64 bit. 
5. Create a host file entry for vmware with the IP address of the vCenter server on your XenDesktop Delivery Controller(s) and Provisioning Server(s) with the XenDesktop Setup Wizard.  You can also create DNS entry for vmware pointing to your vCenter server instead of editing hosts files on your servers. 
6. In the Hosting Infrastructure section when creating a desktop group on the XenDesktop Delivery Controller or on the Provisioning Server when the running the XenDesktop Setup Wizard, select VMware Virtualization for the Hosting Infrastructure and enter https://vmware/sdk for the Virtual Center address.

vCenter HTTP Access

1. Logon to the vCenter server
2. Browse to Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\ (Windows 2003) or ProgramData\VMware\VMware VirtualCenter\SSL (Windows 2008).
3. Open proxy.xml with the text editor of your choice and find the /sdk section.  Change the accessMode to httpAndHttps.
4. Restart the vCenter services.
5. In the Hosting Infrastructure section when creating a desktop group on the XenDesktop Delivery Controller or on the Provisioning Server when the running the XenDesktop Setup Wizard, select VMware Virtualization for the Hosting Infrastructure and enter http://vCenter server IP address/sdk for the Virtual Center address.

Virtual Center and vCenter Permissions

When using XenDesktop with VMware make sure you use an account with the proper permissions to connect to the Virtual Center or vCenter server.  This account will be used for both the XenDesktop Delivery Controller and the XenDesktop Setup Wizard to connect to Virtual Center or vCenter.

The account used for XenDesktop Delivery Controller and the XenDesktop Setup Wizard to communicate to Virtual Center or vCenter will need the following permissions.  The following permissions need to be propagated to the lower levels in the Virtual Center or vCenter tree.  Create a role in Virtual Center or vCenter for XenDesktop with the following permissions:

At the Hosts and Clusters Node

• Global.Manage Custom Attributes

For a complete overview of using XenDesktop with VMware see Citrix eDocs VMware and XenDesktop.

As you can see, using XenDesktop with VMware is pretty straight forward.  I recommend using HTTPS access over HTTP access.  Using HTTPS access is more secure than HTTP access and doesn’t require modifying the proxy.xml file on your Virtual Center or vCenter server.  Note: Using the default Virtual Center or vSphere certificate is not recommended for production use.  To change the default SSL certificate see Replacing Virtual Center Server Certificates in Virtual Infrastructure 3 or Replacing vCenter Server Certificates in vSphere 4. To use an Enterprise CA certificate like Microsoft Certificate Services see Replacing vSphere SSL Certificates over at the VirtualVCP IT Virtualization blog.

If you have found this article interesting or if you have any other insights, please feel free to leave comments on this article.