AWS virtualization environments
This article describes how to set up your AWS account as a resource location you can use with Citrix DaaS.
The resource location includes a basic set of components, ideal for a proof-of-concept, or other deployment that does not require resources spread over multiple availability zones.
When you complete the tasks in this article, your resource location includes the following components:
- A virtual private cloud (VPC) with public and private subnets inside a single availability zone.
- An instance that runs as both an Active Directory Domain Controller and DNS server, located in the private subnet of the VPC.
- Two domain-joined instances on which the Citrix Cloud Connector is installed, located in the private subnet of the VPC.
- An instance that acts as a bastion host, located in the public subnet of your VPC. This instance is used to initiate RDP connections to the instances in the private subnet for administration purposes. After you finish setting up your resource location, you can shut down this instance so it is no longer readily accessible. When you must manage other instances in the private subnet, such as VDA instances, you can restart the bastion host instance.
After you complete the tasks, you can install VDAs, provision machines, create machine catalogs, and create Delivery Groups.
Task overview
Set up a virtual private cloud (VPC) with public and private subnets. When you complete this task, AWS deploys NAT gateways with an Elastic IP address in the public subnet. This enables instances in the private subnet to access the Internet. Instances in the public subnet are accessible to inbound public traffic while instances in the private subnet are not.
Configure security groups. Security groups act as virtual firewalls that control traffic for the instances in your VPC. You add rules to your security groups that allow instances in your public subnet to communicate with instances in your private subnet. You also associate these security groups with each instance in your VPC.
Create a DHCP options set. An Amazon VPC, DHCP, and DNS services are provided by default, which affects how you configure DNS on your Active Directory Domain Controller. Amazon’s DHCP cannot be disabled and Amazon’s DNS can be used only for public DNS resolution, not Active Directory name resolution. To specify the domain and name servers handed to instances through DHCP, create a DHCP options set. The set assigns the Active Directory domain suffix and specifies the DNS server for all instances in your VPC. To ensure Host (A) and Reverse Lookup (PTR) records are automatically registered when instances join the domain, you configure the network adapter properties for each instance you add to the private subnet.
Add a bastion host, Domain Controller, and Cloud Connectors to the VPC. Through the bastion host, you can log on to instances in the private subnet to set up the domain, join instances to the domain, and install the Cloud Connector.
Task 1: Set up the VPC
- From the AWS management console, select VPC.
- From the VPC Dashboard, select Create VPC.
- Select VPC and more.
- Under NAT gateways ($), select In 1 AZ or 1 per AZ.
- Under DNS options, leave Enable DNS hostnames selected.
- Select Create VPC. AWS creates the public and private subnets, Internet gateway, route tables, and default security group.
Note:
Changing the name of an AWS Virtual Private Cloud (VPC) in the AWS console breaks the existing hosting unit in the Citrix Cloud. When the hosting unit is broken, you cannot create catalogs or add machines to existing catalogs. From Known Issue: PMCS-7701
Task 2: Configure security groups
This task creates and configures the following security groups for your VPC:
- A public security group to associate with the instances in your Public subnet.
- A private security group to associate with the instances in your Private subnet.
To create the security groups:
- In the VPC Dashboard, select Security Groups.
- Create a security group for the public security group. Select Create Security Group and enter a name tag and description for the group. In VPC, select the VPC you created earlier. Select Yes, Create.
Configure the Public security group
- From the security group list, select the Public security group.
-
Select the Inbound Rules tab and select Edit to create the following rules:
Type Source ALL Traffic Select the Private security group. ALL Traffic Select the Public security group. ICMP 0.0.0.0/0 22 (SSH) 0.0.0.0/0 80 (HTTP) 0.0.0.0/0 443 (HTTPS) 0.0.0.0/0 1494 (ICA/HDX) 0.0.0.0/0 2598 (Session Reliability) 0.0.0.0/0 3389 (RDP) 0.0.0.0/0 - When finished, select Save.
-
Select the Outbound Rules tab and select Edit to create the following rules.
Type Destination ALL Traffic Select the Private security group. ALL Traffic 0.0.0.0/0 ICMP 0.0.0.0/0 - When finished, select Save.
Configure the private security group
- From the security group list, select the Private security group.
-
If you have not yet setup traffic from the public security group, you must set TCP ports. Select the Inbound Rules tab and select Edit to create the following rules:
Type Source ALL Traffic Select the Private security group. ALL Traffic Select the Public security group. ICMP Select the Public security group. TCP 53 (DNS) Select the Public security group. UDP 53 (DNS) Select the Public security group. 80 (HTTP) Select the Public security group. TCP 135 Select the Public security group. TCP 389 Select the Public security group. UDP 389 Select the Public security group. 443 (HTTPS) Select the Public security group. TCP 1494 (ICA/HDX) Select the Public security group. TCP 2598 (Session Reliability) Select the Public security group. 3389 (RDP) Select the Public security group. TCP 49152–65535 Select the Public security group. -
When finished, select Save.
-
Select the Outbound Rules tab and select Edit to create the following rules.
Type Destination ALL Traffic Select the Private security group. ALL Traffic 0.0.0.0/0 ICMP 0.0.0.0/0 UDP 53 (DNS) 0.0.0.0/0 - When finished, select Save.
Task 3: Launch instances
Do the following steps to create four EC2 instances and decrypt the default Administrator password that Amazon generates:
- From the AWS management console, select EC2.
- From the EC2 Dashboard, select Launch Instance.
- Select a Windows Server machine image and instance type.
- On the Configure Instance Details page, enter a name for the instance and select the VPC that you had set up earlier.
- In Subnet, make the following selections for each instance:
- Bastion host: Select the Public subnet
- Domain controller and Connectors: Select the Private subnet
-
In Auto-assign Public IP address, make the following selections for each instance:
- Bastion host: Select Enable
- Domain controller and Connectors: Select Use default setting or Disable
- In Network Interfaces, enter a primary IP address within the IP range of your private subnet for the Domain Controller and Cloud Connector instances.
- If necessary, on the Add Storage page, modify the disk size.
- On the Tag Instance page, enter a friendly name for each instance.
-
On the Configure Security Groups page, select Select an existing security group and then make the following selections for each instance:
- Bastion host: Select the Public security group.
- Domain controller and Cloud Connectors: Select the Private security group.
- Review your selections and then select Launch.
- Create a new key pair or select an existing one. If you create a new key pair, then download your private key (
.pem) file and keep it in a safe place. You must supply your private key when you acquire the default Administrator password for the instance. - Select Launch Instances. Select View Instances to display a list of your instances. Wait until the newly launched instance has passed all status checks before accessing it.
-
Acquire the default Administrator password for each instance.
- From the instance list, select the instance and then select Connect.
- Go to the RDP client tab, select Get Password, and upload your private key (
.pem) file when prompted. - Select Decrypt Password to get the human readable password. AWS displays the default password.
-
Repeat all the steps from step 2 until you have created four instances:
- One bastion host instance in your public subnet
- Three instances in your private subnet to be used as:
- One as a Domain Controller
- Two as Cloud Connectors
Task 4: Create a DHCP options set
- From the VPC Dashboard, select DHCP Options Sets.
-
Enter the following information:
- Name tag: Enter a friendly name for the set.
- Domain name: Enter the fully qualified domain name that you use when you configure the Domain Controller instance.
- Domain name servers: Enter the private IP address you assigned to the Domain Controller instance and the string AmazonProvidedDNS, separated by commas.
- NTP servers: Leave this field blank.
- NetBIOS name servers: Enter the private IP address of the Domain Controller instance.
- NetBIOS node type: Enter 2.
- Select Yes, Create.
-
Associate the new set with your VPC:
- From the VPC Dashboard, select Your VPCs and then select the VPC you set up earlier.
- Select Actions > Edit DHCP Options Set.
- When prompted, select the new set you created, and then select Save.
Task 5: Configure the instances
- Using an RDP client, connect to the public IP address of the bastion host instance. When prompted, enter the credentials for the Administrator account.
- From the bastion host instance, launch Remote Desktop Connection and connect to the private IP address of the instance you want to configure. When prompted, enter the Administrator credentials for the instance.
-
For all instances in the private subnet, configure the DNS settings:
- Select Start > Control Panel > Network and Internet > Network and Sharing Center > Change adapter settings. Double-click the network connection displayed.
- Select Properties > Internet Protocol Version 4 (TCP/IPv4) > Properties.
-
Select Advanced > DNS. Ensure that the following settings are enabled, and then select OK:
- Register this connection’s addresses in DNS
- Use this connection’s DNS suffix in DNS registration
-
Configure the Domain Controller:
- Using Server Manager, add the Active Directory Domain Services role with all default features.
- Promote the instance to a Domain Controller. During promotion, enable DNS and use the domain name you specified when you created the DHCP options set. Restart the instance when prompted.
-
Configure the first Cloud Connector:
- Join the instance to the domain and restart when prompted. From the bastion host instance, reconnect to the instance using RDP.
- Sign in to Citrix Cloud. Select Resource Locations from the upper left menu.
- Download the Cloud Connector.
- When prompted, run the
cwcconnector.exefile and supply your Citrix Cloud credentials. Follow the wizard. - Once complete, select Refresh to display the Resource Locations page. When the Cloud Connector is registered, the instance appears on the page.
- Repeat the steps to configure the Cloud Connector to configure the second Cloud Connector.
- Attach an IAM Policy to the Cloud Connectors to support AWS hosting connections with role-based authorization. You must have the same IAM Policy attached to all the Cloud Connectors in a resource location. For information about AWS permissions, see Required AWS permissions.
Where to go next
- For a simple proof-of-concept deployment, install a VDA on a machine designated to deliver apps or a desktop to your users.
- For creating and managing connections, see Connection to AWS.
- Review all the steps in the installation and configuration process