FAQ: RIVERBED OPTIMIZATION OF CITRIX ICA TRAFFIC

FAQ: RIVERBED OPTIMIZATION OF CITRIX ICA TRAFFIC

February 2012

Introduction
As the market leader and leading technology innovator in WAN optimization, Riverbed originally introduced Citrix ICA-specific optimization to the Steelhead product in RiOS 6.0, available in 2009. Since that initial introduction, Riverbed has continued to improve its ICA optimization capabilities through number of enhancements and features added in subsequent RiOS software releases. We have seen widespread use of Riverbed ICA optimization features among Citrix users, and the customer feedback has been overwhelmingly positive. The experience that we have acquired over the years of delivering and supporting superior ICA performance has allowed Riverbed to introduce innovations such as ICA packet-order queuing and advanced HFSC-based QoS for ICA trafficinnovations that Citrix does not offer in their Branch Repeater product. This FAQ provides answers to common questions about Riverbed capabilities for optimizing Citrix ICA traffic.

How do Steelhead ICA optimization capabilities deliver performance benefits for Citrix users?
Steelheads optimize ICA traffic through Riverbeds Scalable Data Referencing (SDR) data reduction technology. Due to SDRs ability to recognize repetitive data sequences that are as short as 100 bytes, Riverbed is able to deliver better results than the embedded compression algorithms used by Citrix XenApp and XenDesktop. Riverbed can also apply several advanced transport mechanisms to the ICA traffic that are better adapted to adverse network conditions (e.g., packet loss, high latency, low bandwidth, etc.), including Space Communications Protocol Specification (SCPS), TCP-Westwood, High-Speed TCP (HS-TCP), and Maximum-Speed TCP (MX-TCP). Finally, Riverbed offers advanced QoS mechanisms that are essential for real-time applications including Citrix XenApp and XenDesktop. Riverbeds QoS capabilities are based on Hierarchical Fair Service Curves (HFSC) technology that is particularly effective at guaranteeing appropriate QoS levels for application traffic such as VoIP and ICA that do not consume significant bandwidth. Riverbed Steelheads dynamically disable compression on a per-ICA session basis so that they can apply their SDR data reduction algorithms and thereby obtain superior data reduction results. This occurs only for ICA sessions that are optimized by the Steelhead appliances; ICA sessions to remote sites without Steelhead appliances--as well as ICA sessions to LAN users-continue to get compression benefits from the XenApp/XenDesktop server.

What are typical results for Riverbed optimization of ICA traffic?

Riverbed typically achieves 30% to 80% reduction of Citrix traffic, allowing customers to double the number of Citrix sessions supported by a given amount of WAN bandwidth. The benefit from using Riverbed to optimize ICA traffic is in most cases far better than what would have been achieved using the default compression already included in XenApp and XenDesktop. In many cases Riverbed is able to also improve the responsiveness of Citrix XenApp and XenDesktop applications, leading to an improved end-user experience.

Is ICA optimization available in Steelhead Mobile software client?

Yes, Steelhead Mobile software client versions 3.1 or later have the ICA optimization capabilities that are found in the Steelhead appliance.

What has changed in the new XenApp 6.5 and XenDesktop 5.5 product release?
The newly-released XenApp 6.5 and XenDesktop 5.5 products offer optional new transport modes for the ICA protocol. Previous versions of XenApp and XenDesktop used a single TCP connection to transport each ICA session between Citrix client and server--we refer to this older ICA transport as single-stream ICA. The new XenApp 6.5 and XenDesktop 5.5 also supports single-stream ICA, but they also optionally support a new ICA transport known as multi-stream ICA. We have also observed noticeably better performance results when using Steelhead to optimize multi-stream ICA traffic for XenApp 6.5 and XenDesktop 5.5, compared to older versions of these Citrix products.

Does Riverbed have any issues with optimizing ICA traffic for XenApp 6.5 or XenDesktop 5.5?
There have been no observed issues with using Steelhead to optimize ICA traffic for XenApp 6.5 and XenDesktop 5.5.

2012 Riverbed Technology. All rights reserved.

FAQ: RIVERBED OPTIMIZATION OF CITRIX ICA TRAFFIC

Riverbeds existing Citrix-specific mechanisms for optimizing ICA traffic work fine with no problems. Citrix Branch Repeater has an optional feature that when enabled, will automatically negotiate with XenApp 6.5 and XenDesktop 5.5 to use multi-stream ICA. Riverbed does not yet offer this feature, although we intend to offer a similar feature in a future RiOS software upgrade. With the existing Steelhead RiOS 6.5 release, if multi-stream ICA is not manually enabled in the XenApp 6.5/XenDesktop 5.5 configuration GUI, then single-stream ICA will be used. We recommend that multi-stream ICA be explicitly enabled as this configuration mode will provide the best performance when optimized by Riverbed. Enabling multi-stream ICA is a very simple and easy configuration step in the XenApp 6.5/XenDesktop 5.5 GUIits just a single check box configuration.

What is multiport ICA?

Multiport ICA is an optional variation of multi-stream ICA where each TCP connection in the ICA session uses a different TCP port. Multi-port ICA was introduced in XenApp 6.5 and XenDesktop 5.5, and it is not enabled by default. It takes at least two separate configuration steps to enable it. The existing RiOS 6.5 software in its default configuration does not work with the optional multi-port ICA feature, although there is a hidden command in RiOS 6.5 that when activated, will allow Steelhead to optimize multi-port ICA. The hidden command feature has not been through formal qualification testing, and therefore it is not yet formally supported by Riverbed. However, customers who are interested in multi-port ICA are welcome to test this hidden command feature for evaluation purposes.

Does ICA traffic for XenApp 6.5 and XenDesktop 5.5 have new encryption that prevents Riverbed from optimizing it?
XenApp 6.5 and XenDesktop 5.5 encryption mechanisms have not changed from earlier versions of XenApp and XenDesktop. Riverbed's existing mechanisms to address the Citrix encryption still work fine when applied to XenApp 6.5 and XenDesktop 5.5, and there are no observed issues.

Does Riverbed support 128-bit encryption for XenApp 6.5 and XenDesktop 5.5?
Yes, the Steelhead has been verified to handle all encryption levels properly when optimizing ICA traffic for XenApp 6.5 and XenDesktop 5.5. This includes the following encryption levels: Basic encryption RC5 (128-bit Login Only) = secure encryption encr-level is 10 RC5 (40-bit) = secure encryption encr_level is 20 RC5 (56-bit) = secure encryption encr_level is 30 RC5 (128-bit) = secure encryption encr_level is 40

Starting with RiOS 7.0, Steelhead appliances are also able to optimize ICA over SSL.

Does Riverbed auto-disable compression feature work for XenApp 6.5 and XenDesktop 5.5?
Yes, the Riverbed auto-disable compression mechanism similarly still works with XenApp 6.5 and XenDesktop 5.5 with no observed issues.

Does Riverbed QoS work with the new multi-stream ICA in XenApp 6.5 and XenDesktop 5.5?
Yes, Riverbeds advanced HFSC-based QoS works fine with multi-stream ICA. Riverbed is able to identify the priority tags associated with each ICA virtual channel and appropriately apply HFSC-based QoS to each TCP connection within the ICA session.

What is HFSC-based QoS?

Riverbed Steelhead QoS enforcement mechanisms use Hierarchical Fair Service Curves (HFSC), an advanced QoS algorithm available in the newest generation of QoS products. HFSC-based QoS systems decouple the process of allocating bandwidth from the process of assigning traffic priority. This is important for traffic classes such as Citrix ICA that require high-priority service, but do not consume a significant amount of bandwidth. HFSC-based QoS mechanisms are especially effective for Citrix ICA traffic that consumes a relatively small amount of bandwidth, but must be given higher-priority service than most other traffic classesespecially other traffic classes that consume significantly greater amounts of bandwidth. Older QoS implementations use some form of packet-based fair queuing algorithm. For example, Citrix Branch Repeater uses

2012 Riverbed Technology. All rights reserved.

FAQ: RIVERBED OPTIMIZATION OF CITRIX ICA TRAFFIC

Weighted Fair Queuing (WFQ) when applying QoS to all traffic types including ICA traffic. But these legacy QoS mechanisms use only one parameter to characterize the performance of a flowguaranteed bandwidth. In a nutshell, WFQ dictates that traffic classes that are allocated the most bandwidth receive the highest priority, while traffic classes that are allocated the least bandwidth receive the lowest priority. WFQ-based systems perform poorly when handling traffic classes such as Citrix ICA, VoIP or Telnet that do not consume much bandwidth, but nevertheless must receive high priority service and low latency forwarding. To deliver QoS for these traffic types, WFQ-based systems must waste bandwidth, by over allocating bandwidth to these highpriority traffic classes that use little bandwidth. Conversely, WFQ-based systems are also a poor match for delay-tolerant traffic that demands significant bandwidth (e.g., CIFS, Email, FTP) because the high bandwidth allocations assigned to this traffic tend to interfere with the QoS provided to low-bandwidth latency-sensitive traffic.

What is the Riverbed Packet-Order Queuing feature for ICA traffic?

When enforcing QoS for single-stream Citrix ICA traffic, Riverbed employs a special patent-pending packet-order queuing discipline that respects the ordering of ICA packets in a flow, even when these packets are classified into different queues based on the ICA virtual channels they belong to. This feature is not available in the Citrix Branch Repeater product. Without this capability when optimizing single-stream ICA traffic there is a possibility that QoS will deliver ICA packets out-of-order, thus causing a TCP retransmission and negatively impacting end-to-end responsiveness and performance for the Citrix ICA application. This feature provides benefits when applying QoS to single-stream ICA traffic, and is particularly valuable if the ICA client is older than version 13.0.0 or if the Citrix server is older than XenApp 6.5 or XenDesktop 5.5. Conversely, it is not needed for Citrix sessions that are using multi-stream ICA.

How do I obtain support for Riverbed optimization of ICA traffic?

The support process is no different than that for any other application. For WAN optimization issues, customers should call Riverbed technical support. For issues related to the application, customers should call the application vendor, in this case Citrix. As with any other application vendor, Citrix may ask that you disable Riverbed optimization to verify the issue does not originate with Riverbed. This is standard practice in resolving support cases regardless of the application and software vendor. In a similar manner, Microsoft support may ask that you disable Riverbed when obtaining assistance for troubleshooting problems with Microsoft applications.

Is the Riverbed Steelhead Citrix Ready Certified?

No, the Steelhead is not currently Citrix Ready Certified. However, its important to note that Citrix Ready is a designation that is for the most part used for application software products that are accessed through XenApp or XenDesktop, and hardware products such as blade servers that are used to host Citrix software products. Citrix Ready is not commonly used for networking devices such as routers, switches, and firewalls.

Is Cisco WAAS Citrix Ready Certified?

The Citrix Ready website lists Cisco WAAS as Citrix Ready Certified, but provides no information on which version of WAAS has achieved the certification. According to Cisco documentation, only WAAS version 4.5.1 (and later) have Citrix ICA optimization capabilities. However, at the time of this writing (mid-February, 2012), WAAS version 4.5.1 has not been officially released and is not generally available to WAAS users. Despite the recent Cisco announcements about Citrix Ready Certification, the purported ICA optimization capabilities in WAAS appear to be only available to beta users for testing and evaluation purposes.

Does Citrix refuse to support products that are not Citrix Ready Certified?
No, Citrix Ready is a marketing program that according to the Citrix website, showcases and recommends third party products, solutions and services. Its purpose is to allow Citrixs partner vendors to gain exposure to Citrix customers. Cisco is one such partner vendor. However, there is no indication anywhere that Citrix users are restricted from using third party products that are not Citrix Ready Certified. In most Citrix environments, it is commonplace to use products that are not Citrix Ready Certified (including all Cisco switches and routers), and it is unheard of for Citrix to refuse support merely because a component of the environment is not Citrix Ready Certified.

Does Citrix support policy prohibit or restrict use of Riverbed products?

No, Citrix support policy does not prohibit or restrict use of Riverbed products including use of Steelhead for optimization of Citrix

2012 Riverbed Technology. All rights reserved.

FAQ: RIVERBED OPTIMIZATION OF CITRIX ICA TRAFFIC

ICA traffic. Citrix merely recommends against using any device that re-writes ICA files. However, Riverbed Steelhead does not have the capability to modify or change ICA files any more than a router or switch does. Citrix is primarily concerned about use of productssuch as some application delivery controllersthat do have the potential to modify or change .INI files. As the most widely-used WAN optimization product in the industry, Riverbed has proven to be reliable for delivering data transparently and without modification to the applicationCitrix in this case.

How does Riverbed Steelhead compare with Cisco WAAS for optimizing Citrix ICA traffic?
Riverbed Steelhead products first offered ICA optimization capabilities in RiOS 6.0, almost three years ago. Today, these capabilities are being used by a substantial portion of Riverbed customers in their production environments. In contrast, the Citrix ICA optimization capabilities in their WAAS product do not appear to be available for WAAS users yet, except for testing and evaluation purposes. According to Cisco documentation, WAAS version 4.5.1 (beta) does not optimize multi-stream ICA used in the newest Citrix products including XenApp 6.5 and XenDesktop 5.5. In contrast, the Riverbed Steelhead has been tested and validated to work with multi-stream ICA in XenApp 6.5 and XenDesktop 5.5. In addition, Riverbed Steelhead can apply memory-based SDR data deduplication technology that avoids adding latency from spinning disk media while optimizing ICA traffic. Cisco WAAS lacks this capability, and must process ICA traffic by storing the ICA data on spinning disk media.

What about competitor claims about Riverbed reverse engineering the ICA protocol?
If layer-7 optimization is to be achieved, then some amount of reverse engineering is required to optimize the application, even if that product is certified or validated by the application provider. Those vendors who disparage Riverbed for reverse engineering tend to overlook the fact that they themselves also perform some amount of reverse engineering when they attempt to optimize third party applications.

Is it possible that Citrix will introduce a change that might impact Riverbed ICA optimization functionality in the future?
Its always possible for any application software vendor to introduce changes that impact the ability of WAN optimization devices to deliver benefits for that vendors application. However, our experience has been that such an event is rare, and when it does occur the new software releases always include backward compatibility and interoperability with previous software versions. This experience has proven to be consistent for not only Citrix, but also Microsoft, IBM, Oracle/SAP, and every other vendor of software applications used by Riverbed customers. In the most recent example use of the newly-released XenApp 6.5 and XenDesktop 5.5 does not require use of the matching new Citrix Receiver version 13.0.0. Rather, the newest Citrix software includes backward compatibility with older Citrix Receiver software, using the older ICA protocol format. Similarly, the newest Citrix Receiver version 13.0.0 is capable of using the older ICA protocol format when communicating with older XenApp and XenDesktop servers. Given these observations, if there had been a compatibility issue, then it would have been a rather simple matter to tell the new application software to use older protocol formats that are known to function well with the Steelhead, at least until a convenient time when the Steelheads can be upgraded with a new RiOS software update that can natively handle the new protocol changes. As discussed earlier in this document, while the newest XenApp 6.5 and XenDesktop 5.5 did introduce some ICA protocol changes, nevertheless the changes did not impact the ability of the Riverbed Steelhead product to provide optimized performance for ICA traffic. Customers are free to choose either the new multistream ICA protocol or to use the older singlestream ICA mechanisms. Riverbed can deliver optimized performance both the new and old ICA protocol formats with no issues.

2012 Riverbed Technology. All rights reserved.

FAQ: RIVERBED OPTIMIZATION OF CITRIX ICA TRAFFIC

About Riverbed
Riverbed Technology is the IT infrastructure performance company. The Riverbed family of wide area network (WAN) optimization solutions liberates businesses from common IT constraints by increasing application performance, enabling consolidation, and providing enterprise-wide network and application visibility all while eliminating the need to increase bandwidth, storage or servers. Thousands of companies with distributed operations use Riverbed to make their IT infrastructure faster, less expensive and more responsive. Additional information about Riverbed (NASDAQ: RVBD) is available at www.riverbed.com

Riverbed Technology, Inc. 199 Fremont Street San Francisco, CA 94105 Tel: (415) 247-8800 www.riverbed.com

Riverbed Technology Ltd. Farley Hall, London Rd., Level 2 Binfield Bracknell. Berks RG42 4EU Tel: +44 1344 354910

Riverbed Technology Pte. Ltd. 391A Orchard Road #22-06/10 Ngee Ann City Tower A Singapore 238873 Tel: +65 6508-7400

Riverbed Technology K.K. Shiba-Koen Plaza, Bldg. 9F 3-6-9, Shiba, Minato-ku Tokyo, Japan 105-0014 Tel: +81 3 5419 1990

2012 Riverbed Technology. 199 Fremont Street, San Francisco, CA 94105 USA. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners.

2012 Riverbed Technology. All rights reserved.