System and Connectivity Requirements 编辑
System and Connectivity Requirements
Citrix Cloud provides administrative functions (through a web browser) and operational requests (from other installed components) that connect to resources within your deployment. This article describes the system requirements, required contactable Internet addresses, and considerations for establishing connectivity between your resources and Citrix Cloud.
System requirements
Citrix Cloud requires the following minimum configuration:
- An Active Directory domain
- Two physical or virtual machines, joined to your domain, for the Citrix Cloud Connector. For more information, see Citrix Cloud Connector Technical Details.
- Physical or virtual machines, joined to your domain, for hosting workloads and other components such as StoreFront. For more information about system requirements for specific services, refer to the Citrix documentation for each service.
For information about scale and size requirements, see Scale and size considerations for Cloud Connectors.
Supported web browsers
- Latest version of Google Chrome
- Latest version of Mozilla Firefox
- Latest version of Microsoft Edge
- Microsoft Internet Explorer 11
- Latest version of Apple Safari
Transport Layer Security requirements
Citrix Cloud supports Transport Layer Security (TLS) 1.2 for TCP-based connections between components. Citrix Cloud doesn’t allow communication over TLS 1.0 or TLS 1.1.
To access Citrix Cloud, you must use a browser that supports TLS 1.2 and have accepted cipher suites configured. For more information, see Encryption and key management.
Citrix Cloud management console
The Citrix Cloud management console is a web-based console that you can access after signing in at https://citrix.cloud.com. The webpages that make up the console might require other resources on the Internet, either when signing in or at a later point when carrying out specific operations.
Proxy configuration
If you’re connecting through a proxy server, the management console operates using the same configuration applied to your web browser. The console operates within the user context, so any configuration of proxy servers that require user authentication should work as expected.
Firewall configuration
For the management console to operate, you must have port 443 open for outbound connections. You can test general connectivity by navigating within the console.
Console notifications
The management console uses Pendo to display critical alerts, notifications about new features, and in-product guidance for some features and services. To ensure you can view Pendo content within the management console, Citrix recommends that the address https://citrix-cloud-content.customer.pendo.io/
is contactable.
Services that display Pendo content include:
- Analytics
- Content Collaboration
- Citrix DaaS (formerly Citrix Virtual Apps and Desktops service)
- Workspace
Pendo is a third-party sub-processor that Citrix uses to provide cloud and support services to Citrix customers. For a complete list of these sub-processors, see Sub-Processors for Citrix Cloud & Support Services and Citrix Affiliates.
Session time-outs
After an administrator signs in to Citrix Cloud, the management console session times out after the following intervals have elapsed:
- Idle sessions (no console activity detected): 60 minutes
- Maximum session timeout (regardless of console activity): 24 hours
After the maximum session timeout elapses, any unsaved configuration changes are lost and the administrator must sign in again.
On-premises product registration
If you are using Citrix Cloud with Citrix License Server to register your on-premises products, ensure the following addresses are contactable:
https://trust.citrixnetworkapi.net
(for retrieving a code)https://trust.citrixworkspacesapi.net/
(for confirming the license server is registered)https://cis.citrix.com
(for data upload)https://core-eastus-release-a.citrixworkspacesapi.net
https://core.citrixworkspacesapi.net
ocsp.digicert.com port 80
crl3.digicert.com port 80
crl4.digicert.com port 80
ocsp.entrust.net port 80
crl.entrust.net port 80
If you are using a proxy server with Citrix License Server, ensure the proxy server is configured as described in Configure a proxy server in the Licensing product documentation.
Citrix Cloud Connector
The Citrix Cloud Connector is a software package that deploys a set of services that run on Microsoft Windows servers. The machine hosting the Cloud Connector resides within the network where the resources you use with Citrix Cloud reside. The Cloud Connector connects to Citrix Cloud, allowing it to operate and manage your resources as needed.
For requirements for installing the Cloud Connector, see System requirements. To operate, the Cloud Connector requires outbound connectivity on port 443. After installation, the Cloud Connector might have additional access requirements depending on the Citrix Cloud service with which it is being used.
The machine hosting the Cloud Connector must have stable network connectivity with Citrix Cloud. Networking components must support HTTPS and long-lived secure web sockets. If a timeout is configured in the networking components, it must be greater than 2 minutes.
For help with troubleshooting connectivity between the Cloud Connector and Citrix Cloud, use the Cloud Connector Connectivity Check Utility. This utility runs a series of checks on the Cloud Connector machine to verify it can reach Citrix Cloud and related services. If you use a proxy server in your environment, all connectivity checks are tunneled through your proxy server. To download the utility, see CTX260337 in the Citrix Support Knowledge Center.
Cloud Connector common service connectivity requirements
Connecting to the Internet from your data centers requires opening port 443 to outbound connections. However, to operate within environments containing an Internet proxy server or firewall restrictions, further configuration might be needed. For more information, see Cloud Connector Proxy and Firewall Configuration.
The addresses for each service in this article must be contactable to properly operate and consume the service. The following list includes the addresses that are common to most Citrix Cloud services:
https://*.citrixworkspacesapi.net
(provides access to Citrix Cloud APIs that the services use)https://*.cloud.com
(provides access to the Citrix Cloud sign-in interface)https://*.blob.core.windows.net
(provides access to Azure Blob Storage, which stores updates for Citrix Cloud Connector)https://*.servicebus.windows.net
(provides access to Azure Service Bus, which is used for logging and the Active Directory agent)
These addresses are provided only as domain names because Citrix Cloud services are dynamic and their IP addresses are subject to routine changes.
As a best practice, use Group Policy to configure and manage these addresses. Also, configure only the addresses that are applicable to the services that you and your end-users are consuming.
If you are using Citrix Cloud with Citrix License Server to register your on-premises products, see On-premises product registration in this article for additional required contactable addresses.
Allowed FQDNs for Cloud Connector
For a complete list of the fully-qualified domain names (FQDNs) that the Cloud Connector accesses, refer to the JSON file located at https://fqdnallowlistsa.blob.core.windows.net/fqdnallowlist-commercial/allowlist.json. This list is grouped by product and includes a change log for each group of FQDNs.
Some of these FQDNs are specific to a customer and include templated sections in angular brackets. These templated sections must be replaced with the actual values before use. For example, for <CUSTOMER_ID>.xendesktop.net
, you replace <CUSTOMER_ID>
with the actual customer ID for your Citrix Cloud account. You can find the customer ID in the following console locations:
- In the top-right corner of the screen, beneath the customer name for your Citrix Cloud account.
- On the Account Settings page, under Citrix Cloud Customer ID (CCID).
- On the Secure Clients tab (Identity and Access Management > API Access > Secure Clients.
Certificate validation
Cloud Connector binaries and endpoints that the Cloud Connector contacts are protected by X.509 certificates that are verified when the software is installed. To validate these certificates, each Cloud Connector machine must meet certain requirements. For a full list of these requirements, see Certificate validation requirements.
SSL Decryption
Enabling SSL decryption on certain proxies might prevent the Cloud Connector from connecting successfully to Citrix Cloud. For more information about resolving this issue, see CTX221535.
Citrix Connector Appliance for Cloud Services
The Connector Appliance is an appliance that you can deploy in your hypervisor. The hypervisor hosting the Connector Appliance resides within the network where the resources you use with Citrix Cloud reside. The Connector Appliance connects to Citrix Cloud, allowing it to operate and manage your resources as needed.
For requirements for installing the Connector Appliance, see System requirements.
To operate, the Connector Appliance requires outbound connectivity on port 443. However, to operate within environments containing an Internet proxy server or firewall restrictions, further configuration might be needed.
To properly operate and consume the Citrix Cloud services, the following addresses must be contactable:
https://*.cloud.com
https://*.citrixworkspacesapi.net
https://*.citrixnetworkapi.net
https://*.*.nssvc.net
Customers who can’t enable all sub-domains can use the following addresses instead
https://*.g.nssvc.net
https://*.c.nssvc.net
https://*.servicebus.windows.net
https://iwsprodeastusuniconacr.azurecr.io
https://iwsprodeastusuniconacr.eastus.data.azurecr.io
Network requirements
Ensure that your Connector Appliance environment has the following configuration:
- Either the network allows the Connector Appliance to use DHCP to get DNS and NTP servers, an IP address, a host name, and a domain name or you can manually set the network settings in the Connector Appliance console.
- The network is not configured to use the link-local IP ranges 169.254.0.1/24, 169.254.64.0/18 or 169.254.192.0/18, which are used internally by the Connector Appliance.
- Either the hypervisor clock is set to Coordinated Universal Time (UTC) and is synchronized with a time server or DHCP provides NTP server information to the Connector Appliance.
- If you use a proxy with Connector Appliance, the proxy must be unauthenticated or use basic authentication.
Citrix Analytics service connectivity
- For in-product messages including new features and critical communications:
https://citrix-cloud-content.customer.pendo.io/
- Additional requirements: Prerequisites
For more information about onboarding data sources to the service, see Supported data sources.
Application Delivery Management service connectivity
For complete Internet connectivity requirements, see Supported ports.
Content Collaboration service connectivity
Citrix resource location / Cloud Connector:
- Cloud Connector common service connectivity requirements
https://*.sharefile.com
- Additional requirements: ShareFile Firewall Configuration and IP Address (CTX208318)
- For in-product messages including new features and critical communications:
https://citrix-cloud-content.customer.pendo.io/
Administration console:
https://*.citrixworkspacesapi.net
https://*.cloud.com
- Additional requirements: ShareFile Firewall Configuration and IP Address (CTX208318)
Citrix DaaS service connectivity
Citrix resource location / Cloud Connector:
- Cloud Connector common service connectivity requirements
https://[customerid].xendesktop.net
, where[customerid]
is the customer ID parameter displayed on the Secure Clients tab (Identity and Access Management > API Access > Secure Clients) of the Citrix Cloud management console.- Customers using Citrix Virtual Apps Essentials need to use
https://*.xendesktop.net
instead.
- Customers using Citrix Virtual Apps Essentials need to use
- Customers using Quick Deploy to install Citrix DaaS need to make these additional addresses contactable:
https://*.apps.cloud.com
- The
AzureCloud
service tag
https://*.*.nssvc.net
- Customers who can’t enable all subdomains can use the following addresses instead:
https://*.g.nssvc.net
https://*.c.nssvc.net
- Customers who can’t enable all subdomains can use the following addresses instead:
For an overview of how the Cloud Connector communicates with the service, refer to the Citrix DaaS diagram on the Citrix Tech Zone web site.
Administration console:
https://*.citrixworkspacesapi.net
https://*.citrixnetworkapi.net
https://*.cloud.com
https://[customerid].xendesktop.net
, where[customerid]
is the customer ID parameter displayed on the Secure Clients tab (Identity and Access Management > API Access > Secure Clients) of the Citrix Cloud management console.- Customers using Citrix Virtual Apps Essentials need to use
https://*.xendesktop.net
instead.
- Customers using Citrix Virtual Apps Essentials need to use
https://*.*.nssvc.net
(Not required for Citrix DaaS Standard for Azure)- Customers who can’t enable all sub-domains can use the following addresses instead:
https://*.g.nssvc.net
https://*.c.nssvc.net
- Customers who can’t enable all sub-domains can use the following addresses instead:
- For in-product messages including new features and critical communications:
https://citrix-cloud-content.customer.pendo.io/
Local Host Cache requirement
If your firewall performs packet inspection and you want to use the Local Host Cache feature, ensure your firewall accepts XML and SOAP traffic. This feature requires the ability to download MDF files, which occurs when the Cloud Connector synchronizes configuration data with Citrix Cloud. These files are delivered to the Cloud Connector through XML and SOAP traffic. If the firewall blocks this traffic, the synchronization between the Cloud Connector and Citrix Cloud fails. If an outage occurs, users can’t continue working because the configuration data residing on the Cloud Connector is out-of-date.
For more information about this feature, see Local Host Cache in the Citrix DaaS product documentation.
Endpoint Management service connectivity
Citrix resource location / Cloud Connector:
- Cloud Connector common service connectivity requirements
- Additional requirements: /wiki/citrix/en-us/citrix-endpoint-management/endpoint-management.html
Administration console:
https://*.citrix.com
https://*.citrixworkspacesapi.net
https://*.cloud.com
https://*.blob.core.windows.net
- Additional requirements: /wiki/citrix/en-us/citrix-endpoint-management/endpoint-management.html
Citrix Gateway service connectivity
- Cloud Connector common service connectivity requirements
https://*.*.nssvc.net
- Customers who can’t enable all subdomains can use the following addresses instead:
https://*.g.nssvc.net
https://*.c.nssvc.net
- Customers who can’t enable all subdomains can use the following addresses instead:
Important:
SSL interception cannot be performed on Citrix Gateway addresses. Enabling SSL interception on certain proxies might prevent the Cloud Connector from connecting successfully to Citrix Cloud.
Citrix Intelligent Traffic Management service connectivity
https://*.cedexis-test.com
https://*.citm-test.com
https://cedexis.com
https://cedexis-radar.net
SD-WAN Orchestrator service connectivity
For complete Internet connectivity requirements, see Prerequisites for Citrix SD-WAN Orchestrator service usage.
Remote Browser Isolation (formerly Secure Browser) service connectivity
Citrix resource location / Cloud Connector:
Cloud Connector common service connectivity requirements
Administration console:
https://*.cloud.com
https://*.citrixworkspacesapi.net
https://browser-release-a.azureedge.net
https://browser-release-b.azureedge.net
Citrix Secure Private Access service connectivity
https://*.netscalergateway.net
https://*.*.nssvc.net
- Customers who can’t enable all subdomains can use the following addresses instead:
https://*.g.nssvc.net
https://*.c.nssvc.net
- Customers who can’t enable all subdomains can use the following addresses instead:
Citrix Workspace service connectivity
https://*.cloud.com
https://*.citrixdata.com
- For in-product messages including new features and critical communications:
https://citrix-cloud-content.customer.pendo.io/
To ensure subscribers can successfully access their content in Citrix Files and Content Collaboration through Workspace, Citrix recommends allowing the domains listed in CTX208318.
Workspace single sign-on with Citrix Federated Authentication Service
The console and FAS service access the following addresses using the user’s account and the Network Service account, respectively.
- FAS administration console, under the user’s account
*.cloud.com
*.citrixworkspacesapi.net
- Addresses required by a third party identity provider, if one is used in your environment
- FAS service, under the Network Service account:
*.citrixworkspacesapi.net
If your environment includes proxy servers, configure the user proxy with the addresses for the FAS administration console. Also, ensure the address for the Network Service account is configured as appropriate for your environment.
Workspace Environment Management service connectivity
https://*.wem.cloud.com
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论