Cisco Mobile Workspace Solution with Citrix

Introduction

---

May 14, 2014

Historically the workplace defined the workspace, but trends in mobility have impacted both. Ten years ago, Cisco published a CVD that expanded the workplace to include the home office, which allowed employees to join the corporate network securely, allowing them to remain productive even when not physically on campus. This transformed the workplace, but the devices limited the solution. Often the employee would carry the same laptop back and forth between the campus and the home office out of necessity. While the expanded network kept the devices connected, the data (e.g., an Office document, email, etc.) physically resided on a hard drive in the device. Corporate policy required that only a specific device could be trusted for use by a specific employee.

This Cisco Mobile Workspace Solution with Citrix design guide finally addresses that limitation. A single device no longer binds a user to their work. Instead the device is a tool or a conduit that allows employees to interact with their content. In the ever-continuing effort to maximize productivity gains, organizations are responding by removing restrictions that limit how a user interacts with data, yet still recognize that this content represents intellectual property and is a corporate asset that must be protected. When thinking about productivity, work is user interaction with data. This interaction has context. For example, creating a spreadsheet is a different activity than looking up data in a spreadsheet. The data itself should not be bound by the application, which is especially true in organizations that have developed legacy in-house applications that now must be extended to additional mobile platforms. This design guide explores how users can better interact with data by abstracting the layers that separate them. Conceptually this is accomplished with a mobile workspace. The term is dual purpose: first, the workspace is accessible on mobile devices but, more importantly, the workspace is not tied to any single device or platform. Users can interact with their work securely from any device, anytime, anywhere.

The CVD is broken into several sections that cover on-campus and remote devices using both native applications and virtualized desktops, however these are not mutually-exclusive deployment models. A comprehensive solution includes a range of components to enable a truly fluid mobile experience while securing both the network and the device without compromising the user experience. Cisco and Citrix offer a unique solution that leverages a full range of products that can now integrate together in ways not previously possible. For example, Citrix XenMobile Device Manager and Cisco Identity Services Engine (ISE) can integrate over an API to ensure that network policy and device policy complement one another. The device manager is responsible for establishing mobile policy on hand-held compute devices such as smartphones and tablets. XenMobile device manager is also capable of establishing policy on MacBooks and limited policy on Window devices, although they are not the focus of this guide.

Cisco ISE sets network policy with respect to what level of access a particular device has on the corporate network and the compliance conditions that must be met prior to gaining network connectivity. Cisco ISE can enforce device policy by restricting access to the corporate network, ensuring that mobile devices do not pose a security threat to corporate resources. This is accomplished by setting access appropriate for both the user’s role and asset class of the networked device. Active Directory group membership defines the users role, while the ownership of the device sets the asset class. The CVD builds on concepts introduced in the BYOD design guide and covers employee-owned and corporate-owned devices. The same user in AD does not get the same access level on their personal device as they do on their corporate device. This is true both on campus as well as for remote users that attach to a VPN head-end device. Remote access is covered in a later section.

Citrix XenMobile is a comprehensive solution to manage mobile applications, data, and devices. Users have single-click access to all of their apps from a unified corporate app store and IT can easily configure, secure, and support mobile devices. With XenMobile, IT can meet their compliance and control requirements while giving users the freedom to experience work and life their way.

Citrix is a leading provider of enterprise mobility management (EMM) software used to establish and enforce device policy on hand-held endpoints, which might include corporate- and employee-owned phones and tablets. Devices manufactured by all the major equipment providers are supported at some level. Apple and Android devices are the primary focus, but XenMobile also supports Blackberry and Windows 8 mobile devices.

Enterprise mobility management is a relatively new phenomenon and is in a constant state of expansion. Features can be thought of in several categories:

• Device Restrictions—There are two common types of restrictions. Either some feature of the device is disabled, such as the camera, or there are additional requirements for basic usage, such as a PIN lock or storage encryption. When a restriction is in place, the user is not offered the choice of non-compliance. Restrictions are used to reduce security risks to the enterprise.
• Device Compliance—This may also be referred to as posture enforcement. The XenMobile Device Manager checks the attributes of the device against a list of acceptable operational conditions. Compliance checks can be enforced based on their severity. For example, an email could be sent to the user if they are running a software version known to contain a vulnerability or XenMobile can automatically issue a selective wipe if the device has been compromised. A compliance check is different from a restriction because the user can become out of compliance. XenMobile uses automatic actions to respond to non-compliant devices. Compliance can be used to increase security and reduce operational costs.
• Content Distribution—Bookmarks, Web Clips, and other content can be pushed to devices in the background without user intervention or made available on demand. Content distribution is used to increase productivity. XenMobile can push content to Android devices natively. Both Apple and Android can leverage Citrix’s ShareFile to distribute content from on-premise or cloud-based data repositories. Web Clips are HTML bookmarks that are displayed as application icons on an Apple mobile device.
• Application Distribution—The XenMobile Device Manager can offer a company catalog of available software or in the case of Apple devices, push required software to the device. The software can come from public repositories or can be corporate-developed applications. Application distribution has both security and productivity gains. Security is enhanced because any software distributed by the XenMobile Device Manager or AppController, including local storage associated to the software, can be removed as part of a corporate wipe. This is not true if the user installs the same software from Apple’s App Store, Google Play, or any Android marketplace. The XenMobile Device Manager can also inventory devices for installed software. AppController has the additional advantage of integration with Store Front to offer virtualized applications that are offered through Citrix Receiver.

Citrix XenMobile consists of two core function, XenMobile Device Manager and XenMobile Application Controller. Together they are known as XenMobile Enterprise Edition. The XenMobile Device Manage provides MDM functionality, including traditional device management through the use of policy profiles. XenMobile AppController is a full application life cycle management tool that can integrate into Citrix StoreFront and, by extension, XenDesktop. Citrix offers XenMobile Mobile Device Manager Edition and XenMobile App edition to allow enterprises to customize their deployment to meet their needs. This CVD incorporates device and application management and requires XenMobile Enterprise edition, which includes both components.

Beyond these, there are additional components for enterprise integration, such as WorxMail for secure email, WorxWeb for secure Web browsing, and ShareFile for secure collaboration. Together these components integrate to form a comprehensive mobile policy framework that enables the mobile workforce.

Until recently, many organizations may have simply chosen to grant restricted access to the network and allow only communications between the mobile device and a virtual desktop infrastructure. In doing so, the organization can be sure that access to corporate applications and sensitive data can only be accomplished through the use of a secured, unalterable virtual desktop environment with no data stored locally. When considering this approach, the XenDesktop family of products is the leading solutions in Desktop Virtualization. When combined with WAN Optimization technologies such as Cisco WAAS, protocol enhancements through “Citrix HDX” and Citrix Receiver, the user experience from mobile devices even over slower Internet connections is greatly enhanced.

Overview

This CVD brings together components from Cisco with those from Citrix and details how the complementary mobility offerings can work together to provide a flexible and customizable solution that can meet the full set of requirements needed for a successful mobile workspace program. The CVD presents several use cases to further illustrate the application of this solution to likely business needs. The following use cases are covered:

• Corporate-owned device with full access
• Employee-owned device with full access
• Employee-owned device with partial access
• Contractor-owned device with restricted project access

These use cases generally extend those presented in the most recent version of the Cisco BYOD CVD ( http://www.cisco.com/c/en/us/solutions/enterprise/data-center-designs-cloud-computing/own_device.html ). The intent of the use cases is to illustrate the flexibility of the system and is not meant to restrict how the features of the system can be configured. Within solution design, there is often a trade-off between an extremely secure system and those that deliver a very open user experience. Specific use cases have been chosen to explore how a balance can be achieved by weighing corporate risk against employee productivity.

Although the system is composed of products from both Cisco and Citrix, the foundation is built from the Cisco BYOD CVD, which describes how to provide secure network access to a wide variety of devices, both wired and wireless. A REST API that is supported between the system components makes the integration between Cisco ISE and the XenMobile Device Manager possible. The device manager responds to requests from ISE with respect to a device’s operational parameters, including for example the presence of a PIN Lock on the device and the version of the OS. ISE uses this information to establish the level of network access to which the device and user are entitled. In addition, ISE can request that the device manager execute several tasks on the behalf of ISE, such as removing all corporate data from the device or locking the device.

There is a focus on mobile productivity. Users want to interact with their work from a wide range of device, including smartphones and tablets. With the exception of images and video, most smartphones consume data. Mobile devices are unique because they are always connected either via LTE or WiFi and can be used almost instantly without lengthy boot-up times. They also have ready-to-use video, GPS location, accelerometers, piezo compasses, and a range of other physical sensors they may be attached via Bluetooth. These attributes make mobile devices a compelling platform for a range of new business applications that were not possible on legacy devices such as laptops. Mobile applications offer context around data that is unique. This context has the potential to deliver large productivity gains when fully leveraged, usually through the use of in-house-developed mobile applications. For example, an insurance company could create a claims application that allowed adjusters to include high-resolution pictures or video, GPS location information, or the customer’s verbal statement could be attached to a claim that is filed from the field in real-time. Other companies may already have a Windows-based application that is installed on laptops mounted in the adjuster’s car and may want to port those applications quickly onto a new mobile tablet. The Cisco Mobile Workspace Solution with Citrix enables both scenarios.

Cisco Mobile Workspace Solution with Citrix Components

There are several components required to enable Cisco Mobile Workspace Solution with Citrix. Some components described here could be replaced or substituted with similar products that provide equivalent functionality, such as a Certificate Store. Other components are core to this solution, for example ISE and the WorkHome client. In addition, there is some product overlap between Cisco and Citrix and there may be more than one way to accomplish a specific goal. Not all possible configurations are presented here. In addition, some essential components are not discussed that are a prerequisite for the solution, including DHCP Servers, DNS, NTP, route protocols, and other fundamental network services.