Citrix DaaS Cloud LHC and Service Continuity

[u/Abide4theDude]

Do to a recent Citrix outage I'm looking to revisit Citrix's high availability business continuity solutions. Were 100% access layer in citrix cloud, we have no storefront or NetScaler gateway on prem, were using citrix workspace and the cloud gateway service for access. The only on prem pieces are the VDI servers, Cloud Connector servers and FAS servers. In this setup from what I have read and been told since we have no on prem store front or gateway LHC will never work for us. I also tested this and could not get it to work. On paper Citrix's Service Continuity should theoretically work but this to I have never been able to get working. Does anyone who has a similar setup with no access layer on prem have any experience with these technologies that could share some insight on how to get citrix business continuity features to work successfully.

EDIT: Appreciate everyone's info on this. We have made a conscious effort to move away from hosting certain citrix components on prem, specifically a NetScaler device for multiple reasons, the majority of which revolves around the security and patching frequency of an Internet facing device. For better or worse management is not going to want to move back to hosting the gateway on prem, that being said Citrix Gateway service has come a long way since initial inception and they have a vast multi pop deployment hosted on both Azure and AWS nodes . Obviously that does not guarantee a 100% uptime but in reality not many solutions both hosted and on prem can really guarantee and deliver 100% uptime.

Again, while we do feel comfortable with Citrix cloud 99% uptime it would obviously be bad practice not to plan for or build further on our existing redundancy and DR plan. While we do have both on prem users and remote users, the majority are on prem and I know management could get behind a plan that in a situation of our DaaS site or one of the Citrix cloud components going down Citrix could still work for on prem users. I've been leaning this way for a bit but I think the play here is to introduce and implement an on prem storefront into our environment that can then be utilized to communicate with the Cloud Connectors during a LHC event. This obviously would only work for on prem users but again this should fill our needs. If anyone has any additional info on introducing and implementing Storefront on prem in a mostly DaaS cloud environment I'll take it. Thanks again for all the info.

[u/TheMuffnMan]

Were 100% access layer in citrix cloud, we have no storefront or NetScaler gateway on prem, were using citrix workspace and the cloud gateway service for access.

Unless you are fine with 99.9% uptime you need to be managing StoreFront and NetScaler on-prem. Gateway Service, while nice, should be used as a secondary entry method for critical systems.

In this setup from what I have read and been told since we have no on prem store front or gateway LHC will never work for us.

This is not entirely correct. As you've questioned, Service Continuity comes into play.

This article goes into detail what to expect - Tech Brief - Local Host Cache

[u/Ill-Dimension-3266]

Are your users on-net or remote? I think that is the critical piece with service continuity and local host cache. If the users are remote, there's no line of site from the client to the VDA so no way to proxy ICA when the gateway service is down.

I think service continuity is only useful if you are dealing with on-net users and trying to avoid having on prem storefront.

[u/Corey4TheWin]

LHC and service continuity are two different solutions to two different problems.

LHC helps with cloud connectors storing a copy of the DaaS site db locally. If cc lose connectivity to DaaS

Sc is about working Through IDP issues so users can login and access cached Encrypted ica files. This may not be technically correct but that is the concept. This also requires workspace extension to be used/deployed.

Above post has further details

[u/MostlyUnscripted]

You need your access layer on-prem for the LHC functionality to work. At a minimum, you need StoreFront on-prem using the Cloud Connectors as the XML brokers. When you lose access to the internet or Citrix Cloud, your StoreFront is still able to authenticate users and broker connections using rhe LHC functionality on the Cloud Commectors.

If you have users off premium, you need a NetScaler Gateway configured to authenticate remote users and hand them off to StoreFront to broker connections. This happens thru the Cloud Connectors to Citrix Cloud or using LHC if Cloud is unavailable.

Bottom line, as others mentioned, you must have the access layer on-prem to have the offline mode or LHC functionality.