1 © 2016 Citrix | Confidential Successfully Migrating your XenMobile Enterprise Environment Justin Maeder ​Sr. XenMobile Escalation Engineer MAY 2016

2 © 2016 Citrix | Confidential Agenda 1.Architecture overview 2.Prerequisites 3.Migration process 4.Post-requisites 5.Troubleshooting 6.Resource List 7.Q&A

XenMobile Architecture

4 © 2016 Citrix | Confidential MDM LB NS Gateway Device Manager App Controller PostgreSQL MS-SQL 8443/443 MDM – Device Enrollment – 8443/443/ MAM & MicroVPN – MDX Applications – 443

5 © 2016 Citrix | Confidential XenMobile 9.0

6 © 2016 Citrix | Confidential MDM LB NS Gateway MS-SQL 8443/443 MDM – Device Enrollment – 8443/443/ MAM & MicroVPN – MDX Applications – 8443 XenMobile Server 10

7 © 2016 Citrix | Confidential XenMobile 10

8 © 2016 Citrix | Confidential Why should I migrate? Unified administrator console Wider supported device/OS platform More features More cost efficient MTC upgrades are now possible XenMobile 9 going End of Maintenance (EOM) soon! Java 7 no longer supported

9 © 2016 Citrix | Confidential Planning for Upgrade Test Drive Staging Environmen t Full Upgrade Staging Environmen t Full Upgrade Production Environmen t

10 © 2016 Citrix | Confidential Complete upgrade Prerequisites Install a new XMS 10.1 VPX which points to a new DB Install the latest version of the Upgrade Tool Download & copy the help- upgrade.jsp to existing XDM sever Upload encrypted App Controller support bundle Start upgrade process Reboot and log into XMS console Configure V6 licensing Complete upgrade post-requisites

Migration Prerequisites

12 © 2016 Citrix | Confidential What do I need to focus on first? Hypervisor Platform XenServer – 6.0+ Vmware – ESXi 5.1+ Hyper-V – Windows Server 2008 R2+ Database Version – Non-default named instance SQL Postgres – Supported for POC and test environment Pg_hba.conf Postgresql.conf NetScaler version 10.1 build e 10.5 build

13 © 2016 Citrix | Confidential What do I need to focus on first? Certificate Authority – PKI Windows Server 2008 R2 TLS 1.2 Workaround - Windows Server 2012 License Server – V6 licensing model only

14 © 2016 Citrix | Confidential Migration Prerequisites XenMobile Server 10.1 VPX Note: This is not an in-place migration so a new IP address will be needed XenMobile App Controller Patch Note: Reboot required App Controller Encrypted Support Bundle App Controller Server Certificate Imported into NetScaler XenMobile Snapshot App Controller – Before Patch install NetScaler VPX or ns.conf file

15 © 2016 Citrix | Confidential Migration Prerequisites XenMobile Migration Tool – latest version is V5 Device Manager help.upgrade.jsp file \tomcat\webapps\zdm XenMobile Device Manager Certificate Password Password created during original XDM install 2 Additional DMZ IP Addresses Used for MAM Load Balancers on NS XMS FQDN Must match the Device Manager 9.0 FQDN

16 © 2016 Citrix | Confidential Migration Prerequisites SQL Server Name in Device Manager \tomcat\webapps\zdm\WEB-INF\classes\ew-config.properties Four locations where it needs to be updated/changed from hostname to FQDN 1.pooled.datasource.url=jdbc:jtds:sqlserver:// :1433/xxxxxxxx x 2.pooled.datasource.hostname= 3.audit.datasource.url=jdbc:jtds:sqlserver:// :1433/xxxxxxxxx 4.audit.datasource.hostname=

17 © 2016 Citrix | Confidential Disable Load Balancer Virtual Server(s) Disable NetScaler Gateway Virtual Server Migration Prerequisites – Last Step

18 © 2016 Citrix | Confidential Complete upgrade prerequisites Install a new XMS 10.1 VPX which points to a new DB Install the latest version of the Upgrade Tool Download & copy the help- upgrade.jsp to existing XDM sever Upload encrypted App Controller support bundle Start upgrade process Reboot and log into XMS console Configure V6 licensing Complete upgrade post-requisites

Migration Process

20 © 2016 Citrix | Confidential XenMobile 9XenMobile 10 Configuration Device Data

21 © 2016 Citrix | Confidential /uw/

22 © 2016 Citrix | Confidential Migration Types Test Drive Configuration data only NO device or user data Run this First to ensure all configuration data will be migrated Production Upgrade Configuration, device and user data Require additional post-migration configurations No device re-enrollment

23 © 2016 Citrix | Confidential

24 © 2016 Citrix | Confidential Complete upgrade prerequisites Install a new XMS 10.1 VPX which points to a new DB Install the latest version of the Upgrade Tool Download & copy the help- upgrade.jsp to existing XDM sever Upload encrypted App Controller support bundle Start upgrade process Reboot and log into XMS console Configure V6 licensing Complete upgrade post-requisites

Migration Post-requisites

26 © 2016 Citrix | Confidential Migration Post-requisites – XenMobile Server Verify console access – XDM 9.0 administrator credentials Apps show up correctly LDAP configuration Delivery Groups show AD groups Enrolled devices show: Setup V6 licensing Devices will not connect back in before this is setup (30-day grace period) Verify ports & 7279 are open between XMS and License Server

27 © 2016 Citrix | Confidential XenMobile Server Upgrade Current Migration Tool – Migrates server from XDM 9 to XMS 10.1 After verifying ALL data was migrated successfully Backup XMS VM Backup XMS Database Upgrade XMS using.BIN file

28 © 2016 Citrix | Confidential Migration Post-requisites – NetScaler MDM Load Balancer SSL Bridge Unbind the XenMobile Device Manager 9.0 services and replace with the newly added XenMobile Server 10 services Port: 443 :: Protocol: SSL_Bridge Port: 8443 :: Protocol: SSL_Bridge

29 © 2016 Citrix | Confidential Migration Post-requisites – NetScaler MDM Load Balancer SSL Offload You do NOT need to modify the Devices or Root CA certs that are currently bound Unbind the XenMobile Device Manager 9.0 services and replace with the newly added XenMobile Server 10 services Port: 80 :: Protocol: SSL Enable Port 80 within the XMS firewall – Via CLI

30 © 2016 Citrix | Confidential MAM LB XenMobile Server 10 Newly enrolled devices 8443 – XMS FQDN – 8443 Previously enrolled devices 443 – App Controller FQDN – 8443 Migratio n LB NetScaler Gateway AppC XMS FQDN

31 © 2016 Citrix | Confidential Migration Post-requisites - NetScaler Migration LB Load Balancing Virtual Server IP address must meet RFC1918 standards Protocol: SSL Port: 443 Service/Service Group XenMobile 10 IP address Protocol: SSL Port 8443 Server Id: Node ID found in XMS CLI Bind App Controller Server Certificate Create A New Address Record App Controller FQDN  Migration LB IP

32 © 2016 Citrix | Confidential MAM LB Load Balancing Virtual Server IP address must meet RFC1918 standards Protocol: SSL Port: 8443 Persistence: CUSTOMSERVERID ​ Expression: HTTP.REQ.COOKIE.VALUE(“ACNODEI D”) Service/Service Group XenMobile 10 IP address Protocol: SSL Port 8443 Server Id: Node ID found in XMS CLI Migration Post-requisites – NetScaler Bind XenMobile Server Certificate (SSL Listener) Create A New Address Record XenMobile Server FQDN  MAM LB IP

33 © 2016 Citrix | Confidential Migration Post-requisites – NetScaler Gateway Reconfigure STA within NetScaler Gateway :8443 Change App Controller FQDN field to XMS FQDN:8443 Change Session Polices from App Controller FQDN to XMS FQDN:8443 Add the XenMobile Server FQDN to the Allowed Domains for Clientless Access

Troubleshooting Common Issues

35 © 2016 Citrix | Confidential Browser Cache.. Prior to updating the Upgrade Tool After updating the Upgrade Tool

36 © 2016 Citrix | Confidential Common Issues Migrations that contain a XenMobile Device Manager FQDN with uppercase letters Example: CitrixSynergy.Domain.com Symptoms – Worx Home will not open after the device successfully enrolls Fixes – Prior to the migration, modify your Device Manager hostname within the EW-Config.properties file and Server Groups within XDM console ios.mdm.https.host=CitrixSynergy.Domain.com zdm.awareness.http-plain.host=CitrixSynergy.Domain.com zdm.awareness.https-no-auth.host=CitrixSynergy.Domain.com zdm.awareness.https-want-auth.host=CitrixSynergy.Domain.com Fixed in latest Migration Tool

37 © 2016 Citrix | Confidential Common Issues Migrations that contain a custom store name within the App Controller Default name is Store Symptoms - Error "Please contact support for access to your applications“ during device enrollment Fixes – Prior to the migration, change the store name back to the default name – Store Fixed in XMS **Single name store** Example “Citrix” **Store name with spaces will NOT work** Example “Citrix Store” If this issue occurs after the migration, change the store name back to the default – This will NOT affect the migration

38 © 2016 Citrix | Confidential FAQ Q: If my XenMobile migration fails, can I rollback to 9.0? A: Yes you can, the sooner the better after the migration fails. Any changes made to the XMS 10 configuration or any devices enrolled will no longer work. Q: Can I migrate from Device Manager 8.x to 10? A: No, the XenMobile Migration Tool will only support migrations from 9.0 Q: Can I migrate from a PostgreSQL DB to a remote SQL server? A: No, we do not support cross platform DB migrations Q: Can I run XenMobile 9 & XenMobile 10 simultaneously in my environment? Yes you can, but a mobile device can only be enrolled in 1 EMM instance at a time.

39 © 2016 Citrix | Confidential Review How does XenMobile 9 communication flow differ from XenMobile 10 What pre-requirements are necessary to review prior to starting the migration What are the key steps in the migration process What post-requirements are necessary to complete to regain communication with previously enrolled devices What are some of the common issues that I may run into and how do I fix them

40 © 2016 Citrix | Confidential Resources Lessons Learned on the Field Citrix Product Documentation FAQ: XenMobile 10 Migration Tool Supporting Named SQL Instances Supporting XenMobile Upgrade Rollbacks

41 © 2016 Citrix | Confidential Q & A

42 © 2016 Citrix | Confidential