Simon Bramfitt

The Citrix Nirvana Phone

After being completely underwhelmed by the iPad launch, it has fallen to Citrix of all companies to renew my enthusiasm for mobile devices. A little over two years after Chris Fleck (Citrix VP of Community and Solutions Development) first introduced me to the idea of using a smart phone as a laptop replacement, Citrix announced this morning the latest iteration of its Nirvana Phone concept.

The first iteration of the Nirvana Phone took at its core idea the notion that the then current generation of smart phones (think first generation iPhone) were approaching the level of performance needed to run the Citrix Receiver successfully. If that was the case then with the addition of a Bluetooth mouse and keyboard and a HD video out connection it would be quite possible for your phone to become your always connected mobile thin client. Of course it didn't escape attention that if this idea took off it would most likely result in Citrix selling a few more XenApp and XenDesktop licenses.

Two years later we are still waiting for the Nirvana Phone, all of the individual parts are available all that we are lacking is for someone to assemble them all in a single compelling package, and that is where today's announcement starts. Citrix working together with OK Labs (who I mentioned in my last post) have released a reference architecture document describing a second generation Nirvana Phone that builds on the core concept but updates it to take into account the latest developments in mobile hypervisor capabilities.

I have to stress the word concept, Citrix is most definitely not in the mobile handset business (although OK Labs most definitely is, albeit in a very specialized area). Think of this more as a conversation starter than a clear statement of direction of things to come from Citrix.

The Nirvana Phone concept extends Citrix’s vision for mobile application delivery beyond the point I described it in my last post. Instead of writing a separate Citrix Receiver for each mobile device operating system, the Nirvana Phone has at its heart the OK Labs OKL4 Microvisor, with the Citrix Receiver implemented as what is in effect a virtual appliance running directly on the hypervisor. This brings with it two key advantages; firstly Citrix could now, in theory anyway, provide a single Citrix Receiver for use on all phones running the OK Labs Microvisor (and that's a quite staggering 500 million devices). Secondly by running the Citrix Receiver in its own virtual machine it is significantly more secure than it would be when running alongside many other applications. The second point might not be off too much concern today, but as the number of open ecosystem App stores such as Cydia and the Android Market increases so does the risk of malware gaining a foothold on smart phones. At some point corporate IT will have to wake up to this risk and a secure Citrix Receiver may be just the thing they are looking for to marry the needs of security with the convenience of mobile applications.

Anyway, here's a short video of Chris Fleck demonstrating the Nirvana phone.

How cool is that. 

The demo is is real, there's no trickery involved here. That phone is a standard smartphone, although perhaps only recognizable if you are outside the US. Even so, I'm afraid you can't go out buy a working Nirvana Phone today. While the hardware is off the shelf, the firmware has been hacked somewhat to install the Citrix Receiver. 

What are the chances that we will see a Nirvana Phone for sale any time soon?  Well, the OKL4 Microvisor is embedded in smartphones such as the HTC G1, G2, and the HTC Hero, the Motorola Droid and Cliq, the Palm Pre, and the Toshiba TG01OK . Most significantly the OKL4 Microvisor powers the world's only commercially-available fully-virtualized smartphone, the Motorola Evoke QA4.  So the core technology is already operational in the field, and it becomes a matter of detail to get the Citrix Receiver integrated with a production platform - that and find a mobile wireless operator interested in offering it as a service.

I almost forgot, Citrix and OK Labs are hosting a joint Webinar on the Nirvana Phone on February 9th. 

Application delivery and the evolution of endpoints

Anyone who hasn't been hiding under a rock for the last few weeks won't have been able to avoid the brouhaha concerning the highly anticipated launch of Apple's tablet. Not quite as exciting to some, but certainly more real was Steve Ballmer's keynote at CES last week, where he showed off Windows based tablets from HP, Archos and Pegatron. At the same time there has been an explosion of announcements on Android tablets with manufacturers such as Archos (again), Compal, Dell, HP (again), and Motorola, offering tablets ranging in size from 5 to 10 inches. While in the UK, T-Mobile has announced its own monster 15 inch Vega tablet that will also run Android. If this wasn't enough Intel is pushing Moblin their own Linux-based OS at Netbook manufacturers and have just launched the beta of AppUp Center Intel's take on the single platform application storefront. And let's not forget Walt Mossberg’s interview with Google's VP of Engineering Andy Rubin strongly hinting that Google has RIM in its sights by announcing plans for an enterprise version of the Nexus One smartphone complete with physical keyboard and longer battery life.

A couple of years ago enterprise IT might have seen all this as an interesting diversion and little more. But now with the iPhone, and more importantly the iTunes App Store, expectations on application delivery to the endpoint have changed. Enterprise users now expect to be able to access both personal and business apps where ever they are.  So while many of these new devices are clearly aimed at the consumer market, it would be shortsighted not to expect some of them to see service as enterprise application delivery endpoints in the near future. 

Initial thoughts on Google Chrome OS

Google are pitching Chrome OS as a fast netbook only access platform that will run web apps but offers no support for conventional apps (Windows, Mac OS, linux, Android etc.).  It's designed for online use, with offline support limited to media playback, HTML 5 apps, and that's about it.

Wow!  Errr... hang on a minute, can someone explain to me how the already overloaded US cell phone networks are going to support all the new traffic that this will create.  We've all seen what has happened with AT&T and how the introduction of the iPhone has crippled parts of its network.

And then there's that small problem of 'legacy' application support, does Google think that this doesn't matter, or will there be an announcement from Citrix, VMware, and perhaps Wyse offering support for Chrome in a day or two. I'm talking to Citrix about the Citrix Receiver roadmap tomorrow, it will be interesting to get their take on the matter.

Licensing Storm in a tea cup

Social media presents corporations with as many opportunities as it does challenges. You need look no further than the recent criticism that Citrix have received regarding the announcement of the XenDesktop 4 licensing model to see just what happens when social media isn’t effectively managed. 

Given the level of dissatisfaction expressed over the past week, a bunch of Citrix's execs will no doubt have been sitting behind locked doors this weekend trying to work out a way to mollify their most vocal complainants without leaving themselves open to even more criticism. I fully expect that within 48 hrs we will see some sort of announcement from Citrix to the effect that a new per device licensing scheme will be offered along side the ‘named user’ model previously announced.

The named user model is the most logical solution to licensing a comprehensive VDI platform. I’ve been through this before, as has Chris Wolf and rather obviously as did a significant number of Citrix’s leadership team over the past year or so. But this will not stop the announcement of a change to XenDesktop 4 licensing in favor of a model that will in the long term create more problems than it will solve. 

More on VDI licensing

In my previous post exploring licensing considerations for a VDI licensing model. I came to the conclusion that the concurrent usage licensing model had significant shortcomings compared to a user based model. However, there are other factors that need to be taken into consideration. While a private poll of 500 of Citrix's customers showed broad support for the XenDesktop 4 licensing model, Mike Stanley's previous comments highlight the two most important secondary factors that should have to be taken into consideration when deciding on the upgrade path.

The most visible of these issues is cost. Transition to user based licensing will inevitably result in an increase in the number of licenses required. While many (perhaps most) existing customers will be able to trade up to XenDesktop 4 for little immediate cost, the on-going Subscription Advantage commitment will be substantially more than their previous outlay. Introduction of a significant increase in licensing costs (even if it does not apply for another 12 months) is going to raise serious concerns and cause many customers to review their commitment to Citrix. I think that Citrix need to look closely at how this increase in Subscription Advantage fees will impact their customers and consider taking action to limit its impact. The global recession is still going to be depressing IT budgets for some time to come, and far sighted IT managers will be looking closely at what an increase in the number of licenses under Subscription Advantage will cost. Using a 2 for 1 upgrade path as a way to boost Subscription Advantage revenue is not going to be well received. A reduction in the unit cost of Subscription Advantage would be a welcome announcement at this time, not to mention prompt action to address the concerns of customers like Mike where a 2:1 conversion ratio is of very little benefit.

Which brings me to the second point: Trust. Mike asked a very important question in his previous comments.

Why buy into an expensive XenApp solution today, knowing that the next version may switch to per user licensing ...

Mike Stanley

Now that the door to user based licensing has been opened, Mike is just one of many asking what next for XenApp.  Personally I don't see Citrix making any changes here.  They had the opportunity once when off-line Application Streaming was introduced but didn't take it, acting to do so now is most unlikely. Having said that, I do think that Citrix have a problem here. Just as Citrix and Microsoft are seeing greater adoption of XenServer and Hyper-V as VMware's customers becoming disaffected with their licensing practices, Citrix need to ensure that they do not loose market share to competition in the application and desktop delivery space. A clear message to reassure customers that the XenApp licensing model is not going to change would be most welcome.

How do you choose a VDI licensing model? - Updated

Citrix's announcement that XenDesktop 4 licensing will break from the concurrent user model in favor of licensing by named user has got many people up in arms,and making loud claims as to how this will force them to abandon plans to adopt VDI. However once you get past the shock of the new and start to look at things more coolly it soon becomes clear that while it might have be possible for Citrix to retain a concurrent licensing model a little while longer, the direction that the VDI market is heading in will force every vendor to move away from the concurrent licensing model in the near future. 

I was going to write about VDI licensing from the customer perspective, but the Burton Group's Chris Wolf beat me to the punch on his blog (see side bar for link) 

Reworking licensing to be user-centric needs to be a top priority among client application vendors heading into 2010. Vendors that insist on binding licenses to physical devices in an increasingly virtualized world are not part of the solution. They’re part of the problem.

Chris Wolf

so I'm going to take a look at this from the vendor perspective.

Even today XenApp 5.0 no longer operates with an exclusively concurrent licensing model. The introduction of support for off-line streaming apps requires a hybrid licensing model where hosted apps are served from a pool of licenses assigned concurrently, but streamed apps use license leasing. This is necessary because streamed apps can be configured to continue to operate when disconnected from the host network, and at that point it is no longer possible for the License Server to determine if an application is being accessed used or not. The only viable solution to this problem is to adopt a leasing model. Allocating licenses to the user for a fixed duration with the option to renew for as long as the streamed application is being used. This by the way does more than ensure that Citrix maximizes its licensing revenue.  By preventing a license from be reallocated until its lease expires it prevents licenses from being double booked and so ensures that a customer can meet any audit with confidence.  I can think of a few companies than have been subject to audit and found themselves on the wrong side of a multi-million dollar settlement who might wish that other vendors would offer that approach.

Looking forward beyond the launch of XenDesktop 4 to the day when XenClient is launched, the technical landscape becomes much more complex.  One user might be running a VDI desktop hosted within the data center, another might be a task worker running a single hosted application. Others might be working from their homes running a VDI guest on a XenClient on an otherwise unmanaged workstation but with a VPN connection to the corporate network, while someone else is running another VDI guest on a laptop also running XenClient fully disconnected from any internet connection.  You can no longer control licensing based on connection count if your product does not require a connection to work. This change applies not just to Citrix, but to every VDI software vendor that intends to compete across the full gamut of VDI technology platforms. 

If concurrent licensing is no longer an option that leaves per machine or per user. In most environments, there isn't much difference between these two models. In most cases the number of people sharing PC is very low, so a PC based model could work just as well as a per user model, and this is where it gets interesting. If you go back to Citrix and ask why they adopted the concurrent licensing model, you might if you were lucky find someone who has been around long enough to be able to remember the initial reasoning behind that decision which if I remember correctly went something like 'We license our technology based on usage. You are only using ICA when you have an active connection between PC and server, so we think it is only right that you only consume a license when you have an active connection to the server.' Now the intellectual property that you use is far more than just the presentation protocol and much of that intellectual property is still being used even when the connection is not. But the focus is still on the user of the technology rather than on the machine that it is consumed from.  Furthermore, with the continual increase in diversity of access platform many of which might be used in a single working day, leasing to a device would lead to multiple licenses being consumed by a single user in the course of a day and/or licenses being orphaned as a user accesses stateless devices that are re-provisioned from a gold image every time they are used. So by default licensing based on who is using able to use XenDesktop is the only choice left open.

Unfortunately there is never a good time to move to a new licensing model, Citrix could have forced through the change with XenApp a couple of years ago with the introduction of off-line access to streamed applications, but rightly, in my opinion, chose not to. Leaving the change until VDI is more mature would create even more anguish than it has done today.  So now, as the VDI paradigm starts to gather speed, is probably the least bad time to make this change. 

What matters most at this point is that the transition to this new licensing model be handled with appropriate care and respect for the current customer base. Citrix's opening offer is very attractive to existing customers once you look at the detail and compare upgrade costs with the cost of Subscription Advantage to maintain a XenApp subscription, especially when you take into account that if you time the upgrade right you will finish up with both the XenDesktop 4 upgrade and the XenApp 6 (Parra) release within the same 12 month period. The 2 for 1 offer works very well for most existing XenApp customers but not all. Citrix need to look at how it can address market segments such as retail, education and healthcare where the user to device ratio is frequently much higher.

My final concern is that Citrix ensure that an appropriate balance is achieved between the cost of Subscription Advantage going forwards and the value delivered when customers find themselves owning a far larger number of licenses than they might previously have had.

Remote access and VDI

I received a couple of comments recently about my perspective on PocketCloud, Wyse's first app for the iPhone. One commenter took exception to my stance on the lack of support for either VMware's or Microsoft's remote access gateway solutions, citing availability of the iPhone's native VPN service as justification for his criticism. Unfortunately it isn't quite that simple.

For starters the iPhone has had enough problems to make IT Security managers think very hard before allowing it to connect to their networks.  The fact is that until the iPhone's 3.0 software release the VPN service incorrectly reported its adherence to VPN security policies - specifically reporting that it was not storing user passwords when it was. This flaw has created massive distrust of Apple amongst IT security professionals and obvious reluctance to let the iPhone onto the corporate network. It also should be made clear that only the new 3G S has on-device encryption making all older devices non-compliant with many organisations security policies. With that background, it should not be surprising that many organisations no longer trust Apple and are treating requests to provide remote access via the iPhone with trepidation. 

Assuming the iPhone VPN client can redeem itself in the eyes of the security experts, there's more to it than just providing a trusted connection to the enterprise network. One of the basic tenets of security is to ensure that users are only able to connect to the devices they need to connect to. In building out a typical View desktop farm of say 1000 desktops each desktop will have it's own IP address. So that means that you have to set out an IP address range that exactly matches only the IP addresses of the VDI guests.This is not that difficult, there's going to be a little overhead to accommodate adds, moves and changes but nothing significant. 

But what happens when your security policy say you MUST ensure that the remote user has no access to any system except the VDI session he is assigned. How will you ensure that s/he can access that one IP address and nothing else. It's here that solutions like Citrix's CAG and VMware's View Gateway Server come into their own. These devices functions at several levels, being both a VPN gateway in their own right and acting as an access aggregation solution with a dynamic access control list. The VPN function can be taken as read, it's the access aggregation function that requires closer attention. Working on conjunction with the VDI connection broker the VDI gateway ensures that each incoming connection can communicate only with its assigned VDI instance.  All other communication is blocked.  Very simple really. By handing offer the access control function to the VDI gateway, the security administration overhead is eliminated and a higher level of security can be enforced while maintaining appropriate SLAs. All this done with only the IP address of the gateway server exposed through the firewall with minimal overhead for Network Security.

If the View desktop farm changes in size no additional work is needed to ensure that users can access the new IP address range. More importantly old IP addresses are never left open creating a potential security breach. The final security benefit from using a dedicated remire access solution is that the gateway is self-managing, it allows a single user access to a single View Desktop, the user cannot connect to any other desktop thus fully complying with the security doctrine of the minimum necessary level of access.

So back to PocketCloud; Wyse market PocketCloud as an Enterprise class solution providing remote access to VMware View environments. That being the case, with full awareness of the concerns about the iPhone's security issues, and the management overhead required by conventional VPN solutions, it's entirely reasonable to expect PocketCloud to support for VMware's own standard remote access solution for View, just as Citrix provide support for their CSG and CAG remote access gateways from their iPhone Receiver. Ultimately without support for this feature it's hard impossible to justify the 'Enterprise Ready' tag. 

XenDesktop 4 Licensing

Citrix's decision to change to name user licensing for Xendesktop 4 is understandably creating a bit of a stir (see the comments here and here). After having lived with a concurrent licensing model for so long it is easy to forget that a named user model is for most organizations a better fit than a concurrent user model, and is the model used by both MS and VMware. Nevertheless the transition to another licensing model is bound to be a little difficult for both Citrix and their customers, and inevitably some will win and others will loose.  

Citrix have provided a cushion to ease the transition for most users by offering a 2 for 1 migration package where every XenApp 5 license can be traded in for two XenDesktop 4 licenses. This should address most customers needs, but for some it clearly isn't going to be enough.  Anyone with a large differential between concurrent users and total users is going to complain, and some will probably consider jumping ship to other technology vendors.  However, this is not the end of the story.

In all the excitement of this announcement we should not forget that XenApp is not being discontinued and there is no requirement to migrate to XenDesktop 4. XenApp is still licensed by concurrent user and can still be used to deliver a Published desktop just as it could last week. And while I think that XenDesktop is becoming Citrix flagship product.  Let's get this absolutely clear, XenApp is not going away.  The successor to XenApp 5 will be released as a tech preview some time in Q4 this year and barring any possible name changes we should expect to see XenApp 6 released in Q1 next year. Citrix don't share everything with me, but I fully expect to see dedicated application delivery products being developed by Citrix for a very long time to come (25 years should just about cover it).

For those customers who still find the cost of implementing XenDesktop4 unpalatable, the best advice I could offer would be to wait and see. Citrix's Sumit Dhawan has already made it clear that what was announced on Monday is not the final picture, and that changes will be announced to address customer concerns. 

"Finally, if you are in an industry that has high concurrency ratios - stay tuned - we are working on offering you the right options to address your requirements."

I won't speculate as to what these changes might be, but to all those people who are thinking that the change to user based licensing is unacceptable, I'd offer the following advice:

Think of the prices that Citrix have announced are bargaining positions only.  If you don't like them you can walk away or you can negotiate a better deal. Given the current economic client, Citrix's desire to get ahead of VMware in the number of VDI seats sold, and the fantastic opportunity that XenDesktop 4 represents; I'd suggest that walking away is probably not the right move.  

I wonder, should I write up a post on how to negotiate a VDI license agreement?

XenApp Deathwatch (updated)

A little while back I suggested that Citrix should stop selling products and start selling services, specifically an app delivery service that and a desktop delivery service combining the best elements of XenApp, XenDesktop, Provisioning server for Desktops as a single suite that could be used any way that the customer wanted to deliver either a desktop or an app, hosted or streamed whenever and however the customer wanted.

Well today it seems that Citrix have gone one better. Not content with giving XenApp admins access to XenDesktop to host desktop OS dependant applications, Citrix announced today that the VDI guys can now have piece of the application delivery action by integrating XenApp licenses into what is fast becoming Citrix’s new flagship product XenDesktop 4. Now with XenDesktop 4, one single product license allows you to stream or host a desktop or an application anyway you want. I just hope Citrix don’t forget where the idea first came from - I’ll be expecting a check in the post Mark. 

Aside from opening the door to total delivery flexibility, the other really big change is that for the first time ever Citrix has stepped back from the concurrent usage licensing model.  XenDesktop 4 licensing follows the Microsoft model of one license per user.  The reasoning behind this is not clear and is likely to create some angst amongst Citrix diehards, but old time WinFrame admins are well versed in adapting to change. It will be especially difficult for the channel to explain why XenDesktop 4 is priced per named user while XenApp and XenDesktop 3 are both still priced per concurrent user. 

There's still one piece of the picture missing today, but with a clear indication that XenDesktop 4 will integrate with XenClient just as soon as it is launched, Citrix will have a complete application and desktop delivery suite available mid 2010 just in time for its customers to have got to grips with the idea that desktop virtualization is about to play a big part in their future.

I can’t say that I’m 100% happy though; XenDesktop 4 is still only licensed in terms of pre-paid licenses. There’s no service based offering providing capacity on demand or monthly billing, so you still have to get your demand forecasting right and endure that you don’t over or worse under estimate the number of licenses you need. But there's plenty of time for that in the future.

Here's Tom Flink explaining the announcement to the sales channel, makes me want to run out and buy it right now :)

So is this change the beginning of the end for XenApp? I’m sure we will see XenApp 6 announced towards the end of this year, bringing with it a raft of new management features, (Update  - I have solid assurances from Citrix that XenApp is not going to go away and that XenApp will continue to be enhanced well beyond XenApp 6) but as far as XenApp' loosing it's crown as Citrix’s flagship product is concerned; I think the answer has to be that yes we are seeing a transition here. I’m not sure we will get to see the passing of the torch acted out on stage during next year’s Synergy keynote, but I can see a few moist eyes in the near future.

XenDesktop 4 will be available Nov. 16. Prices range from $75 for Standard Edition (XenDesktop only), through to $225 for Enterprise Edition (XenDesktop + XenApp) to $350 for Platinum Edition which includes full management and security capabilities. XenApp customers with Subscription Advantage will be able to trade up to XenDesktop 4 with discounts of up to 80 per cent. 

More later …

Accelerating DaaS adoption

As we climb up the face of the cloud computing hype curve it appears as though every product manager is looking for ways to show how their product will contribute in the race to move IT into the cloud. Last week it was Akamai's turn when they announced an extension to their IP Application Accelerator service that provides support for Citrix and Microsoft's remote display protocols. But unlike some, Akamai's marketeers need to be given serious attention.

Akamai are hardly a household name, but they are arguably one of the most important companies behind today's Internet - Akamai are responsible for moving 15% - 20% of all web traffic.

Much of Akamai's business is basic content delivery services. Chances are that copy of Windows 7 RC 1 you downloaded a couple of months back, the anti-virus signature file you downloaded yesterday, and the copy of Wyse PocketCloud you downloaded to your iPhone this morning in a moment of rash extravagance all came from your local Akamai server cluster. Media streams from most major media companies are delivered by Akamai, and the web applications that are at the heart of over $100 billion in e-commerce transactions every year. 

In addition to providing bulk data moving services, Akamai's other big value add is in optimizing end to end connections. The tangled web of connections that make up the internet is both a strength and a weakness. The real-time routing and re-routing of traffic as it travels from A to B can result in dropped packets and packets arriving out of sequence, increasing latency and reducing effective bandwidth utilization. By deploying edge servers at strategic points throughout the world (over 40,000 servers in 71 countries) Akamai can ensure the fastest possible delivery of their customers' data, with the lowest number of dropped packets and so maximizing usable bandwidth.

Akamai’s goal here is twofold, to facilitate VDI access anywhere users have an Internet connection, and more importantly to eliminate the need for customers to invest in expensive dedicated communications bandwidth between DaaS provider and corporate network.  Needless to say DaaS vendors will welcome this move; there's little overlap between DaaS and network service providers and where there is it seems to be lacking in conviction (Verizon was an early Desktone partner, but neither company seems to be making much effort to champion the other at the moment). 

Akamai make some remarkable claims for benefit achieved. On a long haul connection from Akamai's HQ in Cambridge, Mass to Singapore, VDI traffic routed via Akamai's service showed a 700% improvement in usable bandwidth. The improvements offer on short haul routes are much smaller, around 5% from Cambridge to Boca Raton in Florida, but while 5% doesn't sound like much of an improvement there may be sufficient secondary benefits in terms of predictability of performance and protection from regional and local infrastructure failures.  

This does not mean that this service is capable of addressing all the issues associated with DaaS. Client/server application latency still needs to be addressed.  Most desktop applications works best when data is co-located with the desktop and to be fully successful a DaaS implementation needs to provide a means of addressing that problem as well.  Fortunately there are plenty of WAN Acceleration solutions available from a wide range of vendors, Akamai included, that go a long way addressing this problem.

There's no denying the value that an effective display protocol acceleration service will bring to the DaaS market. If DaaS providers can leverage IP application acceleration effectively they will be able to extend the reach of their services, improve the end user experience and lower the cost of delivering the service. So it bodes well for all.