Considering Security（安全方面考慮）
The location in your environment for the Web Interface and the XML Broker, depends on your organization’s security requirements:
在你的環(huán)境中，web interface和xml broker部署的位置取決于你組織安全性要求。
When users access the Web Interface from the Internet, Citrix recommends locating the Web Interface server on the internal network and the Citrix XML Broker with the XenApp farm. Shielding the XML Broker from the external Internet, protects the XML Broker and the farm from Internet security threats.
當用戶(hù)從互聯(lián)網(wǎng)訪(fǎng)問(wèn)web interface，citrix建議把web interface服務(wù)器放到內網(wǎng)上，把and the Citrix XML Broker 部署在farm中。屏蔽從外網(wǎng)訪(fǎng)問(wèn)xml broker，以保護xml broker 和farm避免受到互聯(lián)網(wǎng)安全威脅。
If you must place the Web Interface in the DMZ and want to secure the connection between the XML Broker and the Web Interface, put the Web Interface server in the DMZ with Secure Gateway or Access Gateway. This configuration requires putting the Web Interface on a separate Web server.Install a certificate on the Web Interface server and configure SSL Relay on the servers hosting the Citrix XML Broker.
如果你必須把web interface放到DMZ區域，同時(shí)想要xml broker和web interface進(jìn)行安全連接，把web interface服務(wù)器和secure gateway或者access gateway一起放到DMZ區域。這種配置方法需要把web interface配置到一臺單獨的網(wǎng)頁(yè)服務(wù)器。在web interface服務(wù)器上安裝認證服務(wù)，并為托管xml broker的服務(wù)器配置SSL中繼。
In very small farms, configuring the Web Interface and the XML Broker on the same server eliminates having to secure the link from the Web Interface to the farm. This deployment is primarily used in environments that do not have users connecting remotely. However, this might not be possible if your organization does not want Web servers, such as Internet Information Services (IIS), in the farm.
在小型farm部署中，把web interface和xml broker部署在同一服務(wù)器上可以解決從web interface 到farm 安全連接問(wèn)題。這種部署方式最初是用在不需要用戶(hù)遠程訪(fǎng)問(wèn)的環(huán)境中。如果你的組織不要web服務(wù)器，這種方式是不可行的。
You can use any of these protocols for connections between the XML Broker and Web Interface:
HTTP.
HTTPS. If you secure the connection with HTTPS, IIS must host the XML Broker with port sharing enabled. Select the Share default TCP/IP port with Internet Information Server option during XenApp Setup (and enable HTTPS in the IIS Manager.)
SSL/TLS.If you secure the connection with SSL/TLS, the XML Broker can share a port with IIS or use its own dedicated port. Use SSL Relay to configure SSL/TLS support on the XML Broker and Web Interface servers. However, if the XML Broker is sharing a port with secure IIS (HTTPS), ensure SSL/TLS does not conflict with the IIS port. You can display the port in use by checking what port number appears in the SSL Relay tool for the Relay Listener port. By default, XenApp uses port 444.
你可以為xml broker和web interface間選擇任何一個(gè)協(xié)議進(jìn)行通信：
http：默認就是http
https：如果你想用https進(jìn)行安全連接，IIS必須通過(guò)啟用端口共享來(lái)托管xml broker。在xenapp安裝過(guò)程中，選擇與IIS共享默認TCP/IP端口復選框。
ssl/tls：如果你想用ssl/tls進(jìn)行安全連接，xml broker可以使用與iis共享的端口，也可以使用自己指定的端口。在xml broker和web interface服務(wù)器上用ssl中繼來(lái)配置ssl/tls。如果xml broker 與iis（htts）使用共享端口，要確認ssl/tls不會(huì )與iis端口沖突。你可以通過(guò)SSL Relay工具查看那個(gè)端口在使用中。默認情況下，xenapp使用444端口。
6.0中 ssl中繼端口默認使用的是443，看上圖
聯(lián)系客服
