(U) VCPS_Breakout_Citrix_Alignment .pptx

Rich Howard 09/15/2025

UNCLASSIFIED

UNCLASSIFIED

VCPS Breakout / Citrix Alignment Discussion

UNCLASSIFIED

Version 1

The overall classification of this presentation is:

UNCLASSIFIED

Change Log

UNCLASSIFIED

UNCLASSIFIED

UNCLASSIFIED

Virtual Desktop hosting for mission areas in the VCPS Account is accomplished through multiple points of integration supported by FS2 and Enterprise Services FS2: Citrix Management Stack (Netscaler AMI, Delivery Controller, Storefront, MS-SQL Database, On-Prem licensing server) for authentication, authorization, user routing, management of delivery groups and directed servers FS2: Citrix User Profiles, Hosted on VCPS Shared Storage Pool FS2: VDA/Network shares, implemented on Shared Storage Pool in alignment with User AD Security groups FS2: VDA Servers, deployed and integrated in VCPS accounts and environments F5/VDSS for point of presence (URL, Cert), routing, and support of custom FCRs/rulesets to support break and inspect waiver in VCPS/Citrix configuration Enterprise Active Directory (Server OU, User Security Groups) for alignment with Citrix delivery groups, VDA network mapping and access. Implemented per domain.

Registration of Virtual Desktops in Enterprise AD is required per Citrix COTS architecture

Management of VCPS-based Virtual Desktops (Delivery Groups, User access) requires alignment of registered/target instances with User Group membership in Enterprise Active Directory

Citrix COTS configurations (MCS) and fleet management are deployed alongside existing VCPS Delivery Groups and transitioned per mission area (ENC)

VCPS Citrix Implementation Background

UNCLASSIFIED

UNCLASSIFIED

Current VCPS System (Systems Diagram)

UNCLASSIFIED

UNCLASSIFIED

UNCLASSIFIED

Common Services Breakout (Phase 1) to deploy/host a new Citrix Management Stack apart from VCPS is underway (Ur environment) Following integration and accreditation of Ur, FS2 plans for Ti and Cu deployments respectfully Non-FGMOD mission area (Tandem-X) will integrate with Common Services to complete Phase 1

Transition of Citrix-based services from the existing VCPS account to Common services is targeted to take place after Phase 1 completes

The Citrix transition process for the existing VCPS account is targeted to include:

URL/Storefront established to access Citrix desktops Coordinated transition of existing delivery groups to the MC&G Common Services VPC (per environment, per fabric) These are scoped for multiple waves per environment, to include checkout/validation from Mission

The Citrix transition process for the existing VCPS account does not include:

VDA Server changes (instances, current deployments, software baseline) Storage pool data/existing Citrix profile changes MCS-approved baseline changes (ex: ENC)

Citrix Environment Breakout Overview

UNCLASSIFIED

UNCLASSIFIED

Common Services Citrix / VCPS (System Workflow/Segment Arch)

UNCLASSIFIED

UNCLASSIFIED

UNCLASSIFIED

VDA Management:

Per feedback from MC&G Engineering, long-term management of VDA servers will follow along with their resident account ownership after VCPS Breakout completes In support of this end-state, FS2 has identified OU and Security Group alignments/suggestions for maintainability between Common Services and VCPS

Continued coordination efforts will be required between segments (FS2 and FGMOD) to ensure:

Delivery Group/User/OU alignment for inclusion of new/updated servers Distribution of script updates to VDAs based on COTS (Management stack) upgrades MCS Baseline Image/Fleet upgrades (see chart)

Future Items:

Virtual Desktop services / FGMOD Kubernetes architecture alignment Requirements for interconnectivity between current VCPS, Common Services, and K8?

Projected need dates?

Citrix COTS / Kubernetes virtual desktop deployment and Enterprise integration support Consideration for deployment of VDAs under containers, requires coordination between Common Services and FGMOD Citrix COTS capabilities to support Containers along with NGA-specific architecture

Considerations

UNCLASSIFIED

UNCLASSIFIED

MCS Baseline Update Coordination Workflow (Notional)

UNCLASSIFIED

UNCLASSIFIED

UNCLASSIFIED

VCPS Breakout Project Overview Phase 1 – Shared Services and Tandem-X mission breakout (May 2025 – January 2026) FS2 establishes new AWS accounts and SPIDs at each security fabric (Ur, Ti, Cu, Kr) and environment (TP1, Operations) for redeployment of shared services All deployments of instances and services are separate and non-impacting to existing shared services including Citrix Shared services defined as Citrix technical stack, Shared Software artifact S3 buckets, Operations monitoring software/log ingest services, Gx integration proxies) Tandem-X mission area nominated for first mission breakout due to heavy reliance on Citrix/external interconnectivity

Phase 2 – Non-FGMOD Mission Breakout from VCPS Account (January 2026 – June 2026) Non-FGMOD Mission Areas within VCPS (including User Production Environments [virtual desktops]) are redeployed into new AWS accounts/SPIDS in alignment with COA designations New accounts integrate directly with Shared Services account vice existing VCPS-based Citrix and shared services

Phase 3 – VCPS/FGMOD Citrix cutover to Shared Services Account (January 2026 – March 2026) Transition is specifically for Citrix management stack (initial connection to delivery groups, then pointed to existing Virtual Desktops No change to FGMOD mission virtual desktop baselines, hosting, or mission configurations Earliest Target readiness:

Ur TP1*: Early December 2025 (*pre-Tandem-X integration) Ti TP1: Early January 2026 Cu TP1: Early February 2026

Phase 4 – High Availability Implementation of Citrix within Shared Services (March 2026 – August 2026) Procure additional Citrix licenses and perform PoC with latest Citrix delivered baseline, transition shared services configuration to H-A

UNCLASSIFIED

UNCLASSIFIED

UNCLASSIFIED

Backup Slides

UNCLASSIFIED

UNCLASSIFIED

Future - VCPS System Breakout (Systems Diagram)

UNCLASSIFIED

UNCLASSIFIED

UNCLASSIFIED

image2.png image3.png image4.png image5.png image6.png image7.png image8.png image9.png image10.png image11.jpg image12.jpg image13.jpg image14.jpg image1.wmf