Considering Security（安全方面考慮）
The location in your environment for the Web Interface and the XML Broker, depends on your organization’s security requirements:
在你的環(huán)境中，web interface和xml broker部署的位置取決于你組織安全性要求。
When users access the Web Interface from the Internet, Citrix recommends locating the Web Interface server on the internal network and the Citrix XML Broker with the XenApp farm. Shielding the XML Broker from the external Internet, protects the XML Broker and the farm from Internet security threats.
當(dāng)用戶從互聯(lián)網(wǎng)訪問web interface，citrix建議把web interface服務(wù)器放到內(nèi)網(wǎng)上，把a(bǔ)nd the Citrix XML Broker 部署在farm中。屏蔽從外網(wǎng)訪問xml broker，以保護(hù)xml broker 和farm避免受到互聯(lián)網(wǎng)安全威脅。
If you must place the Web Interface in the DMZ and want to secure the connection between the XML Broker and the Web Interface, put the Web Interface server in the DMZ with Secure Gateway or Access Gateway. This configuration requires putting the Web Interface on a separate Web server.Install a certificate on the Web Interface server and configure SSL Relay on the servers hosting the Citrix XML Broker.
如果你必須把web interface放到DMZ區(qū)域，同時想要xml broker和web interface進(jìn)行安全連接，把web interface服務(wù)器和secure gateway或者access gateway一起放到DMZ區(qū)域。這種配置方法需要把web interface配置到一臺單獨(dú)的網(wǎng)頁服務(wù)器。在web interface服務(wù)器上安裝認(rèn)證服務(wù)，并為托管xml broker的服務(wù)器配置SSL中繼。
In very small farms, configuring the Web Interface and the XML Broker on the same server eliminates having to secure the link from the Web Interface to the farm. This deployment is primarily used in environments that do not have users connecting remotely. However, this might not be possible if your organization does not want Web servers, such as Internet Information Services (IIS), in the farm.
在小型farm部署中，把web interface和xml broker部署在同一服務(wù)器上可以解決從web interface 到farm 安全連接問題。這種部署方式最初是用在不需要用戶遠(yuǎn)程訪問的環(huán)境中。如果你的組織不要web服務(wù)器，這種方式是不可行的。
You can use any of these protocols for connections between the XML Broker and Web Interface:
HTTP.
HTTPS. If you secure the connection with HTTPS, IIS must host the XML Broker with port sharing enabled. Select the Share default TCP/IP port with Internet Information Server option during XenApp Setup (and enable HTTPS in the IIS Manager.)
SSL/TLS.If you secure the connection with SSL/TLS, the XML Broker can share a port with IIS or use its own dedicated port. Use SSL Relay to configure SSL/TLS support on the XML Broker and Web Interface servers. However, if the XML Broker is sharing a port with secure IIS (HTTPS), ensure SSL/TLS does not conflict with the IIS port. You can display the port in use by checking what port number appears in the SSL Relay tool for the Relay Listener port. By default, XenApp uses port 444.
你可以為xml broker和web interface間選擇任何一個協(xié)議進(jìn)行通信：
http：默認(rèn)就是http
https：如果你想用https進(jìn)行安全連接，IIS必須通過啟用端口共享來托管xml broker。在xenapp安裝過程中，選擇與IIS共享默認(rèn)TCP/IP端口復(fù)選框。
ssl/tls：如果你想用ssl/tls進(jìn)行安全連接，xml broker可以使用與iis共享的端口，也可以使用自己指定的端口。在xml broker和web interface服務(wù)器上用ssl中繼來配置ssl/tls。如果xml broker 與iis（htts）使用共享端口，要確認(rèn)ssl/tls不會與iis端口沖突。你可以通過SSL Relay工具查看那個端口在使用中。默認(rèn)情況下，xenapp使用444端口。
6.0中 ssl中繼端口默認(rèn)使用的是443，看上圖
