Welcome

The WinFrame Solutions Guide is designed to show you some of the many ways Citrix WinFrame can be used to meet common requirements, and to list some of the products that have been found to be compatible with WinFrame.


How to Use This Guide

To get the most out of the WinFrame Solutions Guide, review the table of contents for the solution category of interest.

For each category, you'll find a brief overview and a description of how the products discussed can be used with WinFrame.

This guide will help you choose hardware and software that can be used with WinFrame.

The "WinFrame Executive Summary" section gives a concise summary of the features and benefits of using WinFrame for application deployment.

Note  The products listed in this guide have been tested and found to be compatible with WinFrame. Other products may (and probably will) work, but Citrix cannot guarantee the compatibility of untested products.

Because WinFrame is based on Microsoft Windows NT Server Version 3.51, most Windows NT compatible applications can be expected to work. Review the application notes in the Solutions Guide and in the online WinFrame Readme for detailed application integration tips and techniques.

Some application notes in the Solutions Guide were supplied by third parties and are noted as such.


Who Should Use This Guide

This guide is designed to help administrators and resellers with the installation, setup, and operation of WinFrame, and to help select the proper hardware and software components necessary to build a system running WinFrame.


Conventions

The following conventional terms, text formats, and symbols are used throughout the printed documentation.

Convention	Meaning
Bold	Indicates the actual commands, words, or characters that you type in a dialog box or at the command prompt.
Italic	Indicates a placeholder for information or parameters that you must provide. For example, if the procedure asks you to type filename, you must type the actual name of a file. Italic also indicates new terms and the titles of other books in the documentation set.
ALL UPPERCASE	Indicates a directory, filename, or acronym. You can use lowercase letters when you type directory names or filenames in a dialog box or at the command prompt, unless otherwise indicated for a specific application or utility.
Monospace	Represents examples of screen text or entries that you might type at the command line or in initialization files.
	Indicates a procedure.
•	Indicates a procedure with only one step.
	Indicates a list of related information, not procedural steps.
WinFrame	Refers to operating system and networking functionality that is available in WinFrame, Windows NT Server, and Windows NT Workstation.
\WINFRAME or \systemroot	Refers to the WinFrame system tree. This can be \WINFRAME, \WINNT, \WINNT35, \WINDOWS, or whatever other directory name you specified when installing WinFrame. Includes all WinFrame family members except where noted.
	Indicates a special note that refers to a WinFrame-specific feature.
Guidelines for mouse and keyboard actions are described in Chapter 2, "Windows NT Basics," in the System Guide.


Finding Information About WinFrame

This guide presents condensed installation information for anyone who is installing WinFrame and the WinFrame Clients. See the Release Notes, the Installation Guide, and the WinFrame Client User's Guide for additional information.

The documentation set also includes the following:

Release Notes

The Release Notes contain the very latest information about WinFrame, such as last-minute features and application notes, additional utilities, and resources available to help you get the most out of your WinFrame installation.

Concepts and Planning Guide

Provides information about the concepts behind WinFrame, such as network drivers and protocols, security, user environments, management of network files and printers, fault tolerance, and performance monitoring.

Installation Guide

Provides detailed information on installing WinFrame. This manual presents detailed procedures for installing, configuring, and troubleshooting WinFrame installations.

WinFrame Client User's Guide

Provides information and procedures for installing and using the WinFrame Client programs that provide remote access to a WinFrame server.

System Guide

Provides a description of the applications and tools provided in your WinFrame package. This manual presents procedures for completing common tasks such as organizing the desktop, managing files and directories, printing, using applications, administering the network, and more. A glossary at the end of the System Guide defines common terms used in WinFrame.

Messages

Lists all messages produced by WinFrame and its components for problem determination and troubleshooting.

Remote Access Service

Provides background information and procedures for installing and managing Remote Access servers and clients for dial-in network access.

Services for Macintosh

Provides background information and procedures for installing and using Services for Macintosh so that PC and Apple Macintosh computers can share files and printers on the network.

Security Guide

Provides a description of applications, utilities, and procedures that can be used to enhance the security of a WinFrame installation.

Services for NetWare Networks

Provides detailed information for installing and using Gateway Service for NetWare. Describes the Migration Tool for NetWare, which helps you integrate WinFrame into an existing NetWare 2.x and 3.x network by transferring user and group accounts and other data from NetWare to WinFrame.

TCP/IP

Provides background information and procedures for using TCP/IP as a transport protocol on the network. This includes instructions for installing and configuring WinFrame computers as Dynamic Host Configuration Protocol (DHCP) servers and Windows Internet Name Service (WINS) servers to support automatic configuration of Internet Protocol (IP) addresses and name resolution services, respectively, for computers on a Windows NT network.

Most Microsoft Windows NT Server compatibility guidelines can be applied to Citrix WinFrame because WinFrame is an authorized extension to Microsoft Windows NT with multiuser capabilities. For example, WinFrame supports the deployment of Win32, Win16, DOS, OS/2 1.x (text only), and POSIX applications. The MultiWin and ICA technologies included in WinFrame 1.x extend the capabilities of Windows NT and, in some cases, require additional setup and configuration for best results with applications.

For Microsoft Windows NT Server compatibility information, see the following Microsoft resources:

The Microsoft Web site, http://www.microsoft.com/ntserver

Microsoft Technet

The Microsoft Windows NT Resource Kit for NT Workstation and NT Server Version 3.51

The Windows NT Version 3.51 Concepts and Planning Guide


Additional Information

Other sources of information in the WinFrame package include:

Release Notes

Contain detailed, up-to-date information on your WinFrame package.

Windows NT Messages Database

Explains error and system information messages. This database is provided on the WinFrame compact disc.

WinFrame Help

An online help file containing the latest WinFrame information. Updates are available from the Citrix Web site (http://citrix.com/support).

WinFrame Books Online

Contain the WinFrame documentation (except for the Quick Install Guide and the WinFrame Client User's Guide) as an online help file.

Online Help

Provides context-sensitive, step-by-step instructions and reference information wherever you are working.

To Get Online Help

•	Press F1 in any window or at the command prompt, type help or net help, and then press ENTER.

To Get an Overview of Online Information for WinFrame

•	In the Main program group in Program Manager, choose the WinFrame Help icon.


Citrix on the World Wide Web

Citrix offers On-line Technical Support Services at http://citrix.com/support that include the following:

A What's New page with the latest information about WinFrame

A Frequently Asked Questions page with answers to the most common technical issues

An FTP server containing the latest Service Packs and Hotfixes for download and the latest online copies of WinFrame Help

An Online Knowledge Base containing an extensive collection of technical articles, troubleshooting tips, and white papers

Interactive online support forums available as HTML pages and as a list server


Citrix Technical Support Bulletin Board Service

The Citrix Technical Support Bulletin Board Service is fully integrated with Citrix Online Technical Support Services. Customers without Web or email access can dial in to the Citrix BBS at (954) 267-2590. Communication parameters are: no parity, 8 data bits, 1 stop bit, up to 28,800 baud.


Citrix Sales Offices

Australia
Citrix Systems Pty Ltd.
State Forest Building
423 Pennant Hills Road
Pennant Hills, NSW 2120
Australia
Telephone: +61(2)9980-6888
Fax: +61(2)9980-6763
Internet URL: www.citrix.com.au

France
Citrix Systems SARL
84 Avenue du General Leclerc
92100 Boulogne-Billancourt
France
Telephone: +33(1)55601070
Fax: +33(1)55601071
Internet URL: www.eu.citrix.com

Germany
Citrix EMEA
Am Soeldnermoos 17
85399 Hallbergmoos
Germany
Telephone: +49(89)607687-10
Fax: +49(89)607687-11
Internet URL: www.eu.citrix.com

UK
Citrix Systems UK Ltd.
The Asmec Centre
Eagle House, The Ring
Bracknell, Berkshire RG12 1HB
United Kingdom
Telephone: +44(1344)382100
Fax: +44(1344)382136
Internet URL: www.eu.citrix.com

United States
Citrix Systems, Inc.
6400 Northwest Sixth Way
Fort Lauderdale, FL 33309
Phone: (954) 267-3000
Fax: (954) 267-93119
BBS: (954) 267-2390
Internet URL: www.citrix.com


WinFrame Compatibility Testing

Citrix has an ongoing program of application compatibility testing; however, it is recommended that you contact the application vendors for information about WinFrame compatibility. The WinFrame Compatible program and the Citrix Business Alliance program supply much of the information found in this book.

The WinFrame Compatible Program

The WinFrame Compatible program enables software manufacturers to showcase their products or services as compatible with WinFrame. Once the products are tested and approved, the manufacturers can use the WinFrame Compatible logo on their products, collateral, packaging, and press releases.

WinFrame Compatible products are listed in this guide. This guide is included with every WinFrame product shipped and is also available for download on the Citrix World Wide Web site (http://www.citrix.com). Some members of the WinFrame Compatible program also include product brochures and special offers in the Citrix Solutions Provider handbook distributed in every CSN training class.

Citrix Business Alliance Partners

Members of the Citrix Business Alliance program provide the technology building blocks for solutions that include high-performance servers, flexible communications infrastructures, robust client-server development tools, and turnkey corporate applications. This program is composed of leading industry vendors who work with Citrix to develop innovative new products and markets for thin-client/server computing.


WinFrame Executive Summary

MIS managers face the daunting task of deploying client/server Windows applications across enterprise networks that can easily grow to regional, national, or global proportions. Unfortunately, traditional client/server technologies rarely rise to the enterprise-wide challenges faced by MIS. In fact, the established approaches usually hinder strategic application deployments by inflating costs, complicating management, and performing poorly.

Traditional client/server application architectures and the accompanying deployment models established by distributed PC-based LANs, remote control, and remote node technologies all fail to deliver fast, inexpensive, efficient application deployments. The problem is inherent to traditional client/server architecture, which emphasizes client-side computational power. In today's widely distributed enterprises, the client/server model breaks down as the client moves farther away from the server yet is required to perform the same tasks as a local machine.

The solution to the enterprise-wide application deployment challenge lies beyond the traditional client/server model. New thin-client/server technologies are creating a new, network-centric computing paradigm. This evolutionary network architecture, which employs multiuser application servers, centralizes application deployment and puts a thin-client at the end-user workstation. The resulting model reduces costs, increases manageability, and improves application performance.


The WinFrame Product Family

This section describes the members of the Citrix WinFrame product family.

WinFrame/Enterprise

WinFrame/Enterprise is the flagship member of the WinFrame product family. It provides a complete application deployment solution for large corporate networks.

WinFrame/Enterprise is well suited for WANs, LANs, Remote Node, and Dial-up.

WinFrame/Enterprise is an excellent tool for personnel in branch offices, IS management, telecommuters, and traveling professionals.

WinFrame/Enterprise comes with 15 Citrix user licenses. This number can be increased with User License Packs.

WinFrame Host/Terminal

WinFrame Host/Terminal provides a complete application deployment solution for a Windows terminal and network computer environment. WinFrame Host/Terminal is geared for LAN access but can be used for dial-in access with the PC Client Pack.

WinFrame Host/Terminal comes with five Citrix user licenses. This number can be increased with User License Packs.

WinFrame/WorkGroups

WinFrame/WorkGroups addresses the needs of small businesses and replicated sites. In most cases, user counts are typically less than the 15-user licenses provided with WinFrame/Enterprise. WorkGroups allows these smaller installations to have the same centrally administered Windows applications and universal access provided by WinFrame as much larger organizations.

WinFrame/WorkGroups supports five users. The number of users cannot be increased with License Packs.

Load Balancing Option Pack

Load balancing allows an application to be published for execution on any of several WinFrame servers.

Load balancing is only available when a copy of the WinFrame Load Balancing Option Pack has been installed on each server that will participate in load balancing.

When a published application configured for load balancing is launched, WinFrame selects which server will run the application based on server load.

License Packs

License Packs can be added to increase the number of concurrent users that a server is licensed for.

Citrix WinFrame License Packs come in 5, 10, 20, and 50 user versions.

PC Client Pack

WinFrame Host/Terminal requires a PC Client license for each PC that connects to the server. The PC Client Pack contains a Client license that allows a WinFrame Client PC to connect to a WinFrame Host/Terminal computer.

SecureICA Option Pack

The SecureICA Option Pack contains features to enhance the security of data communication across any type of connection supported by WinFrame. The SecureICA Option Pack uses the RC5 encryption algorithm from RSA Data Security, Inc. The WinFrame server and WinFrame client use the Diffie-Hellman key agreement algorithm with a 1024-bit key to generate RC5 keys. See "SecureICA Option Pack" in Chapter 4 for a more detailed description.


WinFrame Overview

Based on a network-centric computing model, WinFrame is a multiuser Windows-based application server software for enterprise application deployment. WinFrame extends the reach of business applications beyond the LAN to remote users over the extended network and public Internet. Based on Windows NT Server under license from Microsoft, WinFrame adds two core technologies: Citrix's ICA-based universal thin-client software that works in conjunction with WinFrame multiuser application server software and MultiWin Multiuser Architecture.


ICA Windows Presentation Services Protocol

ICA is a general-purpose presentation services protocol for Windows. Conceptually similar to the UNIX X-Windows protocol, ICA allows an application's user interface to execute with minimal resource consumption on a client PC, while application logic executes on the WinFrame multiuser application server. Because ICA is implemented at the system level (GDI), it is highly efficient and compact. This architecture allows applications that usually consume the largest bandwidth to run at near-LAN speed over low-bandwidth phone lines.


MultiWin Multiuser Architecture

MultiWin is a Citrix-developed technology that extends the Windows NT operating system into a true multiuser system. This means multiple users can execute applications on the same machine at the same time; each user runs as a virtual session on the WinFrame server.

WinFrame is ideally suited for IS managers in large organizations that need to deploy applications across the extended corporate network and public Internet to a wide variety of users such as mobile professionals, field sales and service organizations, telecommuters, branch office workers, customers and prospects, and suppliers and distributors.


Enterprise Application Challenges

Organizations seeking to broadly deploy line-of-business applications across the enterprise face a diverse set of challenges associated with cost, management, and performance.

LAN-Locked Applications. Most business applications, such as two-tier client/server, are designed for the LAN and are not optimized to run over high-latency phone or WAN connections that run 100 to 1000 times slower than a local segment.

New Users. Today's corporate computing infrastructure is built for employees, not a company's prospects, customers, and suppliers.

Heterogeneous Clients. Not everyone uses or needs a PC on the desktop. Some use non-Windows systems such as OS/2, UNIX, or Macintosh. Some need low-cost, fixed function devices, such as terminals. Others need new devices such as wireless tablets and personal digital assistants (PDAs).

Management. Managing access (security), version control (maintenance), system configuration (moves, adds, deletes), and support (help desk) are very costly, particularly for distant users.

MIS rarely has the luxury of deploying mission-critical applications in a homogeneous environment, let alone from a centralized location. Instead, the enterprise network usually includes a widely-dispersed variety of servers, client workstations, and operating systems. A variety of wide area connections joins remote office LANs throughout the nation or the world. The user base can include from dozens to thousands of local, remote, mobile, and telecommuting users.


Key Benefits of WinFrame

WinFrame satisfies the performance and universal application access needs of remote users while equipping IS organizations with the economic benefits of single-point management and control.

Reach. IS organizations can securely and cost effectively deploy line-of-business applications to employees over the extended corporate network as well as to customers, prospects, and suppliers over the public Internet.

Performance. IS organizations can provide users with consistent application performance over any type of network connection.

Simplicity. IS organizations can build a corporate application infrastructure with the fewest moving parts.

Management. IS organizations can economically distribute, support, and manage line-of-business applications from the server.

Security. IS organizations can deliver broad access to corporate information with minimal security risk in data transmission and information storage.


End User Benefits

Fast Application Access. The WinFrame universal thin-client gives remote users fast access to any type of application, including DOS and 16- and 32-bit Windows or client/server programs.

Local/Remote Transparency. WinFrame provides all the familiarity of a local LAN desktop. Remote users have complete access to all local system resources such as notebook drives, remote printers, and clipboards. Users can also cut and paste between local and remote applications and drag-and-drop to copy files in the background while they continue to work.

Integrated Desktop. From a single desktop, remote users can run applications locally from the notebook PC or remotely from the WinFrame server for best performance.

Ease of Setup. With its Windows 95-like installation and setup wizard, WinFrame Clients are easy to install for Windows 3.1, Windows for Workgroups, Windows 95, and Windows NT. The wizard guides users through all the necessary installation steps and automatically detects the PC's available modem.

32-Bit Windows Application Availability. Remote users gain immediate access to Windows 95 and Windows NT applications, regardless of their client hardware. WinFrame enables even DOS-based 286 systems to run Windows 95 applications at near-LAN speeds over low-bandwidth connections.


IS Management Benefits

Economical. WinFrame supports multiple concurrent users on a single processor and offers free, unlimited client software licensing, making it a cost-effective solution for enterprise-wide application delivery.

Enterprise Scalability. Symmetrical multiprocessing (SMP) hardware compatibility enables WinFrame to support hundreds of concurrent users.

Extensive Connectivity. WinFrame connects users to the network through standard telephone lines, WAN links (T1, T3, 56Kb, X.25), broadband connections (ISDN, Frame Relay, ATM), or the Internet.

Single-Point Application Management. With WinFrame, all application upgrades and additions are made only once at the server and are instantly available to all remote users.

End-to-End Management. Using WinFrame/Enteprise's extensive Windows-based utilities, administrators can set up applications, view active sessions, monitor system performance and events, troubleshoot problems, and create reports from the server. WinFrame also allows administrators to use popular network management tools, like Microsoft Systems Management Server or SNMP managers.

Remote Administration. System administrators can dial-up to the Windows NT-based WinFrame server for remote administration and management.

Remote Support and Training. Administrators can connect to a remote user's session to visually see what is on the screen and interact with the user, making WinFrame a valuable remote support and training tool.

Seamless Network Integration. WinFrame integrates into NetWare, Windows NT, Novell, and other PC networks, allowing administrators to quickly set up users from existing domain or bindery information.

C2-Compliant Security. WinFrame incorporates Windows NT's C2-level security, including multi-level passwords and privileges, roving callbacks, encrypted login and data, and file-level security to protect data privacy and network resource integrity.


Conclusion

In today's competitive business environment, organizations look to MIS for information tools that are fast, reliable, and easy-to-use. Expeditious deployment of mission-critical applications can be a strategic weapon. WinFrame is ideally suited for organizations that need to deploy applications across the extended corporate network and public Internet to a wide variety of users such as mobile professionals, field sales and service organizations, telecommuters, branch office workers, customers and prospects, and suppliers and distributors.


Planning, Installing, and Integrating a WinFrame Project

Overview

Deploying a WinFrame server requires planning, preparation, and attention to detail. This chapter contains some guidelines in outline form that can be used to plan a WinFrame deployment project.

A typical WinFrame deployment project has five stages:

1.	Analysis

2.	Evaluation

3.	Capacity planning

4.	System deployment

5.	System maintenance

The following sections detail the steps involved in each stage of the planning and deployment process.

Analysis

Here are some sample questions that will help analyze system requirements, along with possible answers:

1.	What business problem are you trying to solve?

Remote e-mail access while traveling

Branch office access to large client/server applications (for example, human resources)

Streamline order entry process

Improve customer service

2.	What computing platform and applications are you using?

NetWare

Oracle database

PowerBuilder application on Windows 3.1 desktops

3.	How many users will need access? How many concurrent users? How long will a typical connection last?

100 users total, 25 concurrent connections, 30 minutes

4.	How will you be connecting to the application server?

Async Dial-In

Remote node (Microsoft RAS or third-party remote node software)

LAN

WAN (leased line, Frame Relay, ISDN, ATM)

Internet

5.	What client hardware/software will you be using?

486DX/2 Windows notebook, 12MB RAM, Shiva PPP dialer supporting IP and IPX

6.	What are the functional requirements for a remote user?

Interactively access Microsoft Office, client/server applications, 3270 connectivity to mainframe applications

Print e-mail, documents, reports to client printer

File transfer between client and servers

Security issues like dialback, firewalls, third-party security hardware, etc.

7.	What are the performance requirements?

Ten seconds to look up a record

Typeahead limited to 2−3 characters for 50 WPM typist

8.	What is the time frame for initial pilot and full deployment?

Thirty day pilot, full deployment in the following 60 days

9.	Have the resources been allocated for this project?

Budget approved

Project manager and internal resources assigned

Professional systems integrator/Citrix authorized reseller engaged

10.	Who are the decision makers?

Director of MIS: budget approval, overall responsibility

Vice President of Finance: signoff on success criteria and final OK

Project Manager: "owns" the project

Evaluation

It is essential to establish the scope of the evaluation pilot project. This can range from demonstrating multiple concurrent users running the corporate applications to addressing issues like optimum hardware configuration, server/application tuning, client software distribution (and automatic updates), ongoing maintenance, disaster recovery, etc. Keep the following guidelines in mind:

1.	Set up a test environment that emulates actual field conditions.

2.	Use the server and client hardware/software configurations that will actually be deployed.

3.	Agree on a prioritized set of success criteria. Some examples of these are:

Applications that need to be tested

Acceptable performance results based on clearly defined benchmarks

Printing requirements

Authentication and security mechanisms

Event logging, auditing, and reporting requirements

4.	Select several users to help you streamline the client software distribution and configuration process, and maintain a log that records common questions and problems.

5.	Set up a contingency plan in the event of failure; for example, server hardware, communication lines, modems, power.

6.	Try to limit the scope of the evaluation to the most mission-critical applications. Once the power of WinFrame becomes apparent, you may be asked to support many additional applications. This will slow down the evaluation process and move the focus away from the critical applications.

Capacity Planning

Characterize the resource requirements of a typical user utilizing Performance Monitor, network analyzers, etc. The most important categories to monitor are:

1.	CPU

2.	Memory

3.	Paging file

4.	Disk subsystems

5.	NIC

6.	LAN/WAN bandwidth utilization

Based on the above criteria, you should be able to arrive at the following:

Optimum server configuration (CPU, RAM, disk, NICs, protocols, services)

Number of servers required

Number of users per server

Network design considerations (backbone segments, multiple NICs/protocols)

Deployment

Here are a few important considerations to ensure a smooth deployment:

Document server hardware/software setup

Ensure adequate trained staff to administer the system

Use the knowledge provided by an experienced Citrix systems integrator to assist in the deployment and train key personnel

Distribute client software with clear documentation on setup and usage

Set up a help desk with trained staff to handle questions and problems

Establish a weekly review meeting to monitor the operation and resolve open issues

Maintenance

Plan for the following:

Help desk, problem escalation procedures, reseller/Citrix direct support

Procedures for testing interim fixes and loading software upgrades prior to deployment

Maintenance contracts for support, notification of fixes, and software upgrades

Disaster recovery procedures like backup/restore and hot spares


Setting Up a WinFrame Environment

Introduction

WinFrame is a multiuser Windows application server, based on Microsoft Windows NT Server Version 3.51 under license from Microsoft, that supports enterprise application publishing using a thin client architecture. This network-centric approach includes Citrix ICA-based universal client software that works in concert with WinFrame multiuser application server software over dialup, LAN, WAN, and Internet connections. The Citrix thin client architecture provides the high performance and universal application access needed by users while the multiuser application server offers IS professionals the economic benefits of single-point control and management.

Citrix Independent Computing Architecture (ICA) is a general-purpose presentation services protocol. Conceptually similar to the UNIX X Windows protocol, ICA allows an application's user interface to execute with minimal resource consumption on a client PC while application logic executes on the WinFrame multiuser application server.

Citrix MultiWin is a multiuser extension to Microsoft Windows NT Server.


Single Machine or Multiple Machines?

There are two basic ways to design a system to support a large number of users using WinFrame. The first and most direct approach is to have a large single machine with enough power to support a large number of users. For example, if the machine is to support 50 users, a large, fast multiprocessor machine with a large amount of RAM is needed. How much RAM and how many processors per user is very dependent on what type of applications will be run on the WinFrame machine.

As a rule of thumb, a Pentium per 10-15 users and approximately 5-8MB of RAM with 15-20MB of page file space per user is needed. In the 50 user, single machine example, you will need a 4-5 processor Pentium SMP server with approximately 300MB of RAM and 1GB of page file space on the hard disk. Please keep in mind that the numbers change according to what applications will be run and how intensively the users utilize the machine. For example, if the users will be running a simple data entry front end application that communicates with a database server elsewhere on a network, the requirements will be on the low end of the given ranges. If, however, the database server is running locally on the WinFrame server along with the client front end applications, the requirements will be on the high end of the given ranges.

The second solution is to have multiple smaller machines that smaller groups of people will use. For example, instead of having one large machine to serve 50 users, you may have five smaller systems. Each of these systems will require one Pentium processor per system with approximately 64-80MB of RAM per system, with 200MB of page file space on the hard disk. Each system will support approximately ten users. Once again, the requirements per machine will be more or less depending on the applications the users will be using.

Note  Please refer to the Release Notes, the Installation Guide, and the Quick Install Guide for more detailed information on system configuration guidelines.

Load Balancing

Load balancing allows an application to be published for execution on any of several WinFrame servers.

Load balancing is only available when a copy of the WinFrame Load Balancing Option Pack has been installed on each server that will participate in load balancing.

When a published application configured for load balancing is launched, WinFrame selects which server will run the application based on server load. The WinFrame Client contacts the master browser to find the address of the server containing the published application. The master browser maintains a list of servers configured to run the published application. The master browser selects one of the servers based on load and returns the address of that server to the WinFrame Client.

You can tune how WinFrame calculates server load for each server in a load balancing cluster. You can also copy one server's settings to another server's settings. A separate load calculation is performed for each network protocol (IPX, TCP/IP, and NetBIOS).

For additional information, see Chapter 23, "Application Publishing," in the System Guide.


WinFrame as a Stand-alone Server Versus WinFrame on a Network Domain

WinFrame can be used in one of two ways: as a stand-alone server or as a server on a network domain. When you install WinFrame, you have the option of configuring it as a server or as a domain controller.

When installed as a server, WinFrame can be used as a stand-alone system or it can join an existing network domain. If your WinFrame server is not joining an existing WinFrame or Windows NT domain and you do not anticipate having more than one WinFrame server (for example, if you are adding a single WinFrame server to an existing NetWare network for Dial-In user access), you do not need to establish a domain. If your configuration will eventually expand past a single WinFrame server, establishing a WinFrame domain will avoid the need to recreate users on each additional server.

If you set up WinFrame as a domain controller, it becomes the central point for a new network domain. Other WinFrame or Windows NT servers can join this network domain. Usually the best configuration is to make one WinFrame server a domain controller and configure all other WinFrame servers as servers on that network domain. During WinFrame Setup, you are given the option of joining a network domain. In this case, you would select the name of the domain used on the domain controller to join the network domain. Setting up a domain allows your WinFrame and Windows NT systems to work together. You may also leave the WinFrame server in its own network workgroup, which is the default; the system becomes a stand-alone system and is unaware of the domain.

Note  If you do not join a network domain during the installation of the WinFrame server, you can join the network domain at a later time by using the Network application within the WinFrame Control Panel.


Configuring Users on WinFrame

To login to WinFrame, you must have a userID. The userID can be configured on the WinFrame server or on the domain. If a user is configured for a particular WinFrame server, that user can login and use only that WinFrame server. If the userID is configured on the domain, the user can login to any WinFrame or Windows NT system that is in the domain. This flexibility allows users to login from any system on the network. If desired, access can be restricted to specific WinFrame servers or it can be granted across the network domain.

Use the User Manager for Domains utility to configure users on a WinFrame server. See the System Guide or Books Online for more information about this utility.


Editing WIN.INI and SYSTEM.INI

WIN.INI and SYSTEM.INI are WinFrame initialization files. Although these files appear to be standard text files, they are not actually text files but INI databases stored in text form. If these files are modified using a standard text editor (such as Notepad), the changes made are not properly propagated to the users on a WinFrame system. To modify INI files in a way that ensures the changes will be correctly propagated to all users, use the following procedure:

1.	Logon as an administrator. At a command prompt, type change user /install. This places the session in install mode.

2.	At the command prompt, type sysedit. This starts the System Configuration Editor, which can be used to modify WIN.INI and SYSTEM.INI. Make and save the necessary changes and then exit System Configuration Editor.

3.	At the command prompt, type change user /execute. This returns the session to execute mode.

The changes made to WIN.INI and SYSTEM.INI are propagated to all users the next time they logon.


Domain Versus Local Users, Home Directories, and Profiles

Users and their home directories and profiles can be configured one of two ways. The first way is to configure the users on a local or machine-specific level. These users are configured to use only that one particular system and cannot access other machines unless they have an individual login for each machine for which they need access. The profiles and home directories for users in this configuration are stored on a local drive on the system or on a network server. This method may be adequate for smaller, single-server installations.

The second way (and the more scalable method) is to set up a domain of users and machines. One of the WinFrame systems is installed as a domain controller and the rest of the WinFrame servers are configured as servers. One or more of the systems can share disk space for the user's home directories and profile storage. Users are then configured as Domain Users, Administrators, or Guests so they can login to any WinFrame system in the domain and still have their own profile and home directory. Applications can be stored on one or more of the WinFrame servers, where the application directories are shared so that any other WinFrame server can access them for its users. Security can be set to restrict users to particular machines or prevent access to particular machines. File security and user profile security can be set to secure data as needed. See the WinFrame System Guide for more detail on configuring users and security.


Creating User Profiles

Overview

In WinFrame and Windows NT, you have several ways to define and enhance users' workstation environments. You can define network connections, available applications, Windows program groups, and Windows desktop appearance. If you want, you can even prevent users from changing the desktop environment you create.

If you need to set up a large number of users on a WinFrame server who have similar characteristics, it is convenient to create a user template. This template can be configured with the desktop configuration, applications, and network drives that the user will need and can then be used as a pattern to create new users when needed.

This section describes how to create user profiles for single users and for groups of users. Two specific procedures are covered:

Using a default user template for profiles

Using mandatory profiles and group templates

These procedures allow you to create and maintain user configurations with standard default profiles that are designed by the administrator.

For additional information, see Chapter 5, "Managing User Environments" in the Concepts and Planning Guide. Also see Chapter 13, "User Manager for Domains" and Chapter 14, "User Profile Editor" in the System Guide.

User Profiles

The most powerful method you have of managing user environments is through user profiles. A profile is a file that serves as a snapshot of a user's desktop environment. With profiles, you can also restrict users' ability to change these settings. You can create profiles for users that have domain accounts and store these profiles on servers. Each user can have a single profile, with one configuration, that is loaded when the user logs on.

Types of User Profiles

There are two types of server-based user profiles: personal profiles and mandatory profiles. With each type of profile, you assign a profile to a user by specifying the location and filename of the profile in the user's account. Only one profile is assigned to each user.

Users of personal profiles can permanently change their profiles. A user may not consciously change the personal profile, but every time the user logs off, any changes made to the per-user settings are saved. When the user logs on again, the environment that existed the last time the user logged off is restored. Because the user can change the personal profile, each user must have a unique copy of the personal profile. Personal profiles are useful when you want to allow users to customize their desktop environments.

Users of mandatory profiles cannot permanently change their profiles. Although a user with a mandatory profile may be able to change the per-user settings during one session, these changes are not uploaded to the user's profile when the user logs off. When the user logs on again, the profile's original settings are reestablished. Because users cannot change the mandatory profile, more than one user can use the same mandatory profile. Mandatory profiles are useful for supporting large number of users with identical requirements. Any changes made to the mandatory profile affect all users of that profile.

Using Profiles to Restrict Users' Abilities

In both personal and mandatory profiles, you can prevent the user from doing one or more of the following:

Creating program items

Creating program groups

Changing the contents of program groups

Changing program item properties

Running programs from the File menu in Program Manager

Making connections to network printers (other than the connections already configured)

Imposing some or all of these restrictions is useful in a secure environment. In this environment, you may want to create a single mandatory profile for each type of job and assign that profile to all users who fit the job description.

User Home Directories

Each user on a WinFrame computer should have a unique home directory. A user's home directory gives that user private storage space for data and application-dependent workspaces (for example, temporary files). Each user has control over the contents of and access to the home directory.

Note  In a multiuser environment such as WinFrame, it is very important that each user has a unique home directory. If several users share the same directory, changes made by one user may adversely affect the other users.

Using a Default User Template for Profiles

A default user template allows the administrator to create a default configuration for new users. When a new user is added to the system, the user can use the default template to set the default user configuration. There are four steps to creating and implementing user profiles using a default user template:

Create a share point for centrally managed home directories and user profiles

Create and configure a default user template

Create and configure a group profile for users

Use the template to create a new user

Creating a Share Point for Centrally Managed Home Directories and User Profiles

1.	From File Manager, select Create Directory from the File pull down menu. Create a directory called \PROFILE from the root drive of the WinFrame server.

2.	Share the \PROFILE directory by selecting Share As from the Disk pull down menu.

3.	Enter Profile for the Share Name.

4.	Enter a number for User Limit.

5.	Set permissions for the users. The default is Everyone.

6.	Choose OK.

Creating and Configuring the User Template

1.	From the Administrative Tools Group, start User Manager for Domains.

2.	Select New User from the User pull-down menu.

3.	Use the following information to create the template user:

Username	TEMP
Full Name	Template
Description	Template for user accounts
Password	TEMP
Confirm Password:	TEMP
User Cannot Change Password	Check
Password Never Expires	Check
4.	Click on the Groups button and add Administrators to the Member Of group.

5.	Click on OK.

6.	Click on the Profile button.

7.	In the User Profile Path, type \\servername\profile\%username%.usr where servername is the name of the WinFrame server.

8.	In the Local Path, type x:\users\%username%, where x is the drive where the User Profiles share point resides.

9.	Click on OK.

10.	In the New User window, click on Add to create the template user.

Creating and Configuring a User Group Profile

1.	Logon to the system as the TEMP user.

2.	If Gateway Services for NetWare is installed, choose None when prompted for a preferred server.

3.	The following message appears: "Loading User Profile. Your user profile cannot be loaded. A copy of the default profile will be loaded instead." Ignore this message.

4.	Adjust the desktop settings (for example, background, available applications, and application groups).

5.	Close all open programs and open Windows (except for Program Manager).

6.	Select Run from the File pull down menu in Program Manager.

7.	In the Command Line field type upedit.exe and click on OK. Running the User Profile Editor from the File pull-down menu in this way avoids saving the user profile with the Administrative Tools program group opened.

8.	Click on the gray button next to the Permitted To Use Profile field.

9.	Click on Show Users in the User Browser window.

10.	Select the TEMP user created above. Select Add and click on OK.

11.	In Program Manager Settings, choose a setting for the default profile:

Disable Run in File Menu (optional)

Disable Save Settings Menu Item and Never Save Settings (optional)

Show Common Program Groups (optional)

In Program Group Settings, choose whether you want the program group to be locked or unlocked.

12.	In the File pull-down menu, save the profile and select one of the save options:

Save to Current Profile

Save as User Default (global for all users)

Save as System Default (global)

Save as File (specific for individual user)

13.	Log off.

Using the Template to Create a New User

Note  Steps 1 through 5 only need to be completed once.

1.	Logon to the system as an administrator.

2.	In the Administrative Tools Group, double-click on User Manager for Domains.

3.	Double-click on the TEMP user.

4.	Choose Groups.

5.	Remove Administrators from the Member Of group and click OK.

6.	Click on OK in the User Properties Window.

7.	Highlight the Template User, TEMP, and select Copy from the User pull-down menu.

8.	Use the following information as an example:

Username	User1
Full Name	Test User 1
Description	(optional)
Password	User1
Confirm Password	User1
9.	Select the password settings you want and then click on Add.

This creates a new user called User1 with the properties of the template user. This allows the administrator to configure one default user template and create new users by copying the Template User account and supplying a new username.

Using Mandatory Profiles and Group Templates

Mandatory profiles allow the administrator to configure a profile that cannot be changed by the user. The mandatory profile can then be used along with a group template to create new users on the system who will adopt the attributes from the mandatory profile as well as the template.

There are six steps in implementing user profiles using templates and mandatory profiles:

Create a share point for centrally managed home directories and user profiles

Create the Group Template

Create the User Template

Create the Mandatory Profile

Configure the Mandatory Profile

Create new users using the Mandatory Profile and the Group Template

Creating a Share Point for Centrally Managed Home Directories and User Profiles

1.	From File Manager, select Create Directory from the File pull-down menu. Create a directory called \PROFILE from the root drive of the WinFrame server.

2.	Select Share As from the Disk pull down menu to share the \PROFILE directory.

3.	Enter Profile for the Share Name.

4.	Enter a User Limit. The default is Maximum Allowed.

5.	Set permissions for the users. The default is Everyone.

6.	Choose OK.

Creating the Group Template

1.	From User Manager for Domains, create a new local or global group by selecting the New Local Group or New Global Group from the User pull-down menu.

2.	In the Group Name field, type groupname, where groupname is the name of the new group. Add a description if desired.

3.	Click on OK to add the new group.

Creating a User Template

1.	From the Administrative Tools Group, choose the User Manager for Domains.

2.	Select New User from the User pull-down menu.

3.	Use the following information to create the template user:

Username	TEMP
Full Name	Template Group
Description	Template for user accounts
Password	Blank
Confirm Password	Blank
User Cannot Change Password	Check
Password Never Expires	Check
4.	Click on the Groups button; add Administrators and the template created above to the Member Of box.

5.	Remove Users from the Member Of box.

6.	Click OK.

7.	Click on the Profile button.

8.	In the User Profile Path, type \\servername\PROFILES\TEMPLATE.MAN where servername is the name of the WinFrame server.

9.	In the Local Path, type x:\users\%username% where x is the drive where the User Profiles share point resides.

10.	Click on OK.

11.	In the New User window, click on Add to create the User template.

Creating the Mandatory Profile

1.	From the Administrative Tools group, select the User Profile Editor.

2.	Click on the gray button to the right of the Permitted to use Profile field.

3.	Select the Group template created above and click on the Add button.

4.	Click on OK.

5.	Select the desired settings for the User Profile.

6.	Under the File pull-down menu, select Save As File.

7.	Select the drive and PROFILE directory.

8.	Save the file as TEMPLATE.MAN.

9.	Exit User Profile Editor.

Configuring the Mandatory Profile

1.	Logon as user TEMP.

2.	If you are using Gateway Services for NetWare, choose None in the preferred server section and click on OK.

3.	Adjust the settings for the Users group; for example, the background screen saver and other items on the desktop.

4.	Close all open programs and Windows (except for Program Manager).

5.	Select Run from the File pull down menu in Program Manager.

6.	In the Command Line field, type upedit.exe and click on OK. Running the User Profile Editor from the File pull-down menu in this way avoids saving the user profile with the Administrative Tools program group opened.

7.	Click on the gray button to the right of the Permitted to use profile field.

8.	Click on Show Users.

9.	Select the group that was created earlier.

10.	Select Add and click on OK.

11.	Set up the profile you want.

12.	Select Save as File from the File pull down menu.

13.	Select the drive and \PROFILE directory.

14.	Save the file as TEMPLATE.MAN.

15.	When prompted to replace the existing file, click Yes.

16.	Exit the User Profile Editor.

17.	Logoff.

Creating a New User Using the Mandatory Profile and the User Template

Note  Steps 1 through 5 only need to be completed once.

1.	Logon to the system as an administrator.

2.	Double-click on User Manager for Domains in the Administrative Tools group.

3.	Double-click on the TEMP user.

4.	Click on the Groups button.

5.	Remove Administrators from the Member Of group and click OK.

6.	Click on OK in the User Properties Window.

7.	Highlight the User template, TEMP, and select Copy from the User pull-down menu.

8.	Use the following information as an example:

Username	User1
Full Name	Test User 1
Description	(optional)
Password	User1
Confirm Password	User1
9.	Select the password settings and click on Add.

This creates a new user called User1 with the properties of the User template. This allows the administrator to configure one default user template and one mandatory profile, and to create new users by copying the User template account and supplying a new username.


Adding Support for New Modems

Although Citrix and Microsoft make every effort to provide support for the latest modems, new modems are released almost daily. This section describes how to add support for a new modem to WinFrame server and client systems.

The first step in adding support for new modem types is to obtain the modem .INF file from the manufacturer's Web site, bulletin board system (BBS), or FTP site. Once you have the .INF file, follow the procedures in this section to install the .INF file on a client PC for use by the WinFrame client or on WinFrame for use by WinStation Configuration and WinFrame RAS.

To Install a New Modem for use by the WinFrame Client (DOS, Win16, Win32)

1.	The modem scripts for the WinFrame clients are contained in the file MODEM.INI. This file is located in the following directory (by client type):

DOS client: \WFCLIENT\MODEM.INI

Win16 client: \WFC16\MODEM.INI

Win32 client: \PROGRAM FILES\CITRIX\WINFRAME CLIENT\MODEM.INI

2.	Use a text editor to add the name of the new modem to the [Modems] list at the beginning of the MODEM.INI file. Insert the name in the proper position by alphabetical order.

3.	Add the initialization strings for the modem that you downloaded from the manufacturer to the file. These strings are located in alphabetical order by manufacturer and modem type at the end of the Modems list. Save the file and exit the editor.

4.	Verify that the modem added now appears in the Remote Application Manager modem list.

To Install a New Modem for use by WinStation Configuration and WinFrame RAS

1.	The modem scripts for RAS and WinStation configuration are located in %systemroot%\SYSTEM32\RAS\MODEM.INF. Use a text editor such as Notepad to edit this file.

2.	Add the initialization strings downloaded from the manufacturer to the MODEM.INF file. These strings are located in alphabetical order by manufacturer and modem type.

3.	Verify that the modem added now appears in the list of modems in WinStation Configuration and in the list of modems in the Remote Access Service option in the Networking application of Control Panel.


WinFrame Hotfixes and Service Packs

What are Hotfixes and Service Packs?

Hotfixes are interim WinFrame system patches available for download from the Citrix Web site (http://citrix.com/support), the Citrix FTP site (ftp.citrix.com), and the Citrix BBS (954-267-2590). Hotfixes should be applied only on the advice of Citrix Technical Support. Hotfixes are tested and verified to fix specific problems.

Service packs are collections of patches that are released between major revisions of the WinFrame operating system. Service packs are cumulative; that is, they contain the patches included in all prior service packs.

Caution  Do not apply Microsoft Windows NT service packs to your system. These will corrupt your system setup. WinFrame service packs incorporate the updates contained in Microsoft Windows service packs once they have been tested with WinFrame.

Hotfix Naming Convention

Hotfixes are posted as self-extracting executables and follow a specific naming convention. For hotfixes up to and including WF160529.EXE, the table below illustrates the naming convention used. Hotfix WF160406.EXE is used as the example for the table.

WF	Digits 1 and 2 designate the applicable software for the hotfix, WinFrame in this case.
16	Digits 3 and 4 reflect the version of the software for which this hotfix is applicable, Version 1.6 in this case.
0	Digit 5 specifies whether the hotfix is applicable to the server or client. This digit can be one of four values: 0 = Server hotfix, D = DOS client hotfix, W = Windows 16-bit client hotfix, N = Windows 32-bit client hotfix.
4	Digit 6 indicates which service pack should be installed before the hotfix is installed (Service Pack 4 in this case). If this digit is "0," it indicates that the hotfix can be installed without first installing a service pack.
06	Digits 7 and 8 are sequential and indicate the hotfix number. This example shows it is the sixth hotfix since the last service pack was released.

The table below illustrates the new naming convention used after Hotfix WF160529.EXE. Hotfix SE165033.EXE is used as the example for the table.

S	Digit 1 specifies whether the hotfix is applicable to the server client. This digit can be one of four values: S = Server hotfix, D = DOS client hotfix, W = Windows 16-bit client hotfix, N = Windows 32-bit client hotfix.
E	Digit 2 reflects the applicable language, English in this case. Other values include F = French, G = German, S = Spanish, X = all languages
16	Digits 3 and 4 reflect the version of the software for which this hotfix is applicable, WinFrame Version 1.6 in this case.
5	Digit 5 indicates which service pack should be installed before the hotfix is installed (Service Pack 5 in this case). If this digit is "0," it indicates that the hotfix can be installed without first installing a service pack.
033	Digits 68: this value is sequential and indicates the hotfix number. This example shows it is the thirty-third hotfix since the last service pack was released.
Extracting, Installing, and Removing Hotfixes

Create a directory called \HOTFIX to store the self-extracting files that you download. Create subdirectories for each hotfix. Use these subdirectories to store the files that are archived within each self-extracting file. Each hotfix contains an executable file, HOTFIX.EXE. Because each hotfix executable file has the same name (HOTFIX.EXE), it is very important to store each hotfix in a separate subdirectory. Install hotfixes from the directory where you store the extracted files.

To Install a Hotfix

Note  Change drive letters and/or directories to match your system configuration.

1.	Download the hotfix to the \HOTFIX directory.

2.	At a command prompt, change to the system directory; for example c:

3.	Type cd \hotfix to change to the \HOTFIX directory.

4.	Create a subdirectory for the new hotfix; for example, md wf160406. Change to this directory.

5.	Type ..\wf160406 to execute the self-extracting file in the parent directory. The files are extracted to the current directory.

6.	Review the README.TXT file for information about the hotfix, such as special installation instructions.

7.	Type hotfix /i to install the hotfix.

8.	Type hotfix /v to verify that the files have been correctly installed.

9.	Type shutdown 0 /reboot to reboot the server.

To Remove a Hotfix

1.	At a command prompt, type c: to switch to the current directory.

2.	Change to the directory containing the hotfix; for example, cd wf160406.

3.	Type hotfix wf:wf160406 /r to remove the hotfix.

4.	Type shutdown 0 /reboot to reboot the server.

The HOTFIX Utility

HOTFIX is a utility that makes installing, tracking, and maintaining hotfixes easier.

Command Syntax

HOTFIX [ /H /R /V ] [hotfixname]
HOTFIX /I [sourcedir]
HOTFIX [\\computername] [ /L /F ] [hotfixname]

Parameters

\\computername

The name of a remote computer that is the target of the command. This can only be used with the /LIST option.

hotfixname

The name of the hotfix.

sourcedir

Source directory containing the corrected files and the HOTFIX.INI file for the hotfix.

Options

/FULL or /F

Specifies a full listing. Default is brief.

/HELP /H or /?

Displays this message.

/INSTALL or /I

Installs the hotfix identified by the HOTFIX.INI file in the source directory or the current directory in the source directory was not specified. The fix is installed on the local machine.

/LIST or /L

Displays a list of all installed hotfixes. If a hotfixname is specified, a detailed listing of the specific hotfix is displayed.

/REMOVE or /R

Removes the specified hotfix from the local machine.

/VERIFY or /V

Verifies that the specified hotfix is correctly installed on the local machine. If no hotfixname is specified, all installed hotfixes are checked.


Sample WinFrame Server Configurations

The table below shows several sample WinFrame server hardware configurations suitable for enterprise application deployment. This is not a comprehensive list of compatible platforms and is presented solely as examples of known good configurations. No endorsement of any particular manufacturer is implied. Additional information about some of the systems below can be found in Chapter 11.

Server Make/Model	System BIOS	CPUs	Disk Controller	Network Adapter
ALR Revolution*	Phoenix 4.0 Release 5.10.8	(6) P6-200	Adaptec AHA-7880 Version 1.32	3Com 3C905
Amdahl Envista Series	AMI V.1.00.05.CD0	(2) P166	(2) AIC 7870 v.1.26s emb_PCI	Intel EtherExpress Pro 100B
Compaq Proliant 800	P02 11/22/96	(2) P6-200	SimBios SCSI-3	Embedded Netflex-3 PCI
Compaq Proliant 1500	E12 1/16/96	(1) P133	SimBios SCSI-3	Netflex-3
Compaq Proliant 2500		(2) P6-200	SimBios SCSI-3	Netflex-3
Compaq Proliant 4500 Server*		(4) P166		Netflex-3
Compaq Proliant 5000 Server*		(4) P6-200	PCI Smart Array	Netflex-3
Compaq Proliant 6000 Server*
Data General Avion	Phoenix 4.05.9	(4) P6-200	Adaptec PCI 7870	Intel Pro 100B
Dell Power Edge 4100/200*		(2) P6-200	Adaptec 7880, 7860, PE RAID 2	Intel EtherExpress Pro 100B
Hewlett Packard NetServers*
Dell Optiplex Gxpro	Phoenix v1.0 5/29/96	(2) P6-200	Adaptec PCI 2939	3COM 3C590 Extended
HP NetServer LS	AMI 1.00.04.CD0L	(2) P6-200	(2) AIC 7870 v.1.2s8 emb_PCI	3Com 3C595
IBM PC Server 330*	SurePath 1/21/97	(2) P6-200	Adaptec 7880 v.1.25	AMD PCNET
IBM PC Server* 704	AMI 1.00.08	(1) P6-200	Adaptec 7880 v.1.256	3Com 3C905XL
Intel	AMI 1.00.04 060.	(4) P200	Adaptec PCI 7870	SMC PCI
NetFrame NF9000*		(4) P6-200	Qlogic PCI	3Com 3C905XL
NetPower Sparta Series	AMI 1.00.06.CD0	(1) P6-200	Adaptec PCI 7880 V1.25	Intel Pro 100B 82557**
Sequent NTS-2000	AMI 1.00.07.CD0	(4) P6-200	DAC 960 v1.29. 4MB	SMC 9332/9334 BDT 10/100
Unisys	BIOS v2.0	(2) P6-200	Adaptec 7880 v.1.25	3Com 3C905XL

*  See Chapter 11 for more information about these systems.

** Requires a supplied driver, Part Number 2569.


Performance Tuning

Overview

The hardware and software configuration used with a WinFrame server has a large effect on system performance as measured by user response time. The most useful tool in tuning a WinFrame server is Performance Monitor. Performance Monitor is a graphical tool that collects and examines data concerned with system activity. The overall performance of a WinFrame server can be examined by monitoring the following areas:

Processor(s)

Memory

Hard Disk(s)

Network

System throughput problems usually occur when demand for one of these resources exceeds the supply. The available resources in this case are the microprocessor(s), memory, hard disk(s), and networking hardware and software. Finding out how user applications interact with each of these resources is a logical first step when you start monitoring.

When monitoring a system, you are really monitoring the behavior of its objects. In WinFrame, an object is a standard mechanism for identifying and using a system resource. Objects are created to represent individual processes, sections of shared memory, and physical devices. Performance Monitor groups counters by object type. A unique set of counters exists for the processor, memory, cache, hard disk, users, WinStations, processes, and other object types that produce statistical information. Certain object types and their respective counters are present on all systems. However, other counters, such as transport-protocol counters, only appear if the computer is running the associated software.

Each object type can have several instances. For example, the Processor object type will have multiple instances if a system has multiple processors. The PhysicalDisk object type has two instances if a system has two disks. Some object types, such as Memory and Server, do not have instances. If an object type has multiple instances, each instance produces the same set of statistics (counter information).

The following sections describe potential bottlenecks that can affect system performance and discuss how to use Performance Monitor to determine if any of these areas are adversely affecting system performance.

Processor(s)

The processor-related factors that can affect performance on a WinFrame server include:

Processor utilization

Interrupts

Context switches

Screen savers

Processor Utilization

If processor utilization is over 90% on a regular basis, consider upgrading the processors in the WinFrame server. You could install a faster processor if this is a single-processor system, or install additional processors or faster processors in a multiprocessor system. Many server-class systems are designed to allow the inclusion of additional processors or processor boards. WinFrame scales linearly as processors are added, subject to performance constraints from other system resources such as memory. To determine CPU utilization, monitor the %Processor Time counter under the Processor object.

Interrupts

A defective device adapter can cause an excessive number of interrupts. This severely degrades the performance of the system because most of the processor time is spent handling interrupts. A moderately busy server (32-bit hard disk adapter, network card, and about 12 users) will experience an average of about 100 interrupts per second. If the number of interrupts per second increases dramatically without a corresponding increase in system activity, it could indicate a hardware problem. To determine if there is excessive interrupt activity, monitor the Interrupts/sec counter under the Processor object.

Context Switches

Device drivers perform context switches to switch between user and system level processing. A poorly-written device driver can cause the system to make a large amount of context switches. A typical value for context switches is 500 per second or fewer. If the number of context switches per second is greater than 500, a device driver may have built-in critical sections that are too long. If the number of context switches is not too high, the server can be taken off-line and a DOS-based diagnostic program such as CheckIt or QA Plus can be run to pinpoint the malfunctioning driver. To check the server for poorly written device drivers, monitor the Context Switches/Second counter under the System object.

Screen Savers

Screen savers, especially "busy" ones, can use a large amount of processor resources. If you plan to use a screen saver, use a generic one and test it on the system before you implement it.

To determine if a screen saver is using too much processing time, run the screen saver on the console. Logon at a WinStation and run Performance Monitor. Monitor the %Processor Time counter under the Processor object. Note the demand that the screen saver puts on the processor.

Memory

The factors related to system memory that can affect performance on a WinFrame server include:

Memory load

The system page file, PAGEFILE.SYS

Memory paging

Memory Load

To determine how much memory is present on the WinFrame server, use Windows NT Diagnostics. To use Windows NT Diagnostics to determine system memory:

1.	In the Administrative Tools group, double-click on the Windows NT Diagnostics icon. The Windows NT Diagnostics menu appears.

2.	Select Memory. The window that appears contains information about system memory. The Memory Load Index field at the bottom of this screen shows current memory load. If this value is consistently high, increase the amount of system memory.

PAGEFILE.SYS

WinFrame preallocates hard disk space for virtual memory. This area is marked as a file called PAGEFILE.SYS. In the WinFrame server, the default pagefile size is 1.5 times the amount of physical memory. This value is determined during system installation. The WinFrame server can exceed the default size space if it is determined that more memory is needed. However, this is time consuming and can slow down the system.

Use Performance Monitor to monitor the demands on the pagefile. Check the Commit Limit and the Committed Bytes counters under the Memory object to determine how the pagefile is performing. When the Committed Bytes counter exceeds the Commit Limit, increase the size of the pagefile as follows:

1.	In Control Panel, double-click on System.

2.	Click on the Virtual Memory button.

3.	In the Paging File Size for Selected Drive section, enter new Initial and Maximum Sizes. Click on Set and then click OK.

4.	Click OK to exit the System window.

Determine the optimum pagefile size by logging Committed Bytes over a period of two weeks with the Performance Monitor. Record the maximum value over the two week period. Increase this number by 10 to 20% to determine the system's minimum pagefile size.

Memory Paging

The WinFrame server keeps the most used data in physical memory and pages the least accessed data out to the pagefile. When a system is heavily loaded, memory is paged in and out at a rapid rate. This affects system performance if the hardware is unable to keep up with the server. The number of pages per second being paged in and out of memory is a valuable indicator of hardware performance. The pages per second should consistently average five or less per hard drive. If the pages per second is constantly above five per second, the system is paging in and out of virtual memory too much. Either use faster hard disks so the system can access virtual memory quicker or add more RAM to the machine.

Note  All configured WinStations consume system memory, whether active or inactive. To avoid allocating memory for WinStations that will never be used, be sure to configure only the type and number of WinStations required for your configuration.

Hard Disk(s)

Citrix does not recommend installing WinFrame on a RAID drive or using a RAID drive for the WinFrame swap file. RAID drives have additional overhead that enhances data reliablility but can adversely affect operating system performance.

The factors related to hard disk(s) that can affect performance on a WinFrame server include:

Percentage of disk time

Disk queue length

Percentage of Disk Time

The %Disk Time counter measures the percentage of time that a hard disk is active. If the %Disk Time counter value is high, the hard disk is not adequate for the system. You may consider taking one or more of the following steps:

1.	Use a 32-bit PCI bus mastering SCSI controller or a higher-performance (for example, Wide SCSI or Fast Wide SCSI) subsystem in the WinFrame server. This will speed up data transfer to and from the drive.

2.	Spread the pagefile across multiple drives.

3.	Install a separate hard drive and assign only the pagefile to the drive.

4.	Install a separate SCSI controller and hard drive and assign only the pagefile to that drive and controller.

5.	Offload some of the more frequently accessed data to a less utilized server.

6.	Install another server to help handle the user load.

Disk Queue Length

Another item to monitor is the Disk Queue Length counter. This measures the number of I/O requests outstanding for the hard disk. If data has to wait in a long queue before it is written or read from the disk, it can affect the WinFrame server performance. The Disk Queue Length values should be sustained at no more than 1.5 to 2 times the number of spindles making up the physical disk. Most disks have only one spindle. RAID disks usually have more but appear as only one physical disk to Performance Monitor.

Network

When monitoring network performance, examine the total bytes per second passing to and from the server. Compare this with the speed of the network being used to transfer the data; for example, 10Mbps or 100Mbps Ethernet, or 4Mbps or 16Mbps Token Ring. (Because these values are in bits per second, divide by 8 to get the number of bytes per second; for example 10Mbps Ethernet is actually 1.25Mbps.) If the server's total network throughput is close to the network's transfer speed, the network is saturated. Possible solutions are listed below.

Upgrading the Network

Add a faster network backbone

Add a router between network segments

Connect the servers directly to the backbone

Upgrading the Server

Add a faster network adapter

Use the latest drivers for the network adapter

Assign a higher interrupt for the network adapter to give it higher system priority


Unattended WinFrame Installations and Upgrades

Overview

This section describes how to set up an unattended WinFrame installation. Unattended setup allows you to perform a new installation or an upgrade of a WinFrame server without being present.

The unattended setup procedure for a new installation requires a text file, UNATTEND.TXT, that provides the answers to setup questions asked during a normal WinFrame setup. The UNATTEND.TXT file located in the i386 directory of the WinFrame CD-ROM contains configuration instructions. This file must be edited with the values required for your installation before starting the unattended setup process for a new installation. The unattended upgrade of WinFrame does not require the UNATTEND.TXT file and uses the settings from the previous install.

The setup program to execute depends on the operating system present on the computer where you are installing WinFrame. DOS, Windows, and Windows 95 systems use the 16-bit setup program, WINNT.EXE, while Windows NT systems use the 32-bit setup program, WINNT32.EXE.

Unattended WinFrame setup is supported only with WinFrame-compatible hardware. A list of supported network adapters that can be used to perform an unattended setup over the network is provided at the end of this section.

The WinFrame source files can be located on a CD-ROM drive or a shared network drive.

Note  To install TCP/IP services during an unattended new installation, the network must be configured for DHCP; otherwise, the installation will prompt for IP addresses and pause.

Requirements

Hardware Requirements

Standard WinFrame hardware; see the Hardware Compatibility List, the Quick Install Guide, and the Release Notes for detailed information

Software Requirements

WinFrame Version 1.6 or higher

Installation

Unattended New Installation on DOS, Windows, and Windows 95 Machines

1.	Copy the UNATTEND.TXT file from the I386 directory of the SOURCE DRIVE to drive C.

2.	Edit UNATTEND.TXT for your system's configuration according to the documentation in the file.

3.	Save UNATTEND.TXT.

4.	Select the Command Prompt from the Main Window Group.

5.	Change to the drive containing the WinFrame installation files.

6.	Change to the I386 directory.

7.	Type winnt /u:c:\unattend.txt /s:drive:\i386, where drive is the drive containing the WinFrame installation files. The installation will complete without any further user interaction.

Unattended New Installation on Windows NT Machines

1.	Copy the UNATTEND.TXT file from the I386 directory of the drive containing the WinFrame installation files to your local disk (for example, C:\.)

2.	Edit the file for your system's configuration according to the documentation in the file.

3.	Save the UNATTEND.TXT file.

4.	Start a command prompt.

5.	Change to the drive containing the WinFrame installation files.

6.	Change to the I386 directory.

7.	Type winnt32 /u:c:\unattend.txt /s:drive:\i386, where drive is the drive containing the WinFrame installation files. The installation will complete without any further user interaction.

Unattended Upgrade on WinFrame Machines

An unattended upgrade uses the information from the previous WinFrame installation.

1.	Select the Command Prompt from the Main Window Group.

2.	Change to the drive containing the WinFrame installation files.

3.	Change to the I386 directory.

4.	Type winnt32 /u. The upgrade will complete without any further user interaction.

Supported Network Adapters for Unattended WinFrame Setup

The following network adapters are supported for unattended WinFrame setup:

AM1500T - Advanced Micro Devices AM2100/AM1500T/Pcnet Adapter
AM1500T1 - Novell/Anthem NE1500 Adapter
AM1500T2 - Novell/Anthem NE2100 Adapter
BONSAI - COMPAQ DualPort Ethernet Controller
CPQTOK - COMPAQ 32-Bit DualSpeed Token-Ring Controller
DEC100 - DEC EtherWORKS LC Adapter
DEC101 - DEC EtherWORKS Turbo/LC Adapter
DECETHERWORKSTURBO - DEC EtherWORKS Turbo Adapter
DEC422 - DEC EtherWORKS Turbo EISA Adapter
DECSTAT - DEC Turbo Channel Ethernet Adapter
DECPC - DEC EtherWORKS DEPCA
ELNKMC - 3Com 3C523 Etherlink/MC Adapter
ELNK16 - 3Com Etherlink16/EtherLink16 TP Adapter
ELNKII - 3Com Etherlink II Adapter (also ELINK II/16 and II/16 TP)
ELNK3ISA509 - 3Com Etherlink III Adapter
ELNK3EISA - 3Com Etherlink III EISA Adapter
ELNK3MCA - 3Com Etherlink III MCA Adapter
EE16 - Intel Ether Express 16 LAN Adapter
IBMTOK - IBM Token-Ring Adapter
IBMTOKMC - IBM Token Ring Adapter /A
IBMTOK2ISA - IBM Token-Ring Network 16/4 ISA Adapter II
IBMTOK2E - IBM Token-Ring EISA Adapter
LOOP - MS Loopback Adapter
LT200MC - DayStar Digital LocalTalk Adapter (MCA)
LT200 - DayStar Digital LocalTalk Adapter
NE1000 - Novell NE1000 Adapter
NE2000MCA - NE/2 and compatible MC Adapter
NE2000 - Novell NE2000 Adapter
NE3200 Novell NE3200 EISA Adapter
NETFLX - COMPAQ 32-Bit NetFlex/NetFlex-2 Controller
NPEISA - Network Peripherals FDDI, EISA
NPMCA - Network Peripherals FDDI, MCA
P1390 - Proteon P1390 Adapter
P189X - Proteon ProNET - 4/16 p189X NIC
P1990 - Proteon P1990 Adapter
SMCISA - SMC (WD) EtherCard
SONICEISA - Sonic, EISA
SONIC - ARC Built-in Ethernet Adapter
UBPC - Ungermann-Bass Ethernet NIUPC Adapter
UBPCEOTP - Ungermann-Bass Ethernet NIUpc/EOTP Adapter
UBPS - Ungermann-Bass Ethernet NIUPS Adapter
WD8003EA - SMC (WD) 8003E /A
WD8003WA - SMC (WD) 8003W /A
WD8013WPA - SMC (WD) 8013WP /A
WD8013EPA - SMC (WD) 8013EP /A

For more information regarding the configuration of network adapters, refer to the UNATTEND.TXT file in the I386 directory of the WinFrame CD-ROM.

Troubleshooting

Why does the installation pause at a pop-up screen during Setup?

There are several reasons why an unattended installation might pause at a pop-up screen during setup. The first reason is incompatible hardware. All hardware on the server machine must be compatible with WinFrame. The second reason is a mismatch in the UNATTEND.TXT configuration file. The file must specify the answers to all questions asked during the setup. Another reason is specifying TCP/IP support but not specifying DHCP. Without DHCP, TCP/IP requires IP address values to be entered and will pause.


Using the Remoteboot Service With WinFrame

Overview

This document describes the installation and configuration of the WinFrame Remoteboot service. The Remoteboot service is a WinFrame feature that starts (or boots) connected DOS and Microsoft Windows workstations over a network. You install and configure the Remoteboot service on the WinFrame server and then customize it for your particular network and for your user's needs.

When you start, or boot, a computer, the operating system is loaded into its memory. The WinFrame Remoteboot service supports MS-DOS and Microsoft Windows personal computers (also called workstations) that boot using software on the WinFrame server's hard disk instead of the workstation's hard disk. A benefit of this feature is that the remote workstations do not have to have a local hard disk. Each of these workstations must have a network adapter with a Remote Initial Program Load (RPL) ROM chip that retrieves startup and configuration software from the server when the workstation starts. The workstation does not need a hard disk. This process is known as booting remotely or the remoteboot process. Read the section "How Does Remoteboot Work?" in Chapter 8, "Remoteboot," of the Installation Guide for a detailed description of how Remoteboot works.

By following the examples in this document along with the information in Chapter 8 of the Installation Guide, a WinFrame administrator can install, configure, and use the WinFrame Remoteboot service.

Requirements

Hardware Requirements

The first step in preparing to use the Remoteboot service is to ensure the WinFrame server has enough disk space for the files needed by the remote workstations. Use the values in the following table as a guideline.

Component	Disk Space Required (MB)
Network Client Version 2.2 for MS-DOS (LAN Manager Version 2.2)	5.1
MS-DOS 3.30	0.7
MS-DOS 4.01	1.5
MS-DOS 5.00	2.8
MS-DOS 6.xx	5.9
Microsoft Windows 3.1	12.4
You need to total the space required for the network client, the version of DOS, and Windows if used. In addition, you need room for personal copies of Remoteboot profiles (if needed) and for directories for each workstation where users store their own data. For example, if your Remoteboot workstations run the network client, MS-DOS 5.00, and Microsoft Windows 3.1, you need at least 20.3MB of space, plus space for Remoteboot profiles and user data.

You must also install a network adapter containing an RPL (Remote Program Load) ROM chip on each workstation you plan to boot remotely. A list of supported network adapters is provided in the section "Supported Network Adapters" in Chapter 8 of the Installation Guide and in the file %systemroot%\RPL\README.TXT. DOS workstations can be graphical or text-based. Windows workstations must have a mouse and a VGA or better video adapter. Before a workstation with a hard disk can be booted remotely, its hard disk must be properly configured for the Remoteboot service. This does not prevent users from accessing the hard disk after the workstation is booted. See the section "Enabling Remoteboot on a Workstation's Hard Disk" in Chapter 8 of the Installation Guide for details.

Software Requirements

WinFrame Version 1.6 or higher.

MS-DOS Version 3.30 or higher

Microsoft Windows Version 3.1 for any workstations that will be running Windows. Windows 95 and OS/2 workstations are not currently supported by Remoteboot.

System Integration

1.	Prior to installing the Remoteboot service, verify that the WinFrame server is up and running and that the server can access the network. Verify that the workstations have supported network adapters installed and that the workstations can access the network. An RPL ROM chip must be installed in the workstation's network adapter. A list of supported network adapters is provided in the section "Supported Network Adapters" in Chapter 8 of the Installation Guide and in the file %systemroot%\RPL\README.TXT.

2.	Install the Remoteboot service on the WinFrame server:

A.	Have on hand the WinFrame compact disk.

B.	If they are not already installed, install the DLC and NetBEUI protocols. The Remoteboot service requires DLC and NetBEUI. To install DLC and NetBEUI, logon as an administrator and start Control Panel in the Main program group. Double-click on Network and then click on Add Software. Select DLC and NetBEUI from the pull-down list and follow the on-screen instructions. After the DLC and NetBEUI protocols are installed, select Add Software and choose Remoteboot service.

C.	Complete the dialog boxes that appear. The default install directory is \systemroot\RPL. After Remoteboot is installed, the computer must be rebooted for the changes to take effect.

D.	The first time you run the Remoteboot Manager, use the Fix Security command to set permissions throughout the Remoteboot directory and to create necessary user accounts and groups.

3.	Install DOS Files for Remoteboot Workstations onto the WinFrame server:

The following procedure details one way to copy the DOS files to a WinFrame server over the network. Several methods are available, including network transfer, diskettes, CD-ROM, or a second hard disk on the WinFrame server.

A.	Check to make sure the \systemroot\RPL\RPLFILES directory is being shared on the WinFrame server. It should have the share name RPLFILES. To check this, type net view \\servername, where servername is the name of the WinFrame remoteboot server, at a command prompt.

B.	From a DOS client workstation (running a version of DOS that you want to copy on the WinFrame Remoteboot server), connect to the Remoteboot server's RPLFILES share directory by typing net use x: \\servername\rplfiles, where x is an available drive letter.

C.	Copy all the MS-DOS files to the \systemroot\RPL\RPLFILES \BINFILES\DOSxxx directory of the WinFrame server, where xxx is the version number (for example, DOS622), by typing:

copy c:\dos\*.*  x:\binfiles\dos622
attrib -s  -h  c:\io.sys
attrib -s  -h  c:\msdos.sys
copy c:\io.sys  x:\binfiles\dos622
copy c:\msdos.sys  x:\binfiles\dos622
attrib +s  +h  c:\io.sys
attrib +s  +h  c:\msdos.sys

4.	Start the Remoteboot service on the WinFrame server:

A.	In Control Panel, choose the Services icon.

B.	In the Services dialog box, select the Remoteboot service. You may need to scroll down the list of services to reach it.

C.	Choose the Start button to start the Remoteboot service.

D.	In the Services dialog box, choose the Close button.

E.	You can also use the net start remoteboot command to start the Remoteboot service and net stop remoteboot to stop it.

5.	Use the Remoteboot Manager program to create new profiles and manage workstations. The Remoteboot service must be started before the Remoteboot Manager can be started.

A.	To start Remoteboot Manager, log on to a user account on the WinFrame server that belongs to the administrators local group.

B.	From the Network Administration program group, choose the Remoteboot Manager icon. You may also start Remoteboot Manager from a command prompt by typing rplmgr (or rplmgr \\server, where server is the name of a WinFrame computer).

C.	If you want to administer a Remoteboot server other than the local computer, choose Set Focus from the Remoteboot menu and specify the Remoteboot server you want to administer.

6.	When you use Remoteboot Manager for the first time, you must decide which profiles you need. A profile is the working environment shared by one or more workstations. It consists of the operating system, the workstation and architecture type, the network adapter type, and all the other information needed to boot a workstation. They are not the same as user profiles. For more information, including instructions on how to change and delete Remoteboot profiles, see the section "Managing Profiles" in Chapter 8, "Remoteboot," of the Installation Guide. To create a profile:

A.	From the Remoteboot menu in Remoteboot Manager, choose New Profile.

B.	For the Profile Name, type a name for this profile [no more than 16 characters, with no spaces or backslashes(\)]. If the server's RPL directory is on a FAT file system, use the standard MS-DOS 8.3 format (eight characters, with an optional period and three-character extension) for directory and file names.

C.	In the Configuration box, choose a configuration that describes the network adapter and DOS version to be run on the workstation to be booted remotely.

D.	For the Description, type a comment for the profile. The description should summarize the profile for easy recognition, such as MSDOS 6.20 VGA and 3Com 503 EtherLink II adapter.

E.	Choose OK.

7.	You can add a new Remoteboot workstation manually or by booting the workstation remotely with no special preparation on the server.

Adding a workstation manually is recommended only when you know the workstation's network adapter ID number and you are copying an existing workstation record. Booting the workstation remotely with no special preparation on the server creates an adapter record on the server that you can convert to a workstation record by adding the workstation's name and profile. This is easier because you do not need to know the workstation's network adapter ID number. See the section "Adding a New Workstation" in Chapter 8 of the Installation Guide for more information.

To create a new Remoteboot workstation record manually:

A.	Logon as a local administrator and start Remoteboot Manager.

B.	From the Remoteboot menu, choose New Workstation or select an existing workstation record and choose Copy from the Remoteboot menu.

C.	In the Adapter ID box, type the workstation's network adapter ID number. This is a unique number supplied by the network adapter firmware. The adapter ID is 12 hexadecimal digits; the first six digits identify the adapter type. If you do not know the adapter ID, you must use the "To create a new workstation automatically" procedure found in the section "Adding a New Workstation" in Chapter 8 of the Installation Guide.

D.	In the Wksta Name box, type a name for the workstation. The name can have no more than 15 characters, with no spaces or backslashes (\). The Remoteboot service will create a WinFrame user account with this name, not for the user, but for the workstation itself. If the server's RPL directory is on a FAT file system, use the standard MS-DOS 8.3 format (eight characters, with an optional period and three-character extension) for directory and file names.

E.	In the Description box, type a comment that describes the workstation.

F.	In the Password box, type a password for the workstation's account (not for the user using the workstation).

G.	Choose a configuration type: Shared if this workstation can share its profile with other workstations, Personal if this workstation must use a personal copy of a profile so that you can customize the environment for the workstation.

H.	In the Wksta In Profile box, choose a profile for this workstation. The Profile was created in Step 6 above. If none of the profiles are suitable, you will need to create a profile.

I.	In the TCP/IP Settings box, enter appropriate addresses only if the workstation will use TCP/IP and not DHCP for automatic address handling; otherwise select DHCP.

J.	Choose the Add button to create the Remoteboot workstation record.

8.	You can install Microsoft Windows in similar workstation environments simply by creating a profile for Windows users and installing the Windows environment in the profile. In this way, you can add as many new workstations as you need without having to install the Microsoft Windows environment with each new addition. Keep in mind, however, that all the workstations sharing the profile must be similar enough to share the same startup information.

If the workstations are not similar, you create personal copies of profiles. If Windows is already installed for a profile and you create a new personal copy of that profile, the Windows installation is part of the new copy and you do not have to reinstall it. If you have established a personal copy of a profile and later want to add Windows, you must add it separately for that personal copy of the profile or delete the personal copy of the profile and create a new one from a profile that does have Windows installed. See the section "Installing Microsoft Windows for Remoteboot Workstations" in Chapter 8 of the Installation Guide for more information.

To support Microsoft Windows for Remoteboot workstations:

A.	Create a DOS profile if one does not exist.

B.	Boot a Remoteboot workstation that will use Microsoft Windows and join it to the DOS profile using Remoteboot Manager. If you will use the shared Windows profile method for similar workstations, assign the workstation to use a profile, not a personal copy of a profile. If you will use the personal profile user method for different workstations, assign the workstation to use a personal copy of a profile.

C.	Reboot the workstation. At the Remoteboot logon prompt, supply the name and password of an account that is a member of the administrators local group on the WinFrame server.

D.	If the workstation does not have a floppy disk drive, use the floppy disk drive of a server on the network. At the server (it doesn't have to be the Remoteboot server), use the File Manager or the net share command to share the server's floppy disk drive. Then at the workstation, use the File Manager or net use command to connect to the shared floppy disk drive.

E.	Put the Windows Disk 1 in the shared floppy disk drive.

F.	Run setup /a on the Windows Version 3.1 Disk 1 and install to C:\WIN. Windows files are expanded and put into the \systemroot\RPL\RPLFILES \BINFILES\WIN directory on the Remoteboot server. After Windows is installed, proceed to Step 9 or 10 depending on whether you are using shared or private Windows profiles.

9.	To install Windows for a profile, see the directions in the section "Installing Windows for a Profile" in Chapter 8 of the Installation Guide. You can install Microsoft Windows in similar workstation environments simply by creating a profile for Windows users and installing the Windows environment in the profile.

10.	To install Windows for a personal copy of a profile, see the directions in the section "Installing Windows for a Personal Copy of a Profile" in Chapter 8 of the Installation Guide. When you install Windows for a profile, all workstations that share that profile use Windows. Also, if you later assign a personal copy of the profile to a workstation, that workstation uses Windows.

Notes

If you encounter problems using Remoteboot, see the "Troubleshooting Remoteboot" section in Chapter 8 of the Installation Guide. The section "Optimizing the Remoteboot Performance" in Chapter 8 contains suggestions for increasing performance of remoteboot workstations.


Application Integration

When integrating an application into a WinFrame environment, the main areas of consideration are:

Application installation and configuration

Application network communications

Application video performance

Some applications have characteristics that, although relatively benign in a single-user environment, may lead to decreased performance or application incompatibilities in a WinFrame multiuser distributed presentation environment. Understanding and avoiding these characteristics (if possible) will help ensure the smooth integration of an application into a WinFrame environment.

As a general rule, follow the application guidelines below when selecting or developing applications:

Win32 (32-bit Windows) applications are preferred over Win16 (16-bit Windows) applications. WinFrame runs Win16 applications through a process called Win16 on Win32 (WOW), which causes Win16 applications to consume about 20% more resources than comparable Win32 applications.

The Windows INI files must be accessed using the proper Windows NT APIs. This is needed for the INI file synchronization features of WinFrame to work properly.

Applications (mostly DOS applications) that poll a hardware device or the keyboard rather than waiting for an event can have an adverse effect on system performance. The DOSKBD command can be used to tune DOS applications that perform excessive keyboard polling.

Use the Windows NT APIs instead of custom coding whenever possible. Many Windows NT APIs have Citrix MultiWin enhancements to seamlessly support a multiuser environment.

Avoid hard coding of paths and network identifiers.

NetWare applications must be able to run in bindery mode.

DOS graphics are not supported on ICA WinStations.

Avoid using bitmaps in graphics; use vector-based graphics instead. Use the raster operator to "brush" graphics on the screen for best performance on an ICA device.

VxDs are not supported in a Windows NT or WinFrame environment.

Use Windows fonts instead of Adobe fonts. The Citrix Windows Clients can then use the local font libraries. If you need to use custom or Adobe fonts, configure them as embedded Windows NT fonts to improve performance.

When developing Win32 applications, make sure that the DLLs do not have to be moved in memory; instead, use fixed DLL addresses. The Windows NT SDK includes tools to help with this.

The following sections discuss some of these guidelines in greater detail.

Application Installation and Configuration

In a multiuser environment such as WinFrame, it is essential that all users be able to make use of the same applications concurrently without interfering with each other's preference settings or data.

The first and most important step is to assign each user a unique home directory; for example, C:\USERS\%USERNAME%. By default, all users use the directory \USER\DEFAULT on the WinFrame server as their home directory. For applications to work properly, utilize User Manager for Domains to assign a separate home directory to each user. See the Managing Profiles section of Chapter 13 in the System Guide for more information about home directories.

To Configure Existing Users to use Separate Home Directories

1.	Login as an administrator and run User Manager for Domains.

2.	If you are logged into the domain and want to change local users, from the User menu choose Select Domain and type in the name of the WinFrame server the user accounts are on.

3.	Select the users you want to change. To select multiple users, press and hold the SHIFT key while using the up and down arrow keys. To select all users in a specific group, from the User menu choose Select Users.

4.	From the User menu, choose Properties.

5.	Click on the Profile button.

6.	Click on the radio button next to Local Path and enter d:\users\%username%, where d is the drive WinFrame is installed on (usually drive C).

7.	Click OK to return to the User Properties dialog box.

8.	Click OK to return to the User Manager for Domains main screen.

DOS and OS/2 text applications can generally be installed and used as-is. DOS applications that perform keyboard polling may need tuning with the DOSKBD command to avoid excessive resource consumption. Check the Application Notes section of this guide for any information about specific applications.

Windows applications often use Windows features such as the system Registry and INI files. Some of the information in these files is common to all users and some information is user-specific. This may require some application customization, as discussed in this section.

There are two ways to install 16- or 32-bit Windows applications in a WinFrame environment: user-global and user-specific.

User-Specific

User-specific means that the application is installed by a specific user for his or her own use only. The default installation is user-specific. Any INI or other files the application tries to place in the default WINDOWS directory are installed to that user's home WINDOWS directory. Even if the application is installed to a network or shared directory, other users may not have access to all the DLL and INI files needed to run the application, and must do a user-specific install for themselves. In short, a separate install must be done for each user who wants to use the application.

If an application is installed using the user-specific method, no special considerations regarding the storage and retrieval of data are needed. However, because the application must be completely installed once for each user, this method can consume a large amount of disk space and adds to administrative overhead in larger environments.

Some applications offer the option of doing a network installation. This process copies the installation diskettes or CD-ROM files to a common directory on the network from which individual users can then run a SETUP or INSTALL utility, which copies the required INI files to their home WINDOWS directory. While it does use less space on the WinFrame server than multiple user-specific installations, it still requires that a separate process be run for each user.

User-Global

Citrix recommends using the user-global method of installing Windows applications. With this method, an application is installed once by an administrator and can be run by anyone who logs into that WinFrame server.

To perform a user-global install, use the change user /install utility to place the session into install mode. This ensures that any INI files are installed to the WinFrame system directory instead of the user's home WINDOWS directory. When the installation is complete, use the change user /execute command to place the session back into execute mode. When a user starts the application for the first time, the required user-specific files are automatically copied to the user's home directory.

Most Win32 applications install in a pseudo user-global fashion by default, even when the session is not in install mode, because they make use of WinFrame's Registry, where each user can have a unique set of Registry settings. Win16 applications use INI files for configuration settings so they must be installed using install mode in order for multiple users to get separate copies of these files. It is recommended that you always install any Windows application, whether 16-bit or 32-bit, using install mode.

To Perform a User-Global Install

1.	Logon to the WinFrame server as an administrator.

2.	In the Main group of the Program Manager, double-click on Command Prompt to open a command prompt.

3.	At the command prompt, type change user /install.

This command places the system in install mode and allows WinFrame to keep track of the user-specific application Registry entries, initialization (.INI) files, and Dynamic Linked Library (.DLL) files the application adds to the WinFrame system during installation.

4.	Install the application per its instructions.

If you are asked to enter your name during the installation process, you may want to give a generic name because the name will be the default for all users. Configure any default program settings you want all users to have.

Verify that any icon groups added in Program Manager are Common groups, not Personal groups. If the group that was added for the application is a Personal group, create a Common group and drag the new icons from the Personal group to the Common group. The group must be a Common group for all users to be able to access the application.

5.	When installation is complete, switch to the command prompt and type change user /execute.

This command returns the system to execute mode.

6.	Log out and log back on as a user to verify that the application works correctly. Make sure that any shared resources (such as network drives or printers) are set up for each user before running the application. Check the software documentation for any notes that may apply to the installation or usage of the application.

7.	It is generally a good idea to write-protect the application's directory (and \WINFRAME if you have not already done so) from all non-administrator users. This allows users to read the program files but protects them from inadvertent changes or deletion. See the "Setting File Permissions" section of Chapter 4 in the System Guide for more information.

Note  If you installed to an NTFS partition, the security options in the Windows File Manager allow you to set the security to a wide array of options and restrict access only to specific users groups. If the application was installed on a FAT partition, you can use the ATTRIB command to mark the files and directories as read-only but cannot use the advanced security features of NTFS. For this reason, it is recommended that WinFrame and applications be installed on NTFS partitions. While using NTFS is not a must, it does provide a wider range of security options. If the applications reside on a NetWare file server, use the FILER program to set the security options.

If you need to determine if the system is in execution or installation mode, type change user /query at the command prompt.

The exact actions performed when a user-global application is started can be tuned and optimized by creating and setting compatibility bits in Registry variables associated with the application. Refer to the WinFrame Readme for more information on optimizing your applications using Registry variables.

The following sections describe what happens in install mode and execute mode.

Install Mode

Putting a user's session in install mode before installing an application causes the application to install to the %systemroot% directory, rather than the user's home directory. Whenever a user's session is in install mode, all changes made to an application's INI files are written to this central location.

Placing the session in install mode allows WinFrame to keep track of the user-specific application Registry entries and any INI files that the application may install during installation. This allows WinFrame to automatically propagate these Registry keys and files to each user as they are needed by applications while in execute mode. Once an application has been installed, return the user's session to execute mode. This avoids writing user-specific data to the initial user-global installation. When a session is in install mode, the following happens when installing an application:

All Registry entries that are created for the current user are shadowed under the key \\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Install.

Registry keys added by an application to \\HKEY_LOCAL_MACHINE are copied under the key \\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Install \Machine.

If an application queries the \WINDOWS directory using the GetWindowsDirectory API, WinFrame returns the %systemroot% directory. If any INI file entries are added using the WritePrivateProfileString API, they are added to the INI files under the %systemroot% directory.

If the application does not use these APIs for modifying INI files, the results will be unpredictable and could cause performance or usability issues.

Execute Mode

Execute mode is the default mode when a user logs in. WinFrame compares the INI files in %systemroot% to the INI files in the user's home WINDOWS directory. What happens when a %systemroot% INI file is newer than the INI file in the user's home directory is controlled by the 0x00000040 bit of the Registry value for the file in \\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix \Compatibility\IniFiles:

If the bit is 0 or the value does not exist, the user's INI file is overwritten with the newer version of the INI file in %systemroot%.

If the bit is 1, the user's INI file is merged with the newer %systemroot% INI file.

The user's previous version of the INI file is renamed to inifile.CTX, where inifile is the name of the INI file.

Warning  You can read *.INI files with a text editor but DO NOT save any changes! WinFrame has no way of knowing that the file has been updated. The changes may be lost and the file may be damaged.

The user's Registry values are loaded from their user profile (or the default profile if no user profile exists for them) and stored in \\HKEY_USERS\sid where sid is the security identifier for the user's account (for more information about SIDs, see Chapter 6, "Upgrading to a Trusted Domain Model" of the Upgrade Guide for Microsoft LAN Manager for OS/2). The values are then compared with the system values stored under \\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Install. If the user's keys are older, they are deleted and replaced with the system versions. Registry mapping is disabled if the 0x00000100 bit of the Registry value for the file in \\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Compatibility \Applications is set to 1. \\HKEY_CURRENT_USER will point to the \\HKEY_USERS path for the current user, even when there are multiple users on the WinFrame server.

While an application is running, the following occurs:

When an application tries to read a Registry entry under \\HKEY_CURRENT_USER that does not exist, WinFrame checks for the key under the \\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Install key. If the requested key exists, the key and its subkeys are copied to the appropriate location under \\HKEY_CURRENT_USER.

When an application uses the GetPrivateProfileString API to read an INI file that does not exist in the user's home WINDOWS directory, WinFrame checks for the INI file in %systemroot%. If the INI file exists in %systemroot%, the INI file is copied to the user's home directory.

When an application queries the \WINDOWS directory path using the GetWindowsDirectory API, WinFrame returns the user's home directory.

Controlling Application Execution in Execute Mode

Several compatibility bits can be set for an application, Registry path, or INI file to change how WinFrame handles the merging of application initialization data when a session is in execute mode. These compatibility bits are set in the Registry under \\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Compatibility. There are three separate keys for Applications, INI files, and Registry entries under this Registry path.

The default settings work for most applications, but can be further tuned using the compatibility bits described below.

Warning  These compatibility bits should only be changed if an application is not working properly.

The first set of compatibility bits indicates the version of the application that the settings are for. Not all combinations are useful; for example, a DOS application will never make any Registry calls. Because the path to the file is not specified and multiple applications may use the same filename (for example, SETUP.EXE and INSTALL.EXE are now regularly used for installation programs), specifying the application type will help ensure the compatibility settings do not affect other applications that have the same filename.

Add together the values of the bits you want to set to get the String value. For example, to return the username instead of the computername for both 16- and 32-bit versions of MYAPP.EXE create a key \\HKEY_LOCAL_MACHINE \SOFTWARE\Citrix\Compatibility\Applications\MYAPP and add a value called Flags of type REG_DWORD containing the hex value of 11C (add 0x00000004 for 16-bit Windows applications, 0x00000008 for 32-bit Windows applications, 0x00000010 to return username instead of computername, and 0x00000100 to disable Registry mapping).

Applications

The following compatibility bits under \\HKEY_LOCAL_MACHINE \SOFTWARE\Citrix\Compatibility\Applications\appname, where appname is the name of the application's executable file (for example, if the executable file name for an application is PROG1.EXE, appname would be PROG1) affect the application when it is running:

DOS application	0x00000001
OS/2 application	0x00000002
Windows 16-bit application	0x00000004
Windows 32-bit application	0x00000008
Return username instead of computername	0x00000010
Return Citrix build number	0x00000020
Disable Registry mapping for this application	0x00000100
Do not substitute user WINDOWS directory	0x00000400
Use the "Return username instead of computername" flag for applications that use the computer name as a unique identifier. This returns the user's name to the application, thereby giving each user of the application a unique identifier.

Use the "Disable Registry mapping for this application" to retain only one global copy of the Registry variables used by the application.

The "Do not substitute user WINDOWS directory" bit, when set, retains the systemroot directory for GetWindowsDirectory API calls. The default action if this bit is not set is to replace all paths to the WINDOWS directory with the path to the user's WINDOWS directory.

INI Files

The following compatibility bits under \\HKEY_LOCAL_MACHINE \SOFTWARE\Citrix\Compatibility\IniFiles\inifile, where inifile is the name of the INI file (for example, if the INI file name for an application is PROG1.INI, inifile would be PROG1) control INI file propagation:

Windows 16-bit application	0x00000004
Windows 32-bit application	0x00000008
Synchronize user INI file to system version	0x00000040
Do not substitute user WINDOWS directory	0x00000080
The "Synchronize user INI file to system version" bit, when set, adds new entries from the system master INI file when the application is started, but does not delete any existing data in the user's INI file. The default action if this bit is not set is to overwrite the user's INI file if it is older than the system master INI file.

The "Do not substitute user WINDOWS directory" bit, when set, retains the systemroot directory for file paths in the INI file when the system master version of the INI file is copied to the user's WINDOWS directory. The default action if this bit is not set is to replace all paths to the WINDOWS directory with the path to the user's WINDOWS directory.

Registry Paths

The following compatibility bits under \\HKEY_LOCAL_MACHINE \SOFTWARE\Citrix\Compatibility\RegistryEntries\pathname, where pathname is the Registry path under the key \\HKEY_CURRENT_USER\Software (for example, if the Registry variable path for an application is \\HKEY_CURRENT_USER\Software\BrandX\PROG1, pathname would be Brandx\PROG1) control Registry propagation:

Windows 32-bit application	0x00000008
Disable Registry mapping for application	0x00000100
The "Disable Registry mapping for application" bit, when set, adds new entries from the system master Registry image when the application is started, but does not delete any existing data in the user's Registry. The default action if this bit is not set is to delete and overwrite the user's Registry data if it is older than the system master Registry data.

Required API Usage for Application Compatibility

To properly exploit the user-global install feature of WinFrame, an application must use the proper APIs to read and write INI file and Registry information.

16-bit Applications

16-bit applications must use the GetPrivateProfileString API to read an INI file and the WritePrivateProfileString API to write to an INI file.

32-bit Applications

32-bit applications must use the Registry APIs to update Registry keys. These APIs include:

RegOpenKeyEx

RegCloseKeyEx

RegEnumKeyEx

RegDeleteKeyEx

RegQueryValueEx

RegSetValueEx

Using these APIs in install mode will time-stamp the entry and cause an update of each user's Registry settings upon their next login. Manually editing the Registry does not change the time-stamp for the Registry entry and the changes will not be propagated to users when they login.

Application Network Integration

In addition to the Windows NT environment requirements, the following considerations may apply to network-aware applications in a WinFrame environment:

Unique network addresses

Gateways

NetWare NDS requirements

Unique Network Addresses

Some applications are designed to require a unique network interface card (NIC) address for each instance of the application. An example of this design is a client/server application that requires a unique IP address for each client connecting to a server. An application designed to communicate in this manner will allow only one concurrent instance of its client to run on a WinFrame server. For an application to properly communicate in a WinFrame MultiWin environment, the application must be able to negotiate a unique socket.

The ability to negotiate a unique socket is a key component in the design of a compatible network application. Hard-coding any part of the address scheme may lead to incompatibilities. If two applications try to communicate through the same address, incorrect operation and application failure may result.

TCP/IP

Some applications that use the TCP/IP protocol to communicate use the IP address as a hard-coded identifier of the client. Multiple instances of these applications will not run in a WinFrame MultiWin environment. For an application to properly communicate in a MultiWin environment, the application must be able to negotiate a private socket. This allows the client and server to communicate using a unique IP/PORT/SOCKET address.

IPX

Some applications that use IPX use a hard-coded socket for communications, relying on a NIC address as the unique identifier. These applications will not run in a WinFrame MultiWin environment because all users communicate over the same NIC address, causing incorrect program operation.

NetBEUI and NetBIOS

Some applications that use NetBEUI or NetBIOS use a specific name as the unique identifier. These applications will not run in a WinFrame MultiWin environment because all users communicate using the same specific name, causing incorrect program operation.

Gateways

Some mainframe connectivity products use the network address of the NIC as a session and user identifier. These products are limited to only one concurrent user on a WinFrame server. In these cases, the only solution is to use a data communications gateway between the WinFrame server and the minicomputer. The terminal emulator can then use a virtual socket-based protocol (for example, IPX) to communicate with the gateway, allowing multiple users on the WinFrame server to use the product.

Novell NetWare NDS Requirements

WinFrame 1.x users can be authenticated by and use resources in a NetWare NDS (NetWare 4.x) environment. Most applications running in the NDS environment do not utilize the NDS-specific APIs and run exactly as they would if they were in a NetWare bindery (NetWare 3.x) environment. Applications running on a WinFrame server must be able to operate in a NetWare bindery environment because NDS-specific APIs are not supported.

Other Networking Considerations

For best performance, do not install the server component of client/server software such as Microsoft SQL server on the WinFrame server. These components are very resource-intensive and may affect the performance of multiple WinFrame user sessions.

Application Video Performance

The Citrix Independent Computing Architecture (ICA) protocol provides high-performance Windows presentation services over low-bandwidth connections. ICA is a robust and extensible protocol that includes protocol definitions for the following capabilities:

Full-screen text presentation

Graphical Windows application screen presentation

Keyboard and mouse input

Session control

Framing for asynchronous connections

Error detection and recovery

Encryption

Data compression

File system redirection

Print redirection

COM port redirection

Multiple generic virtual channels

Cut and paste across clients and servers

General purpose WinFrame server browsing

The Thinwire Virtual Channel

The thinwire protocol is an ICA virtual channel protocol used to transmit presentation commands from Windows applications running on the application server to the client. The thinwire protocol is highly tuned for transmission of Windows object display over low-bandwidth connections. This is accomplished through:

Command- and object-specific intelligent compression with state persistence; that is, run-length encoding for bitmaps

Outboard complex clipping and complex curve drawing

Intelligent caching of Windows objects such as bitmaps, brushes, glyphs, and pointers

Remote SaveScreenBitmaps

Cross-session persistent caching

To enable thinwire to most efficiently distribute the Windows image to the ICA client, use the following guidelines:

Use vector graphics instead of bit-mapped images for graphics

Use the raster operator to "brush" graphics to the screen

Bitmaps require more bandwidth than vector graphics because all of the image data for each unique bitmap must be transmitted from the server at least once. ICA compensates for this by caching each unique bitmap on the client system. When a bitmap is to be displayed, it is compared with the client's locally cached bitmaps. If the displayed bitmap matches one that is already cached at the client, ICA sends a command telling the client to redisplay the local copy instead of sending the image over the wire.

The use of TrueType fonts is preferred because these fonts are stored at the client. If an application must use custom or Adobe fonts, make sure the fonts are configured as embedded Windows NT fonts to allow faster display. More font technology is now being embedded in the Windows NT kernel, so this will improve performance in future versions of WinFrame.

Blinking cursors cause unnecessary bandwidth utilization because every blink requires data packets to be transmitted. Applications that do not use a blinking cursor or that allow the blinking cursor to be disabled are preferred.


ICA Browsing and Error Handling Overview

ICA browsing is at the heart of WinFrame license pooling, load balancing, and application publishing.

A separate ICA browsing system is in operation for each network protocol (TCP/IP, IPX/SPX, or NetBIOS) supported by WinFrame servers on a subnetwork. Each ICA browsing system is independent of the other systems. If a WinFrame server supports a network protocol, it can support license pooling; you must configure network WinStations for that network protocol to support user logons and published applications on that server.

For example, if two of the three servers in a subnetwork support IPX/SPX and all three servers in the subnetwork support TCP/IP, and each server has 15 licenses (all of which are pooled), 45 pooled licenses are available for TCP/IP connections but only 30 pooled licenses are available for IPX/SPX connections. If TCP/IP WinStations are configured on only two of the three servers, only those two servers can support TCP/IP user logons or published applications, up to a total of 45 users. The total number of users includes all connection types; for instance, with all 45 licenses in use, you might have 30 TCP/IP users, ten IPX/SPX users, and five Dial-in users on at one time, and 20 TCP/IP users, 15 IPX/SPX users, and ten Dial-in users on at another time.

ICA Browsing System Description

The ICA browsing system contains two categories of servers:

The Master Browser. The Master Browser is a server that is selected by an election process (called Master Browser Election) to contain the master list of available Citrix servers, published applications, and pooled licenses. At any time, there is only one master browser per protocol (TCP/IP, IPX/SPX, or NetBIOS) per subnet. If several protocols are supported on a subnet, the master browsers for each protocol can be different computers. License pooling is not supported across subnets; however, ICA browsing can be configured to allow Citrix server logons, load balancing, and published applications access across subnets.

Member Servers. Member Servers are the other WinFrame servers on the network that have not been elected as the master browser. Member servers periodically report information about their available connections, published applications, and pooled licenses to the master browser. If a network protocol is not configured on a server, that server is not a member server of the ICA browsing system for that protocol. Citrix server logon access is controlled by WinStation Configuration; the number of concurrent users for a connection type is limited by the number of configured WinStations as well as free licenses.

The master browser collects and maintains information from member servers in a database on the master browser for use by the Citrix ICA Clients for locating servers and published applications, by license management support, and by application publishing support. The master browser does not initiate contact with the member servers but merely collects information provided by the member servers.

Each member server reports its server data to the master browser periodically (the default interval is every 30 minutes) or whenever a change occurs, such as a user logging on or off at a client or an administrator adding a new published application or changing the pooled license count.

The master browser retains the information reported by a server in its database for up to 30 minutes, with the exception of license information, which is retained for 48 hours.

Whenever there is a browser election and a new master browser is elected, the server information database on the new master browser starts out empty and all information from the database on the previous master browser is lost. Each member server automatically updates the new master browser within a few seconds after the election.

If a member server goes down or off-line, its pooled licenses time out after 48 hours or at the next master browser election, whichever comes first. Member server information used for server browsing or application publishing times out after 30 minutes or at the next master browser election, whichever comes first.

Master Browser Elections

Master browser elections can be initiated by a client (WinFrame PC Client, Citrix ICA Client, or ICA device such as a Wyse Winterm) by a member server or by a master browser. Master browser elections are usually caused by the master browser going down or off-line. Whenever there is a browser election and a new master browser is elected, the server information database on the new master browser starts out empty and all information from the database on the previous master browser is lost. Each member server automatically updates the new master browser within a few seconds after the election.

A client will initiate a master browser election if it does not receive a response from the master browser to a request such as a request for the server or published application list or a request to map a server name to a network address.

A member server will initiate a master browser election if it does not receive an acknowledgement from the master browser after sending information to the master browser or requesting information from the master browser.

A master browser will initiate a master browser election if it detects the presence of another master browser on the network (this is rare).

Handling Fault Conditions

In most cases, a single server (which can be the master browser or a member server) fails or is brought off-line for maintenance. In this case, the 30 minute timeout for application publishing and server enumeration ensures that momentary interruptions (such as a quick reboot after a system crash) have a minimal impact on the overall system. Because many installations depend on license pooling to support large numbers of users with server farms, the pooled license timeout has been made longer (48 hours) to avoid impacting system throughput if a server needs to be replaced or requires more extensive maintenance. However, if the master browser goes down or off-line, the next user logon or logoff will force a master browser election, causing the licenses associated with the downed server to disappear.

Because licenses are only used to validate logons, active user sessions are not terminated if the license count on the network goes below the number of currently logged on users; however, new users will not be able to log in until the number of active user connections goes below the number of available licenses, freeing up licenses.

Citrix does not recommend placing all the pooled licenses on a single server. Although it is unlikely that a master browser election would occur while the server containing the pooled licenses is down, if it does occur, all those licenses would be lost until that server comes on-line again.


Fault Tolerance for High Availability

Overview

Reliability is a key component in an enterprise network. System availability can be expressed as the fraction of time that a system is available for productive work. One of the most powerful characteristics of Citrix WinFrame is its high reliability. Based on Microsoft Windows NT, WinFrame provides maximum availability of information and services to users. The WinFrame system ensures this high availability in three ways:

By uniformly handling hardware and software system faults

By protecting user programs from each other as well as the system

By providing data and system recovery mechanisms

Each WinFrame server includes the following reliability and fault tolerance capabilities:

Error handling and protected subsystems

Automatic restart

Recoverable file system

Tape backup support

Uninterruptible power supply (UPS) support

Several RAID configurations

Load Balancing

Additional fault tolerance functionality in the WinFrame server can be enhanced by the use of third-party products.

Error Handling and Protected Subsystems

Software applications do not always operate as expected - they can have faults that cause the application to fail. WinFrame is designed to tolerate these faults by ensuring that they do not affect other components of the operating system. For the WinFrame server, the first line of defense against software errors is its structured method of exception handling. When an abnormal event occurs, the event is captured and either the processor or operating system issues an exception. This design ensures that no undetected error is allowed to influence the system or other user programs.

Automatic Restart (Fail-Soft)

The system can be configured to automatically restart itself in the event of a failure. This feature helps provide maximum system uptime. To assist the administrator in determining the cause of the failure, WinFrame can be set to transfer its memory contents to a disk file for later analysis before restarting.

Recoverable File System

While WinFrame is highly tolerant of software faults, it also excels in handling hardware faults, such as disk and disk related failures, through the use of the Windows NT file system (NTFS). The file system logs each disk I/O operation as a unique transaction. When a user updates a file, the Log File Service logs redo and undo information for that transaction. Redo information tells NTFS how to repeat the transaction; undo tells NTFS how to undo (roll back) the transaction. File system recovery is straightforward with NTFS. If an operation fails, NTFS performs three passes - an analysis pass, a redo pass, and an undo pass. During the analysis pass, NTFS appraises the damage and determines exactly which clusters must be updated using the information in the log file. The redo pass performs all transaction steps logged from the last checkpoint. The undo pass backs out any incomplete (uncommitted) transactions.

In addition to virtually instant recovery, NTFS supports hot-fixing. If an error occurs due to a bad sector, NTFS moves the information to a different sector and marks the original sector as bad. This process is completely transparent to an application performing disk I/O. Hot-fixing eliminates error messages such as the "Abort, Retry, or Fail?" error message that occurs when a file system, such as FAT, encounters a bad sector.

Tape Backup Support (Fail-Soft)

Regular tape backup is an important part of guaranteeing data availability. WinFrame includes a Backup utility that makes it easy to back up your WinFrame server-based data to tape.

In addition to the built-in backup utility in WinFrame server, third-party products (such as Arcada's Backup Exec for Windows NT and Cheyenne Software's Arcserve) provide additional functionality such as the ability to create and script jobs, automate scheduling of jobs, remote backup administration, and client/server backup to remote tape devices.

Uninterruptible Power Supply (UPS) (Fail-Soft)

The UPS service for WinFrame detects and warns users of power failures and manages a safe system shutdown when the backup power supply is about to fail.

RAID

WinFrame server supports disk striping (RAID level 0), disk mirroring (RAID level 1), and disk striping with parity (RAID level 5).

Disk Mirroring (RAID Level 1)

Disk mirroring creates and maintains an identical twin for a selected disk. Any file system, including FAT, HPFS, and NTFS, can take advantage of disk mirroring. Disk mirroring uses two partitions on different drives connected to the same disk controller. All data on the first (primary) partition is mirrored automatically onto the secondary partition. Thus, if the primary disk fails, no data is lost. Instead, the partition on the secondary disk is used.

Disk mirroring has better overall read and write performance than stripe sets with parity. Another advantage of mirroring over stripe sets with parity is that there is no loss in performance when a member of a mirror set fails. Disk mirroring, however, is more expensive in terms of dollars per megabyte because disk utilization is lower than with striping with parity. Disk mirroring is best suited for peer-to-peer and modest server-based LANs, not for enterprise applications where WinFrame is deployed.

Disk Duplexing (RAID Level 1)

Disk duplexing is simply a mirrored pair with a separat disk controller for the secondary drive. Duplexing provides fault tolerance for both disk and controller failures, and can also improve performance.

Like mirroring, duplexing is performed at the partition level. To the WinFrame operating system, there is no difference between mirroring and duplexing.

Disk Striping with Parity (RAID Level 5)

Disk striping is another popular method of protecting data against disk failure. With disk striping, data is divided into large blocks and spread in a fixed order among multiple disks in an array. In a stripe set with parity, parity information for the data is also written across the array, with the parity information and data residing on different disks. If a member of the disk array fails, data can be recovered from the parity information because it is stored on a different disk. One advantage of stripe sets with parity is that they have better read performance (although slower write performance) than mirror sets. Another advantage is that the cost per stored megabyte is typically lower for stripe sets with parity than for mirrored sets because disk utilization is much higher.

To understand fully WinFrame-based disk striping, it is valuable to compare it to hardware-based striping systems. Hardware implementation of the RAID level can offer performance advantages over software implementations. With some systems, it may even be possible to replace a failed drive without shutting down the system. However, hardware RAID implementations tend to be very expensive and may lock an organization to a single vendor solution. The RAID technology of WinFrame is powerful and cost-effective and provides a consistent implementation across numerous hardware platforms. The WinFrame RAID technology also provides greater flexibility in mixing systems that provide optimum price and performance for customer needs.

Load Balancing

WinFrame's load balancing can be used to publish applications that execute on any of a number of servers when launched by a user. All WinFrame servers in a group share the responsibility of providing an increased level of service to all users without requiring the user to specify which server to connect to.

A published application can be as simple as a global name for the server group. Server groups configured in this manner allow users to start a Windows desktop without logging into a specific server.

Example

Domain 1 has 12 WinFrame servers installed. The administrator publishes an application called Domain_One and configures the application to provide complete access to all applications for all users.

Each time a user connects to the application Domain_One, he/she is attaching to any one of the 12 servers in the group. Although the users do not necessarily attach to the same server each time they connect, they are accessing the same personalized user screens.

In the event of a server failure, only one-twelfth of the service is interrupted. On a system that is configured to auto-save data regularly, a user would simply reconnect to the application and continue working from the most recently saved data.

This capability also allows a greater level of scalability. When it is time to add another WinFrame server, the system administrator can simply install the server in the domain and add the server to the group with the Application Configuration utility.

Implementations/Recommendations

Although there are many configurations that could provide a greater level of availability than a stand-alone system, this note focuses on the three most easily configured and deployed solutions. With a goal of high availability, this document will concentrate on implementations that use the following assumptions:

Do not require proprietary hardware (use standard hardware platforms only)

Configurations use readily available software solutions

All systems in a given configuration are connected to a separate backup server that is scheduled to run a complete backup of all regularly changing data on each of the systems

All systems in a given configuration are connected to an Uninterruptible Power Supply (UPS) that has a network connection and can be managed in situations where a power outage requires a system to fail softly

All WinFrame and Windows NT systems in a configuration replicate Registry information between multiple hosts through the use of a primary domain controller (PDC) or backup domain controller (BDC)

Recommendation 1 - Good Availability

The following configuration provides a greater level of availability through the use of redundant systems configured within the same domain. Disk drives and controllers are duplexed to provide drive and controller redundancy within a system and each of the two systems provides redundancy to the other.

In the above diagram, both WinFrame servers reside on the same domain. The administrator has designated WinFrame server 1 as the PDC and the primary server for users 1-30 and WinFrame server 2 as the primary server for users 31-60.

Both WinFrame servers are configured identically and scaled to handle 100% of the total load of 60 users. This includes applications, processors, WinFrame licenses, memory, and disk drive space. The only data that needs to be replicated on these two servers is the individual user directories; these only need to be replicated once and then synchronized at regular intervals using the replication utility provided with WinFrame.

In the event of a system level failure on server 1, all users would simply connect to WinFrame server 2 and continue working from the last saved copy of the data they were working on prior to the fault.

With the use of duplexed disk drives on every system, the system can remain operational in the event of a disk or controller failure until the administrator can safely bring the system down for repairs without interrupting service.

Recommendation 2 - Better Availability

In larger configurations where user load and file and print services can tax the processing power of the WinFrame servers, the use of separate file and print servers is recommended.

In the following diagram, all servers reside on one domain. For each WinFrame server, a separate Windows NT server is configured to provide file and print services. As in recommendation 1, each of the servers is configured with duplexed disk drives to provide redundancy within a given system.

The task of the PDC is moved to one of the Microsoft Windows NT Servers on the back end, with the other Windows NT server and both WinFrame servers configured as BDCs. This provides for the replication of user configurations through the synchronization of registry information, without taxing the processing capabilities of a WinFrame server with user authentication or server browsing.

Both Windows NT servers run Octopus Technologies Super Automatic Switch Over software (SASO) while the WinFrame servers run the Citrix Load Balancing Option Pack.

In the above diagram, all servers are configured and scaled to handle 100% of the total load of 60 users. This includes processors, WinFrame and Windows NT licenses, memory, and drive space.

All applications and user directories are installed on drives mapped to the Windows NT Servers. This enables the real-time replication between the Windows NT servers without interfering with the performance of the WinFrame servers.

The Windows NT servers use the Octopus SASO software. Octopus Technologies, Inc. offers a product for Windows NT that operates with WinFrame. Octopus provides real-time fault-tolerance for WinFrame by updating copies of selected files on a mirror server as the file system commits file updates on the primary server. As a result, data is mirrored in real-time. Octopus also uses a standard LAN or WAN connection between the primary and mirror servers. No dedicated link is required and mirrors do not have to be local. Instead, they can be anywhere on the network, including remote locations. This is particularly valuable in highly active, mission-critical transaction processing environments. If a transaction processing application server went down due to extreme circumstances in one location, a server in a remote location would be ready to begin running that application with all of its associated data.

Octopus is also a very cost-effective solution. It minimizes network bandwidth consumption by sending only file changes to the mirror, not the whole file. Octopus allows users to selectively mirror files rather than forcing mirroring of the entire server. As a result, Octopus provides more flexibility because it does not have to dedicate a machine strictly to mirroring a server. Also, multiple primary servers can be mirrored to a single mirror server or multiple mirror servers. The result is maximum disk utilization while still offering a high level of data redundancy. User data and services are thereby protected in the most cost-effective way.

In the event of a failure on one of the Windows NT servers, Octopus' SASO software will switch the entire user load over to the remaining server without any administrative intervention. This enables the system to remain up and running while the administrator troubleshoots and repairs the failed system.

By using the load balancing option for WinFrame, users connect to an application rather than a specific server. (That application can be something as simple as a name for the domain, which starts a Windows desktop.) In the event of a failure of either WinFrame server, users would simply login to the load balanced application and continue working from the latest copy of the saved data. With all data stored and replicated on the Windows NT servers, data integrity is maintained without sacrificing performance.

In this scenario, one WinFrame server and one Windows NT server could fail and the system would still be able to provide service to all users because of the scaling of the hardware and software platforms.

With the use of duplexed disk drives on every system, the system can remain operational in the event of a disk or controller failure until the administrator can safely bring the system down for repairs without interrupting service.

Recommendation 3 - Best Availability

In a large corporate network or enterprise, the use of a RAID storage subsystem is recommended on file and print servers with critical data storage responsibilities.

The actual configuration would look similar to recommendation two, with the addition of the RAID storage device and a remote data replication facility.

In larger configurations where user load and file/print services can tax the processing power of the WinFrame servers, the use of separate file and print servers is recommended.

In the following diagram, all servers reside on one domain. For each WinFrame server, a separate Windows NT server is configured to provide file and print services. Each of the systems is configured with RAID level 5 to provide disk striping with parity.

The task of the PDC is moved to one of the Windows NT servers on the back end, with the other Windows NT server and both WinFrame servers configured as BDCs. This provides for the replication of user configurations through the synchronization of registry information, without taxing the processing capabilities of a WinFrame server with user authentication or server browsing.

All Windows NT servers run Octopus SASO while the WinFrame servers run the Citrix Load Balancing Option Pack.

In the above diagram, all WinFrame servers are configured and scaled to handle 25% of the total user load. This includes processors, WinFrame licenses, memory, and drive space. The Windows NT servers are scaled to handle 66% of the total user load including processors, memory, Windows NT licenses, and application licenses, while the RAID storage systems are identical and can each store 66% of the total data requirements of all users.

All applications and user directories are installed on drives mapped to the Windows NT servers. This enables the real-time replication between the Windows NT servers without interfering with the performance of the WinFrame servers.

By using Octopus SASO, all Windows NT servers are actively supporting user demand, while maintaining redundancy of both data and hardware. In the event of a failure on one of the Windows NT servers, Octopus' SASO software will switch that server's user load to the designated server without any administrative intervention. This enables the system to remain up and running while the administrator troubleshoots and repairs the failed system.

By using the Load Balancing Option Pack for WinFrame, users connect to an application rather than a specific server. (That application can be something as simple as a name for the domain, which starts a Windows desktop.) In the event of a failure of either WinFrame server, users would simply login to the load balanced application and continue working from the latest copy of the saved data. With all data stored and replicated on the Windows NT servers, data integrity is maintained without sacrificing performance.

With the use of RAID level 5 striped sets with parity, data can be restored from the information on the parity disk in the event of a failure of one of the disks in the array. The RAID subsystems that are attached to the Windows NT servers should work with any off-the-shelf disk drive. By avoiding proprietary disk drives, spare drives can be obtained under virtually any situation.

The remote site would also be a target site for the SASO software; each of the Windows NT servers would replicate data across the remote connection to the remote servers. The location for these servers should be a site distant enough from the primary that natural disasters or other events would not affect the integrity of the replicated data. In the event of a natural disaster or a total systems loss at the primary site, the SASO software would rename the remote servers to the same name as the local servers and data access could be restored.

Licensing Issues

Licensing policy allows WinFrame to be installed on a single system at a time. If an administrator elects to maintain a complete hot standby WinFrame system, he/she must purchase a full base license for the redundant and backup servers. If a primary server is being mirrored properly, all registry and security information is protected.

One Server - Two Drives

Customers can mirror all WinFrame system files to a second disk drive, provided users only have access to one drive during operations. The following diagram requires one WinFrame license:

In the above diagram, Drive A is the primary drive and all WinFrame files are mirrored to Drive B. In the event of a failure on Drive A, the system can be rebooted from Drive B and normal operations can resume. This is often seen with two internal disk drives.

Two Servers - One Drive

Customers can install WinFrame in a configuration where two separate systems can access the same drive, such as with a RAID storage subsystem. However, WinFrame can only be booted on one of the systems at a time. The following diagram requires one WinFrame license:

In the above diagram, Server A is primary and is actively reading from the single drive. In the event of a failure on Server A, Server B can be booted as the primary.

Two Servers - Two Drives

Customers who want to provide total redundancy for both data and hardware might choose to implement the system in the following manner. The following configuration requires two WinFrame licenses:

In the above configuration, Server A acts as the primary server while Server B maintains a full image of Server A. Server B must be an independent license of WinFrame because of its ability to maintain an active role on the network while providing redundancy to Server A. Additionally, Server A can provide redundancy to Server B while maintaining an active role on the network.


WinFrame Problem Solving

Overview

This chapter contains some application notes to help you solve common problems you may encounter in WinFrame.


Setting up a WinFrame Kernel Debug Session

Overview

Kernel debugging is a process that uses the built-in debugging features of Citrix WinFrame to gather information for detecting, isolating, and resolving system problems.

Kernel debugging involves two WinFrame computers:

The computer being debugged, referred to as the target computer

A second computer that controls the execution of the target computer, called the host computer

The host computer runs an application called the kernel debugger that is used to examine memory and processor status, single-step through programs, and perform other operations useful in problem determination. The target computer can be allowed to run until an error condition occurs or it can be stopped at any time. For Intel-based systems, the kernel debugger application is I386KD.EXE.

To allow symbolic debugging (that is, debugging using descriptive names instead of numbers), symbols are loaded onto both target and host computers. These symbols contain information used to present information to technical personnel in a more readable manner; for example, displaying regions of memory in terms of their actual usage instead of as lists of hexadecimal numbers. For the information presented to be meaningful, it is important that the symbols present on the target and host computers be identical.

The host computer controls the target computer through a serial communications port. The host can be connected to a local target computer by a serial communications null-modem cable (local debugging), or the host can be at a remote location (such as Citrix headquarters) and connected to the target computer by modem (remote debugging). The modem used can be any standard Hayes-compatible PC modem; however, Citrix recommends using a U.S. Robotics Sportster series 33.6Kbps modem for best results.

This section describes how to configure a target computer and a host computer for local or remote debugging.

The Kernel Debugger (I386KD.EXE)

Using the kernel debugger program, I386KD.EXE, a support engineer can use the host computer to control program execution on the target computer. The target computer can be allowed to run until an error condition occurs or it can be manually stopped at any time. The action of stopping the target computer is called "breaking in." The support engineer breaks into the target computer by pressing CTRL+C in the kernel debugger session on the host computer. If a trap or fault occurs on the target computer, the target machine halts and displays system information. At this point, the operator on the host computer can interactively examine the status of the target computer or allow execution to resume. Pressing G in the kernel debugger session on the host computer allows execution on the target computer to resume. The screen below displays a sample kernel debugger session:

The kernel debugger can be used to set execution and memory access breakpoints, examine and modify memory contents, check the state of CPU registers, disassemble code, and other operations.

Symbols and Symbol Trees

To allow symbolic debugging (that is, debugging using descriptive text instead of hex numbers), symbols are loaded onto both the target and host computers. Each WinFrame executable, dynamic link library (DLL), and device driver has a corresponding symbol file with a .DBG extension. For example, the symbol file that corresponds to the program manager, PROGMAN.EXE is PROGMAN.DBG. These symbols contain information used to present data to technical personnel in a more readable manner; for example, displaying regions of memory in terms of their actual usage, instead of as lists of hexadecimal numbers.

For the information presented to be meaningful, it is important that the symbols installed on the target and host computers be identical and that they match the executable files on the target computer. The symbol files for the base WinFrame system are located on the WinFrame CD-ROM in the directory \SUPPORT \DEBUG\I386\SYMBOLS. The SYMBOLS directory contains directories corresponding to each type of file. You must use xcopy to copy the SYMBOLS directory and all its subdirectories to the %systemroot% directory on the target computer. These symbols are also copied to a directory on the host computer; this can be any directory and does not have to be the %systemroot% directory. These directory structures are referred to as the symbol tree.

If the WinFrame server has service packs or hotfixes installed, the symbol files must be installed in the proper order: first the base WinFrame symbols, then the service pack symbols, then the hotfix symbols. This ensures that the symbols exactly match the executable code.

Kernel Debug Configurations

There are two basic kernel debug configurations - local debug and remote debug. A third type of debug configuration, the ICA debug, is a variation of local debug. Each configuration is discussed below.

In a local debug configuration, the host and target computers are in close proximity and are connected by a null-modem cable. While this is the simplest debug configuration, it can only be used for on-site debugging. The diagram below represents a local debug configuration:

In a remote debugging configuration, the host and target computers are connected through dial-up modems. This configuration allows a support representative to dial into the target computer located at a remote customer site from a host computer located at Citrix headquarters. The diagram below represents a remote debug configuration:

In some cases, the support representative may be unable to directly access the target computer. If there are two WinFrame servers at the remote site, the support representative may suggest an ICA debug configuration, configured as shown below:

Much like the local debug, the host and target computers are in the same location connected by a null-modem cable. In addition, the host computer is configured to accept an ICA dial-in connection. The remote support representative dials in to the host computer and runs the kernel debugger in a remote session. This method combines the simplicity and reliability of a local debug with the ability to remotely debug a customer's target computer.

Requirements for Debugging

Software

Target system: WinFrame server with the latest service packs installed (if available)

Host system (local and ICA debug sessions): WinFrame server with the latest service packs installed (if available)

Note  The symbols for the server, service packs, and hotfixes must be installed in the proper order so that the symbols match the executable files. The host system must have the same server, service pack, and hotfix symbols installed, but it does not have to have the same software configuration.

Hardware

Local Debug Session

Null-modem cable between host and target computers

Remote Debug Session

Modems and modem cables for host and target computers. The host computer is usually preconfigured and is at the support provider's site. The target computer requires a modem configured to allow dial-in access to the target system. Citrix recommends using the U.S. Robotics Sportster series 33.6 modem.

ICA Debug Session

Null-modem cable between host and target computers

Modems and modem cables for host and remote client computers. The host computer must have a WinStation configured for remote ICA dial-in.

Configuring the Target Computer for Debugging

The procedure for configuring the target computer is similar for both local and remote debugging. The only difference is that remote debugging requires you to place the modem attached to the debugging port into auto-answer mode.

There are four steps to the setup process:

Installing service packs and hotfixes

Installing symbols

Preparing the modem and/or COM port

Modifying the BOOT.INI to enable kernel debugging

Installing Service Packs and Hotfixes on the Target Computer

Service packs are released between major WinFrame versions. They contain enhancements and patches (hotfixes). Service packs are cumulative; that is, they contain the hotfixes included in all prior service packs.

Hotfixes are interim WinFrame system patches posted between releases of service packs. Hotfixes should be applied only on the advice of Citrix Technical Support. Hotfixes are tested and verified to fix specific problems.

Service packs and hotfixes are available for download as self-extracting files from the Citrix FTP site at ftp://ftp.citrix.com and from the Citrix BBS (954-267-2590).

Installing a Service Pack

In most cases, the latest service pack should be installed on the target computer before support engineers perform a kernel debug session. The support engineer may also ask that additional hotfixes be installed or removed depending on the circumstances. Install the service pack before installing any hotfixes.

To Install a WinFrame Service Pack

1.	Download the service pack from ftp://ftp.citrix.com. The service pack is a self-extracting compressed file.

2.	Copy the file to a temporary directory on your hard drive and execute it to extract the service pack files.

3.	Execute UPDATE.EXE from the temporary directory.

4.	When you are done installing the service pack, type shutdown 0 /reboot to reboot the server.

Installing a Hotfix

Create a directory called \HOTFIX to store the self-extracting files that you download. Create subdirectories for each hotfix. Use these subdirectories to store the files that are archived within each self-extracting file. Each hotfix contains an executable file, HOTFIX.EXE. Because each hotfix executable file has the same name (HOTFIX.EXE), it is very important to store each hotfix in a separate subdirectory. Install hotfixes from the directory where you store the extracted files.

To Install a Hotfix

Note  Change drive letters and/or directories to match your system configuration.

1.	Download the hotfix to the \HOTFIX directory.

2.	At a command prompt, change to the system directory; for example c:

3.	Type cd \hotfix to change to the \HOTFIX directory.

4.	Create a subdirectory for the new hotfix; for example, md wf160406. Change to this directory.

5.	Type ..\wf160406 to execute the self-extracting file in the parent directory. The files are extracted to the current directory.

6.	Review the README.TXT file for information about the hotfix, such as special installation instructions.

7.	Type hotfix /i to install the hotfix.

8.	Type hotfix /v to verify that the files have been correctly installed.

9.	Type shutdown 0 /reboot to reboot the server.

Installing Symbols on the Target Computer

The correct symbols must be installed on the target computer before kernel debugging can occur. If a WinFrame service pack has been applied to the target computer, download the symbols for the service pack from the Citrix FTP site. The service pack symbols are posted in a self-extracting file. The Citrix Support representative will inform you of the correct file to download based on the currently installed service pack. The self-extracting file contains both the service pack symbols and an install utility. This utility installs the symbols first from the original WinFrame CD-ROM and then from the self-extracting file. See the Readme that accompanies the service pack symbols for more details on installing the symbols with this utility.

To Install the Debugging Symbols on the Target Computer

1.	Create a SYMBOLS directory in the %systemroot% directory; for example, md %systemroot%\symbols.

2.	If you are installing service pack symbols, go to Step 4. Step 3 is not required because the service pack symbol installation also installs the base WinFrame symbols from the CD-ROM.

3.	Insert the WinFrame CD-ROM into a CD-ROM drive that can be accessed by the target computer. Use xcopy to copy the \SUPPORT\DEBUG\I386 \SYMBOLS directory and its subdirectories from the WinFrame CD-ROM to the SYMBOLS directory; for example: xcopy /v /s x:\support\debug\i386 \symbols %systemroot%\symbols, where x is the CD-ROM drive.

4.	Follow the instructions included with the service pack to copy the service pack symbols to the appropriate target directories. If a WinFrame service pack has been applied to the target system, download the symbols for the service pack from the Citrix FTP site if they have not already been downloaded. The ZIP file contains both the service pack symbols and an install utility that will install the symbols from both your CD-ROM and the self-extracting ZIP file. See the Readme that accompanies the service pack for more details on installing the symbols.

5.	Contact your support representative to obtain any hotfix symbols that you may need. Follow the supplied instructions to install the hotfix symbols.

6.	When you are done installing the symbols, you can configure the target system modem and COM port.

If the target computer is a multiprocessor system or uses a special hardware abstraction layer (HAL), you must rename some of the symbol files.

For multiprocessor systems rename NTKRNLMP.DBG to NTOSKRNL.DBG. These files are located in the EXE subdirectory of the symbol tree.

Use File Manager, Properties to examine the internal name of the HAL.DLL file on the target computer. This file is located in the %systemroot%\SYSTEM32 subdirectory. Based on this information, rename the corresponding .DBG file to HAL.DBG in the DLL subdirectory of the symbol tree.

Preparing the Target Computer Modem and COM Port

The next step is to configure the COM port and the optional modem (remote debug only) on the target computer. Local and ICA debug configurations use a null-modem connection between the target and host computers and do not need modem configuration. Remote debug configurations require modem configuration.

To Configure the Target System COM Port for Debugging

1.	Obtain a copy of WINRDU.EXE, the debug configuration utility, from your Citrix support representative.

2.	Start a command prompt session and copy the WINRDU utility to your system's hard disk; for example: copy a:\winrdu.exe %systemroot%.

3.	Type winrdu and press ENTER. The Citrix Remote Debug Utility dialog box appears:

4.	The NTSD Settings can be ignored. If these settings need to be changed, your support representative will tell you what settings to use.

5.	For both local and remote debugging, you must select the serial port that will be used by the host system. This must be the highest numbered planar COM port; for example, if your motherboard contains COM1 and COM2 ports, the debugger must use COM2. Select the highest-numbered planar COM port from the pull-down list.

Note  The COM port used for debugging must not be configured as a WinStation. Use WinStation Configuration to make sure no WinStation is configured for that port.

The Modem Command text box is used for remote debugging only. When you click on the Reset Modem button, the Remote Debug Utility sends a command string to the modem that contains the following default commands:

Reset to factory defaults (AT&F)

Auto-answer on first ring (ATS0=1)

Ignore DTR (AT&D0)

Some modems may require additional commands. These commands can be entered in the Modem Command field. In most cases, no additional modem commands are required. Attach the modem you will use to the debugger COM port with a conventional PC modem cable.

Modifying the BOOT.INI File to Enable Kernel Debugging

BOOT.INI is a system text file that lists the operating systems that can be started, the default operating system to start, and a timeout value specifying how long to wait before automatically starting the default operating system.

When you first start a WinFrame server, the system loader (NTLDR) reads the BOOT.INI file in the system partition. BOOT.INI defines what items will be listed in the boot menu and how NTLDR will start each item. Here is a sample BOOT.INI file:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(2)\WINFRAME

[operating systems]

multi(0)disk(0)rdisk(0)partition(2)\WINFRAME="WinFrame Version 1.7"

multi(0)disk(0)rdisk(0)partition(2)\WINFRAME="WinFrame Version 1.7 [VGA mode]" /basevideo /sos

C:\="MS-DOS"

The line immediately following the [operating system] section describes the path NTLDR uses to boot this particular installation of WinFrame. For the purpose of this document, this line is referred to as the boot line. The boot line in this example shows that WinFrame is installed in the \WINFRAME directory on the second partition (partition 2) of the first disk (disk 0). The next line down starts the same installation of WinFrame but it uses two switches, /basevideo and /sos, which instruct NTLDR to start the server in a special way. The /basevideo switch starts the system using the standard VGA video driver. The /sos switch displays device driver names as they are loaded.

The target computer is placed in debug mode by setting one or more of the following switches in the boot line in BOOT.INI.

BOOT.INI Debugger Switches

The following BOOT.INI switches are used to enable the kernel debugger on the target computer:

/DEBUG	Causes the kernel debugger to be loaded during boot and kept in memory at all times. This allows a support engineer to break into the target computer at any time, even if the system is not suspended at a kernel STOP (blue) screen.
/CRASHDEBUG	Causes the kernel debugger to be loaded during boot but swapped out to the pagefile after boot. In this mode, a support engineer will only be able to break into the debugger if the target computer is suspended at a kernel STOP (blue) screen.
/BAUDRATE=value	Determines the speed at which the target computer communicates with the host computer. The default value is 19200 bps. For a remote debug configuration, the value should be set for 9600 bps. This switch also forces /DEBUG mode.
/DEBUGPORT=COMx	Specifies the serial port used for the kernel debugger on the target computer, where x is the communications port to use. If no serial port is specified, the kernel debugger defaults to COM2. Like /BAUDRATE, this switch also forces /DEBUG mode.
BOOT.INI Changes

Because the BOOT.INI file usually has the hidden, system, and read-only file attributes set, Citrix has added the ability to edit BOOT.INI to the Citrix Remote Debug utility (WINRDU). This unhides BOOT.INI and starts Notepad. When Notepad terminates, WINRDU resets the file attributes.

To Modify BOOT.INI

1.	From the Citrix Remote Debug Utility, click on the Edit BOOT.INI button. A BOOT.INI edit window appears. A sample BOOT.INI follows:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(6)\WINFRAME

[operating systems]

multi(0)disk(0)rdisk(0)partition(6)\WINFRAME="WinFrame Version 1.7"

multi(0)disk(0)rdisk(0)partition(2)\WINFRAME="WinFrame Version 1.7 [VGA mode]" /basevideo /sos

C:\="MS-DOS"

2.	The best way to modify BOOT.INI is to create a new boot entry for debugging. This gives you the ability to boot your WinFrame server for normal use or for debug use. Copy the desired boot line and append the /DEBUG switch to the end of the boot line. This switch is sufficient for local and ICA debug configurations. For remote debug configurations, you must also append the /BAUDRATE=9600 switch to the end of the boot line. If the debug modem or null-modem cable is connected to a communications port other than COM2, make sure you append the /DEBUGPORT=COMx switch. A sample modified BOOT.INI follows:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(6)\WINFRAME

[operating systems]

multi(0)disk(0)rdisk(0)partition(6)\WINFRAME="WinFrame Version 1.7"

multi(0)disk(0)rdisk(0)partition(6)\WINFRAME="WinFrame Version 1.7 (debug)" /debug /baudrate=9600 debugport=com1

multi(0)disk(0)rdisk(0)partition(2)\WINFRAME="WinFrame Version 1.7 [VGA mode]" /basevideo /sos

C:\="MS-DOS"

Note  The COM port used for debugging must not be configured as a WinStation. Use WinStation Configuration to make sure no WinStation is configured for that COM port.

After making the required changes, choose the Save option from the File pull-down menu to save the changes.

3.	Exit Notepad. You are returned to the Citrix Remote Debug Utility. Select Done to exit the Remote Debug Utility. This will also restore the hidden, system, and read-only attributes of BOOT.INI.

4.	Reboot the system. The WinFrame server is now ready for debugging by a remote host.

Configuring the Host Computer for Debugging

The host computer set up is similar whether the host computer is used in a local, remote, or ICA debug configuration. There are four steps to the set up process:

Installing symbols

Preparing the COM port and optional modem

Installing and configuring the kernel debugger

Executing the kernel debugger

Installing Symbols on the Host Computer

To effectively debug the target computer, the host computer must have access to a set of symbol files that exactly correspond to the files installed on the target computer. Because the system files installed on the host may not match the system files installed on the target (and are not required to), the symbol tree on the host should exist in a directory other than the host's %systemroot% directory. Citrix recommends creating a \DEBUG directory on the host computer with subdirectories for each version of the symbol tree; for example the tree containing the symbols for WinFrame Version 1.6 with Service Pack 3 might be named \DEBUG\WF16.SP3\SYMBOLS. The same procedures used to install the symbol files on the target computer should also be followed to install symbols on the host computer, except that where the procedure refers to the %systemroot% directory on the target computer, use the \DEBUG directory on the host computer instead.

To Install the Debugging Symbols on the Host Computer

1.	Create a \DEBUG directory on the host computer. Create a subdirectory for each version of the symbol tree; for example the tree containing the symbols for WinFrame Version 1.6 with Service Pack 3 might be named \DEBUG\WF16.SP3\SYMBOLS.

2.	If you are installing service pack symbols, go to Step 4. Step 3 is not required because the service pack symbol installation also installs the base WinFrame symbols from the CD-ROM.

3.	Insert the WinFrame CD-ROM into a CD-ROM drive that can be accessed by the target computer. Use xcopy to copy the \SUPPORT\DEBUG\I386 \SYMBOLS directory and its subdirectories from the WinFrame CD-ROM to the directory created in Step 1; for example: xcopy /v /s x:\support \debug\i386 \symbols d:\debug\wf16.sp3\symbols, where x is the CD-ROM drive.

4.	Follow the instructions included with the service pack to copy the service pack symbols to the appropriate target directories. If a WinFrame service pack has been applied to the target system, download the symbols for the service pack from the Citrix FTP site if they have not already been downloaded. The ZIP file contains both the service pack symbols and an install utility that will install the symbols from both your CD-ROM and the self-extracting ZIP file. See the Readme that accompanies the service pack for more details on installing the symbols. When prompted for the system directory, specify the directory created in Step 1.

5.	Contact your support representative to obtain any hotfix symbols that you may need. Follow the supplied instructions to install the hotfix symbols. When prompted for the system directory, specify the directory created in Step 1.

6.	When you are done installing the symbols, you can configure the target system for debugging.

If the target computer is a multiprocessor system or uses a special hardware abstraction layer (HAL), you must rename some of the symbol files.

For multiprocessor systems, rename NTKRNLMP.DBG to NTOSKRNL.DBG. These files are located in the EXE subdirectory of the symbol tree.

Use File Manager, Properties to examine the internal name of the HAL.DLL file on the target computer. This file is located in the %systemroot%\SYSTEM32 subdirectory. Based on this information, rename the corresponding .DBG file to HAL.DBG in the DLL subdirectory of the symbol tree.

Preparing the Host Computer Modem and COM Port

As with the target computer, the next step is to configure the COM port and the optional modem (remote debug only) on the host computer. Local and ICA debug configurations use a null-modem connection between the target and host computers and do not need modem configuration. Remote debug configurations require modem configuration.

Local Debug

For local debugging, very little configuration is required. Connect a null-modem cable between the serial ports of the host and target computers.

Remote Debug

In a remote debug configuration, a modem is connected to the host computer. This modem must be set to communicate at 9600 bps. It may also be necessary to disable flow control, error correction, and compression. Directions for resetting the modem are discussed in the section "Executing the Kernel Debugger" below.

ICA Debug

Like local debug configurations, ICA debug configurations require a null-modem connection between the host and target computers. In addition, an async dial-in WinStation must be configured on the host computer and a modem connected to the dial-in WinStation port. Use WinStation Configuration or the Dial-In Setup Wizard to create the dial-in WinStation. See your WinFrame documentation for more information.

Installing and Configuring the Kernel Debugger Application

To install the kernel debugger application, insert the WinFrame CD-ROM in the host computer. Copy the files located in the \SUPPORT\I386\DEBUG directory on the WinFrame CD-ROM to the \DEBUG directory on the host that was created to hold the symbol files.

The following environment variables control the behavior of the kernel debug application, I386KD.EXE.

Variable	Purpose
_NT_DEBUG_PORT	COM port used by the host computer for debugging.
_NT_DEBUG_BAUD_RATE	The maximum baud rate for the debug port. Use 9600 or 19200 for modem connections, 19200 for null-modem serial connections.
_NT_SYMBOL_PATH	The path to the symbols directory.
_NT_LOG_FILE_OPEN	Optional; the name of the file to which to write a log of the debug session.
I386KD.EXE supports the following command-line switches:

-b	Causes the debugger to stop execution on the target computer as soon as possible, by causing a debug breakpoint (INT 3).
-c	Causes the debugger to request a resynchronization on connect. Resynchronization ensures that the host and target computers are communicating in proper sequence.
-m	Causes the debugger to monitor modem control lines. The debugger is only active when the data carrier detect (DCD) modem signal is asserted; otherwise, the debugger is in terminal mode and all commands are sent to the modem. This option can only be used with a remote debug configuration.
-n	Causes symbols to be loaded immediately, rather than at a later time.
-v	Verbose mode; displays more information about such things as when symbols are loaded.
-x	Causes the debugger to stop execution on the target computer and break to a command prompt when an exception first occurs, rather than letting the application or module that caused the exception handle it.
Citrix recommends that a batch file be used to configure the environment prior to executing I386KD.EXE. For example, assume the following host configuration:

Remote debug configuration

Host modem is connected to COM2

The baud rate is 9600

The host's symbol tree is located in C:\DEBUG\WF16.SP4\SYMBOLS

A log file is created in C:\DEBUG

Here is a sample batch file using the assumptions listed above:

REM Sample Debug Batch File: SETDEBUG.BAT

REM Set Remote Debug Configuration: COM2, 9600 baud

set _NT_DEBUG_PORT=com2

set _NT_EBUG_BAUD_RATE=9600

REM Set path to debug symbols

set _NT_SYMBOL_PATH=c:\debug\symbols

REM Enable logging and set log path

set _NT_LOG_FILE_OPEN=c:\debug\debug.log

REM Start kernel debugger: Verbose mode, Monitor DCD

i386kd -v -m

Running the Kernel Debugger

The actual debugging process is outside the scope of this document. This section describes only how to verify that the debugger is installed and configured properly. Once this is verified, the system is ready for a support engineer to debug the system.

Local and ICA Debugs

When I386KD is executed on the host computer, the following text is displayed:

Microsoft(R) Windows NT Kernel Debugger

Version 3.51

(C) 1991-1995 Microsoft Corp.

Symbol search path is:

KD: waiting to connect...

At this point, the kernel debugger is waiting for user input. You can use CTRL+C to break into the target computer, if it is still running. If the target is currently stopped at a blue screen, break in occurs automatically. If you have any problems at this point, try using CTRL+R to force a resynchronization between the host and target computers.

Remote Debug

If you are using a remote debug configuration, I386KD must be executed with the -m option. The following text is displayed:

Microsoft(R) Windows NT Kernel Debugger

Version 3.51

(C) 1991-1995 Microsoft Corp.

Symbol search path is:

KD: waiting to connect...

KD: No carrier detect - in terminal mode

In this case, the debugger is in terminal mode, so you may directly send standard AT commands to the host modem. Begin by sending commands to disable hardware compression, flow control, and error correction. These commands will vary from modem to modem, so consult your modem documentation. The following modem initialization string is recommended for U.S. Robotics modems:

AT&H0&I0&K0&M0&N6

Once the modem is initialized properly, it must be instructed to dial the phone number of the target modem. This is accomplished by sending the ATD command to the modem. For tone dialing phone systems, type ATDTphonenumber, where phonenumber is the telephone number of the modem connected to the target system.

Some telephone systems may use pulse dialing systems. For pulse dialing systems, type ATDPphonenumber, where phonenumber is the telephone number of the target modem.

Assuming the modem connected to the target system is properly configured, the host modem and target modem establish a connection and assert the data carrier detect (DCD) signal. Once DCD is detected, terminal mode is disabled and you are connected to the debugger on the remote target computer.

At this point, the kernel debugger is waiting for user input. You can use CTRL+C to break into the target computer, if it is still running. If the target is currently stopped at a blue screen, break in occurs automatically. If you have any problems at this point, try using CTRL+R to force a resynchronization between the host and target computers.

With some remote debug configurations, you may find it difficult to break into the debugger. See the "Troubleshooting" section below for additional tips.

Troubleshooting

Typically, few problems are encountered with local and ICA debugs. Most problems occur when doing a remote debug and they are generally modem related. The most common problems encountered are:

Inability to break into the debugger

Failure of the target modem to auto-answer

[Parity Error] message

Each problem is discussed separately below.

Inability to Break into the Debugger

This is the most common problem experienced. The symptom is that the target computer fails to respond to the CTRL+C and CTRL+R commands from the host computer. The target and host modems appear to be connected and functioning normally but the host operator is unable to stop the target computer.

At this time it is not clear why this condition occurs. Because this problem can be difficult to resolve, Citrix recommends using an ICA debug instead of a remote debug if the problem occurs. If an ICA debug configuration is not possible, follow the steps below to resolve this problem:

1.	Make sure the target computer was started in debug mode. When the target computer is rebooted in debug mode, the initial blue startup screen displays text showing the kernel debugger enabled on a particular COM port. If this text is not displayed, the debug options were not added correctly to the BOOT.INI file. Make sure the COM port displayed is the one the modem is connected to.

2.	Change the modem make and model on the target computer. If possible, use the same make and model modem as the Citrix representative. Similar modems appear to have a higher remote debug success rate compared with modems from different manufacturers. Citrix recommends using the U.S. Robotics Sportster series 33.6 modem.

3.	Force the baud rate of both modems to 9600 bps. Consult your modem documentation for the initialization strings that set the DTE and DCE rates to 9600 bps. For U.S. Robotics modems, this command is AT&N6.

4.	Add the /baudrate=9600 option to BOOT.INI. This forces the baud rate on the debug COM port to 9600 bps. Remote debug configurations should always set this option.

5.	Try pressing the PrintScreen key on the target computer console. While in debug mode, the PrintScreen key should cause the host computer to break in.

6.	Make sure both modems are set to transmit break signals. For some modems, a break signal (CTRL+C) received from the computer may cause the modem to perform a specific task without actually transmitting the break to the remote system. For instance, the default behavior of U.S. Robotics modems is to flush the data buffer before sending the break signal to the remote modem. Make sure both modems are set to pass the CTRL+C character. Consult your modem documentation for the necessary commands. For example, to disable destructive breaks on U.S. Robotics modems, the command is AT&Y2.

7.	With the modems connected [and data carrier detect (DCD) present], reboot the target computer. If the target modem is set to ignore the state of DTR, the modems will stay connected even if the target computer is rebooted. When the kernel loads on the target computer, it will output information to the debug port. If the host computer is connected at that time, this may cause the systems to synchronize.

Failure of the Target Modem to Auto-answer

For all Hayes-compatible modems, ATS0=1 is the command that instructs the modem to auto-answer on one ring. The target modem must be configured with this setting. If the target modem does not auto-answer after using the WINRDU utility, follow the procedure below:

1.	Move the target modem to a COM port other than the port currently being used by the kernel debugger. If only one COM port is available on the target computer, connect the modem to a different computer or reboot the target with the debugger disabled.

2.	Use the Terminal application (or another communications program such as Hyperterminal) to send the ATS0=1 command to the modem. Make sure you receive an OK response from the modem.

3.	If possible, dial the number for the modem from a telephone handset to check that it now auto-answers.

4.	Save the current modem configuration in non-volatile RAM. This way the modem will be in auto-answer mode when it is powered up. For example, the command AT&W saves the current modem configuration to non-volatile RAM (NVRAM) for U.S. Robotics modems. When the debug process is finished, restore the factory defaults by sending the AT&F command (or equivalent) to the modem. Use the AT&W command (or equivalent) to save the factory defaults to NVRAM.

5.	Reconnect the target modem to the debug port on the target computer (or restart the target computer in debug mode).

6.	Use the host computer to dial into the target modem.

[Parity Error] Message

This message may be displayed on the host computer if the baud rates are too high to sustain a reliable connection. These steps should resolve this problem:

1.	Force the baud rate of both modems to 9600 bps. Consult your modem documentation for the initialization string(s) that sets the DTE and DCE rates to 9600 bps. For U.S. Robotics modems, this command is AT&N6.

2.	Add the /baudrate=9600 option to the BOOT.INI. This sets the baud rate on the debug COM port to 9600 bps. Remote debug configurations should always have this option set.

3.	Change the modem make and model on the target computer. If possible, use the same make and model modem as the Citrix representative. Like modems appear to have a higher remote debug success rate versus modems from different manufacturers. Citrix recommends using the U.S. Robotics Sportster series 33.6 modem.


Troubleshooting IPX Client Connection Problems

This section contains a troubleshooting checklist useful for debugging IPX client connection problems. Follow this procedure when your IPX client devices have trouble connecting to a WinFrame server.

1.	Determine which client type is failing to make an IPX connection (WinFrame DOS Client, Win16 Client, Win32 Client, or ICA terminal).

2.	Verify that the client PC can access the NetWare servers. Execute the slist command at a client command prompt; a list of NetWare servers should be displayed. If not, make sure that VLM.EXE is loaded.

3.	Specify the MAC address or node address along with the MAC address of the WinFrame server when making the IPX connection. Execute the QUERY SERVER /MASTER command at a WinFrame command prompt to determine the IPX MAC address.

4.	Use WinStation Administration on the WinFrame server to check that IPX WinStations are configured and active. Verify that the WinFrame server can access the NetWare servers.

5.	Conduct a loopback test to isolate the network. Install the WinFrame Win32 client on the WinFrame server and make an IPX connection back to the WinFrame server. If the loopback test passes, check if WinStations on the same network segment as the WinFrame server are able to connect. If clients on the same network segment can connect but clients on other segments are unable to connect, there may be a problem with the router configuration or cabling.

6.	Install the most current WinFrame Client from the latest service pack. Install Hotfix WF160459.EXE to fix an IPX connection timeout problem.

7.	Install the most current network interface card (NIC) drivers on the client and server machines.

8.	Remove and reinstall the NWlink IPX service.

9.	Use Event Viewer to check for connection-related error messages.

10.	If the problem persists, create a debug trace for the WinFrame Client connection.


Security and WinFrame

Introduction

Unauthorized access to computer systems is a serious problem in many organizations. This chapter describes some techniques a WinFrame administrator can use to protect valuable computer resources and company data. For those companies requiring additional security measures for remote access, WinFrame supports several third-party security solutions described later in this chapter.

WinFrame and the WinFrame client provide security features over and above the features provided by the Windows NT Server operating system:

Login names and passwords sent to the WinFrame server from the WinFrame client are never sent in clear text.

The Citrix ICA protocol uses a compression technique that effectively scrambles all data sent over the communications link. Additional encryption can also be specified for the WinStation using WinStation Configuration.

WinFrame WinStations can be configured to require callback to a fixed telephone number, preventing an intruder from accessing your server from a remote location.

WinFrame WinStations can be configured to always require a password to be entered, preventing an intruder who has obtained access to a WinFrame client PC from accessing a WinFrame server.

WinFrame Remote Access Service (RAS) supports RSA and DES security options.

WinFrame can be used with third-party security hardware for maximum security.

WinFrame provides the AUDITLOG utility, which can be used to generate a report of failed logon attempts or user logon/logoff reports, as text reports or in a format readable by spreadsheet or database programs.

Additional security for Internet access is provided by the Security Utilities Pack for WinFrame Version 1.6. This package is available from Citrix. You do not need the Security Utilities Pack for WinFrame Version 1.7. The security utilities are included with Version 1.7.


Customizing Winlogon

Overview

Winlogon is the process that controls the logon sequence to a WinFrame server. Winlogon can be customized by adding an announcement box prior to the logon screen. Winlogon customization fulfills two important goals:

To identify the purpose of the machine to the organization

To add an announcement indicating that unauthorized access to the server is prohibited

Note  To successfully prosecute system break-ins, most courts require that you declare that your system may only be accessed by users with valid accounts. In addition, you should avoid "Welcome" messages because they may be interpreted as giving blanket permission to anyone to access your system.

Modifications to Winlogon are controlled by the Registry configuration database. The value entries that control Winlogon are found under the following Registry key:

\\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT \CurrentVersion\Winlogon

Note  To modify the Registry configuration database, use the Registry Editor, REGEDT32.EXE, located in %systemroot%\SYSTEM32 \REGEDT32.EXE, where %systemroot% is the root directory of the installation partition. The Registry Editor is not loaded as an icon at installation.

There are several ways to start the Registry Editor.

Start it from the Run menu under Program Manager or File Manager.

Locate it in the File Manager and double-click on the executable.

Add an icon to a program group.

From the Administrative Tools program group, double-click the Windows NT Diagnostics icon and select Tools, Registry Editor.

To Customize Winlogon

1.	With the Registry Editor, proceed to the Winlogon Registry key (\\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon).

2.	Scan down the Winlogon value list on the right side of the window and locate LegalNoticeCaption and LegalNoticeText. When strings are assigned to these two values, an announcement appears prior to the login screen. The announcement is displayed until the user clicks on OK. Specify two strings for the announcement box: LegalNoticeCaption for the title bar, and LegalNoticeText for the dialog box. For example:

LegalNoticeCaption:REG_SZ: This is the Corporate Internet Server.
LegalNoticeText:REG_SZ: Unauthorized Access is Strictly Prohibited.

3.	Exit the Registry Editor and log off. When you log back on, the message box appears.

Note  WinFrame has a screen saver that is automatically invoked after 15 minutes of workstation "connected" state idle time.

Note  It is recommended that WinStations be left in a disconnected state whenever possible, because connected WinStations consume valuable CPU time that could otherwise be used by active users. If WinStations must be left in a connected state, modify the screen saver and time-out periods by using the Registry Editor on the following key:

\\HKEY_USERS\DEFAULT\Control Panel\Desktop

Search for the values:

ScreenSaveTimeOut:REG_SZ:900

SCRNSAVE.EXE:REG_SZ:D:\%systemroot%\System32\logon.scr

Change the logon.scr to another .scr file or (none); other .scr choices are listed in the \system32 directory.

The (none) choice looks like:

SCRNSAVE.EXE:REG_SZ:(none)

The time-out period is listed in seconds. To change the time-out from 15 to 5 minutes, change the time-out period from 900 to 300.

Caution  Some screen saver programs consume valuable CPU resources. It is highly recommended that you select a low-overhead screen saver such as logon.scr, black16.scr, or (none) if you must leave a workstation in a connected state.


Protecting Against Viruses and Trojan Horses

It is extremely important to prevent intentional intrusions into your computer network that take the form of viruses and Trojan horses. Viruses are programs that attempt to spread from computer to computer and either cause damage (by erasing or corrupting data) or annoy users (by printing messages or altering what is displayed on the screen) on every computer they infect. Trojan horses are programs that masquerade as other common programs while they attempt to capture information.

An example of a Trojan horse is a program that masquerades as a system logon screen in an attempt to capture user names and password information, which the writers of the Trojan horse can use later to access the system.

How to Prevent Virus Outbreaks

Viruses are usually not intentionally introduced to your system. In most cases, users unknowingly introduce a virus into your network when they obtain what they believe to be a useful, safe program from another source, such as an online bulletin board. Many network users are unaware that they can bring viruses into the network this way. Therefore, one of the best ways to keep your network virus-free is by educating your users.

Have at least one commercial virus-detection program in use and regularly check your file servers for viruses. If possible, make virus-detection software available to your users.

Other ways to protect against computer viruses include the following:

Set file permissions to make all applications available on network servers and workstations read and execute only, preventing them from being replaced by viruses. (For more information about this procedure, refer to Chapter 13 of the System Guide.)

Before putting a new application or file on the network, put it on a computer not attached to the network and check it with your virus detection software. Log on to this computer using a Guest account so that the program being examined will not be able to modify any important files.

Regularly use an NT-compatible virus scanner. You may consider using the at command to periodically run the virus scanning program; for example, late at night when no users are logged on.

NEVER LEAVE A DISKETTE IN THE DISKETTE DRIVE OF YOUR SERVER. If the system is rebooted (for example, because of a power failure), the system may attempt to boot from diskette and become infected.

Regularly back up the files on your file servers (and workstations, if possible) so that damage is minimized if a virus attack does occur.

How to Prevent Trojan Horse Attacks

WinFrame provides an important safeguard against Trojan horse programs. Before you can log onto a WinFrame computer, you must press the secure attention sequence, CTRL+ALT+DEL. This series of keystrokes always directly invokes the WinFrame operating system logon screen; Trojan horse programs will never be activated this way. Users provide only their username and password to the operating system itself. To ensure the effectiveness of this procedure, train your users to always press CTRL+ALT+DEL, or CTRL+F1 on a WinFrame WinStation before logging on at a computer, even if the logon window already appears on the screen.

The secure attention sequence is also required before a user can unlock a locked workstation or change his/her password.

Another way to guard against Trojan horses is to make your applications read and execute only so that they cannot be replaced with programs that masquerade as the original program and illegally obtain information.


How to Control What Users Can Do

You can control what users can and cannot do on their workstations and on the rest of the network in several ways. The most important method, and the one most often utilized, is to use the predefined local groups. Adding a user to one of these groups will give the user a large set of predefined rights and abilities. (For more information on what each predefined local group can do, see "What Different Types of Users Can Do" in the Concepts and Planning Guide.)

Another way to restrict users' abilities is by limiting their logon hours and the network computers they are allowed to use.

Permissions on each file, directory, or printer shared on the network define who can and cannot access those resources. You can assign permissions to local groups, global groups, and directly to individual users. It is not recommended that you assign permissions to individual users, however, because this is hard to maintain for large numbers of users.

You can monitor what users do by auditing actions and resources. Auditing an action or resource causes an entry to be written to the Event Log whenever that action is performed or that resource is accessed.

Although not recommended, you can directly manipulate user rights (also called rights) that specify what actions local groups, global groups, and users can perform. Using the predefined local groups and their predetermined sets of rights should serve most needs. If you need to grant rights to other groups or users, or fine-tune what rights the predetermined groups have, you have the ability to do so.

Finally, you can also control a user's desktop environment by assigning the user a profile. For more information about profiles, see Chapter 13 of the System Guide.

Permissions

Use File Manager to set NTFS partition file permissions. These permissions apply to all users accessing the computer with the NTFS permissions and to users accessing these files over the network (if they are shared). You can set file permissions to a fine degree of granularity; for example, you may set different permissions for each file in a directory. You can also set many other types of permissions. For example, you can let one user read the contents of a file and change it, let another user only read the file, and prevent other users from any access to the file.

This type of access restriction is not available for files on file allocation table (FAT) or high-performance file system (HPFS) partitions on WinFrame or Windows NT computers. Files on these partitions are always readable and changeable. However, you can protect shared directories on FAT or HPFS partitions by specifying one set of permissions that apply to all users for all files and subdirectories of the shared directory. These are called share permissions.

Similar types of permissions can be set on shared printers managed by WinFrame or Windows NT Server computers. For more information, see Chapter 6, "Sharing Printers" in the Concepts and Planning Guide.

ClipBook Viewer Permissions

ClipBook Viewer enables you to share information among different applications and users and dynamically link and embed that information into other files and documents on the same computer or on other WinFrame or Windows NT computers. For more information about ClipBook Viewer and object linking and embedding (OLE), see the System Guide.

When data is transferred to ClipBook Viewer, it takes the format of a page. ClipBook Viewer can hold up to 127 pages that can be shared with other users. The user who creates a page can set permissions on the page, specifying whether or not other users can use the page.

To create, share, stop sharing, and delete a ClipBook Viewer page, a user must be in one of the following groups on the computer:

Administrators

Server Operators

Power Users

Users

In addition, the special group Everyone can use ClipBook Viewer to see a list of pages shared on the computer.

When a user creates and shares a new ClipBook Viewer page, that user becomes the owner of the new page and the following permissions are set by default on the page. The owner of the page may change these permissions.

Permissions for New ClipBook Viewer Page

User or Group	Permissions
Username of creator/owner	Full Control
Everyone	Read and Link
The following list shows the types of permissions that can be set on ClipBook Viewer pages. You can grant different permissions to different users, thereby allowing some people access to the page while denying access to others.

No Access

Read

Read and Link

Change

Full Control

Auditing

You can specify that an audit entry be written to the Event Log whenever certain actions are performed or files are accessed. The audit entry shows the action performed, the user who performed it, and the date and time of the action. You can audit both successful and failed attempts at actions, so the audit trail can show both who actually performed actions on the network and who tried to perform actions that are not permitted.

Note  Event Viewer log entries for logon events now include the computer name where the logon attempt originated.

The following table lists the categories of events you can choose to audit and what events are covered by each category. For each of the categories listed below, you can choose whether to audit only successful actions in that category, failed attempts to perform actions in that category, both, or neither.

Category	Events
Logon and Logoff	Logon attempts, logoff attempts, and the creating and breaking of network connections to servers.
File and Object Access	Accesses a directory or a file set for auditing in File Manager; uses of a printer managed by the computer.
Use Of User Rights	Successful uses of user rights and failed attempts to use rights not assigned to users.
User and Group Management	Creation, deletion, and modification of user and group accounts.
Security Policy Changes	Granting or revoking user rights to users and groups, and establishing and breaking trust relationships with other domains.
Restart, Shutdown, and System	Shutting down and restarting the computer, filling up the audit log, and discarding audit entries if the audit log is already full.
Process Tracking	Starting and stopping processes on the computer.
You specify what types of system events are audited through User Manager. You specify what files are audited and how (provided you have used User Manager to turn on the auditing of file accesses) through File Manager.

The following table shows the types of directory and file accesses you can audit.

Directory Access		File Access
Displaying names of files in the directory		Displaying the file's data
Displaying directory attributes		Displaying file attributes
Changing directory attributes		Displaying the file's owner and permissions
Creating subdirectories and files		Changing the file
Going to the directory's subdirectories		Changing file attributes
Displaying the directory's owner and permissions		Running the file
Deleting the directory		Deleting the file
Changing directory permissions		Changing the file's permissions
Changing directory ownership		Changing the file's ownership
The AUDITLOG Utility

The AUDITLOG utility is used to generate reports of logon/logoff activity for a WinFrame server based on the WinFrame security Event Log. To use AUDITLOG, logon/logoff accounting must be enabled.

Syntax

AUDITLOG	[username|winstation] [/before:mm/dd/yy] [/after:mm/dd/yy] [/write:filename | [/time | /fail  | /all | /detail]] [/eventlog:filename]
AUDITLOG	[/clear[:filename]]
AUDITLOG	[/?]
Parameters

username

Generates a report of logon/logoff activity for the specified username.

winstation

Generates a report of logon/logoff activity for the specified winstation.

/before:mm/dd/yy

Reports on logon/logoff activity only before mm/dd/yy.

/after:mm/dd/yy

Reports on logon/logoff activity only after mm/dd/yy.

/write:filename

Specifies the name of an output file. Creates a comma-delimited file that can be imported into an application such as a spreadsheet to produce custom reports or statistics.

/time

Generates a report of logon/logoff activity for each user, displaying logon/logoff times and total time logged on. Useful for gathering usage statistics by user.

/fail

Generates a report of failed logon/logoff attempts.

/all

Generates a report of all logon/logoff activity.

/detail

Generates a detailed report of logon/logoff activity.

/eventlog:filename

Specifies the name of a backup security event log to use as input to AUDITLOG. Create a backup security log from the Event Log Viewer or with the AUDITLOG /CLEAR:filename utility, which saves the current event log in filename and clears the event log.

/clear[:filename]]

Closes the current logon/logoff log file, optionally saves it as filename, and opens a new log file.

/? (help)

Displays the syntax for the utility and information about the utility's options.

Remarks

AUDITLOG gives the administrator a powerful tool in verifying and maintaining system security and correct usage. The information can be extracted as reports or as comma-delimited files that can be used as input to other programs.

You must enable logon/logoff accounting in order to collect the information used by AUDITLOG. To enable logon/logoff accounting, logon as an administrator and start User Manager. In User Manager, select Audit from the Policies pull-down menu and check the Logon Success and Failure boxes. Choose OK to save your changes.

You can use the at command to set up an automatic procedure that runs AUDITLOG periodically.

User Rights

User rights control who can perform many types of actions on WinFrame computers. The actions governed by rights include the ability to log on locally at the computer, shut it down, set its time, back up and restore the server's files, and perform other tasks.

On Windows NT domains, rights are granted and restricted on the domain level; if a group has a right in a domain, its members have that right on all primary and backup domain controllers in the domain. On each Windows NT Workstation computer and on each server computer that is not a domain controller, rights granted apply only to that single computer.

User Rights	Comments	Granted to Domains	Granted to Workstations and Servers
Manage auditing and security log	Specify what types of file and object access are to be audited. View and clear the security log.	Administrators	Administrators
Back up files and directories		Administrators, Server Operators, Backup Operators	Administrators, Backup Operators
Restore files and directories	This right supersedes file permissions. When performing a restore, a user with the Restore right can overwrite files for which he or she has no permissions.	Administrators, Server Operators, Backup Operators	Administrators, Backup Operators
Change system time		Administrators, Server Operators	Administrators, Power Users
Access this computer from network	Access the computer from another workstation on the network.	Administrators, Everyone	Administrators, Power Users, Everyone
Log on locally	Ability to log on at the computer itself, on the computer's keyboard, or at a WinStation.	Administrators, Server Operators, Account Operators, Print Operators, Backup Operators	Administrators, Backup Operators, Power Users, Users, Guests
Shut down the system		Administrators, Server Operators, Account Operators, Print Operators, Backup Operators	Administrators, Backup Operators, Power Users, Users, Guests
Add workstations to domain	Allows a user who is not a member of the domain's administrators group to add new WinFrame computers to the domain.	None*	N/A
Take ownership of files and other objects	Take ownership of files and directories on the computer.	Administrators	Administrators
Load and unload device drivers		Administrators	Administrators
Force shutdown from a remote system	This right gives a user no abilities in this version of the operating system, but will be supported in future upgrades of the operating system.	Administrators, Server Operators	Administrators, Power Users

* Members of the domain's Administrators and Server Operators groups can always add workstations to a domain, whether or not this right is assigned to them. This right is needed only to enable users who are not members of these groups to add workstations to the domain.

For more detailed information and tables showing the rights assigned to the built-in local groups, see "What Different Types of Users Can Do" in the Concepts and Planning Guide.

Setting Password and Account Policy

For each domain, you can specify all aspects of password policy: minimum password length (default is six characters), minimum and maximum password age (defaults are 14 and 30 days), and password uniqueness, which prevents a user from changing his/her password to a password that the user has used recently (the default is to prevent users from reusing their last three passwords).

Note  If you use password uniqueness as part of your password policy, be sure to set minimum password age high enough to prevent users from quickly cycling through several temporary passwords to get to their favorite password.

You can also specify these other aspects of account policy:

Whether account lockout occurs

Whether users are forced to disconnect from the domain's servers when their logon hours expire

Whether users must log on to change their passwords

When account lockout is enabled, if too many invalid logon attempts occur on a user account and no more than a specified length of time occurs between any two of the logon attempts, the account is locked out. Accounts that are locked out cannot log on. If you enable account lockout, you can specify how many invalid logon attempts cause lockout, the maximum amount of time that can occur between any two of the attempts to trigger lockout, and how long accounts are locked out.

If users are forced to disconnect from servers when their logon hours expire, they are given warnings just before the end of their specified logon hours. If they have not ended their connections by then, the server(s) to which they are connected will end the connection(s). However, users are not forced to log off from their workstations.

If users must logon to change their passwords, they cannot change their passwords after they expire and will need an administrator to change their passwords. If users are not required to log on to change their passwords, they are prompted to change their passwords the first time they attempt to log on after their passwords expire and will not need help from an administrator.

How Administrators Should Log On

Most or all of the administrators on your network have a dual role: they are both administrators and users of the network. Although at times they will perform network administration tasks, at other times they will simply be network users performing the same tasks as other users.

Therefore, it is a good idea for each administrator to have two user accounts. One of these accounts should be in the Administrators group and be the account the administrator uses when performing network management tasks. The other account should be in the Users group in the domain and be the account the administrator uses when not performing network management. The network will be more secure if the administrator uses two accounts.

Allowing Guest Access

By default, every domain and every WinFrame computer initially has a Guest account defined. The Guest account has no password and can be used for two types of Guest logons: local Guest logons and network Guest logons. You can configure each domain and computer so that it allows both types of Guest logon, only one type, or neither.

How Local Guest Logons Work

A local Guest logon occurs when a user logging on at a WinFrame computer specifies Guest as the user name in the logon dialog box. The Guest user can then work at that computer (subject to the rights and permissions you have granted the Guest account) and use it to access the network.

How Network Guest Logons Work

A network Guest logon occurs at a computer when a user from a domain that the computer does not trust tries to access the computer over the network. The computer allowing the network Guest logon does not recognize the account trying to access it because the computer does not trust that domain. In this case, access is approved as a Guest logon (as long as the Guest account of the target computer has no password). The Guest user then has all rights, permissions, and group memberships on the computer that are granted to the Guest account, even though the Guest user doesn't specify Guest as his/her user name.

Note  If you have set up your network so that all user accounts are defined in domains that are trusted by all other domains, network Guest logons will rarely happen at servers. A network Guest logon can occur only when a user from an untrusted domain tries to access the computer. (Network Guest logons may still happen with user accounts stored at Windows NT Workstation computers or when a user of a DOS computer logs on stand-alone and then accesses a WinFrame or Windows NT Server computer.)

Managing Guest Logons

If you do not want to allow either local or network Guest logons on a domain, you do not need to do anything; by default, the Guest account is disabled. If you want to allow both local and remote Guest logons, use User Manager for Domains to enable the Guest account. To allow local Guest logons but not network Guest logons, enable the Guest account, but revoke its Access This Computer From Network right. To allow network Guest logons but not local Guest logons, enable the Guest account and revoke its Log On Locally right (be sure Guest has the Access This Computer From Network right).

Managing Guest logons on Windows NT Workstation computers and on servers that are not domain controllers works the same way, except that the Guest account is enabled by default. No action is required if you want to allow Guest logons on the computer. If you want to prevent Guest logons, you must disable the Guest account.

Configuring Users on WinFrame

To login to WinFrame, a person must have a userID configured for use on a particular WinFrame server or on the network domain. If a user is configured for use on a particular WinFrame server, the user can login and use only that WinFrame server. If the userID is configured on the network domain, the user can login to any WinFrame or Windows NT system that has joined the network domain. This makes it far more flexible and allows users to login from anywhere on the network. Access can be restricted to specific WinFrame servers or can be granted across the network domain. This can be configured in the User Manager for Domains Utility. Refer to Chapter 13 of the System Guide for additional information about this utility.

If you have a Novell NetWare 3.x server on your network, you can move the configured userIDs from the NetWare server to the WinFrame server. This makes it easy to create accounts on the WinFrame server by migrating the userIDs already configured for your WinFrame network. See the WinFrame Online Readme "Migrating UserIDs from a NetWare Server to a WinFrame Server" for more information.


SecureICA Option Pack

Technical Overview

The Citrix SecureICA Option Pack enhances the security of WinFrame by allowing users to access WinFrame servers over secure communications channels. This SecureICA Technical Overview provides details on the SecureICA encryption software.

Topics discussed include:

The SecureICA implementation

Encryption security

SecureICA performance characteristics

Security beyond encryption

SecureICA Features

SecureICA contains features to enhance the security of data communication across any type of connection supported by WinFrame. The SecureICA Option Pack uses the RC5 encryption algorithm from RSA Data Security, Inc. The WinFrame server and WinFrame client use the Diffie-Hellman key agreement algorithm with a 1024-bit key to generate RC5 keys.

The SecureICA Option Pack offers the following features:

128-bit encryption during user authentication

To ensure account security, SecureICA uses 128-bit encryption during the authentication phase.

Strong session encryption and flexible encryption support

The 128-bit encryption level is considered virtually impossible to break with current technology. The 40-bit and 56-bit encryption levels require a significant investment in time and money to break with a brute force attack. The availability of 40-bit encryption for global use provides an international data encryption solution.

Per-connection encryption support

Different encryption levels can be used for each connection. For example, a dial-up connection with 40-bit encryption and a LAN connection with 128-bit encryption can be used simultaneously.

Cross client compatibility

SecureICA-enabled clients are available for DOS, Win16, Win32, and the WinFrame Web client Netscape plug-in and Internet Explorer ActiveX control.

Enforceable encryption levels

The WinFrame administrator can enforce minimum encryption levels on a per-WinStation and per-user basis. WinFrame client connections are allowed only if the WinFrame client is using at least the minimum level.

Dynamic key generation

The SecureICA WinFrame server and client generate unique RC5 keys for each connection. A system service periodically generates new Diffie-Hellman parameters in the background, providing an enhanced level of security.

Understanding Encryption

Encryption is the process of obscuring the true meaning of a message so that only the intended recipient can understand it.

The encryption process transforms data into a form that is unreadable to anyone without a special piece of information. This information allows the recipient to unscramble or decrypt the message. This piece of information is called a key.

The process used to create the scrambled message is called an encryption algorithm.

There are two general types of encryption algorithms. A symmetric key algorithm uses the same key to encrypt and decrypt the scrambled data. This means the secret key must never be revealed to anyone but the intended recipient of the data. The advantage of a symmetric key algorithm is its speed.

The disadvantage of a symmetric key algorithm is that the secret key used to encrypt the data must be sent to whoever needs to decrypt the data. If there was a secure channel to transmit the key, the data could be sent the same way and encryption would be unnecessary.

The second type of algorithm is a public-private key algorithm. It relies on certain mathematical properties to create a set of keys, so that one key can only encrypt data and the other key can only decrypt the data. The encrypt-only key is called a public key. The decrypt-only key is called a private key. A message encrypted with the public key can only be decrypted by the private key.

The public key can be openly transmitted without compromising the security of the encrypted data. Knowing the public key will not allow anyone to decrypt the encrypted data.

Many modern encryption programs combine the two types of algorithms. A symmetric key algorithm encrypts the data. The secret key is exchanged using a public-private key algorithm. This provides the speed of a symmetric key algorithm with the security of a public-private key algorithm.

RC5 is a symmetric key algorithm. The Diffie-Hellman key agreement algorithm is a public-private key algorithm.

Understanding Government Export Restrictions

The United States government restricts the export of strong cryptography. Encryption strength is usually defined by the size of the keys used to encrypt and decrypt data.

Encryption products using keys greater than 40 bits are usually restricted from export. However, larger keys can be exported for use in authentication products.

The SecureICA Option Pack comes in two versions: North American and Global. The North American version of the SecureICA Option Pack uses a 128-bit key during user logon. A selectable 40-, 56-, or 128-bit key is used to encrypt the remainder of the session. The Global version uses a 128-bit key during user logon. A 40-bit key is used to encrypt the remainder of the session.

United States export policy regarding encryption is known to allow export of stronger data keys to subsidiaries of North American-based financial institutions. The export of these stronger keys is controlled on a per-application basis and must be applied for.

The SecureICA Implementation

This section details the SecureICA implementation.

The SecureICA encryption modules use the RC5 algorithm to encrypt ICA packets. A random RC5 key is generated for each WinFrame session. The Diffie-Hellman key agreement algorithm is used to generate the session key on the WinFrame client and the WinFrame server.

SecureICA Protocol Architecture

The Independent Computing Architecture (ICA) is a modular architecture. The encryption layer is negotiated at connect time between the WinFrame server and WinFrame client.

The ICA Protocol and Transport Layers

Beneath the ICA data packets are several optional protocol driver layers. Their existence and use is negotiated during the ICA handshaking that occurs at the start of a session. Because these layers sit below ICA, they can be removed or replaced. Additional protocol drivers can also be added. The SecureICA encryption module is inserted at this layer.

The following diagram shows an expanded view of the ICA protocol layer.

What is Encrypted

SecureICA encryption is applied to the entire ICA packet. Except for a small encryption header, all of the ICA commands and data are encrypted. This includes:

Keystrokes

Mouse data

Graphic information

Client drive data

Client printer data

The RC5 Algorithm

The RC5 algorithm was developed by RSA Data Security, Inc. The SecureICA Option Pack uses the RC5 algorithm to encrypt ICA packets.

RC5 is a chaining block cipher. In a chaining block cipher, each block uses a variable size key combined with the encrypted version of the previous block to encrypt the current block. Rounds denotes the number of times each block is passed through the encryption algorithm. SecureICA uses a 64-bit block size, 12 rounds, and a 40-, 56-, or 128-bit key size.

A detailed description of the RSA RC5 algorithm is available from RSA at http://www.rsa.com.

RC5 Keys

The RC5 algorithm is a symmetric key algorithm. One key is used to both encrypt and decrypt data. The security of the data depends on keeping the key secret. In order to keep data secure, there must be a method of exchanging the RC5 keys without allowing the keys themselves to be copied. The Diffie-Hellman key agreement algorithm generates the same RC5 key on the WinFrame client and server without exchanging information that compromises the security of the key. The SecureICA Option Pack uses a total of four keys during each session.

During user logon, SecureICA uses two 128-bit keys for enhanced security. One key is used to encrypt ICA packets the server sends to the client. The other key is used for client to server communication.

The SecureICA Option Pack uses two 40-, 56-, or 128-bit keys to encrypt ICA packets after logon. One key is used when the server is sending data to the client. The other key is used for client-to-server communication. Using two separate keys increases security. The key size to use for the session is specified by the WinFrame client. An administrator can specify the minimum key size in the WinStation Configuration and User Manager for Domains utilities.

Generating RC5 Keys

Each time a WinFrame client connects to a WinFrame server the four RC5 keys are generated.

The Diffie-Hellman algorithm is used when two people need to establish secret keys but they cannot securely transmit those keys to each other. The WinFrame server and the WinFrame client establish RC5 session keys using the Diffie-Hellman key agreement algorithm.

The WinFrame server periodically generates two numbers (A and B) using the Encryption Service installed by the SecureICA Option Pack. These numbers are the Diffie-Hellman parameters.

The WinFrame server and client follow the steps outlined below to establish a 1024-bit secret key. This secret key is split into two 128-bit keys used during logon and two 128-, 56-, or 40-bit keys used after logon.

1.	The WinFrame server generates a private key K1 each time a WinFrame client connects.

2.	Using the private key K1 and the Diffie-Hellman parameters (A and B), the server generates a public key P1.

3.	The WinFrame server sends the WinFrame client A, B, and the server's public key P1.

4.	The WinFrame client generates a private key K2 each time a connection is made to a WinFrame server. The client receives A, B, and the server's public key P1.

5.	Using the private key K2 and the WinFrame server's public key P1, a 1024-bit secret key S is generated.

6.	The WinFrame client generates a public key P2 using its private key K2 and the Diffie-Hellman parameters (A and B).

7.	The WinFrame client sends its public key P2 to the WinFrame server.

8.	The WinFrame server receives the client's public key P2. Using the client's public key P2, the Diffie-Hellman parameters (A and B), and the server's private key K1, the WinFrame server generates the secret key S.

The WinFrame client and WinFrame server both have the same 1024-bit secret key S.

The mathematical steps to generate the secret key are described below.

Server

Generate private key K1

Use two well known values A and B

Generate a public key P1 = AK1 mod B

Send P1, A, and B to the client.

Client

Client receives P1, A, and B

Client generates a private key K2

Client uses the public key P1 and its private key K2 to generate a secret key S using the following algorithm:

S = P1K2 mod B

Generate a public key P2 = AK2 mod B

Send P2 to the server

Server

Server receives P2

Server uses the public key P2 and its private key K1 to generate a secret key S using the following algorithm:

S = P2K1 mod B

Even if P2, P1, A and B are known by an intruder, S cannot be derived from that information. The algorithm relies on the mathematical property that

(AK1 mod B) K2 mod B = AK1K2 mod B

(AK2 mod B) K1 mod B = AK1K2 mod B

Encryption Strength

The strength of an encryption algorithm is related to two factors. One is the strength of the algorithm itself. The second is the size of the key used with the algorithm.

The RC5 algorithm has been extensively examined by RSA Data Security, Inc. as well as outside consultants. The cryptographic community is confident that RC5 is a secure algorithm.

The only way to break a secure algorithm is to try every possible key on a sequence of encrypted data. As the size of the key increases, the time and effort required to guess the correct key increases. Trying every possible key is known as a brute force attack.

A key 8 bits long contains 256 possible keys. A brute force attack on this key would be simple. However, the number of possible keys increases exponentially with key size. A 56-bit key contains 256 possible keys. If an attacker tried one million keys a second, it would take 2285 years to try each one. A 64-bit key would take the same attacker 585,000 years.

It is estimated that a million dollar parallel processing computer can crack a 128-bit key in 1018 years. For comparison, the age of the Universe is estimated at 1010 years.

It is important to evaluate the requirements for encryption. If the data being encrypted is time sensitive, shorter keys can be used. For example, if you are encrypting details of a planned merger, the data must be kept secret for a few months. If an attacker manages to decrypt the data twenty years after the merger is complete, whatever information is gained will be useless.

SecureICA Performance

The encryption algorithms used by SecureICA have been highly optimized. The performance impact of encryption on a 386 class client is slight. On a 486 or higher class client, the difference is almost negligible.

Note  SecureICA will not work on a 286 class client PC.

The Diffie-Hellman key agreement occurs during the initial connection. A 386 class client takes longer to complete the initial connection when strong encryption is used. On 486 or higher WinFrame client hardware, connect time is almost identical with or without strong encryption.

Other Security Concerns

The SecureICA Option Pack encrypts end to end communications between a WinFrame server and an ICA client. It would be nearly impossible for anyone to read the data while it is in transit and steal secret information.

However, it is important to realize that a comprehensive security model includes more than encrypted communication channels. A secure communication method is only as secure as its weakest link.

It is vital to ensure the security of the WinFrame server itself. See the Security Guide for more information on setting up a secure WinFrame server.

Further Reading

Schneier, Bruce. (1996). Applied cryptography: Protocols, algorithms, and source code in c. Wiley and Sons, Inc. New York, NY

RSA Data Security, Inc. (1996). Answers to frequently asked questions about today's cryptography. http://www.rsa.com/rsalabs


Third-Party Security Devices

This section contains detailed installation and integration information for the following third-party security devices:

Communication Devices Inc. MultiGuard

Digital Pathways Defender 5000 Security System

Security Dynamics Access Control Module System

Security Dynamics ACE/Server

VTCP/SECURE Software

These security devices are placed between a COM port on the WinFrame server and the modem for that COM port. They control remote access to the WinFrame server through proprietary access control hardware and software. The remote user dials in to the modem attached to the security device and obtains access to the WinFrame server by successfully completing an authentication dialog with the security device. Once the user has been authenticated, the security device is transparent to the user. A typical external security device configuration is illustrated below.

Several general configuration issues are encountered when using third-party security devices:

For the WinFrame server to properly detect when a connection is made or broken, the security device must supply modem signals that can be used by the WinFrame server to detect when a connection is made or terminated. This varies depending on the security device.

The client PC and the WinFrame client software may need to be configured to operate properly with the security device. Some security systems require software or hardware on the client PC.

The WinFrame server and the security device itself must be secured from unauthorized tampering. You may want to place all hardware in a secured room to prevent unauthorized personnel from having access to the equipment.

Most third-party security devices secure remote Dial-In users (or local, directly connected async users) only. You may also need to consider how to secure your system from improper access by LAN- or WAN-connected users.


Communication Devices MultiGuard

Overview

The Communication Devices MultiGuard is a hardware-resident data communications security device that protects dial-up access to networks and host computers. MultiGuard verifies that users have authorization and access privileges when users enter IDs, passwords, and personal identifiers. The MultiGuard supports three modes of operation: callback, Dial-In, and network dial out.

There are two main ways to use MultiGuard with WinFrame: Dial-In and WinFrame configured with RAS. The MultiGuard allows dial-out and call back with RAS and WinStations, respectively. The MultiGuard system is composed of two major elements:

The MultiGuard hardware, which is a highly secure communications controller that connects and disconnects the input/output lines to the protected host computer

SoftToken Disk, a software solution on the client that optimizes security by allowing access to the host with a diskette configured for that specific user's login name and password, and an encrypted algorithm password identical to the user's records on the MultiGuard)

Note  There is also a hardware SecurNet Key solution where the user does not need the diskette but has a hand-held calculator-like device to help decipher the SoftToken challenge response from the MultiGuard host.

Requirements

Software Requirements

WinFrame server software Version 1.5 or higher

WinFrame DOS client software shipped with WinFrame 1.5 or higher; WinFrame Windows client software shipped with WinFrame 1.6 or higher

Communication Devices NetGuard Administrative software for Windows, Version 1.08 or higher

Communication Devices SoftToken security disk for use with DOSGuard or WinGuard Version 2.04 or higher

Hardware Requirements

A WinFrame server with a configured modem

Communication Devices MultiGuard

A client machine with a modem

Proper asynchronous cables as outlined in both the WinFrame and Communication Devices Inc. manuals

Installation

There are two ways to configure a Dial-In connection to a WinFrame server:

Modem Dial-In to a WinFrame server via the MultiGuard

Direct-connect to a WinFrame server via the MultiGuard

To use Dial-In with the WinFrame client, make sure you are using the version of the WinFrame client shipped with Version 1.6 or higher.

Modem Dial-In

Assuming a WinStation is properly configured on the WinFrame server and Dial-In is able to connect to the WinFrame server and run a remote control session, use the following procedure to integrate the WinFrame server with the MultiGuard device:

1.	Use the WinStation Configuration utility on the WinFrame server to set the WinStation to Connect on DSR. Connect the host modem to a modem port on the MultiGuard via a modem cable.

2.	Connect the WinStation COM port to the MultiGuard host port via a modem cable.

3.	Configure the user of the MultiGuard with Secure Call Thru security.

Note  For installation purposes, you may wish to disable Token Security. After a connection is made to the host through the MultiGuard, configure your client Token disk and host using Token security enabled for that specific user.

4.	From the terminal you used to configure your MultiGuard, login as a MultiGuard administrator.

5.	Under the Port Control menu, select P to modify/review parameters.

6.	Select single card and the card number you are using to connect to your WinFrame server and set that channel with the following parameters:

Port Security: (1) Enabled
Host to Modem Call Access: (1) Enabled
Baud-Rate: Equal to the speed configured on your WinStation and your Dial-In Client
Bits/Parity: (3) 8, None

7.	Return to the main menu and select System Options.

8.	Select H for Enable/Disable Host to Modem Access and make sure you have this set for Enable.

9.	Under the System Options menu, select U for Security and set it for 1 User ID & Password.

10.	Return to the main menu and select User Functions; select C for change user parameters.

11.	Enter a user who is already in the system and establish the following settings:

User Type: (S) for Secure Call Thru
User Enabled: (A) Always
Delete user if inactive: (N) for No

Usage

1.	Run the WinFrame client on the remote client machine.

2.	In the WinFrame client, select the configured entry that was previously connected to the WinFrame host.

3.	Dial in to the WinFrame host. Press ENTER until you receive a login prompt for the MultiGuard. Enter the proper user name and password.

4.	Continue logging into the WinFrame Dial-In WinStation with your WinFrame password.

Dial-In

Assuming a WinStation is properly configured on the WinFrame server and a Dial-In PC is able to connect to the WinFrame server and run a remote control session, integrate the WinFrame server with the MultiGuard for a direct asynchronous connection:

1.	Use the WinStation Configuration Utility on the WinFrame server to set the WinStation to Connect on DSR.

2.	Connect the COM port of the client machine to a modem port on the MultiGuard via a null modem cable.

3.	Connect the host port of the MultiGuard to the WinFrame server WinStation COM port using a straight modem cable.

4.	Configure the security of a user on the MultiGuard with Secure Call Thru.

Note  For Dial-In you can only use Secure Call Thru with user name and password checking.

5.	From the terminal you used to configure your MultiGuard, login as a MultiGuard administrator.

6.	Under the Port Control menu, select P to modify/review parameters.

7.	Select single card and the card number you are using to connect to your WinFrame server and set that channel with the following parameters:

Port Security: (1) Enabled
Host to Modem Call Access: (1) Enabled
Baud-Rate: Equal to the speed configured in your WinStation and your Dial-In client
Bits/Parity: (3) 8, None

8.	Return to the main menu and select System Options.

9.	Select H for Enable/Disable Host to Modem Access and make sure you have this set for Enable.

10.	Under the System Options menu, select U for Security and set it for 1 User ID & Password.

11.	Return to the main menu and select User Functions; select C for change user parameters.

12.	Edit a user who is already in the system and establish the following settings:

User Type: (S) for Secure Call Thru
User Enabled: (A) Always
Delete user if inactive: (N) for No

Usage

1.	Run the WinFrame client on the remote client machine configured for direct-connect.

2.	In the WinFrame client, select the configured entry that was previously connected to the WinFrame host.

3.	Connect into the WinFrame host. Press ENTER until you get to a login prompt for the MultiGuard. Enter the proper user name and password.

4.	Continue logging into the WinFrame Dial-In WinStation with your WinFrame password.

Modem Dial-In Usage With Token Security Checking Enabled for a User

1.	Configure a SoftToken disk and the MultiGuard for a specific user who has security set for Token.

2.	Run the remote DOS or Windows SoftToken security TSR that is supplied with the MultiGuard on the remote client machine (DOSGuard or WinGuard).

Note  WinGuard must be installed while DOSGuard is a single executable file.

3.	Run the WinFrame client on the remote client machine.

4.	In the WinFrame client, select the configured entry that was previously connected to the WinFrame host.

5.	Dial in to the WinFrame host.

Note  For Dial-In using Token security, the client machine must be running WinGuard with a DCD delay of at least ten seconds and the user must quickly make the direct-connect asynchronous connection immediately after running this. Once you are connected, the MultiGuard software automatically enters the required information such as user name, password, and security challenge.

6.	Continue logging into the WinFrame WinStation with your WinFrame password.


Digital Pathways Defender 5000

Overview

The Digital Pathways Defender 5000 is a hardware-resident data communications security device that protects dial-up access to networks and host computers. Defender 5000 verifies that users have authorization and access privileges when they enter usernames, passwords, and personal identifiers. The Defender 5000 supports three modes of operation: callback, Dial-In, and dial-out over the network.

There are two main ways to use the Defender with WinFrame: Dial-In and WinFrame configured with RAS. The Defender 5000 allows dial-out and call-back with RAS and WinStations, respectively. The Defender 5000 system is composed of two major elements:

The Defender 5000 hardware, which is a highly secure communications controller that connects and disconnects the input/output lines to the protected host computer

SNK Disk, a software solution on the client that optimizes security by allowing access to the host with a diskette configured for that specific user's login name and password, and an encrypted algorithm password identical to the user's records on the Defender 5000.

Note  There is also a hardware SecureNet Key solution that uses a hand-held calculator-like device to decipher the SNK challenge response from the Defender 5000 host.

Requirements

Software Requirements

WinFrame server software Version 1.5 or higher

WinFrame client software Version 1.5 or higher

Digital Pathways Super Administrative software Version 2.07

Digital Pathways WinSNK software user disk for DOS and Windows versions; WinSNK 1.21, Filter 1.20, and Driver 1.20 or higher.

Hardware Requirements

A WinFrame server with a configured modem

Digital Pathways Defender 5000

A client machine with a modem

Digital Pathways Hardware SecureNet Key (not required if using a WinSNK user disk)

Using Digital Pathways Hardware with WinFrame ICA Connections

Installation

There are two methods of making a Dial-In connection to the WinFrame server:

Modem Dial-In to a WinFrame server via the Defender 5000

Direct-connect to a WinFrame server via the Defender 5000

Note  To use the WinFrame Windows clients with asynchronous connections, WinFrame client software Version 1.6 or higher is required. Version 1.5 of the WinFrame client does not support asynchronous connectivity for the Windows clients.

Modem Dial-In

Assuming a WinStation is properly configured on the WinFrame server and a remote client is able to dial into the WinStation and run a remote control session, do the following to integrate the WinFrame server with the Defender 5000:

1.	Use WinStation Configuration to set the WinStation to Connect on DCD.

2.	Connect the host modem to a modem port on the Defender 5000 via a modem cable.

3.	Connect the WinStation COM port to the Defender 5000 host port via a modem cable.

4.	Configure the host port of the Defender 5000 with SNK security checking disabled.

Note  For installation purposes, you may wish to disable SNK security within the Defender 5000. After a connection is made to the host through the Defender, configure your client SNK disk and host using SNK security enabled.

5.	From the terminal you used to configure your Defender 5000, login as a Defender 5000 administrator.

6.	Under the Status/box menu of the Defender 5000, select the board and channel you are going to use for your connection.

7.	Configure this channel with the following parameters:

Program: DC (Direct Connect)

Modem Type: Options 0-9 (select the modem type you are using at the host end)

Host Name: A-Z (this is the host name assigned for security purposes; the letter designated here must also be used in each user's individual record under the [4] OK Hosts menu)

Init Rate: Equal to the baud setting of the dial-in modem and the WinFrame ICA WinStation.

8.	Run the WinFrame client on the remote client machine.

9.	In the WinFrame client, select the entry that was previously connected to the WinFrame server.

10.	Dial into the WinFrame server.

11.	Press ENTER until you get to a login prompt for the Defender. Enter the user name and password that have security privileges to the host/modem port of the Defender.

12.	Continue logging into the WinFrame Dial-In WinStation with your WinFrame password.

Direct Connect

Assuming a WinStation is properly configured on the WinFrame server and a direct connect client is able to connect into a WinStation and run a remote control session, do the following to integrate the WinFrame server with the Defender 5000 for a direct asynchronous connection:

1.	With the Configuration Utility of the WinFrame server, set the WinStation to Connect on DCD.

2.	Connect the COM port of the client machine to a modem port on the Defender 5000 via a null modem cable.

3.	Connect the host port of the Defender 5000 to the WinFrame server WinStation COM port.

4.	Configure the host port of the Defender 5000 with SNK security checking disabled.

Note  For installation purposes, you may wish to disable SNK security within the Defender 5000. After connection is made to the host through the Defender, configure your client SNK disk and host using SNK security enabled.

5.	From the terminal you used to configure your Defender 5000, login as a Defender 5000 administrator.

6.	Under the Status/box menu of the Defender 5000, select the board and channel you are going to use for your connection.

7.	Configure this channel with the following parameters:

Program: DC (Direct Connect)

Modem Type: Options 0-9 (select the modem type you are using at the host end)

Host Name: A-Z (this is the host name assigned for security purposes; the letter designated here must also be used in each user's individual record under the [4] OK Hosts menu)

Init Rate: Equal to the baud setting of the dial-in modem and the WinFrame WinStation.

8.	Run the WinFrame client on the remote client machine.

9.	In the WinFrame client, select the configured entry that was previously connected to the WinFrame server.

10.	Connect to the WinFrame server.

11.	Press ENTER until you get to a login prompt for the Defender. Enter the user name and password that have security privileges to that specific Defender port.

12.	Continue logging into the WinFrame WinStation with your WinFrame password.

Direct Connect and Modem Dial-In Usage With SNK Checking

1.	Configure an SNK user disk and the Defender 5000 for a specific user to have access privileges to the designated host/modem port.

2.	Configure the Defender 5000 for SNK security checking enabled for the Defender host port.

3.	Run the remote DOS or Windows SNK security TSR that is supplied with the Defender 5000 on the remote client machine (SNK.EXE /V).

4.	Run the WinFrame client on the remote client machine.

5.	In the WinFrame client, select the configured entry that was previously connected to the WinFrame server.

6.	Dial or connect to the WinFrame server.

7.	When connected, press ENTER and enter a valid user name and password for the Defender 5000. If you are using the correct version of SNK software, the SNK challenge will automatically be echoed.

8.	Continue logging into the WinFrame WinStation with your WinFrame password.

Using Digital Pathways Hardware with WinFrame RAS

Possible Connectivity Options

The following chart lists connectivity options for the various WinFrame clients and their compatibility with remote node dial-in connections. The top row indicates the WinFrame client being used to run a remote control session. The left-hand column identifies the dial-up (remote node) client being used. The intersection states which protocols can be used for that particular combination of WinFrame client and remote node client. (No means this combination is not currently possible.)

Note  For the RAS configurations, a dial-up connection to a RAS server must be established first. This is a remote node connection. A WinFrame client can then be used to connect to a WinFrame server over the dial-up connection. This is a remote control session (over a remote node session).

RAS Connectivity and Transport Options Chart

Remote Node Client Software	DOS Client	Win16 Client	Win32 Client
Windows 3.1 RAS	No	NetBIOS	No
Citrix WinFrame or Windows NT 3.5x RAS	No	No	NetBIOS IPX/SPX TCP/IP
Windows 95 Dial up Networking	No	No	NetBIOS IPX/SPX TCP/IP
WinFrame Dial-Up Manager for DOS	IPX/SPX TCP/IP	IPX/SPX TCP/IP	No
WinFrame Dial-Up Manager for Windows 3.1x	No	IPX/SPX TCP/IP	No
Installation

To ensure proper security and configuration settings, set up a remote node client to dial in and make a connection to a WinFrame RAS server without the Defender 5000 product connected. Run the remote control software provided with WinFrame to ensure a proper connection to the WinFrame server. Consult the WinFrame documentation for settings and installation.

Note  When RAS is installed and configured, you must use RAS Admin to enable dial-in access for each user.

WinFrame RAS Server Configuration

1.	Use the RAS Admin icon under Server/Stop Remote Access Service to shut down RAS before continuing with the next step.

2.	With a text editor, edit the MODEM.INF file located in %systemroot% \SYSTEM32\RAS. Set the "MAXCONNECTBPS=" to match the speed of your modem and the channel baud rate of the Defender 5000. This is also the maximum baud rate for the dial-in remote node software you are using.

Note  In the Defender 5000, the channel baud rate is located in the Status/box menu and designated as "rate" when the particular host port is highlighted. You will need to set this when you reach that part of the installation.

3.	Reboot your system for these changes to take effect.

4.	Connect and configure modems and clients.

5.	On the remote computer, you now have a remote node client and a remote control client configured for connection to a WinFrame server. Test this again; if it does not work, change the MODEM.INF file until a satisfactory baud-rate is achieved and a connection is made.

Defender 5000 Configuration

1.	Using a modem or straight-through cable, connect the Defender 5000 between the WinFrame server serial port and the server modem.

2.	Contact Digital Pathways for a Lingo script file (NT-RAS35.LNG) that was written to allow the WinFrame remote access server to communicate to the modem via the Defender 5000 for modem initialization. This file has to be uploaded into the Defender 5000. This file must also be edited for a modem type; consult Digital Pathways for the proper modification.

3.	Once the script is installed for a specific modem type, reboot the Defender and configure the host port that will be used.

4.	Temporarily disable SNK checking. When the system is configured, re-enable it in the Defender 5000 for the specific user class.

5.	Configure the Defender host port with the following settings:

Program: DC (Direct Connect)

Modem Type: Options 0-9 (select the modem type you are using at the host end). Note that the NT-RAS35.LNG script file points to a specific modem. If you change this, you must also change your Lingo script file.

Host Name: A-Z (this is the host name assigned for security purposes; the letter designated here must also be used in each user's individual record under the [4] OK Hosts menu)

Init Rate: Equal to the baud setting of the dial-in remote node client and the MAXCONNECTBPS setting you selected in your MODEM.INF file above.

Remote Node and Remote Control Client Connection

1.	Connect and configure modems and clients.

2.	Dial into the RAS port with a remote node client with the following settings:

Terminal mode on connect: enabled

Baud rate: equal to the channel baud rate settings of the Defender 5000 and WinFrame RAS server

Note  This baud rate cannot exceed the baud rate of the host modem or remote modem.

Protocol: IPX, TCP/IP, or NetBIOS

3.	Press ENTER twice to reach a login prompt for the Defender 5000.

4.	Enter the Defender 5000 user name and password.

5.	You have passed Defender security and are now connected to the WinFrame RAS server.

6.	If you have entered your WinFrame username and password in your dial-up remote node client, you will be authenticated and logged on to the network automatically. If not, you will be prompted to enter your username and password now.

7.	Depending on which protocol you are using, run ping (TCP/IP), net use (NetBIOS), or slist (IPX/SPX) to verify that you are connected to the network properly.

Note  If your remote workstation has a network connection, unplug it temporarily to verify that the network status reported in the previous step is actually from the modem.

8.	Run the remote control client and establish a remote control session.

9.	Enable SNK password checking on the Defender. On the client end, you must run the SNK client software before you dial up with your remote node client. Be sure to use the /V option when running (for example, SNK.EXE /V).

Note  Make sure you are using the correct versions of the DOS SNK and the WinSNK programs.


Security Dynamics Access Control Module

The Security Dynamics Access Control Module is a hardware-resident access-control system with accompanying credit card-sized SecurID cards. When installed in a physically secure area and used properly, the ACM protects a WinFrame server by preventing unauthorized persons from access, while allowing authorized users to gain entry easily.

The Security Dynamics ACM system can be used to secure:

WinFrame RAS connections

WinFrame ICA dial-in connections

The ACM restricts ports to dial-in only for Dial-In WinStations. The ACM allows dial out and call back with RAS. The Security Dynamics ACM system is composed of two elements:

The Access Control Module (hardware), which is a highly secure communications controller that connects and disconnects the input/output lines to the protected host computer.

The SecurID card(s), credit card-sized unit(s) that calculate and display codes that change unpredictably at a specified interval.

Requirements

Citrix WinFrame Version 1.5 or higher

Security Dynamics Equipment

ACM/400 hardware running software, Version 1.12A or later

SecurID cards

Note  One of the cards must be an administrator level card.

Using Security Dynamics Hardware with WinFrame Dial-In

The WinFrame client is supported by the ACM for direct connections and for modem connections used for Dial-In only.

WinFrame Server WinStation Configuration

From the WinFrame console, use the WinStation Configuration utility in the Administrative Tools program group to configure an ICA Dial-In WinStation terminal with the following parameters:

Transport: async

Device: the COM port connected to the modem via the ACM

Baud rate: match the ACM and the modem. The fastest baud rate that the ACM currently can handle is 38400.

Device connect on: DCD

Modem: choose none

ACM Configuration

1.	Send the proper init string to your modem using a terminal program to initialize your modem properly.

2.	Using a modem or straight-through cable, connect the ACM between the WinFrame WinStation COM port and the modem.

3.	With a TTY terminal client, dial into the host modem connected to the DTE terminal on the ACM or connect via direct-connect to the DTE input of another port using a null modem cable.

4.	Select different baud rates until you receive an Enter PASSCODE prompt in terminal mode.

5.	Enter an ADMIN SecurID passcode to enter the Administration utility.

6.	Configure the ACM for valid users and SecurID cards.

7.	Under the Main Administration menu, go to channel settings to configure the ports. Set the modem port as follows:

Baud rate: the fastest baud rate that the ACM currently can handle is 38400

Data Bits: 7 or 8 to match the RAS server (default = 8)

Parity: None, Even, Odd, Mark, or Space to match the WinStation server (default=none)

Protocol: DCD at modem and DCD at host (default = d-d)

Host Command Mode: Enable, Text, same as channel baud rate (default=disabled)

Dialout: N (disabled)

Connectivity Matrix for ICA Dial-In

Operating System	DOS Client	Win16 Client	Win32 Client
MS-DOS	Yes
Windows 3.1x		Yes
Windows 95			Yes
WinFrame or Windows NT			Yes
WinFrame Client Software

1.	Install and run the WinFrame client.

2.	Add a new entry and select user specific settings and the following:

Transport: serial

Device: COM# (same baud rate as WinStation, modem connected to client)

Phone Number: phone number of the Dial-In WinStation modem

3.	Select the configured entry to dial into the WinStation. An Enter PASSCODE prompt is displayed. Type your pin and cardcode and press ENTER.

Using Security Dynamics Hardware with WinFrame RAS

Below is a chart listing connectivity options for the various WinFrame clients and their compatibility with remote node Dial-In connections. The listing across the top row indicates the WinFrame client being used to run a remote control session. The listing along the left-hand column identifies the dial up client being used.

Note  For the RAS configurations, a dial up connection to a RAS server must be established first. Then a WinFrame client can be used to connect to a WinFrame server over the dial up connection.

Connectivity Options Chart, ACM Connected to a WinFrame RAS Server for Dial-In and Dial-Out

Dial-Up Net- working Client	DOS Client	Win16 Client	Win32 Client
Windows 3.1 RAS	No	Yes NetBIOS only	No
Citrix WinFrame or Windows NT 3.5x RAS	No	No	Yes
Windows 95 Dial up Networking	Yes	No	Yes
WinFrame Dial-Up Manager for DOS	Yes	Yes	No
WinFrame Dial-Up Manager for Windows 3.1x	No	Yes	No
Integration

Install the WinFrame server. To ensure working configurations, connect and configure terminals and remote PCs without the SecurID product.

Note  For best asynchronous connectivity performance, equip the WinFrame server with an intelligent multiport adapter.

WinFrame RAS Server Configuration

1.	With a text editor, edit the MODEM.INF file located in %WINDIR% \SYSTEM32\RAS. Find the specific modem you are using and set MAXCONNECTBPS= to match the speed of your modem and ACM.

Note  The fastest baud rate that the ACM currently can handle is 38400. This must be done before configuring the RAS port for a specific modem.

2.	Install and configure RAS.

3.	Connect and configure modems and clients.

4.	Dial into the RAS port with a valid client to verify that the RAS connection works.

WinFrame Server WinStation Configuration

1.	Run WinStation Configuration in the Administrative Tools group.

2.	Create a new WinStation and select a transport (NetBIOS, IPX, or TCP/IP), depending on the client you will be running.

ACM Configuration

1.	Using modem or straight-through cables, connect the ACM between the WinFrame port and the host modem.

2.	With a TTY terminal client, dial into the host modem connected to the DTE terminal on the ACM or connect via direct connect to the DTE input of another port using a null modem cable.

3.	Select different baud rates until you receive an Enter PASSCODE: prompt in terminal mode.

4.	Enter an ADMIN SecurID passcode to enter the Administration utility.

5.	Configure the ACM for valid users and SecurID cards.

Note  The SecurID serial number found on each SecurID card must be configured for each specific user who will have access to the ACM. Under the Main Administration menu, go to channel settings to configure the ports. Set the modem port as follows:

Baud rate: equal to the RAS server and modem. The fastest baud rate that the ACM currently can handle is 38400

Data Bits: 7 or 8 to match the RAS server (default = 8)

Parity: None, Even, Odd, Mark, or Space to match RAS server

Protocol: DCD at modem and DCD at host (default = d-d)

Host Command Mode: Enable, Text, same as channel baud rate (t##)

Dialout: Y (enabled)

Note  Always have dial out enabled on the ACM so that it allows the RAS server to initialize and set the modem to auto-answer after each call. Also, for dial out to function properly, your ACM hardware may require host and modem adapters to be attached to each port of your ACM. Various revisions of the ACM hardware exist, requiring different models of these adapters.

RAS Client

1.	Install the client dial in software you want to use.

2.	Create an entry.

3.	Select the compatible transport.

4.	Set the baud rate you selected so it is the same as the ACM channel baud rate.

5.	Select a setting; for example, "Terminal mode on connect," "Post Connect Terminal mode," or similar variations. In Windows 95 the selection is "Bring up Terminal windows after dialing."

6.	Dial into the RAS Server/ACM/modem with proper username and password (if not already configured).

7.	The terminal screen will appear and an Enter PASSCODE: prompt is displayed. Type your pin and cardcode and press ENTER.

8.	Run the appropriate WinFrame client.

WinFrame Client Software

1.	Install and run the appropriate WinFrame client.

2.	Add a new entry and select user-specific settings and the following:

Transport: NetBIOS, IPX, or TCP/IP (depending on what type of transport the WinStation is configured for)

Device: COM#: (same baud as WinStation, modem connected to client)

Phone Number: Phone number of the Dial-In WinStation modem

3.	Select the configured entry to dial into the WinStation. An Enter PASSCODE: prompt appears. Type your pin and cardcode and press ENTER.


Security Dynamics ACE/Server

The Security Dynamics ACE/Server security software provides SecurID identification and authentication of users on TCP/IP networks. There are two pieces to the ACE/Server security software program: the ACE/Server Host and the ACE/Client for Windows NT. The ACE/Server host software operates on Windows NT Server 3.51 and on a wide variety of UNIX-based platforms, while the ACE/Client for Windows NT runs on a WinFrame server. When used in conjunction with a SecurID token, ACE/Server centrally authenticates a user's identity, allowing only authorized users access to protected network resources.

The ACE/Server is a secondary security solution that supplements WinFrame's own Windows NT-based C2 level security. This additional security can be configured for remote control logins (WinStations) and remote access logins (RAS). The ACE/Server, which currently resides on a Windows NT 3.51 server or a UNIX platform, acts as a database storing PIN tokens for authenticating users logging onto a WinFrame server. The ACE/Client is installed on the WinFrame server and is integrated into the WinStation and RAS logins. Upon login to the WinFrame server, the user will be challenged by both WinFrame security and SecurID passcode security.

Requirements

The ACE/Server host software operates on Windows NT 3.51 server and a wide variety of UNIX platforms. Check with Security Dynamics for available configurations. This application note describes only the configuration tested in the Citrix labs.

Security Dynamics SecurID

ACE/Server Windows NT 3.51 Version

Software Requirements

Windows NT Server Version 3.51 with Service Pack 5

Security Dynamics ACE/Server for Windows NT Version 2.2

Security Dynamics ACE/Client for Windows NT Version 4.0 or higher

NTFS File System

Hardware Requirements

Intel Pentium 166 or better

CD-ROM Drive

ACE/Server UNIX Solaris Version

Software Requirements

Solaris Version 2.5 (UNIX Operating System)

Progress Software database Version 7.3C01 with patch 7.3C05

Security Dynamics ACE/Server Version 2.1

Security Dynamics ACE/Client for Windows NT Version 4.0 or higher

Hardware Requirements

Sun SPARCstation with CD-ROM drive and 4mm DAT tape

Citrix WinFrame

Software Requirements

WinFrame Version 1.6 or higher (see WinFrame Server Configuration below)

Hardware Requirements

WinFrame server (see the WinFrame Installation Guide, Welcome section)

Integration Overview

The steps to install ACE/Server on a Windows NT platform are:

1.	Install Windows NT 3.51 and apply Service Pack 5.

2.	Install and configure the ACE/Server.

3.	Configure a WinFrame server (detailed below).

4.	Install and configure the ACE/Client for Windows NT on the WinFrame server (detailed below).

The steps to install ACE/Server on a Solaris UNIX platform are:

1.	Install the Solaris UNIX Operating System.

2.	Install the Progress Database.

3.	Install and configure the ACE/Server.

4.	Configure a WinFrame server (detailed below).

5.	Install and configure the ACE/Client for Windows NT on the WinFrame server (detailed below).

WinFrame Server Configuration

For detailed information regarding WinFrame server equipment selection and software installation, refer to the WinFrame Installation Guide.

1.	Install the WinFrame operating system following the instructions in the Installation Guide.

Notes  The WinFrame server must have the TCP/IP protocol installed in order to communicate with the ACE/Server installed on the Sun SPARCstation.

For asynchronous modem connections, the WinFrame server must have an intelligent multiport board, such as a DigiBoard, installed and configured.

For remote node connections, RAS must be installed on the WinFrame server. (Remote control ICA Dial-In connections do not use RAS.)

2.	Install Service Pack 5.

3.	Reboot the server.

ACE/Client for Windows NT Installation

1.	Obtain a copy of the SDCONF.REC file from the ACE Server and place it in the %systemroot%\SYSTEM32 directory on the WinFrame server. This allows you to set security options and test the installation without having to reboot beforehand.

2.	Make sure that the WinFrame server is configured as a client machine in the ACE/Server database. (Refer to the section entitled "Windows NT Ace/Server Configuration.") If this is the first authentication for this WinFrame server, verify that the Sent Node Secret checkbox is unchecked. [This is verified using the SDADMIN (UNIX) program or ACE/Server Administration (Windows NT) program.]

3.	If the ACE/Client for Windows NT has been installed on this WinFrame server but has been reconfigured; that is, the IP address has changed, be sure to delete the Node Secret file. This file is stored in the %systemroot%\SYSTEM32 directory and is called SECURID.

4.	Insert the ACE/Client for Windows NT diskette in the floppy drive of the WinFrame server and proceed with the installation as described in the ACE/Client documentation. The ACE/Client can be configured to support remote control connections, remote node connections, or both.

5.	When prompted to set security options, do so. For remote control users, select Enable Local Access Security in the SDGINA section of that dialog. You can verify that a user can authenticate by selecting the button at the bottom of the dialog. Authentication problems will occur here if the WinFrame server has not been configured as a client in the ACE/Server database, if the SDCONF.REC file is outdated, or if the SECURID (Node secret) file is outdated (see "Troubleshooting" below for solutions to these problems).

6.	If you intend to use RAS as a connectivity option on the WinFrame server, select Enable Remote Access Security in the SDRAS section. This option will be disabled if the RAS server hasn't been installed yet.

Note  You may want to have the ACE/Server authenticate everyone who connects via RAS. This can be done under the SDRAS section by selecting Challenge All Users.

7.	After configuring security options, the installation asks whether you want to add users to the Security Dynamics user groups that have been created (see "Usage" below for more details on these groups). Click on Yes to start the WinFrame User Manager and create users to add to these groups, as well as to add existing users. Users configured as such will be required to provide SecurID authentication.

8.	Upon completion of the installation of the software, reboot the WinFrame server.

Note  If the ACE/Client has already been installed, the above configuration can be accomplished with the Control Panel applet for the ACE/Client.

Connectivity Matrix

The connectivity matrix below identifies currently supported configurations for using the SecurID product and WinFrame client programs for various operating systems and protocols.

Client Operating System	WinFrame Client	Protocol	WinStation*	RAS**
DOS	DOS	IPX	X	X
		NetBIOS	X
		TCP/IP	X	X
		Async null modem	X
		Async Dial-In	X
Windows 3.x	Win16	IPX	X	X
		NetBIOS	X
		TCP/IP	X	X
		Async null modem	X
		Async Dial-In	X
Windows 95/NT	Win32	IPX	X	X
		NetBIOS	X	X
		TCP/IP	X	X
		Async null modem	X
		Async Dial-In	X

*WinStation connections are remote control connections made using the Citrix WinFrame Client Independent Computing Architecture (ICA) protocol.

**RAS connections are remote node connections made using the Citrix WinFrame Dialup Manager for DOS, WinFrame Dialup Manager for Windows, Windows 95 Dialup Networking, or Remote Access Dialout for Windows NT in conjunction with RAS configured on the WinFrame server.

Usage

Remote Control Connections

1.	Select a configuration from the connectivity matrix above and set up a supported client configuration. (For instructions on installing and configuring a connection with a WinFrame client, please refer to the WinFrame Installation Guide.)

2.	Initiate a connection to the WinFrame server using one of the supported protocols. The standard WinFrame login screen will appear.

3.	Logon to the WinFrame server. If the user specified belongs to the local user group SDLOCAL or Domain SDLOCAL (see "PDC Installations" below), the user is required to provide a SecurID authentication passcode.

4.	Respond to the SecurID challenge with a passcode from a SecurID token card.

Bypassing Authentication on a Per-WinStation Basis

WinFrame Version 1.6 Service Pack 5 and WinFrame Version 1.7 contain a fix that allows the administrator to configure WinStations to bypass SecurID logon authentication (not RAS authentication) on a per-WinStation basis. If the user is a member of the SDLOCAL group or the server is configured to challenge all users, the user will not be challenged. To bypass SecurID authentication for a WinStation:

1.	Start WinStation Configuration.

2.	Select a WinStation.

3.	Select Advanced WinStation.

4.	Check the Use default Authentication box and select OK to save the changes.

Remote Node Connections

1.	Configure a machine as specified in the above configuration matrix. Dial into a WinFrame RAS port. Be sure that the client software is configured to display Terminal mode after dialup. This step is essential or you will not be able to login. Each user configured in the SDREMOTE or Domain SDREMOTE user groups will be prompted for the domain, username, and passcode.

2.	Upon successful authentication, your username and password will be taken from the RAS client's configuration and they will be verified by the network as with a normal RAS login.

Note  Your RAS/WinFrame logon username and your ACE/Server name must be identical.

Primary Domain Controller (PDC) Installations

If the ACE/Client software is installed on a WinFrame server that is also a Primary Domain Controller, two additional groups are created during the installation: Domain SDREMOTE and Domain SDLOCAL. These two groups can be used to allow users on any machine that uses this PDC to be authenticated using the SecurID solution.

Note  This does not change the requirement that any machine that wants to use SecurID authentication, whether local or domain, must have the ACE/Client installed.

Two example configurations are shown below:

Example 1

A WinFrame client connects using RAS to the WinFrame server Server_1 in the domain PDC_EX and the user specified is a member of PDC_EX's domain SDREMOTE user group. The user is challenged with the SecurID authentication.

Note  In this example, both Server_1 and PDC_EX must have the ACE/Client installed.

Example 2

A WinFrame client connects using ICA remote control to the WinFrame server named Server_2 and logs into domain PDC_EX2. The user is a member of PDC_EX2's domain SDLOCAL group. The user is challenged with the secondary authentication.

Note  Both Server_2 and PDC_EX2 must have the ACE/Client installed.

Troubleshooting

When I try to connect to the WinFrame server using RAS, it drops the connection whenever it tries to verify the username and password on the network.

Don't forget to turn on terminal mode after dialin option on the RAS client side. This option is essential or you will not be prompted by the SecurID authentication.

When I try to logon to the WinFrame server using a RAS or WinStation connection, I get a "User access denied" message. The ACE/Server log shows the message "Node verification failed".

There are two possible causes. First, check to see if the client configuration on the ACE/Server has the Sent Node Secret box checked. If it does, uncheck it. Next, go to the WinFrame server and look in the %systemroot% \SYSTEM32 directory. If the file SECURID exists, delete it. Try to logon again. If you still get the failure, delete the SDCONF.REC file from the %systemroot% \SYSTEM32 directory and obtain a current copy from the ACE/Server.

When I try to start SDADMIN on the ACE/Server, I get a "user root not found" message even though I have a root user on the server.

This should only happen on the first login after installation, if ever, and it means that the database is not yet ready to be administered. Run SDCREADM on the ACE/Server and then try again.

I'm trying to get a user to authenticate but the token isn't being accepted. I tried to resynchronize the card in the database but that gives an Invalid tokencode error message.

The database is not receiving a value in the range of values that it will accept. Typically, this means that the time zone or the date and time configured on the ACE/Server are not correct. Check the date and time that the ACE/Server reports in the System, Edit System Parameters menu. If the time shown there is not correct, make the appropriate adjustments to either the TIMEZONE variable (in /ETC/SYSTEM/INIT) or to the date and time (using the DATE command).

I have dialup or network users who do not have SecurID cards. How can they connect without being challenged by the ACE/Server?

As an administrator, run WinStation Configuration and edit a WinStation. Click on Advanced WinStation. Check the "Use default Authentication" box and select OK to save the change.

During installation, I get an "Operating system not supported" error when I run SDSETUP and SDNEWDB.

The documentation provided with the ACE/Server includes a Readme stating that certain operating systems (including newer versions of Solaris) are not included in the installation scripts. It also includes directions for editing those scripts (SDSETUP and SDNEWDB) to make them support those operating systems. Follow the instructions in the ACE/Server documentation.

Windows NT ACE/Server Installation

1.	Logon to the Windows NT console as the local administrator.

2.	Run SETUP.EXE from the ACE/Server \ACESVR directory on the CD.

3.	Place the Security Dynamics license diskette in drive A and select Next.

4.	Enter the destination directory to which to install the master ACE/Server.

5.	Select Encryption type: DES or SDI.

6.	In Main\Control Panel\Ace\Server, select Automatic ACE/Server startup. Select OK.

7.	Configure the console display for 800x600 or better video resolution. This minimum display size is necessary for viewing the entire ACE/Server configuration menu. The Display can be changed using the Display option in Control Panel.

8.	Reboot the system.

Windows NT ACE/Server Configuration

1.	Logon to the Windows NT Server console as the local group administrator.

2.	Copy the SDCONF.REC file from the \ACE\DATA directory to the \%systemroot%\SYSTEM32 directory.

3.	Run the ACE/Server Administration program.

Note  If an error appears stating the configuration record COMPUTERNAME does not match the host computer name "COMPUTERNAME.FDN" (FULL DOMAIN NAME), it may be necessary to edit the %systemroot%\SYSTEM32 \drivers\etc\hosts file and add the IP address of the Master Server along with the FDN of the server. Double-click the Aceserver configuration icon and enter the FDN name in the Master Server section. This can be done by selecting the edit button in the lower right corner. If you do make modifications, you must re-copy the SDCONF.REC file as described above and run Server Administration again.

4.	From the Tokens menu, select Import and import the token file(s) you intend to use for this integration.

5.	Select Site and then Add. This is a container for machines you intend to use from this location. It is a client machine management tool, not a physical separation.

6.	Add a Group. A group is a way to easily associate a selection of client machines with a selection of users. Any user who is designated as a member of a group can logon and get authenticated by any machine also contained in that group.

7.	Add one client entry for each machine that will use the SecurID secondary authentication. Each machine's IP address must be resolvable by the server, whether by DNS, NIS, or simply the %systemroot%\SYSTEM32 \drivers\etc\hosts file. The machine's type is dependent on the operating system. For Windows NT and WinFrame machines, it is NetOS. Be sure to add the clients to the group created above.

8.	Add a User entry for each user who will use SecurID authentication. The default shell variable is not relevant for users who will logon from Windows NT and WinFrame hosts but is required for users who will login from a UNIX client. Be sure to add the users to the group configured in Step 4 above; all will be able to login from any client configured in that group.

Solaris Installation

Installation of the Solaris operating system is detailed in the documentation provided by Sun Microsystems; however, some general steps are listed below.

1.	Place the Solaris installation CD in the CD-ROM drive and turn on the computer. If a previous installation of Solaris or SunOS exists on the machine, interrupt the boot process (with STOP+A), specify N for new command mode, and type boot cdrom.

2.	From this point on, you are in the Solaris installation procedure. The three parts of the installation procedure are: Machine Identification, Software Installation, and Post Installation. The following questions are important to ensure that both Progress and ACE/Server will function correctly:

Machine Identification

Question	Answer
Networked	Yes
Specify Time Zone By	Offset from GMT
Install Software

Question	Answer
Software Group	<-Entire Distribution
Be sure to specify a valid root password.

3.	When the installation is complete, make the following modification:

cd /etc
vi system (or use whatever editor you like)
and add the following lines to the end of the file:

Set SEMSYS:SEMINFO_SEMMNI = 64
Set SEMSYS:SEMINFO_SEMMNS = 200
Set SEMSYS:SEMINFO_SEMMNU = 100
Set SEMSYS:SEMINFO_SEMMSL = 50
Set SHMSYS:SHMINFO_SHMMAX = 16777216
Set SHMSYS:SHMINFO_SHMMNI = 100
Set SHMSYS:SHMINFO_SHMSEG = 16

4.	The TIMEZONE, as set up by the default installation, will not work correctly with the ACE/Server's reliance on GMT (UTC) time. Change the /ETC/DEFAULT/INIT file to match your particular time zone configuration. In the Eastern US, the TZ field in that file should be changed to EST5EDT4; this indicates Eastern Standard Time, with an offset from UTC of five hours, and Eastern Daylight Time with an offset from UTC of four hours.

5.	Modify the /ETC/SERVICES file to include the two lines for the ACE services. They are as follows:

securid	5500/udp	# ACE/Server
securidprop	5510/tcp	# ACE/Server Slave
Progress Database Installation

Installation of the Progress Database is detailed in the documentation provided by Security Dynamics; however, some general steps are listed below.

1.	Login as root user to the Solaris machine. Insert the Progress Database 4mm DAT into the tape reader. From the console, execute these commands:

cd /mnt
cpio -iudcvBm < /dev/rmt/0m
/proinst

2.	Enter the product license Serial Numbers, Reference Numbers, and Control Numbers from the product license addendum sheet that came with the database package. When done, press CTRL+E.

3.	Specify the installation directory and let the installation continue. When asked if you want to copy scripts, answer N or No.

4.	The patch for the Progress Database should also be installed. Insert the Progress Patch DAT tape and execute these commands:

md temp
cd temp
tar -xv

Note  The process takes several minutes.

5.	Follow directions in the README.PRO file created by the previous command. This file can be used to create a shell script (batch file) that will update everything in one command.

Solaris ACE/Server Installation

Installation of the ACE/Server is detailed in the documentation provided by Security Dynamics; however, some general steps are listed below.

1.	Place the ACE/Server tape in the DAT drive. On the drive where you intend to install the ACE/Server, execute these commands:

mkdir sds
cd sds
tar -xv

2.	Edit the SDSETUP and SDNEWDB files to modify the versions of Solaris that are supported.

3.	Execute \SDSETUP and follow the installation instructions, answering the questions asked as they apply to your system and configuration.

Solaris ACE/Server Configuration

Configuration of the ACE/Server is detailed in the documentation provided by Security Dynamics; however, some key details are listed below.

1.	From the ACE/Server console, start the SDADMIN program.

2.	From the Tokens menu, select Import and import the token file(s) you intend to use for this integration.

3.	Select Site and then Add. This is a container for machines you intend to use from this location. It is a client machine management tool, not a physical separation.

4.	Add a Group. A group is a way to easily associate a selection of client machines with a selection of users. Any user who is designated as a member of a group can login and get authenticated by any machine also contained in that group.

5.	Add one client entry for each machine that will use the SecurID secondary authentication. Each machine's IP address must be resolvable by the server, whether by DNS, NIS, or simply the /ETC/HOSTS file. The machine's type is dependent on the operating system. For Windows NT and WinFrame machines, it is NetOS. Be sure to add the clients to the group created above.

6.	Add a User entry for each user who will use SecurID authentication. The default shell variable is not relevant for users who will logon from Windows NT and WinFrame hosts but is required for users who will login from a UNIX client. Be sure to add the users to the group configured in Step 4 above; all will be able to login from any client configured in that group.


VTCP/SECURE Software

Overview

VTCP/SECURE is a security software package that allows remote users to connect to a WinFrame server over untrusted networks for a secure remote WinFrame session. This is done by creating a virtual private network that transparently encrypts and validates all data between the WinFrame client and the WinFrame server.

VTCP/SECURE provides encryption, authentication, and authorization to protect TCP networked computers and incorporates a number of security management features. The encryption, authentication, and key exchange algorithms include DES 40, Triple DES, and Diffie-Hellman. Authentication, authorization, and accounting services are provided through TACACS+ or the internal one-time password authentication service.

Software Requirements

WinFrame Server Version 1.6 or higher

VSGATE Server Software Version 2.1a or higher

VSCLIENT Client Software Version 2.1a or higher

TCP client WinSock Version 1.1 or higher

Note  Client systems require a minimum of 8MB of RAM for VTCP/SECURE and the WinFrame client software.

Installation Overview

VTCP/Secure is composed of two parts: the VSCLIENT software that is installed on the client machine and the VSGATE software that is installed on a WinFrame server or a gateway server to the corporate Intranet. VTCP/SECURE gateways may reside on the UNIX, Windows NT, or Windows 95 operating systems. These gateways allow network connectivity to a WinFrame server residing on the corporate Intranet. The gateways decrypt data from the remote client for communication on the local Intranet. The VSCLIENT software can reside on Windows operating systems compliant with WinSock 1.1 or higher.

The procedures below describe how to install the VTCP/SECURE gateway software on WinFrame and how to install and use the VSCLIENT software with Windows 95. In this example, the WinFrame server itself is directly connected to the Internet without an intervening gateway server. For other WinFrame client configurations, see the connectivity matrix below. For more detailed information about VTCP/SECURE, see the VTCP/SECURE Administrators Guide, the VAMIN2.HLP file included with VTCP/SECURE software, or contact Infoexpress, Inc.

Note  When connecting any WinFrame server to an untrusted network, you should secure your WinFrame server using the procedures outlined in the WinFrame Version 1.7 Security Guide or the WinFrame Security Utilities Pack.

Quick Start Installation

1.	Install the VSGATE software on a WinFrame server with TCP/IP WinStations and Internet networking access.

2.	Configure the VSGATE software.

3.	Install the VSCLIENT software on a Windows 95 system.

4.	Create a VSCLIENT connection entry to the WinFrame server.

5.	Install the WinFrame Win32 Client.

6.	Use the WinFrame Client Remote Application Manager to create a remote TCP/IP network connection entry.

Quick Start Usage

1.	Use Dial-up networking from the Windows 95 client machine to dial into an ISP (Internet Service Provider) for TCP connectivity.

2.	Run the VTCP/SECURE client software from Windows 95, creating a secure communications channel to the WinFrame server.

3.	Run the WinFrame Win32 Client Remote Application Manager and connect to the WinFrame server.

The following matrix lists the possible client operating systems and the recommended WinFrame clients to use. The VSCLIENT software for Windows works on all of the listed operating systems over TCP/IP remote node dial up or network TCP/IP client connections only. Direct WinFrame ICA dialin and other network protocols are not supported by VTCP/SECURE software.

Client Operating System	WinFrame Client
Windows 3.1 (with WinSock 1.1 or higher)	WinFrame 16-bit client for Windows
Windows for Workgroups (with WinSock 1.1 or higher)	WinFrame 32-bit client for Windows
Windows 95	WinFrame 32-bit client for Windows
Windows NT 3.51 or 4.0	WinFrame 32-bit client for Windows
Installation

VSGATE Software

1.	Logon to the WinFrame server as an administrator.

2.	At a command prompt, type change user /install.

3.	Install the VSGATE software.

4.	During the VSGATE software installation, select to install the software as a service and enter the TCP/IP subnet mask of the WinFrame server.

5.	Reboot the WinFrame server.

6.	Logon to the WinFrame server as an administrator.

7.	Run VSADMIN from the VSGATE program group.

8.	From the VSADMIN program, select 5 to Manage local passwords.

9.	Select 1 to add a user.

10.	Enter the new username.

11.	Select the default settings except for the Access Filter settings.

12.	Select 1 for NETOPS for Access Filter settings.

13.	Save the configuration.

VSCLIENT Software

1.	On a Windows 95 client, install the VTCP/SECURE software.

2.	During the VSCLIENT installation, select System Wide.

3.	Reboot the Windows 95 client.

Usage

1.	From the Windows 95 client machine, dial into the ISP for Internet access using Windows 95 Dial-up Networking.

2.	Select the VSCLIENT application from the VSCLIENT program group.

3.	Click the Connect button.

4.	Enter the name or IP address of the WinFrame server and select OK. (Leave the port address empty.)

5.	Once communication to the VSGATE Server has been established, you will be prompted for the VTCP/SECURE username and password you created in VSADMIN. With proper authentication, a "Smart Tunnel" or virtual private network is created between the remote client and the WinFrame server.

6.	Run the WinFrame Win32 Client Remote Application Manager and create an entry to connect over TCP/IP to the WinFrame server.

7.	Double-click the new entry to establish a secure TCP/IP network connection to the WinFrame server.


Internet Connectivity and WinFrame

Overview

WinFrame application servers can be used to solve common Internet requirements:

WinFrame allows access providers to create a Windows Internet gateway, giving customers easy access to the Internet.

WinFrame allows any organization to easily publish information over the Internet using conventional Windows applications and tools to create interactive Windows Internet services.

WinFrame gives local LAN users Internet access without having to install TCP/IP software on each workstation. You require only one IP address for all users.

See the following illustration for sample Internet Windows gateway and Interactive Windows Internet service configurations.

Note  If you are attaching aVersion 1.6 WinFrame server to the Internet for the purpose of publishing applications, you must obtain the Security Utilities Pack for WinFrame from Citrix. The Security Utilities Pack contains programs, procedures, and documentation that help you set up a secure WinFrame server for Internet access. Contact Citrix for additional information.

The Security Utilities are included as part of WinFrame Version 1.7. Follow the procedures in the Security Guide for WinFrame Version 1.7 servers.


How to Connect WinFrame to the Internet

You need three components to connect a WinFrame server to the Internet:

An Internet leased line (56KB, T1, T3)

An Internet router (IP)

An optional Internet firewall between your LAN and the Internet

The Internet Leased Line

Contact an Internet access provider to get an Internet leased line. Your provider can give you guidelines for selecting the proper line speed (56KB, T1, or T3). Some of the major Internet access providers are:

CERFnet
Contact: Sales Manager
Phone: (800) 876-2373, (619) 455-3900
Fax: (619) 455-3990
E-mail: Sales@cerf.net

Delphi Internet Services Corp.
Contact: Walt Howe
Phone: (800) 695-4005
Fax: (617) 491-6642
E-mail: walthowe@delphi.com

NEARnet
Contact: NEARNET information hotline
Phone: (617) 873-8730
Fax: (617) 873-5620
E-mail: nearnet-join@near.net

Netcom On-Line Communication Services
Contact: Sales
Phone: (800) 501-8649, (408) 554-8649
Fax: (408) 241-9145
E-mail: info@netcom.com

OARnet
Contact: Sales
Phone: (800) 627-8101, (614) 728-8100
Fax: (614) 728-8110
E-mail: info@oar.net

PSINet
Contact: Sales
Phone: (800) 82PSI82, (703) 620-6651
Fax: (703) 620-2430
E-mail: info@psi.com

The Internet Router

Your Internet access provider can help you select an Internet router for your connectivity needs. For instance, if you have a Novell NetWare LAN and want to gain Internet access from any LAN workstation, you will need a router that can handle IP packets.

Routers are hardware or software systems that manage the exchange of information (in the form of data packets) between network cabling systems. Routers are "intelligent" - they not only pass packets between different cabling systems but they also route the packets through the most efficient path.

Routers can also connect cabling systems that use different kinds of transmission media and different addressing systems. For example, a router can connect a local Ethernet 10Base-T network to the Internet using a 56Kbps leased digital line.

The Internet Firewall (Optional)

If the WinFrame Internet server will be connected to an existing network, you may want to consider using a firewall system to prevent unauthorized users from accessing your LAN. Firewall systems allow outgoing TCP/IP packets to flow freely, while they reject or filter any incoming TCP/IP packets such as electronic mail, remote terminal sessions, or file transfers.

Note  A WinFrame server does not need to be connected to a network in order to service information over the Internet. If the data and programs are available on the WinFrame server hard drive, you can create a "stand-alone" WinFrame Internet server. Such a configuration does not require a firewall system because all the information available to the Internet is directly protected by the WinFrame security system.

When connecting WinFrame to the Internet, you have two types of firewall options. One option is to use a dedicated firewall system to filter any Internet TCP/IP packets that travel into your LAN, as illustrated below:

The second option is to use WinFrame as a firewall. This method requires two network cards in your WinFrame server. One card is configured for TCP/IP and is connected to your Internet router. The second network card is configured for IPX and is connected to your local network, as illustrated below:

For instance, in a Novell NetWare environment, one card manages the TCP/IP traffic coming from the Internet while the other card manages only the IPX traffic coming from the LAN.

To use this option, it is recommended that you use a "restricted" Windows application shell instead of the Windows Program Manager. A restricted shell limits the applications an Internet user can access and restricts any access to system command prompts. This type of configuration effectively controls access to the information you want to publish over the Internet in a fully secured environment.

For additional information concerning the Internet firewall, refer to Firewalls and Internet Security, Repelling the Wily Hacker, William R. Cheswick and Steven M. Bellovin, ISBN 0-201-63357-4, and Building Internet Firewalls, D. Brent Chapman and Elizabeth D. Zwicky, ISBN 1-56592-124-0.


Using Firewalls With WinFrame

Overview

Internet security is becoming more important as companies connect their local networks to the Internet. One of the most popular methods to secure an internal network from the Internet is a firewall. A firewall allows an administrator to permit access from the internal network to the Internet while rejecting access from the Internet to the internal network. This provides the corporation with a direct Internet connection while keeping the internal network secure.

Citrix's Internet technology allows users to run WinFrame sessions over the Internet. This poses a challenge for maintaining Internet security because Citrix's Independent Computing Architecture (ICA) protocol is a relatively new networking protocol that runs over TCP/IP using registered port 1494. Firewalls do not understand ICA because it is not a "well known" networking protocol. Therefore, allowing the ICA protocol to pass through the firewall becomes a configuration challenge. Some types of firewalls can be configured to pass ICA, while others cannot. ICA uses dynamic port allocation much like the FTP protocol. The initial synchronization between the WinFrame client and the WinFrame server occurs over port 1494, but the actual WinFrame session occurs over a dynamically allocated port. For this reason, it might be necessary to allow connections over a range of TCP/IP ports through the given firewall. If required, these connections should be allowed only between the client and the server.

The WinFrame TCP/IP client uses the UDP (User Datagram Protocol) feature of the TCP/IP protocol suite when browsing for a WinFrame server. UDP is a connectionless mode protocol, providing a potentially unreliable, unsequenced, and/or duplicated (because it leaves these functions to other protocol layers) communications layer. The WinFrame client broadcasts UDP packets to the network with a destination address of UDP port 1604 (0644 hex) and the source address of the client is any high UDP port (any port over 1023). A WinFrame server replies with a UDP packet where the data area contains the names of the current WinFrame servers. The pull down list is built using this information. This use of UDP can be eliminated by connecting using the IP address rather than by browsing.

Most firewalls use one of four architectures:

Packet Filtering Gateway

Circuit Level Gateway

Application Proxy

Stateful Inspection

These four firewall architectures pose different configuration challenges for passing the ICA protocol. Some of the firewalls have built-in abilities to allow new protocols such as ICA to be passed, while others require specific workarounds.

Packet Filtering Gateways

Packet filtering gateways are the easiest to configure for ICA but provide the least security. A packet filter analyzes each IP packet at the network layer and determines whether to pass or block it based on a set of rules. A packet filtering gateway is more of an intelligent router than a firewall. If the packet filter has a rule specified in its rule base that allows communication between two specific addresses, packets are allowed to travel through the firewall to the specified address. If no rule is available for a given address, the packet is rejected and not allowed to pass through the firewall.

To configure a packet filtering gateway to pass the ICA protocol, insert a rule in the packet filter's rule base that allows communications to the WinFrame server over port 1494. Depending on the vendor and model of the packet filtering gateway, this could involve defining a rule that allows traffic over port 1494 to and from certain machines or groups of machines inside and outside of the network.

Circuit Level Gateways

Circuit level gateways operate at the session level used by TCP/IP and UDP. A circuit is a logical connection that is maintained for a period of time, then torn down or disconnected. The firewall verifies the circuit when it is first created. Once the circuit is verified, subsequent data transferred over the circuit is not checked. Circuit level gateways can limit which connections can be made through the gateway and can be configured for the ICA protocol. They provide a moderate level of security.

Configuring circuit level gateways to pass the ICA protocol involves allowing circuits to be made through the gateway on port 1494. Once the circuit is allowed, connections to WinFrame servers are verified through a circuit that allows WinFrame sessions through the gateway.

Application Proxies

Application proxies are probably the most secure firewalls but a special proxy must be written for a given protocol. Proxy servers provide in-depth knowledge of IP protocols and allow application level analysis. They examine each packet of information as it passes through the gateway. Proxy servers are not designed to allow for new types of protocols. To pass a new protocol through a proxy server, you must develop a workaround.

The most common workaround for proxy servers is a service called SOCKS. This service is loaded on the proxy server and allows new protocols to be passed through the proxy server without writing a full application proxy for the new protocol. While this is a workable solution, not all proxy servers support the SOCKS services. Some vendors are currently working on transparent interfaces much like SOCKS that could allow proxy servers to pass new protocols such as ICA. At the present time, no proxies or SOCKS-compatible services are available for ICA.

Configuring a proxy server to pass the ICA protocol requires allowing communications over port 1494 to the WinFrame server. It should be noted that this is not supported by all proxy servers. Because opening a port on the firewall can pose a security risk, it is recommended that communication be allowed to initiate only from inside the local network. Allowing access over port 1494 from the Internet could pose a serious security risk. Therefore, it is suggested that only WinFrame clients from the local network be allowed to connect to WinFrame servers on the Internet.

Stateful Inspection

Stateful Inspection (SI) is a new firewall technology that lends itself to the configuration of new protocols. Stateful inspection expands on packet filtering by adding state information derived from past communications and other applications. Some of the new SI firewalls allow new protocol definitions to be added to the firewall with minimal work. Much like a packet filtering gateway, SI firewalls can be easily configured to allow new protocols to be passed through the firewall over defined ports. In addition to this ease of configuration, the SI firewalls can provide added security to these new protocols by performing packet inspection as the packets move through the firewall. Some SI firewalls; for example, Checkpoint Firewall-1, have a scripting language that allows custom scripts to be written for packet inspection. This adds an extra layer of security above packet filtering while keeping ease of configuration. The SI firewalls have the ability to inspect all levels of the TCP/IP packets, allowing inspection scripts to be as simple or complex as required.

Configuring SI firewalls to pass the ICA protocol requires defining the ICA protocol as a network service. The ICA protocol should be defined on port 1494 with a dynamic source port allocation; that is, above port 1023. Rules can then be added to the rule base to allow users to access WinFrame servers. It should be noted that allowing inbound connections from the Internet could pose a security problem. Most SI firewalls do perform some level of packet inspection even without a custom inspection script. This provides an extra level of security above packet filtering; however, it is an issue that should be researched depending on the model of firewall used.

While many firewalls can be configured to pass the ICA protocol, take measures to ensure a secure environment.

Network Topologies for Using Firewalls With WinFrame

There are three basic network topologies for using firewalls with WinFrame and the ICA protocol:

Clients can connect to WinFrame servers on the Internet from their local area networks through a firewall

Internet users can access a WinFrame server that is behind a corporate firewall

Virtual Private Network (VPN) architecture

Allowing Connections to a WinFrame Server on the Internet

For local users to access WinFrame servers on the Internet, ICA packets must be passed through the firewall in an outbound direction to the Internet. Depending on the type of firewall being used, this could involve opening up port 1494 on the firewall to allow outbound access to the Internet. Because the local users are considered to be inside the trusted domain, a minimal security risk is involved.

In this configuration, a WinFrame client behind the firewall can initiate a WinFrame session to a WinFrame server anywhere on the Internet. Because port 1494 is only open to outbound access from the local network, there is little security risk involved in this setup.

Allowing Connections to a WinFrame Server Behind the Firewall

For Internet users to access a WinFrame server behind the corporate firewall, ICA packets must be passed in an inbound direction through the firewall. In this situation, port 1494 should be opened for inbound communication from the Internet.

Caution  If connections over port 1494 are allowed to all machines behind the firewall, a hole is opened that exposes the entire internal network to the Internet. Therefore, for security reasons, inbound communications over port 1494 from the Internet should be allowed to connect only to the WinFrame server(s).

In this configuration, WinFrame users on the Internet are able to connect to a WinFrame server behind the corporate firewall.

Caution  Anything the WinFrame server is connected to can be seen by the Internet client when it logs in. For this reason, it is recommended that some level of security be implemented on the WinFrame server to restrict access from Internet users.

Allowing WinFrame Connections in a Virtual Private Network

New firewall technologies allow the extension of the corporate network through the firewall to remote sites. In a situation like this, two office networks in different parts of the world can be linked together over a secure channel on the Internet. By implementing a firewall solution that supports Virtual Private Networking (VPN) at both sites, a secure connection can be created that encrypts data as it passes over the Internet from one site to the other.

For WinFrame to run in a VPN architecture, allow communication over port 1494 in the desired direction from the secured network on the other side of the VPN. In a situation like this, an administrator has the option of allowing connections originating from in front of the firewall or from behind the firewall. This is possible because in a VPN architecture both sides of the VPN are considered secure. For WinFrame sessions to run from both sides of the VPN, communication must be opened for port 1494 in both directions. An example of one way communication over a VPN is shown below.

In this configuration, a WinFrame client behind Firewall Corporate 1 can connect to a WinFrame server that is behind Firewall Corporate 2. To configure this setup, Firewall Corporate 1 must allow outgoing communication over port 1494 and Firewall Corporate 2 must allow inbound communication over port 1494 from Firewall Corporate 1.

Configuring a Firewall for TCP/IP WinStations

Citrix ICA traffic uses the registered port 1494 with the TCP protocol. If you have a firewall or other TCP/IP network security protection, you need to configure it to allow information to pass to this port number on any WinFrame servers on your network. Allowing ICA traffic through a firewall generally entails defining a rule to allow port access for port 1494 traffic in the proper direction. If a user receives a "There is no route to the specified address" message, this is usually due to a firewall not allowing port 1494 access.

If your firewall does not support port 1494 (for example, if your firewall does not support port numbers greater than 1024 or port 1494 is in use by another application), you can configure the client and server to use a different port number. Use the ICAPORT command-line utility to change the default port number on the server. All WinFrame client computers must then be changed to use the new port by editing the MODULE.INI initialization file located in the Remote Application Manager directory. Refer to the WinFrame Client User Guide for more information about the MODULE.INI file.


Internet Firewalls Supported by WinFrame

The following Internet Firewall is supported by WinFrame:

Firewall	Version
CheckPoint Firewall-1	2.1 or later


CheckPoint Firewall-1

Overview

This document describes how to integrate the Checkpoint Software Technologies Firewall-1 firewall product with WinFrame servers and the Citrix Independent Computing Architecture (ICA) protocol.

CheckPoint Firewall-1 addresses the network security challenge created when a local network is connected to the Internet. Firewall-1 builds intelligence into the network layer, creating virtual barriers to control access to the local network and regulating and protecting the flow of data between network resources and segments. Utilizing a patent-pending multilayer Stateful Inspection technology, Firewall-1 builds upon the network infrastructure. Firewall-1 scales in tandem with the network to accommodate a growing number and type of network applications and high-speed networking technologies; for example, 100 Base-T and ATM, and business connectivity requirements.

This document addresses the following considerations for configuring Firewall-1 for use with the ICA protocol and WinFrame:

Defining the ICA protocol in Firewall-1

Allowing ICA connectivity originating from inside the firewall

Allowing ICA connectivity originating from outside the firewall

Software Requirements

CheckPoint Firewall-1 Version 2.1 or later

WinFrame Server Version 1.6 or higher

Installation

At the present time, Firewall-1 does not install on WinFrame. Firewall-1 must be implemented on one of the operating systems currently supported by CheckPoint Software, including:

Windows NT Version 3.51

SunOs Version 4.1.3

Solaris Versions 2.3, 2.4, and 2.5

HP-UX 9 and 10

Follow the documentation provided by CheckPoint Software to install Firewall-1 on the host.

Configuration

Defining the ICA Protocol on the Firewall-1 Host

This step adds the Citrix Independent Computing Architecture (ICA) protocol to the Firewall-1 services list.

1.	Open the Security Policy Editor in the CheckPoint Firewall-1 User Interface Group.

2.	Log into the Firewall-1 Server.

3.	Under the Manage Menu in the Title Bar, select Services.

4.	Click on the New button and select TCP.

5.	Type winframe in the Name field.

6.	In the Port field, enter 1494.

7.	For the Source Port Range, enter 1023 to 9999. (The upper limit may be increased if necessary.)

8.	Click the OK button and close the Services window.

Allowing ICA Connectivity Originating From Inside the Firewall

This configuration step allows WinFrame clients on the internal network to connect to WinFrame servers on the Internet or outside of the internal network through the firewall.

At the Firewall-1 host console, add a rule for WinFrame sessions originating from inside the firewall.

1.	From the Security Policy Editor, add a rule at the top of the rule base with the following properties:

Source: Inside (this is the object representing the internal network)

Destination: Any

Service: WinFrame (this is the service configured above)

Action: Allow

Track: Optional

Install On: Gateways

2.	Verify the Rule Base.

Click on the Policy button in the pull-down menu and select Verify.

Click on OK in the popup window when the rules are verified.

3.	Install the Rule Base on the firewall.

Click on the Policy button in the pull-down menu and select Install.

Click on OK in the Install Security Policy Module Window.

Click on Close in the popup window when the Security Policy is installed.

Allowing ICA Connectivity Originating From Outside the Firewall

This configuration allows users on the Internet or outside the firewall to connect to a WinFrame server on the local network behind the firewall.

Note  For security reasons, configure the WinFrame server so that there are no security risks to the internal network from external users who might log into the WinFrame server. Security measures should be taken to restrict access to the local network from the WinFrame server if unknown users or demo users are going to access the WinFrame server. When configuring a rule in the firewall rule base, WinFrame sessions should only be allowed to go to a specific WinFrame server. Allowing the WinFrame service to pass through the firewall to a machine behind the firewall could pose a security risk. For this reason, the defined WinFrame service should be allowed to access only specified WinFrame servers behind the firewall. To accomplish this, the WinFrame servers behind the firewall must be defined as network objects in Firewall-1.

1.	At the Firewall-1 host console, define the WinFrame server as a network object.

A.	From the Security Policy Editor, under the Manage Menu in the Title Bar, select Network Objects.

B.	Click on the New button and select Machine.

C.	Enter a name, IP address, and an optional comment for the WinFrame server.

D.	Click on the Internal option in the Location section.

E.	Click on the Host option in the Type section.

F.	Click on OK to save the WinFrame server object and close the Network Objects Window.

2.	Add a rule for WinFrame sessions originating from outside the firewall.

A.	From the Security Policy Editor, add a rule at the top of the rule base with the following properties:

Source: Any (this includes any machine, internal or external)

Destination: "WinFrame Server" (this is the network object representing the internal WinFrame server configured in the previous step).

Service: WinFrame (this is the service configured above)

Action: Allow

Track: Optional

Install On: Gateways

B.	Verify the Rule Base.

Click on the Policy button in the pull-down menu and select Verify.

Click on OK in the popup window when the rules are verified.

C.	Install the Rule Base on the firewall.

Click on the Policy button in the pull-down menu and select Install.

Click on OK in the Install Security Policy Module Window.

Click on Close in the popup window when the Security Policy is installed.

Troubleshooting

If the WinFrame service does not pass through the firewall, enable tracking in Security Policy Manager. Track any rule that specifies the WinFrame service to the Security Log. The Security Log provides valuable information on why the service is failing to pass through the firewall.


Web Browsers Supported by WinFrame

The following Web browsers are supported by WinFrame.

Browser	Version
Microsoft Internet Explorer for Windows NT	1.5 and 2.0
Microsoft Internet Explorer	3.03
Netscape Navigator, 32-bit Version	2.01 and 3.0


Microsoft Internet Explorer Versions 1.5 and 2.0 for Windows NT

Overview

Microsoft Internet Explorer Versions 1.5 and 2.0 are World Wide Web browsers for HTML documents on the Internet and on Intranets. Internet Explorer brings Web exploration and FTP capabilities into one integrated package.

Requirements

Hardware Requirements

Internet connection (modem, Ethernet Card, ISDN, etc.)

Software Requirements

Microsoft Internet Explorer Version 1.5 or 2.0 for Windows NT

WinFrame Version 1.6 or higher with TCP/IP support installed

Installation

To Install Microsoft Internet Explorer Version 1.5 or 2.0 on a WinFrame Server

1.	Logon as an administrator at the WinFrame system console.

2.	Start a command prompt and type change user /install. This places the user session in install mode.

3.	Exit command prompt.

4.	Install Microsoft Internet Explorer as described in the Microsoft Internet Explorer Installation Guide.

5.	After Netscape Fast Track Server is installed, start a command prompt and type change user /execute. This changes the user session back to execute mode.

6.	Exit command prompt.

Configuration

To run Microsoft Internet Explorer on a WinFrame server, TCP/IP support must be installed. To install WinFrame TCP/IP support:

1.	Start Control Panel in the Main program group.

2.	Double-click on Network in Control Panel. The Network Settings dialog appears.

3.	Select Add Software.

4.	Choose TCP/IP Protocol and Related Components from the pull-down list and select OK. Enter the values for your configuration and select OK.

5.	Restart WinFrame to start TCP/IP support.

Troubleshooting

Why do I get the error: The program could not find the address for…?

Make sure your TCP/IP stack is configured. Also make sure that your Internet connection is functioning properly. This error usually results from a broken Internet connection but it could also occur from network traffic. Ping the Microsoft Web server at http://www.microsoft.com to check your Internet connection.


Microsoft Internet Explorer Version 3.03

The latest version of Internet Explorer that will run on WinFrame is 3.03, 16-bit. This version does not support ActiveX controls but does support Netscape Plug-ins. To configure Internet Explorer for use with the ICA Netscape Plug-in, follow these instructions.

To Configure Internet Explorer 3.03 16-bit for Use With the ICA Netscape Plug-in

1.	Install Internet Explorer if it is not already installed. Make note of the directory where it is installed.

2.	Run the Web Client Plug-in installation file, %SYSTEMROOT% \SYSTEM32\CLIENTS\WFCWEB\DISK1\NSPLUGIN\WFPLUG16.EXE.

3.	In Unzip to Directory, type a directory to unzip the files to a temporary directory; for example C:\TEMP, and then click Unzip.

4.	Start File Manager and change to the directory used in Step 3.

5.	Copy WFICA16.EXE and NPICAW.DLL to the PLUGINS subdirectory of the directory where Internet Explorer is installed; for example, C:\IEXPLORE\PLUGINS.

6.	Change to the PLUGINS subdirectory.

7.	Click on the WFICA16.EXE file. Click Run on the File menu.

8.	In the Command Line field type:

wfica16.exe/setup

9.	Exit File Manager.


Netscape Navigator Versions 2.01 and 3.0, 32-Bit Version

Overview

Netscape Navigator Versions 2.01 and 3.0 are multimedia World Wide Web browsers for HTML documents on the Internet and on Intranets. Navigator integrates Web exploration, e-mail, news groups, chat, and FTP capabilities. There is also platform support for live on-line applications. Navigator supports Live Objects, frames, Java applets, and Netscape inline plug-ins.

When a WinFrame user starts Netscape Navigator, the program loads all user-specific information from a default registry that is created at the time of the initial installation. In order to use Navigator in a multiuser environment, each user needs to make several changes in the Options Menu within the program. These changes are described in the Multiuser Configuration section below.

Requirements

Hardware Requirements

Internet connection (modem, Ethernet Card, ISDN)

Software Requirements

Netscape Navigator Version 2.01 or 3.0, 32-Bit Version

WinFrame Version 1.6 or higher with TCP/IP support installed

Installation

1.	Start a command prompt session.

2.	At the prompt type change user /install and press ENTER.

3.	Exit the command prompt.

4.	Install Netscape Navigator as described in the Installation Guide.

5.	Start a command prompt.

6.	At the prompt type change user /execute and press ENTER.

7.	Exit the command prompt.

Configuration

To run Netscape Navigator on a WinFrame server, you must install WinFrame TCP/IP support. Refer to the Installation Guide and the TCP/IP manual for details.

Multiuser Configuration

Netscape Navigator creates default configuration directories that are used to store program settings. The following procedures customize Navigator for a user by creating user-specific configuration directories. These procedures automatically create directories; these directories should be based on the user's home directory to prevent conflicts with other users. You must logon as the user to perform these procedures.

To Configure User Bookmarks

1.	Select Go To Bookmarks from the Bookmarks pull-down menu. The Bookmarks window appears.

2.	Select Save As from the File pull-down menu.

3.	Specify a filename and user-unique directory; for example, X:\users\username\Netscape \bookmark.htm.

4.	Click on OK.

To Configure General Preferences

1.	Select General Preferences from the Options pull-down menu. The General Preferences window appears.

2.	Click on the Apps tab at the top of the window. The Apps Preferences page appears.

3.	Change the Temporary Directory to a user-unique temporary directory; for example, X:\users\username\temp.

4.	Click on OK.

To Configure Mail and News Preferences

1.	Select Mail and News Preferences from the Options pull-down menu. The Mail and News Preferences window appears.

2.	Click on the Servers tab at the top of the window. The Servers page appears.

3.	Change the Mail Directory to the user's Netscape Mail directory; for example, X:\users\username\Netscape\Mail.

4.	Change the News RC Directory to the user's News directory; for example, X:\users\username \Netscape\News.

5.	Click on OK.

To Configure Network Preferences

1.	Select Network Preferences from the Options pull-down menu.

2.	Click on the Cache tab at the top of the window.

3.	Change the Cache Directory to the user's Netscape cache directory; for example, X:\users\username\Netscape\Cache.

4.	Click on OK.

The following changes to the user preferences are optional.

To Configure Server Preferences

1.	Select Mail and News Preferences from the Options pull-down menu. The Mail and News Preferences window appears.

2.	Click on the Servers tab at the top of the window. The Servers page appears.

3.	Change the Outgoing Mail Server, Incoming Mail Server, Pop User Name, and News (NNTP) Server fields as desired.

4.	Click on OK.

To Configure User Information

1.	Select Mail and News Preferences from the Options pull-down menu. The Mail and News Preferences window appears.

2.	Click on the Identity tab at the top of the window. The Identity page appears.

3.	Update the user information fields.

4.	Click on OK.

When these changes are done, exit Netscape Navigator. The next time Navigator is started, the directory tree where the user information is stored is created by the program and Navigator is configured to the user's specifications.

Troubleshooting

Why do I keep getting the following error: Netscape cannot connect to host?

This error usually results from a broken Internet connection, but it can also be caused by excessive network traffic. Make sure TCP/IP support is configured and operating properly. Also make sure that you are connected to the Internet and the connection is functioning properly. To check the Internet connection, ping the Netscape Web server at http://www.netscape.com


Web Servers Supported by WinFrame

The following Web Server is supported by WinFrame:

Firewall	Version
Netscape Fast Track Server	2.0 Beta for Windows NT


Netscape Fast Track Server Version 2.0 Beta for Windows NT

Overview

Netscape Fast Track Server 2.0 Beta is an entry level Web server that lets users create and manage a Web site. It is a complete solution for creating and managing Web sites on the Internet or an Intranet.

Netscape Fast Track Server 2.0 Beta includes a copy of the Netscape Navigator Gold 2.0 Web Browser. The Navigator Gold Web Browser is used to access and control the server. All functions of the Fast Track Server are controlled through the Web Browser.

Software Requirements

Netscape Fast Track Server 2.0 Beta for Windows NT

WinFrame Version 1.6 or higher with TCP/IP support installed

Installation

To install the Netscape Fast Track Server on a WinFrame server:

1.	Logon as an administrator at the WinFrame system console.

2.	Start a command prompt and type change user /install. This places the user session in install mode.

3.	Exit command prompt.

4.	Install Netscape Fast Track Server 2.0 Beta as described in the Netscape Installation Guide.

5.	After Netscape Fast Track Server is installed, start a command prompt and type change user /execute. This changes the user session back to execute mode.

6.	Exit command prompt.

Configuration

To use the Netscape Fast Track 2.0 Beta on a WinFrame server, TCP/IP support must be installed. To install WinFrame TCP/IP support:

1.	Start Control Panel in the Main program group.

2.	Double-click on Network in Control Panel. The Network Settings dialog appears.

3.	Select Add Software.

4.	Choose TCP/IP Protocol and Related Components from the pull-down list and select OK. Enter the values for your configuration and select OK.

5.	Restart WinFrame to start TCP/IP support.

Troubleshooting

Why do I keep getting the error: Netscape cannot connect to host?

Make sure WinFrame TCP/IP support is properly configured. Use the Administer Netscape Servers tool in the Netscape Gold program group to verify that Fast Track Web Server is running.


Remote Node Connectivity Products

Overview

Remote LAN node products allow a remote PC to dial in to a computer on the local network running a remote node product, also called the remote node server, and appear as a LAN workstation. After the remote node connection is established, the remote computer can access network resources on a WinFrame server or use the WinFrame client to establish a remote node + remote control user session. WinFrame/Enterprise contains a native remote node solution called WinFrame Remote Access Service (RAS) that is compatible with many third-party remote node solutions.

Remote node and remote control are two distinct, but compatible, methods of remotely accessing a WinFrame server. A remote node session accesses the WinFrame server through a network emulation layer that causes the remote connection to emulate a LAN connection. A remote control session uses the WinFrame to execute applications on the WinFrame server and uses the client PC for presentation services (display, keyboard, and mouse data) only. Remote users can simultaneously run applications using remote node and applications using remote control.

With WinFrame remote node, users become true network nodes and gain total network transparency. Remote node also allows remote users to work detached from the network and connect to it only when required.

WinFrame remote control support provides remote users with the high performance they need to run applications outside the network. Remote control requires users to work connected to the WinFrame server. This mode is particularly well-suited for applications that are designed to run over the network. The WinFrame Client also supports Dial-In remote control to the WinFrame server.

Some typical remote node configurations are shown below.

Remote Connection Bandwidth Constraints

Remote users such as mobile workers, telecommuters, and branch office personnel work outside the boundaries of a high-speed LAN. They connect to the LAN using communications media such as standard telephone lines, WAN links (T1, T3, 56KB, or X.25), broadband connections (ISDN, Frame Relay, or ATM), or the Internet.

Remote connections are orders of magnitude slower than traditional high-speed Local Area Networks. The most commonly used links are phone lines. The following table shows the dramatic constraints on bandwidth (kilobytes per second) and data round trip times (latency) for remote users using various connection methods:

Connection	Bandwidth	Latency
Modem	2400-28800bps	0.2-2 seconds
Leased Line	9600-56000bps	0.005-0.1 second
LAN	4000-100000Kbps	0.0005-0.001 second
Application Considerations

Most applications can be placed into one of two categories:

Bandwidth-demanding applications. These applications are designed to run over high-speed network connections. Most existing applications fall into this category.

Bandwidth-efficient applications. These applications are designed to run over low-speed connections. Many new applications fall into this category.

Bandwidth-Demanding Applications Need Remote Node + Remote Control

Bandwidth-demanding applications include shared database applications, two-tier client/server database applications, and many other legacy applications for DOS or Windows.

These applications have been designed to run over high-speed networks and typically require large amounts of data to travel between the client PC and the database or file server. To illustrate why bandwidth-demanding applications need  remote control, consider two-tier client/server applications, which are the most bandwidth-efficient applications in this category. Two-tier client/server applications require much less bandwidth than shared database or legacy applications, because they are designed to send a compact request to a database server, which will send only results to the client PC. However, a typical two-tier client/server application, such as a customer tracking database, might need to exchange 50 criteria before transferring the required data to the client.

The table below shows typical response times encountered performing a request that exchanges 50 criteria over three different types of network connections:

Transport	Bandwidth	Latency	Minimum Response Time
LAN	10Mbps	0.0005 second	0.025 second
Leased Line	56Kbps	0.1 second	5 seconds
Modem	14.4Kbps	0.4 second	20 seconds
The example below illustrates the performance problem of a two-tier client/server application running over a low speed remote node connection. In this case, the client portion of the application runs on the remote PC and the server portion runs on a database server on the network. To execute a transaction, the application would exchange 50 criteria between the remote PC and the database server before transferring the required data to the client. These exchanges are performed over a 14.4Kbps modem connection. The resulting response time for the user is 20 seconds.

The example below illustrates the performance of a two-tier client/server application running over a low speed connection using combined remote node and remote control modes. In this case, the client portion of the application runs on the WinFrame server connected to the LAN, and the server portion runs on the database server. To execute a transaction, the application would exchange 50 criteria between the WinFrame server and the database server before transferring the required results to the client. In this case, the criteria are exchanged over a 10Mbps LAN connection instead of a 14.4Kbps modem connection. The 10Mbps LAN connection is nearly 700 times faster than the 14.4Kbps modem connection. In this scenario, the latencies for the transmission of the user interface results to the client PC using the Citrix ICA 3.0 protocol is negligible and the resulting response time for the user is in the range of 0.025 seconds.

Using remote node and remote control together with Citrix WinFrame and the WinFrame client gives the user the best of both worlds - the transparent network access of remote node, and the high performance of remote control.

Bandwidth-Efficient Applications Need Only Remote Node

Bandwidth-efficient applications include three-tier client/server applications, replicated database applications, and workgroup and productivity applications.

The most efficient applications within this group are three-tier client/server applications. These applications are composed of three components:

The client that manages the application user interface and runs on the remote PC.

The agent that performs the business logic of the applications and runs on a server connected to the network.

The database server that stores the data, executes SQL database commands, and runs on a server connected to the LAN.

With this architecture, designed to run over low speed network connections, only small compact requests travel between the client PC and the agent server. Large SQL requests are performed on the network between the agent and the database server.

Let's take again the example of a three-tier client/server application, such as a customer tracking database, which might exchange 50 criteria between the agent and the database server and then send the required results to the client. In this scenario, the transmission of the user interface results to the client is negligible, and the resulting response time for the user is in the range of 0.025 seconds.


Remote NetWare 4.x Administration Using NETADMIN and NWADMIN Over a RAS Connection

Overview

WinFrame does not currently support the NetWare NETADMIN and NWADMIN utilities. However, these utilities can be run from a network workstation running DOS or Windows 3.x or a remote workstation connected to WinFrame RAS using the Dial-Up Manager supplied with WinFrame DOS and WinFrame Win16 clients or a third-party RAS package. This allows administration of NetWare 4.x servers from a remote DOS or Windows workstation.

You should not attempt to run the NETADMIN and NWADMIN utilities from the NetWare 4.x server directly. Although this works over a RAS connection, the application runs very slowly because the executable files have to be accessed over the RAS connection. To avoid a significant performance hit, it is strongly recommended that you copy these utilities and their supporting files to the remote workstation. This prevents the NETADMIN and NWADMIN utilities from loading over the RAS connection. Only data packets are transferred over the RAS connection instead of data and program files, providing a great increase in performance.

The following files must be copied to the remote workstation in order to run the NETADMIN and NWADMIN utilities:

\PUBLIC\NWADMIN.EXE

\PUBLIC\NWADMIN.INI

\PUBLIC\NWC0COR.DLL

\PUBLIC\TCLASS31.DLL

\PUBLIC\OWL31.DLL

\PUBLIC\BC30RTL.DLL

\PUBLIC\NWBRWS.DLL

\PUBLIC\NLS\ENGLISH\HCSSRES.DLL

\PUBLIC\NLS\ENGLISH\NWADMINR.DLL

\PUBLIC\NLS\ENGLISH\NWPARR.DLL

\PUBLIC\NLS\ENGLISH\NWTOOLS.DLL

\PUBLIC\NLS\ENGLISH\PBTRVRES.DLL

\PUBLIC\NLS\ENGLISH\WBROLLRS.DLL

\PUBLIC\NLS\ENGLISH\WBTRVRES.DLL

\PUBLIC\NWC0DS.DLL

\PUBLIC\NWCNTRLS.DLL

\PUBLIC\NWRCON.DLL

\PUBLIC\NWMOD00.DLL

\PUBLIC\NWMOD01.DLL

\PUBLIC\NWVCTRLS.DLL

\PUBLIC\NWVIS00.DLL

\PUBLIC\NWVIS01.DLL

\PUBLIC\NWVIS02.DLL

\PUBLIC\NWVPS.DLL

\PUBLIC\NSAPI.DLL

\PUBLIC\NWVPT.DLL

\PUBLIC\NWVQUEUE.DLL

\PUBLIC\MUSCROLL.DLL

\PUBLIC\NLS\ENGLISH\NWADMIN.HLP

\PUBLIC\RCONSOLE.EXE

\PUBLIC\NLS\ENGLISH\RCONSOLE.HEP

\PUBLIC\NLS\ENGLISH\RCONSOLE.MSG

\PUBLIC\NLS\ENGLISH\NETADMIN.HEP

\PUBLIC\NLS\ENGLISH\NETADMIN.MSG

\PUBLIC\NETADMIN.EXE

\PUBLIC\NLS\ENGLISH\TEXTUTIL.HEP

\PUBLIC\NLS\ENGLISH\TEXTUTIL.MSG

\PUBLIC\CMPQ_AIO.OVL

\PUBLIC\CMPQ_RUN.OVL

\PUBLIC\DOSV_RUN.OVL

\PUBLIC\IBM_AIO.OVL

\PUBLIC\IBM_RUN.OVL

\PUBLIC\_AIO.OVL

\PUBLIC\_RUN.OVL

\PUBLIC\MENU.OVL

\PUBLIC\IBM$ISW.OVL

\PUBLIC\TEXTUTIL.IDX

\PUBLIC\NLS\ENGLISH\NWDSBRWS.MSG

\PUBLIC\NLS\1252_UNI.001

\PUBLIC\NLS\437_UNI.001

\PUBLIC\NLS\UNI_1252.001

\PUBLIC\NLS\850_UNI.001

\PUBLIC\NLS\UNI_437.001

\PUBLIC\NLS\UNI_850.001

\PUBLIC\NLS\UNI_COL.001

\PUBLIC\NLS\UNI_MON.001

\PUBLI\NLS\ENGLISH\SCHEMA.XLT

There are 57 files totaling about 6.3MB of data. Use the NWSETUP.BAT batch file, located in the %systemroot%\SYSTEM32 directory, to transfer the files to your workstation. To use the NWSETUP.BAT batch file:

1.	Connect the workstation to the WinFrame RAS server using the Dial-Up Manager or other RAS software.

2.	Login to the NetWare 4.x server over the RAS connection and map a drive letter to the NetWare 4.x server SYS volume containing the NetWare \PUBLIC directory.

3.	Type nwsetup dest: src:, where dest is the destination drive on the workstation to copy the NETADMIN and NWADMIN files to and src is the drive letter mapped in Step 2.

The NWSETUP.BAT file copies the files listed above from the NetWare 4.x server \PUBLIC directory to a \NWADMIN directory on the remote workstation's hard disk. For faster copying over a remote connection, you may want to use a file compression utility such as PKZIP to compress the above 57 files into one compressed file. These files compress to about 2MB with PKZIP, significantly reducing the transfer time.

After the files are transferred to the DOS or Windows workstation, you can run the NETADMIN or NWADMIN utilities over the RAS connection in the usual manner.


Third-Party Remote LAN Node Connectivity Solutions Supported by WinFrame

Vendor	Model	Version	Notes
3Com	AccessBuilder	2.01
Attachmate	Remote LAN Node	2.0x
Digi International	LANAserver
Novell	NetWare Connect	2.01
Shiva	LAN Rover Family	3.0	Download latest Shiva updates from Shiva BBS (617) 273-0023.
Stallion Technologies	LantraServer


3Com AccessBuilder 2000

The 3Com AccessBuilder 2000 is a remote node solution that allows remote client systems to access a network via modem. The AccessBuilder 2000 series family consists of RISC-based multi-protocol, multiport networking devices. These offer a simple and cost-effective solution for remote users to access the corporate network for data transmission or retrieval using the Public Switched Telephone Network (PSTN). A system consists of a hardware unit and client software used to establish an asynchronous modem connection to a network. Protocols supported are IPX, TCP/IP, and NetBEUI.

Once the modem connection to the AccessBuilder has been established, the remote user can run a WinFrame client to start a remote control session on the WinFrame  server. Running a remote control session on the WinFrame server in this manner allows fast access to the network, quick application response, fast processing, and total access to the network over a remote connection. In addition, the remote user has the ability to simultaneously run his/her own point-to-point (PPP) network applications locally while still running a remote control session.

Requirements

Software Requirements

WinFrame, Version 1.5 or higher

WinFrame Client, Version 1.5 or higher

3Com AccessBuilder, Version 2.0 or higher

Hardware Requirements

A WinFrame server

A 3Com AccessBuilder 2000 with at least one modem

A client machine with a modem able to dial in to the AccessBuilder

A network linking the WinFrame host and the 3Com AccessBuilder

Connectivity Requirements Usage Chart

Below is a chart listing the connectivity options available for using the 3Com AccessBuilder in conjunction with a WinFrame client. The listings across the top row indicate the dial-in options available to make a remote node connection. The listings in the left hand column identify the WinFrame client options used to make a connection to a WinFrame server.

Note  A dial-up connection to the 3Com AccessBuilder must first be established between the client machine and the 3Com AccessBuilder. The WinFrame client can then be used to connect to a WinFrame server over the dial-up connection for a remote node + remote control session.

Dial-up Client Software for Network Connections Through 3Com AccessBuilder

	DOS Client	Win16 Remote Application Manager	Win32 Remote Application Manager
3Com Dial in Client for DOS	Yes	Yes	No
3Com Dial in Client for Windows 3.1	No	Yes	No
WinFrame DOS Dial-up Manager	Yes	Yes	No
WinFrame Win16 Dial-up Manager	No	Yes	No
Windows 95 Dial-up Networking	No	No	Yes
WinFrame RAS	No	No	Yes
System Integration

The following steps describe how to integrate the 3Com AccessBuilder with the WinFrame server. For simplicity, IPX connections are used. For help on IP with IPX, or IP alone, please consult the appropriate documentation for the specific setup you want to configure.

To Integrate 3Com AccessBuilder with WinFrame

1.	WinFrame Server

Ensure that the WinFrame server is up and running. Use the WinStation Configuration Utility in the Administrative Tools Group to determine that IPX WinStations are available on the WinFrame server.

2.	3Com AccessBuilder Host

Follow the normal installation procedure as defined in the documentation provided with AccessBuilder. The 3Com administration software must be installed on a Windows 3.1x client. This machine must reside on the same network as AccessBuilder.

When the software is installed and AccessBuilder is connected to the network, configure AccessBuilder. This includes creating users with network access privileges.

3.	Dial-In clients (choose one of the following to be installed on the remote user's machine)

3Com AccessBuilder Dial-up Client for DOS

Follow the installation procedure defined in the documentation provided with the AccessBuilder Remote Client.

Run ABSETUP.BAT to configure your dial-up client. You will need to configure modem type, COM port, baud rate, login user name, phone number to dial, and other information. When you are done entering the appropriate information, run ABLOGIN.BAT. Your remote client will now initialize the modem and dial into the AccessBuilder 2000.

After you have successfully logged in, return to a DOS prompt. Execute a NetWare command; for example, slist, to verify that you have a valid network connection.

Hang up the connection and go to Step 4.

3Com AccessBuilder Dial-Up Client for Windows

Follow the installation procedure defined in the documentation provided with the AccessBuilder Remote Client and then proceed to Step 4.

WinFrame DOS Client Dial-Up Manager

Install the WinFrame Client for DOS as described in Chapter 3 of the WinFrame Client User's Guide. Install Dial-Up Manager. Go to Step 4.

WinFrame Win16 Client Dial-Up Manager

Install the WinFrame Win16 Client as described in Chapter 6 of the WinFrame Client User's Guide. Install Dial-Up Manager. Go to Step 4.

Windows 95 Dial-up Networking

Under the Windows 95 Control Panel/Add-Remove Programs, choose the Windows set up, double-click Communications, and select Dial-up Networking.

Under Control Panel/network/configuration/protocol, choose Add and select protocol/Microsoft. Select TCP/IP and/or IPX-SPX. Go to Step 4.

WinFrame RAS Server

From the console, select Control Panel, Network, and choose add software. Select Remote Access Service. Install as described in the WinFrame documentation. Go to Step 4.

4.	For WinFrame clients, choose one of the following to be installed on the remote user's client system:

If the client system is a DOS system, install the WinFrame client for DOS.

If the client system is a Windows 3.1x or Windows for Workgroups system, install the WinFrame Win16 client.

If the client system is a Windows 95 or Windows NT system, install the WinFrame Win32 client.

Refer to the WinFrame client documentation for installation instructions. When installing the DOS or Win16 WinFrame client, install only the Remote Application Manager if you are using a third-party PPP dial-in client. The third-party software supplies the remote node networking connectivity. Only install the Dial-Up Manager if you intend to use the WinFrame client Dial-Up Manager for remote node connectivity.

Usage

1.	Ensure that an appropriate WinFrame WinStation is configured and available (for example, an IPX WinStation).

2.	From the client system, establish a remote node connection to the network by dialing into the AccessBuilder with one of the dial-in clients as outlined in Step 3 of the installation section.

3.	Execute the appropriate WinFrame client (use the connectivity chart above to select the correct WinFrame client).

Notes  For optimum performance, run the WinFrame client software from a local drive on the remote client system.

The 3Com Windows client will not work with the NETX shell. For IPX connectivity, VLMs must be used.

When a third-party PPP client connects to a 3Com AccessBuilder, the remote client can act as a router instead of a bridge.


Attachmate RLN Version 2.0x

Remote LAN Node server Version 2.0x from Attachmate is a remote node solution that allows remote client systems to access a network via modem. Once a connection to the remote network has been established, the client user can run the WinFrame Remote Application Manager to start a remote control session on the WinFrame server. This allows the user to access the network and run applications on the WinFrame server. This gives Attachmate RLN users faster access to the network, quicker application response and processing, and total access to the network over a remote connection.

Requirements

Hardware Requirements

Attachmate RLN Server: see the Attachmate RLN Server Administrator's Guide for hardware requirements.

Client system: 386 minimum with 4-8MB RAM, hard disk, and modem

Software Requirements

Attachmate RLN server Version 2.0x

Attachmate RLN Client Maker Version 2.0x

Attachmate RLN Manager Version 2.0x

DOS/Windows for client system

WinFrame Version 1.6 or higher

Installation

Attachmate RLN Server Installation

To install the Attachmate RLN Server, follow the steps in the Attachmate RLN Server Administrator's Guide. Chapter 3 covers hardware requirements of the Attachmate RLN Server and how to install it. Chapter 4 covers the installation of the Attachmate RLN Server software itself. The Attachmate RLN Server can be set up and configured for IPX/SPX and TCP/IP network protocols. Set up the server with the network protocols that are used on your network.

Attachmate RLN Client Installation on the Client System

The client system should have a modem connected and DOS installed. If the client will be using Windows, Windows 3.1 or Windows for Workgroups 3.11 should be installed. A DOS system must have at least 4MB of RAM; a Windows system must have at least 8MB of RAM. Install the Attachmate RLN client according to the Attachmate RLN documentation.

Note  If you are using Windows 95 or Windows NT 3.5, check with the Attachmate RLN documentation on connectivity. The standard Attachmate RLN client software will not work on Windows NT 3.5. While it can be made to work under Windows 95, it is not recommended.

Installation of WinFrame Client Remote Application Manager on Client System

If the client is a DOS system, install the WinFrame Client for DOS. If the system is running Windows 3.1 or Windows for Workgroups 3.11, install the Win16 WinFrame client. If you are using Windows 95 or Windows NT, install the Win32 WinFrame client. See the WinFrame client documentation for installation instructions for each of these setups. When installing the DOS or Win16 WinFrame client, install the Remote Application Manager only. Do not install the Dial-Up Manager or any of the Dial-Up Manager network support. The Attachmate RLN client will supply all the remote node networking connectivity.

Configuration

The Attachmate RLN server should be set up and running on the network. The Attachmate RLN server should have at least one dial-in modem configured for remote node access and should have either IPX/SPX and/or TCP/IP networking protocols installed, depending on your network. This provides remote node access to the network for remote clients. The WinFrame server should be set up and configured on the same network or on a network accessible from the Attachmate RLN server. The WinFrame server should have IPX and/or TCP/IP WinStations configured for remote control sessions. If the WinFrame server will use IPX, it should have the IPX protocol and the NetWare Gateway Service installed. If the WinFrame server will use TCP/IP, the TCP/IP protocol should be installed and configured for your network.

The client should have DOS and (if desired) Windows installed. The Attachmate RLN client software should be installed on the client system along with the desired WinFrame client.

Usage

Before running Windows, load the Attachmate RLN client software and establish a remote node connection. A sample set of commands follows:

RLN -c2
RLNUSER
LSL
PDETHER
IPXODI
NETX

The -c2 parameter on the RLN command specifies the COM port used (COM2 in this example). The RLNUSER program sets up the modem on the client, creates a dial-out entry for the Attachmate RLN server, and dials out and connects to the remote network. Once the remote node connection is successfully established, exit the RLNUSER program. If there is a preconfigured Attachmate RLN server entry, you can auto load and dial the server from the command line by typing RLNUSER dcaservername, where dcaservername is the name of the preconfigured entry for dial out in the RLNUSER program.

After the RLN connection is established, the standard NetWare and TCP/IP stacks can be loaded using the special Attachmate RLN ODI driver, PDETHER. This example loads NETX, but VLMs can be loaded instead if your network uses 4.x NetWare file servers. When all of these are loaded, the client system is connected to the remote network and has standard network access. All of these commands can be added to the AUTOEXEC.BAT file of the client system so that the connection can be automatically dialed and connected, and the network will be loaded when the client system is booted, or placed in a batch file.

At this point, the remote user can run the WinFrame client and connect to any WinFrame server on the remote network.

Troubleshooting

The RLNUSER program cannot access the modem. It gives the error message, Error 1011: DSR and CTS did not go high. What is going on?

This is caused by not using the -c<n> parameter on the RLN TSR when you load it. If your modem is connected to COM1, it will work because this is the default setting. If your modem is on any other COM port, you must supply the -c<n> parameter in order to tell the Attachmate RLN client which COM port the modem is connected to; for example, RLN -c2 would load the TSR to use a modem on COM2.


Digi International LANAserver

Overview

The Digi International LANAserver allows remote users to access a LAN as if they were directly attached to it, using inexpensive voice-grade telephone circuits and asynchronous modems.

Requirements

Hardware Requirements

A remote WinFrame server with enough free disk space after WinFrame has been installed for the files needed by the LANAclient software

Asynchronous modems, one attached to the remote WinFrame server and one attached to the LANAserver

Software Requirements

WinFrame Version 1.6 or higher with Remote Access Service (RAS) installed

LANAclient software

System Integration

1.	Connect the Digi LANAserver to the network you want to remotely access by following the installation procedure in the LANAserver Guide.

2.	Connect an asynchronous modem to the Digi LANAserver you want to remotely access by following the installation procedure in the LANAserver Guide.

3.	Connect an asynchronous modem to the WinFrame server you will use to remotely access the network-connected LANAserver by following the installation procedure in the LANAserver Guide.

4.	Install the LANAclient software by following the installation procedure in the LANAserver Guide.

5.	Prior to installing the Remote Access Service, verify that the WinFrame server is up and running.

6.	Install the Remote Access Service on the WinFrame server.

A.	Have the WinFrame CD-ROM available.

B.	Configure the Remote Access Service to be compatible with LANAserver by following the installation procedure in the LANAserver Guide.

Notes  See application note AN-16, August 29, 1995 (Windows NT 3.5 RAS Dial-in with LANAserver) in the LANAserver Guide.

The only protocol currently supported for use with the LANAserver using a RAS connection is TCP/IP.

LANAserver does not currently support NetBEUI or IPX. Many network resources may not be available. For example, when running the WinFrame command net view (from the remote WinFrame server) to view resources on a WinFrame server running NetBEUI or IPX, those IPX and NetBEUI servers will not be available.

Usage

Follow the usage directions in the LANAserver Guide.

Troubleshooting

See "Troubleshooting" in the LANAserver Guide Index.


Novell NetWare Connect Version 2.0

NetWare Connect 2.0 is a software add-on component to a Novell NetWare 3.x or 4.x file server that provides access to a Novell network via asynchronous connections, utilizing an intelligent multiport serial controller in the file server.

NetWare Connect provides two services that can be used in conjunction with WinFrame. When connected using DOSDIAL for DOS or Remote Client Dialer for Windows, your computer appears as a locally connected workstation on the network. When connected via a NASI WinStation, your computer functions as if it had dialed into a modem directly connected to the WinFrame host.

NASI Connection Services (NCS)

NASI Connection Service (NCS) allows remote users to dial into a LAN and local users to dial out from one of the pooled communication ports. A WinFrame NASI WinStation is configured to connect to a NetWare Connect port for asynchronous dial-in access. When a user dials into the NetWare Connect server with the WinFrame client, a NetWare Connect login authentication is required, and then a list of services (WinFrame hosts that have a WinStation attached to a port on the NetWare Connect server) is presented. When a WinFrame host is selected, the user is logged in, and it appears as if the user dialed into a modem that was attached directly to the WinFrame host. The only exception is the NetWare Connect login and the service selector. The advanced Independent Computing Architecture (ICA 3.0) protocol used by the WinFrame clients improves performance because it sends only compressed screen updates and mouse and keyboard events over the NASI connection.

A NASI WinStation is required for each simultaneous NASI connection to the WinFrame server. Use WinStation configuration to create and maintain NASI WinStations.

Point-To-Point Protocol Remote Node Services (PPPRNS)

Point-To-Point Protocol Remote Node Service (PPPRNS) is a new feature implemented in NetWare Connect 2.0, which gives remote node access to the workstations dialing in. Remote node is the ability to dial in to a remote network and act as a network workstation. You can access network drives on servers on the LAN, access printers on the LAN, send e-mail, etc. The remote PC acts as if it is on the host network. The communication taking place on the LAN is translated on the NetWare Connect server and sent over the modem to the remote workstation.

In contrast, NetWare Connect 1.0 used the Novell NetWare Remote Node (NRN) communication protocol to allow remote node attachment to the LAN through the NetWare Connect 1.0 server. NetWare Connect 1.0's NRN was a Novell proprietary protocol. Users were forced to use only the Novell client software, and only the IPX transport was available. In creating and using PPPRNS in NetWare Connect 2.0, Novell used an industry standard protocol, PPP, and an industry standard PPP Link Control Protocol (LCP) extension, IPXCP (Internetwork Packet Exchange Control Protocol). With NetWare Connect 2.0, virtually any third-party TCP/IP with a PPP stack can connect to the NetWare Connect server. The remote PC, in effect, becomes another node on the LAN and has access to all network resources.

In comparing the two services/protocols provided by NetWare Connect 2.0, NCS is the easiest to implement of the two, but PPPRNS is the most versatile, providing direct IPX and TCP/IP protocol access to the LAN. When using PPPRNS, not only can WinFrame hosts be accessed, but also any NetWare or IPX servers and any TCP/IP resources, depending on which transport is installed.

The Novell NetWare Connect client software and information on each implementation supporting the PPPRNS service are listed in the "Connection Types Supported" table. NetWare Connect provides two client components for DOS, Windows, and Windows for Workgroups that support IPX and TCP/IP over PPPRNS: DOSDIAL for DOS, and Remote Client Dialer for Windows and Windows for Workgroups.

Requirements

Network

NetWare server with NetWare Connect Version 2.0 installed and operational

Modems installed on the NetWare Connect server configured for dial-in service

Citrix WinFrame host connected to a NetWare network

Remote Workstation

Novell NetWare Connect client software loaded and operational (see Connection Types Supported below)

Modem supported by the transport being used on the remote workstation

High-speed serial port (16550 or equivalent) or intelligent serial port board

WinFrame client software for the remote workstation's environment

Connection Types Supported

Following is a list of the different WinFrame client connections supported with NetWare Connect 2.0, the components needed, and the protocol used to communicate with the NetWare Connect server.

1.	DOS

Novell NetWare Connect DOSDIAL, WinFrame client for DOS (PPPRNS Protocol)

WinFrame client for DOS (NCS Protocol)

2.	Windows 16-Bit

Novell NetWare Remote Client Dialer for Windows, WinFrame Win16 or DOS client (PPPRNS Protocol)

Installation

NetWare Server

Install NetWare Connect 2.0 on the NetWare server. Please carefully read any Readme files or notes supplied with NetWare Connect 2.0.

Notes  Under NetWare Connect Setup for PPPRNS, the NetWare Connect PPP ports and the clients should have their own IP network (for example, if the network card installed in the NetWare Connect server has an IP address of 1.1.1.1, the PPP ports would be 1.1.2.x, and the IP address pool would fall under the 1.1.2.x network).

Under NetWare Connect Setup for PPPRNS, the IPX network address should be a (network-wide) unique address. In other words, if the network card installed in the NetWare Connect server has an IPX address of 0000DADA, the PPPRNS IPX address would be 0000DADB.

IP and IPX addresses mentioned above are examples. Usage and assignment is specific to individual sites. Sample NetWare server AUTOEXEC.NCF and NetWare Connect NWCSTART.NCF files are included later in this chapter.

You need to configure sufficient WinStations to support both local LAN users and remote NetWare Connect users.

Sample Configuration 1

Workstation	DOS
Transport	TCP/IP and/or IPX
Components	Novell NetWare Connect DOSDIAL, WinFrame Client for DOS
Connection	PPPRNS
Verify that WinStations (TCP/IP or IPX) are configured on the WinFrame server for the network protocol in use. Make sure you have enough WinStations configured to support both local LAN connections and remote NetWare Connect connections.

To Install a WinFrame Remote Workstation

1.	Install both the NetWare Connect DOSDIAL and WinFrame Client for DOS software on the remote workstation. After installation is complete, verify that the system boots properly.

2.	Start the NetWare Connect DOSDIAL client to establish an IPX and/or IP connection to the NetWare Connect 2.0 host on the remote network. After you exit NetWare Connect DOSDIAL, change to the network drive and verify that a remote network connection has been established.

Note  Do not proceed until this step is completed successfully.

3.	Start the WinFrame client.

4.	Create a remote application. If you select IPX as the transport, you may or may not be able to see server names in the WinFrame server list, depending on whether or not you have loaded a Novell DOS redirector, NETX.EXE, or VLMs. If no redirector has been installed, you must enter the MAC address of the WinFrame server you wish to connect to (for example, 00DA004BC382). To identify the MAC address of the WinFrame server, click on the Windows NT Diagnostics icon and select Network from the WinFrame server console under Administrative Tools.

5.	If you configured PPPRNS to use TCP/IP on the NetWare Connect 2.0 server and also configured it during client setup, choose Novell TCP/IP as the transport.

6.	If you have a functioning DNS system or have a correct and valid HOSTS file, enter the name of the WinFrame host you wish to connect to. If no name resolution is available, either add the name and IP address to your local HOSTS file, or enter the IP address of the WinFrame host you wish to connect to in the Properties dialog box (for example, 128.128.1.2). The HOSTS file is under the TCP directory, in the directory in which the TCP/IP transport is installed.

Sample Configuration 2

Workstation	DOS
Transport	Serial Port (NCS)
Components	WinFrame client for DOS and WinFrame client supported modem (16550 UART recommended)
Connection	Novell NCS
Use WinStation configuration to set up NASI WinStations on your WinFrame server.

To Install the WinFrame Remote Workstation

1.	Install the WinFrame client for DOS but do not choose any networking components.

2.	Change to the directory the client is installed in and run WFCLIENT.EXE.

3.	When installed, there are no entries in the server list. Create an entry by clicking on Entry, New, and filling out the fields on the Properties screen.

4.	Assign a name to the entry, select Serial for the transport (unless you are using one of the supported intelligent serial boards), and click on Settings.

5.	Fill in this form to match your configuration, including baud rate, port, and modem type.

6.	Click OK to exit the device setting and return to the Properties screen.

7.	Enter a telephone number and fill in the user information, if desired.

Note  If no user information is entered, it will be requested when the attachment to WinFrame is made.

8.	Click on OK to save the entry.

9.	To dial the WinFrame host, either double-click the name or highlight the name by single-clicking on it and then selecting Entry, Connect.

10.	The screen will clear and a message saying it is dialing will appear. Once the connection to the NetWare Connect server is made, it will ask for a login. Enter the username and password when requested.

11.	Once the authentication is passed, a service selector will appear.

12.	Select the WinFrame host to connect to by typing its number and pressing ENTER. From this point on, the connection will function as a standard WinFrame asynchronous connection. Refer to the WinFrame Client User Guide for further information.

Troubleshooting

To troubleshoot client problems, first isolate which client software is set up incorrectly. For example, load only the NetWare Connect client software and attempt to access the network before starting the WinFrame client. If you cannot access the network, troubleshoot the NetWare Connect 2.0 server and client configuration.

Note  Listed below are samples of the remote workstation and server configuration files that NetWare Connect 2.0 uses. They will differ depending on your hardware and software configurations. They are provided as examples only.

A sample server AUTOEXEC.NCF file, located in the SYS:SYSTEM directory:

file server name 312NWC
IPX internal net 1234baba
load conlog
load SMC8000 port=300 frame=ETHERNET_802.3 name=IPXNET
bind IPX to IPXNET net=A
load SMC8000 port=300 name=IPNET frame=ETHERNET_II
load tcpip forward=yes
bind IP to IPNET address=128.128.1.220 mask=255.255.255.0
load AIODGXI port=110 mem=D0000  name=PCXI8
nwcstart
load nwccon
load monitor
load remote ""
load rspx

A sample server NWCSTART.NCF file, located in the SYS:SYSTEM directory:

;
; These are support modules used by NetWare Connect services.
;
load NWCSS
; Load BSPXCOM for NetWare Connect Service Manager
load BSPXCOM
;
; NASI Connection Service
;
load sys:\system\ncs.nlm
;
; PPP Remote Node Service
;
load ipxstack
load ipxrtr
load PPPRNS

A sample remote workstation STARTNET.BAT file, located in the NetWare Connect client directory:

c:\nwcnet\bin\yesno.exe "Do you want to load the remote client software? (y/n) "
if errorlevel 1 go to LoadNet
go to LoadRem
:LoadNet
echo off
lh C:\NWCLIENT\lsl.com /C=C:\NWCLIENT\net.cfg
lh C:\NWCLIENT\nesl.com
lh C:\NWCLIENT\ncomx.com
lh C:\NWCLIENT\nwremote.com
REM Load IPX
REM @ LH C:\NWCLIENT\IPXODI.COM
@ lh c:\nwclient\ipxodi.com
REM Load TCPIP
REM @ C:\NWCNET\BIN\TCPIP.EXE
@ c:\nwcnet\bin\tcpip.exe
C:\NWCLIENT\vlm.exe /C=C:\NWCLIENT\net.cfg
@ SET NWLANGUAGE=ENGLISH
echo on
go to Exit
:LoadRem
REM **DO NOT DELETE**
:Exit

A sample remote workstation NET.CFG file, located in the NetWare Connect client directory:

Link Support
   MemPool 6192
   Buffers 10 1580
Link Driver NCOMX
   Port 3f8
   Int 4
   Modem Name
   Frame ETHERNET_802.3
Protocol TCPIP
   PATH SCRIPT C:\NWCNET\SCRIPT
   PATH PROFILE C:\NWCNET\PROFILE
   PATH LWP_CFG C:\NWCNET\HSTACC
   PATH TCP_CFG C:\NWCNET\TCP
NetWare DOS Requester
   FIRST NETWORK DRIVE = F
   NETWARE PROTOCOL = NDS BIND PNW

The sample lines below are added to the AUTOEXEC.BAT file in your root directory:

PATH C:\NWCLIENT;%PATH%
PATH C:\NWCNET\BIN;%PATH%
@CALL C:\NWCLIENT\STARTNET

The sample line below is added to the CONFIG.SYS file in your root directory:

LASTDRIVE=Z


Shiva LanRover

Shiva LanRover provides a remote node solution that allows remote client systems to access a network via a modem. When a connection to the remote network has been established, the client user can run the WinFrame Remote Application Manager to start a remote control session on the WinFrame server. This allows the user to access the network and run applications on the WinFrame server. This gives Shiva LanRover users quick application response and processing, fast access to the network, and total access to the network over a remote connection.

Requirements

Hardware Requirements

Shiva LanRover: see the Shiva LanRover documentation for hardware requirements

Client system: 386 minimum with 4-8MB of RAM, hard disk, and modem

Software Requirements

Shiva Client Software

Shiva Net Manager

DOS/Windows

WinFrame

Installation

Shiva LanRover Installation

To install the Shiva LanRover, follow the steps in the Shiva LanRover documentation. The Shiva LanRover must be configured for your network by the Shiva Net Manager program. This is a Windows 3.1 program that must run on a DOS/Windows 3.1 system. It will not run on WinFrame or Windows NT. Refer to the Shiva documentation regarding the use of this software to configure the LanRover. Various network protocols can be used by the Shiva LanRover including IPX/SPX, TCP/IP, and NetBEUI.

A corresponding network protocol stack must be installed on the remote client to support these protocols that must agree with your network. This section addresses only IPX support. See the Shiva manuals for more information on supported NetBEUI and TCP/IP stacks.

WinFrame Client to be Run Over the Dial-Up Networking Connection

Dial-Up Net- working Client	DOS Client	Win16 Client	Win32 Client
Shiva DOS Dial-Up Client	Yes
Shiva Windows Dial-Up Client		Yes
Windows 95 Dial-Up Client			Yes
Windows NT RAS			Yes
Shiva LanRover Client Installation on the Client System

A DOS system needs 4MB of RAM; a Windows system needs 8MB of RAM. Connect a modem to a COM port with a modem cable. Install the Shiva client according to the Shiva documentation.

Note  If you are using Windows 95 or Windows NT 3.5, check the Shiva documentation. Windows 95 and Windows NT come with their own PPP network client. These are the Windows 95 Dial-Up Networking application and Windows NT Remote Access. See the Shiva manuals for how to use these PPP clients with the Shiva LanRover. Once connected, the WinFrame Win32 client Remote Application Manager may be run as usual.

Installation of WinFrame Client Remote Application Manager on Client System

If the client is a DOS system, install the WinFrame client for DOS. If the system is running Windows 3.1 or Windows for Workgroups 3.11, install the Win16 WinFrame client. If you are using Windows 95 or Windows NT, install the Win32 WinFrame client. See the WinFrame client documentation for installation instructions for each of these set ups. When installing the DOS or Win16 WinFrame client, install the Remote Application Manager only. Do not install the Dial-Up Manager or any of the Dial-Up Manager network support. The Shiva client will supply all the remote node networking connectivity.

Configuration

The Shiva LanRover should be set up, configured, and running on the network. The Shiva LanRover should have at least one dial-in modem configured for remote node access and should have either IPX/SPX, and/or TCP/IP, and/or NetBEUI networking protocols installed, depending on your network. This will provide remote node access to the network for remote clients.

The WinFrame server should be set up and configured on the same network or on a network accessible by the Shiva LanRover. The WinFrame server should have either IPX, and/or TCP/IP, and/or NetBIOS WinStations configured for remote control sessions to connect to. If the WinFrame server will be using IPX, it should have the IPX protocol and the NetWare Gateway Service installed. If the WinFrame server will be using TCP/IP, the TCP/IP protocol should be installed and configured for the IP address required by your network. If the WinFrame server will be using NetBEUI, the NetBEUI protocol should be installed.

DOS and, if desired, Windows should be installed on the client system. The Shiva client software should be installed on the client system along with the desired WinFrame client.

Usage

Loading

Boot the client PC. Load the Shiva client software and establish a remote node connection. A typical set of commands follows:

LSL
DIALODI
CONNECT
IPXODI
NETX
GUARD

Connection

When started, the CONNECT program allows the user to set up the modem on the client, create a dial out entry for the Shiva LanRover, and dial out and connect to the remote network. Once connected, the CONNECT program can be exited. If you have a preconfigured Shiva LanRover entry, you can auto-load and dial the server from the command line by typing connect @sample, where sample is the name of the preconfigured entry for dial out in the CONNECT program. Once connected via modem, the standard NetWare, TCP/IP, and NetBEUI stacks can be loaded using the special Shiva ODI driver, DIALODI. This example loads NETX, but VLMs could be loaded instead if your network uses 4.x NetWare file servers. A TCP/IP stack could also be loaded that would hook into the DIALODI driver. If you are using LAN Manager, obtain the NDIS version of this driver from Shiva for NetBEUI support. Once all of these are loaded, the client system should be connected to the remote network and have standard network access. All of these commands can be added to the AUTOEXEC.BAT file of the client system so that the connection will be automatically dialed and connected, and the network will be loaded upon booting the client system.

Running the Application

The GUARD application does not have to be loaded in order to connect to the network, although it is very useful. The GUARD application prevents remote users from accidentally running large applications over the remote node connection. If the user attempts to start a large application, the user is notified that this may cause slow performance. The user may terminate the application if desired.

The suggested method of running large applications is to use the WinFrame Remote Application Manager to connect to a WinFrame server and to run the large application on the WinFrame server. This is far faster than running the application over the remote node connection.

At this point, the remote user can start the WinFrame client for DOS, or if the client has Windows, Windows may be started and the Win16 Remote Application Manager can be loaded. After the desired WinFrame client is loaded, a remote control session can be created on any WinFrame server on the remote network. From the WinFrame server, the user may then access any network server and printer, and run any application on the remote network.


Stallion Technologies LantraServer

Note  This document was written by David Tuffley, Stallion Technologies, Brisbane, Australia. Copyright Stallion Technologies Pty. Ltd., 1997. This document is a copyright and contains information that is the property of Stallion. No part of this document may be copied or stored in a retrieval system without the written permission of Stallion.

The Stallion Technologies LantraServer realizes the full capability of Citrix WinFrame. A WinFrame client can access the WinFrame server using a standard serial interface from anywhere on the network. This allows legacy PCs, PC terminals, Wyse Winterm terminals, and remote clients to gain full Windows applications functionality, including Internet access, without the need for a NIC or any TCP/IP protocol software.

Local clients do not need to connect to the LAN or be placed in proximity to the WinFrame server to gain access to the network. Remote clients do not need Winsock to remotely interface with the network. LantraServer uses its own TCP/IP transport  to create a virtual link between the client and the server, allowing WinFrame clients to take advantage of Citrix's ICA protocol. This makes client systems cheaper to install, easier to maintain, and better performing.

LantraServer itself is a standalone remote access server that extends Windows NT-RAS for remote WinFrame users via LAN connections. Stallion LantraServer uses Microsoft NT's built-in networking and remote access capabilities to offer an integrated remote access solution.

LantraServer extends the Remote Access functionality of WinFrame to any point on the network. This is achieved by installing the NERP virtual serial driver on a WinFrame server. Serial ports on the LantraServer are then mapped transparently as WinFrame COM ports. This allows the LantraServer serial ports to be used by any WinFrame application or service.

Stallion LantraServer offers all network users - regardless of location - features such as on-demand dialing, multilink PPP, RAS security, integrated Web-based graphical user interface for setup and support, and the Point to Point Tunneling protocol that enables the establishment of Intranets, Extranets, and Virtual Private Networks (VPNs).

Requirements

Software Requirements

WinFrame Version 1.6 or higher

WinFrame Client, Version 1.6 or higher

Stallion Virtual COM Port driver, as supplied with LantraServer

Hardware Requirements

A WinFrame server

A Stallion LantraServer with at least one modem

A client machine with a modem able to dial the LantraServer

A network linking the WinFrame host and the LantraServer

Installation

Perform the following steps to set up the LantraServer and configure it's serial ports as WinFrame COM ports:

To Install LantraServer Hardware on the Network

1.	Hardware Installation. Refer to Chapter 2 of the EasyServer II Installation and Reference Guide for hardware installation and power-on self-test.

2.	Enter an IP Address. If your network is configured to provide an Internet (IP) address using the BOOTP or RARP protocols, the LantraServer will determine it's address from the network when you boot-up. Otherwise, you will need to enter an IP address manually.

Using the cable provided, connect serial port 1 on the LantraServer to a serial (COM) port on a WinFrame or Windows 95 PC. Use a terminal emulator such as HyperTerminal and configure the COM port to 9600 baud, 8 data bits, 1 stop bit, no parity, and XON-XOFF flow control. Press ENTER until you are prompted to enter an Internet address. Enter a valid IP address and press ENTER to accept the default subnet mask.

3.	Connect to LantraServer with a Web Browser. Once the LantraServer has been given a valid IP address, the built-in Web-based configuration utility may be used to set up the server. Use a Web browser such as Internet Explorer or Netscape to connect to the LantraServer.

Go to the LantraServer "Home Page" by entering the URL of the LantraServer in a Web browser on the network; for example http://123.456.789.001

To Configure LantraServer Ports for NERP Operation

1.	Using the LantraServer Home Page. From the LantraServer Home Page, click on Setup. This screen shows a number of subsystems that may be configured. Click on the NERP hotlink.

From the NERP Setup Screen, select the LantraServer ports to be configured for NERP operation and then click on Configure. The server setup is now complete.

2.	Using the Command Line Interface. If a Web browser is unavailable, the setup can be done from the command line text interface in Privileged Mode.

To get to Privileged Mode:

If directly connected to a LantraServer port, press the ENTER key several times to get to the LantraServer command line.

If connecting to the LantraServer via the network, telnet to the IP Address. The Enter Name: prompt will appear. Press CTRL+Z to get to the command line. Set Privilege and press ENTER. Enter Password: (system by default).

To set up a port for NERP via the command line:

CHANGE Telnet Listener 2001 Ports 1 Enabled

CHANGE Telnet Listener 2001 Connections Enabled

CHANGE Telnet Listener Raw Mode Disabled

Logout Port 1

CHANGE Port 1 Access Remote

CHANGE Port 1 Flow Control Disabled

Repeat these commands for each port to be configured.

Note  Use Telnet Listener 2001 for port 1, 2002 for port 2, etc.

To Install the NERP Driver onto a WinFrame Server

The LantraServer diskette contains the NERP virtual serial port driver and associated software. To install the driver, logon as an administrator and select the following in the sequence given:

Control Panel
Network
Services
Add
Have Disk

Insert the driver diskette when requested and specify the path to the driver directory; for example A:\I386. The system then displays the Stallion NERP driver in the Select OEM Option window. Only one software component is provided, so simply press OK. The required files are installed on the system.

To Create WinFrame Virtual COM Ports

You are now prompted to create the virtual serial ports. You may create as many virtual serial ports as required. The created ports must be allocated in a single block and may not conflict with existing serial ports. For example, if you have COM1 and COM2 installed on your system, you may choose to create four serial ports starting at COM5. Do this by entering 5 for First Port and 4 for Number of Ports and press OK.

To Map LantraServer Serial Ports to the Virtual COM Ports

The NERP Manager - Port Configuration window will now appear. From here, you may specify the terminal server port to configure for each WinFrame virtual serial port.

Select a COM port and click on Configure. The Add/Configure Port window will now appear. This window contains the following input fields:

First COM Port. This is the WinFrame COM port you want to map to a LantraServer serial port.

# of Ports. The number of COM ports you want to map to a single LantraServer serial port. This will always be one except in very advanced situations.

Remote Host Name or IP Address. The name or IP address of the LantraServer.

TCP/IP Port. This is the Telnet Listener port number that is already set up on the LantraServer. The numbering scheme starts at 2001 for port 1 on the LantraServer. Port 2 on the LantraServer is Listener port 2002, etc.

Raw Mode and Retry Timeout. This should be left unchecked.

Click OK when complete. The Ports Configuration window will reappear.

Select the next COM port and click Configure. Repeat for each COM port.

Press OK to close the window and reboot when prompted. After the system is rebooted, the configured serial ports will be available for use as WinFrame COM ports.

System Administration

To add, configure or remove NERP ports after the initial installation, run NERP from the Control Panel. Click on the Configuration radio button. The NERP Port Status screen will appear.

NERP Manager

Click on Add Port, Remove Port, or Configure Port  to return to the appropriate configuration screens previously described. The system must be rebooted before the COM ports will be available under WinFrame.

Port Monitoring

To assist in troubleshooting various serial port problems, NERP manager includes screens displaying signal status, port statistics, and port setup details. Click on the Status, Statistics, or Settings radio buttons as required.


3270 Mainframe Connectivity and WinFrame

Overview

The 3270 series of mainframe peripherals is a family of IBM system components (terminals, printers, and terminal cluster controllers) that can be used with a mainframe computer over a Systems Network Architecture (SNA) link. There are several ways to link a WinFrame application server to a mainframe using the 3270 protocol. Instead of multiple individual connections, a gateway should be used. A gateway is a shared connection between a LAN and a larger system - in this case a mainframe - that performs the required protocol conversions.

Other Windows NT-compatible 3270 products may work, but have not been tested by Citrix at this time. Refer to the online WinFrame Readme for the latest compatibility information, as well as general application integration guidelines.

Note  Some products use the network address of the NIC as a session/user identifier. These products are limited to only one concurrent user on a WinFrame server. In these cases, the only solution is to use a data communications gateway between the WinFrame server and the mainframe. The terminal emulator can then use a virtual socket-based protocol (for example, IPX) to communicate with the gateway, allowing multiple users on the WinFrame server to use the product.

A sample 3270 configuration is illustrated below.


Supported 3270 Connectivity Products

Vendor	Model	Version	Notes
Microsoft	SNA Client	2.11	Requires Microsoft SNA Server 2.11
Microsoft	SNA Client	3.0	Requires Microsoft SNA Server 3.0
NetSoft	NS/Portfolio
Reflection Products and Citrix WinFrame*	Reflection 1, 2, 4 for Windows 95 and Windows NT Reflection for IBM for Windows 95 and Windows NT Reflection Suite for TCP for Windows 95 and Windows NT Reflection X for Windows 95 and Windows NT	5.21 6.1 6.5, 6.6 6.1

*See Chapter 12 for more information about these Reflection products.


Microsoft SNA Client/SNA Server Version 2.11

Overview

Microsoft SNA Client/SNA Server supports both 3270 and 5250 connections. There are two components:

The SNA Server, which communicates with the mainframe and acts as the gateway.

The SNA Client. This communicates with the SNA Server component. Each WinFrame user accessing a 3270/5250 session runs a copy of the SNA Client.

Because these components are standard Microsoft Windows NT packages, installation and configuration are straightforward and there are no special considerations for WinFrame.

Requirements

Software Requirements

Microsoft SNA Client/SNA Server Version 2.11

WinFrame Version 1.5 and higher

Hardware Requirements

486DX with a 66MHz CPU or larger

Minimum of 16MB

Minimum of 20MB free hard disk space

WinFrame-supported network adapter

Supported SNA communications adapter(s)

Installation

There are three ways that Microsoft SNA Server can be installed on a WinFrame application server: as an SNA Server, an SNA Client, or both SNA Server and SNA Client.

SNA Server and Client Installation

For the SNA-based installation on a WinFrame server, follow the instructions described in the Microsoft SNA Server Installation Guide. However, when Microsoft SNA Server is installed on a WinFrame server, four files must be registered as system global. Follow this procedure:

1.	From the SNA Server Setup Finish dialog box, choose the Exit button.

2.	From the Main Group, start a DOS prompt.

3.	Type net stop snabase and press ENTER.

4.	Change to the SNA Server's system directory (for example, C:\SNA\SYSTEM).

5.	Execute the following commands:

register snadmod.dll /system

register snamanag.dll /system

register snaadmin.exe /system

register wappc32.dll /system

6.	Type net start snabase and press ENTER.

Configuration

To configure the Microsoft SNA Server connection, logical unit (LU), and users, follow the instructions in the Microsoft SNA Server Administration Guide.


Microsoft SNA Client/SNA Server Version 3.0

Overview

This application note describes how to install and configure Microsoft SNA Server Version 3.0 on a WinFrame server. Microsoft SNA Client/SNA Server supports both 3270 and 5250 connections. Microsoft SNA has two components:

The SNA Server, which communicates with the mainframe and acts as the gateway.

The SNA Client. This communicates with the SNA Server component. Each WinFrame user accessing a 3270/5250 session runs a copy of the SNA Client.

Requirements

Software Requirements

WinFrame Version 1.6 with Service Pack 5 and Hotfix SE165088 dated 10/8/97, or WinFrame Version 1.7

Microsoft SNA Client/SNA Server Version 3.0

Hardware Requirements

WinFrame server

Minimum of 20MB free hard disk space

Supported network adapter

Supported SNA communications adapters

Installation

SNA Server is installed by executing the program SETUP.EXE on the SNA Server CD-ROM. This is a 16-bit program that calls the actual 32-bit install program ACMSETUP.EXE. Because of a WinFrame performance tuning Registry entry, SETUP.EXE consumes nearly 100% of the CPU while running in the background. Because of this, ACMSETUP.EXE does not receive enough CPU resources to complete in a timely fashion. The procedure below modifies the performance tuning parameters to allow SNA Server to install properly, and restores the settings after installation.

To Install Microsoft SNA Server on a WinFrame Server

1.	Install WinFrame on your server hardware.

2.	If you are installing WinFrame Version 1.6, obtain and apply WinFrame Service Pack 5. You can download Service Pack 5 from the Citrix Web site, http://www.citrix.com. Service Pack 5 is included with WinFrame Version 1.7.

3.	For WinFrame Version 1.6, obtain and apply Hotfix SE165088 dated 10/8/97. You can download hotfixes from the Citrix Web site. If you do not apply Hotfix SE165088 after applying Service Pack 5, the SNA Setup program will cause a trap in PROGMAN.EXE when you attempt to install SNA Server 3.0. It is not necessary to download Hotfix SE165088 if you are installing WinFrame Version 1.7.

4.	Logon as an administrator.

5.	At a command prompt, type regedt32 and press ENTER.

6.	Locate the Registry key:

\\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Compatibility\Applications\SETUP

7.	Change the value MsgQBadAppSleepTimeInMillisec: REG_DWORD from 0 to 1.

8.	Save the changes and exit the Registry Editor.

9.	At a command prompt, enter the following commands:

change user /install

setbuild /ms

10.	Install Microsoft SNA Server and SNA Client according to the supplied installation instructions.

11.	At a command prompt, type regedt32 and press ENTER.

12.	Locate the Registry key:

\\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Compatibility\Applications\SETUP

13.	Change the value MsgQBadAppSleepTimeInMillisec: REG_DWORD from 1 to 0.

14.	Save the changes and exit the Registry Editor.

15.	Use change user /execute to return the session to execute mode.

16.	Use Notepad (or another text editor) to create a batch file named SNAREG.CMD that contains the following commands:

@ECHO OFF

REM *** SNAREG.CMD: Batch file to register SNA Server 3.0 ***

REM *** files system global ***

REGISTER %SNAROOT%\SNADMOD.DLL /SYSTEM

REGISTER %SNAROOT%\SNAMANAG.DLL /SYSTEM

REGISTER %SNAROOT%\WAPPC32.DLL /SYSTEM

REGISTER %SNAROOT%\DBGTRACE.DLL /SYSTEM

REGISTER %SNAROOT%\MNGBASE.DLL /SYSTEM

REGISTER %SNAROOT%\SNATRC.DLL /SYSTEM

REGISTER %SNAROOT%\SNALM.DLL /SYSTEM

REGISTER %SNAROOT%\SNANW.DLL /SYSTEM

REGISTER %SNAROOT%\SNAIP.DLL /SYSTEM

REGISTER %SNAROOT%\SNABASE.EXE /SYSTEM

REGISTER %SNAROOT%\SNASERVR.EXE /SYSTEM

REGISTER %SNAROOT%\SNASII.DLL /SYSTEM

REGISTER %SNAROOT%\SNALINK.DLL /SYSTEM

This file contains commands used to register some SNA executable files and DLLs as system global. Save the file and exit Notepad.

17.	Before executing the SNAREG.CMD batch file, you must stop the SNABase service or the batch file will not function properly. To stop the SNABase service:

A.	After installing SNA Server 3.0, run the Services application in Control Panel. The Services dialog box appears.

B.	Select the SNABase service in the Service list box and then click the Startup button. The Service Startup dialog box appears.

C.	Select Disabled in the Startup Type box and then click OK.

D.	Click the Close button in the main Services dialog box.

E.	Exit Control Panel. Shutdown and reboot the WinFrame server.

F.	Logon to WinFrame as an administrator.

G.	Start a command prompt session and execute the SNAREG.CMD batch file.

H.	After the SNAREG.CMD batch file has completed, run the Services application in Control Panel. The Services dialog box appears.

I.	Select the SNABase service in the Service list box and then click the Startup button. The Service Startup dialog box appears.

J.	Select Automatic in the Startup Type box and then click OK.

K.	Click the Close button in the main Services dialog box.

L.	Exit Control Panel. Shutdown and reboot the WinFrame server.

18.	Configure SNA Server as required for your installation.


NetSoft Communications Products

Note  This document was written by NetSoft of Irvine, California. This publication contains information that is the property of NetSoft. No part of this document may be copied or stored in a retrieval system without the written permission of NetSoft.

NetSoft develops and markets PC-to-IBM host communications software for connecting Windows clients to IBM mainframe and AS/400 databases. The NS/Portfolio product line gives users access to the data and applications residing on these IBM host systems. Through the NS/Portfolio communications channel, NetSoft acts as the enabling technology for facilitating the exchange of data and supporting third-party programs through industry standard Application Programming Interfaces (APIs).

This application note describes how to use NetSoft 3270 and 5250 32-bit communications products with Citrix WinFrame. Information about configuring WinFrame and NetSoft is included.

NetSoft plans on releasing a more integrated version of their software for the Citrix WinFrame environment. Please contact NetSoft for the latest status at (714) 753-0800 or (800) 352-3270. NetSoft's Web address is http://www.netsoft.com.

WinFrame Configuration

To Configure WinFrame for Maximum Application Throughput (Makes Applications More Responsive)

1.	Log in as an administrator.

2.	Open the Control Panel.

3.	Click on the Network icon.

4.	Select Server from the Installed Network Software list.

5.	Press the Configure button.

6.	Select the Maximize Throughput for Network Applications optimization option.

7.	Click OK.

To Disable Wallpaper (Makes the Client Display Draw Faster)

1.	Open the Administrative Tools program group.

2.	Click on the WinStation Configuration icon.

3.	For each WinStation and transport in the list, do the following:

A.	Double-click on the WinStation or select it and choose Edit from the WinStation pull-down menu.

B.	Click the Advanced WinStation button.

C.	Check the Disable Wallpaper box in the User Profile Overrides panel.

D.	Click OK.

Download and apply the latest hotfixes from the Citrix Web site (http://www.citrix.com). Ensure there is sufficient base memory on the server. Allocate at least 16MB for WinFrame, 4MB for each user, 8MB for each power user, and 1MB for each configured WinStation.

NetSoft Configuration

If several users on the WinFrame server try to run NS/Portfolio simultaneously, the first user connects instantly but subsequent users experience a delay. This is because each instance of NetSoft tries to lock the same event log file.

To solve this problem, the NetSoft Event Log Server (EVNTSRV.EXE) detects whether it is running in a WinFrame environment or a Microsoft Windows NT or Windows 95 platform. If it is running on WinFrame, it creates a unique log file with the filename User login ID + WinStation ID.EVT such as ADMINipx#001.EVT.

The following are NetSoft related steps that needs to be taken:

Apply the NetSoft Event Log Server module, EVNTSVR.EXE (Version 2.20.0.17), to the C:\Progra~1\netsoft\elite\ui directory. This file is located on the NetSoft ftp site under outgoing/CAP/Citrix.

Make sure the Registry keys below exist; if they don't, import the EVWRITE.REG and EVREAD.EXE files from ftp.netsoft:outgoing/CAP/Citrix into the Registry:

[HKEY_CLASSES_ROOT]

[CLSID]

{e57e87e1-6427-11ce-9364-08005a9b1ce9}

{e57e87e0-6427-11ce-9364-08005a9b1ce9}


AS/400 Minicomputer Connectivity and WinFrame

Introduction

IBM's AS/400 family of minicomputers is used by many businesses. In its standard configuration, the AS/400 connects to separate IBM 5250-series terminals over a specialized dual coaxial cable called twinax.

There are several ways to link an AS/400 minicomputer to a WinFrame server. Instead of multiple individual connections, a gateway should be used. A gateway is a shared connection between a LAN and a larger system, in this case a minicomputer, that performs the required protocol conversions.

Other Windows NT-compatible 5250 products may work but have not been tested by Citrix at this time. Refer to the online WinFrame Readme for the latest compatibility information, as well as general application integration guidelines.

Note  Some products use the network address of the NIC as a session/user identifier. These products are limited to only one concurrent user on a WinFrame server. In these cases, the only solution is to use a data communications gateway between the WinFrame server and the minicomputer. The terminal emulator can then use a virtual socket-based protocol (for example, IPX) to communicate with the gateway, allowing multiple users on the WinFrame server to use the product.

A sample 5250 configuration is illustrated below.


Supported AS/400 Connectivity Products

Vendor	Model	Version	Notes
Eicon	Access for Windows NT Multiuser	3.21	Requires Microsoft SNA Server 2.11
Microsoft	SNA Client	2.11	Requires Microsoft SNA Server 2.11
Microsoft	SNA Client	3.0	Requires Microsoft SNA Server 3.0
NetSoft	NS/Portfolio
Reflection Products and Citrix WinFrame*	Reflection 1, 2, 4 for Windows 95 and Windows NT Reflection for IBM for Windows 95 and Windows NT Reflection Suite for TCP for Windows 95 and Windows NT Reflection X for Windows 95 and Windows NT	5.21 6.1 6.5, 6.6 6.1

*See Chapter 12 for more information about these Reflection products.


Microsoft SNA Client/SNA Server Version 2.11

Overview

Microsoft SNA Client/SNA Server supports both 3270 and 5250 connections. There are two components:

The SNA Server, which communicates with the mainframe and acts as the gateway.

The SNA Client. This communicates with the SNA Server component. Each WinFrame user accessing a 3270/5250 session runs a copy of the SNA Client.

Because these components are standard Microsoft Windows NT packages, installation and configuration are straightforward and there are no special considerations for WinFrame.

Requirements

Software Requirements

Microsoft SNA Client/SNA Server Version 2.11

WinFrame Version 1.5 and higher

Hardware Requirements

486DX with a 66MHz CPU or larger

Minimum of 16MB

Minimum of 20MB free hard disk space

WinFrame-supported network adapter

Supported SNA communications adapter(s)

Installation

There are three ways that Microsoft SNA Server can be installed on a WinFrame application server: as an SNA Server, an SNA Client, or both SNA Server and SNA Client.

SNA Server and Client Installation

For the SNA-based installation on a WinFrame server, follow the instructions described in the Microsoft SNA Server Installation Guide. However, when Microsoft SNA Server is installed on a WinFrame server, there are four files that must be registered as system global. Follow this procedure:

1.	From the SNA Server Setup Finish dialog box, choose the Exit button.

2.	From the Main Group, start a DOS prompt.

3.	Type net stop snabase and press ENTER.

4.	Change to the SNA Server's system directory (for example, C:\SNA\SYSTEM).

5.	Execute the following commands:

register snadmod.dll /system
register snamanag.dll /system
register snaadmin.exe /system
register wappc32.dll /system

6.	Type net start snabase and press ENTER.

Configuration

To configure the Microsoft SNA Server connection, logical unit (LU), and users, follow the instructions in the Microsoft SNA Server Administration Guide.


Microsoft SNA Client/SNA Server Version 3.0

Overview

This application note describes how to install and configure Microsoft SNA Server Version 3.0 on a WinFrame server. Microsoft SNA Client/SNA Server supports both 3270 and 5250 connections. Microsoft SNA has two components:

The SNA Server, which communicates with the mainframe and acts as the gateway.

The SNA Client. This communicates with the SNA Server component. Each WinFrame user accessing a 3270/5250 session runs a copy of the SNA Client.

Requirements

Software Requirements

WinFrame Version 1.6 with Service Pack 5 and Hotfix SE165088 dated 10/8/97, or WinFrame Version 1.7

Microsoft SNA Client/SNA Server Version 3.0

Hardware Requirements

WinFrame server

Minimum of 20MB free hard disk space

Supported network adapter

Supported SNA communications adapters

Installation

SNA Server is installed by executing the program SETUP.EXE on the SNA Server CD-ROM. This is a 16-bit program that calls the actual 32-bit install program ACMSETUP.EXE. Because of a WinFrame performance tuning Registry entry, SETUP.EXE consumes nearly 100% of the CPU while running in the background. Because of this, ACMSETUP.EXE does not receive enough CPU resources to complete in a timely fashion. The procedure below modifies the performance tuning parameters to allow SNA Server to install properly, and restores the settings after installation.

To Install Microsoft SNA Server on a WinFrame Server

1.	Install WinFrame on your server hardware.

2.	If you are installing WinFrame Version 1.6, obtain and apply Service Pack 5. You can download Service Pack 5 from the Citrix Web site, www.citrix.com. Service Pack 5 is included with WinFrame Version 1.7.

3.	For WinFrame Version 1.6, obtain and apply Hotfix SE165088 dated 10/8/97. You can download hotfixes from the Citrix Web site. If you do not apply Hotfix SE165088 after applying Service Pack 5, the SNA Setup program will cause a trap in PROGMAN.EXE when you attempt to install SNA Server 3.0. It is not necessary to download Hotfix SE165088 if you are installing WinFrame Version 1.7.

4.	Logon as an administrator.

5.	At a command prompt, type regedt32 and press ENTER.

6.	Locate the Registry key:

\\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Compatibility \Applications\SETUP

7.	Change the value MsgQBadAppSleepTimeInMillisec: REG_DWORD from 0 to 1.

8.	Save the changes and exit the Registry Editor.

9.	At a command prompt, enter the following commands:

change user /install
setbuild /ms

10.	Install Microsoft SNA Server and SNA Client according to the supplied installation instructions.

11.	At a command prompt, type regedt32 and press ENTER.

12.	Locate the Registry key:

\\HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Compatibility \Applications\SETUP

13.	Change the value MsgQBadAppSleepTimeInMillisec: REG_DWORD from 1 to 0.

14.	Save the changes and exit the Registry Editor.

15.	Use change user /execute to return the session to execute mode.

16.	Use Notepad (or another text editor) to create a batch file named SNAREG.CMD that contains the following commands:

@ECHO OFF

REM *** SNAREG.CMD: Batch file to register SNA Server 3.0 ***

REM *** files system global ***

REGISTER %SNAROOT%\SNADMOD.DLL /SYSTEM

REGISTER %SNAROOT%\SNAMANAG.DLL /SYSTEM

REGISTER %SNAROOT%\WAPPC32.DLL /SYSTEM

REGISTER %SNAROOT%\DBGTRACE.DLL /SYSTEM

REGISTER %SNAROOT%\MNGBASE.DLL /SYSTEM

REGISTER %SNAROOT%\SNATRC.DLL /SYSTEM

REGISTER %SNAROOT%\SNALM.DLL /SYSTEM

REGISTER %SNAROOT%\SNANW.DLL /SYSTEM

REGISTER %SNAROOT%\SNAIP.DLL /SYSTEM

REGISTER %SNAROOT%\SNABASE.EXE /SYSTEM

REGISTER %SNAROOT%\SNASERVR.EXE /SYSTEM

REGISTER %SNAROOT%\SNASII.DLL /SYSTEM

REGISTER %SNAROOT%\SNALINK.DLL /SYSTEM

This file contains commands used to register some SNA executable files and DLLs as system global. Save the file and exit Notepad.

17.	Before executing the SNAREG.CMD batch file, you must stop the SNABase service or the batch file will not function properly. To stop the SNABase service:

A.	After installing SNA Server 3.0, run the Services application in Control Panel. The Services dialog box appears.

B.	Select the SNABase service in the Service list box and then click the Startup button. The Service Startup dialog box appears.

C.	Select Disabled in the Startup Type box and then click OK.

D.	Click the Close button in the main Services dialog box.

E.	Exit Control Panel. Shutdown and reboot the WinFrame server.

F.	Logon to WinFrame as an administrator.

G.	Start a command prompt session and execute the SNAREG.CMD batch file.

H.	After the SNAREG.CMD batch file has completed, run the Services application in Control Panel. The Services dialog box appears.

I.	Select the SNABase service in the Service list box and then click the Startup button. The Service Startup dialog box appears.

J.	Select Automatic in the Startup Type box and then click OK.

K.	Click the Close button in the main Services dialog box.

L.	Exit Control Panel. Shutdown and reboot the WinFrame server.

18.	Configure SNA Server as required for your installation.


NetSoft Communications Products

Note  This document was written by NetSoft of Irvine, California. This publication contains information that is the property of NetSoft. No part of this document may be copied or stored in a retrieval system without the written permission of NetSoft.

NetSoft develops and markets PC-to-IBM host communications software for connecting Windows clients to IBM mainframe and AS/400 databases. The NS/Portfolio product line gives users access to the data and applications residing on these IBM host systems. Through the NS/Portfolio communications channel, NetSoft acts as the enabling technology for facilitating the exchange of data and supporting third-party programs through industry standard Application Programming Interfaces (APIs).

This application note describes how to use NetSoft 3270 and 5250 32-bit communications products with Citrix WinFrame. Information about configuring WinFrame and NetSoft is included.

NetSoft plans on releasing a more integrated version of their software for the Citrix WinFrame environment. Please contact NetSoft for the latest status at (714) 753-0800 or (800) 352-3270. NetSoft's Web address is http://www.netsoft.com.

WinFrame Configuration

To Configure WinFrame for Maximum Application Throughput (Makes Applications More Responsive)

1.	Log in as an administrator.

2.	Open the Control Panel.

3.	Click on the Network icon.

4.	Select Server from the Installed Network Software list.

5.	Press the Configure button.

6.	Select the Maximize Throughput for Network Applications optimization option.

7.	Click OK.

To Disable Wallpaper (Makes the Client Display Draw Faster)

1.	Open the Administrative Tools program group.

2.	Click on the WinStation Configuration icon.

3.	For each WinStation and transport in the list, do the following:

A.	Double-click on the WinStation or select it and choose Edit from the WinStation pull-down menu.

B.	Click the Advanced WinStation button.

C.	Check the Disable Wallpaper box in the User Profile Overrides panel.

D.	Click OK.

Download and apply the latest hotfixes from the Citrix Web site (http://www.citrix.com). Ensure there is sufficient base memory on the server. Allocate at least 16MB for WinFrame, 4MB for each user, 8MB for each power user, and 1MB for each configured WinStation.

NetSoft Configuration

If several users on the WinFrame server try to run NS/Portfolio simultaneously, the first user connects instantly but subsequent users experience a delay. This is because each instance of NetSoft tries to lock the same event log file.

To solve this problem, the NetSoft Event Log Server (EVNTSRV.EXE) detects whether it is running in a WinFrame environment or a Microsoft Windows NT or Windows 95 platform. If it is running on WinFrame, it creates a unique log file with the filename User login ID + WinStation ID.EVT such as ADMINipx#001.EVT.

The following are NetSoft related steps that needs to be taken:

Apply the NetSoft Event Log Server module, EVNTSVR.EXE (Version 2.20.0.17), to the C:\Progra~1\netsoft\elite\ui directory. This file is located on the NetSoft ftp site under outgoing/CAP/Citrix.

Make sure the Registry keys below exist; if they don't, import the EVWRITE.REG and EVREAD.EXE files from ftp.netsoft:outgoing/CAP/Citrix into the Registry:

[HKEY_CLASSES_ROOT]

[CLSID]

{e57e87e1-6427-11ce-9364-08005a9b1ce9}

{e57e87e0-6427-11ce-9364-08005a9b1ce9}


ISDN Connectivity and WinFrame

Overview

Integrated Services Digital Network (ISDN) is an International Telephone and Telegraph Union Standardization Sector (ITU-T, formerly CCITT) standard for a digital communications network intended to replace conventional telephone service with a completely digital transmission system. You must obtain ISDN connections from your telephone company.

Most current ISDN products function as LAN bridges. ISDN bridge products provide remote networking over ISDN lines, often supporting both IP and IPX networks. They can be compared to remote node connectivity products. Remote and local workstations connect to WinFrame servers on either side of the ISDN bridge.

In general, ISDN bridges are transparent to WinFrame. Any external ISDN products (for example, a product that acts as a LAN bridge and connects directly to the existing network cabling) can be expected to work. Field experience indicates that a 128Kbps BRI line can support approximately six to ten concurrent users without performance degradation.

A typical ISDN bridge configuration is shown below.


Spoofing With ISDN and WinFrame

Most ISDN routers support spoofing for the TCP/IP and SPX protocols. Spoofing allows the ISDN connection to drop when the line becomes idle without losing any existing connections. Spoofing is a function of the ISDN devices and is transparent to WinFrame.

When possible, use the TCP/IP protocol with WinFrame over an ISDN connection because it is routable and much faster than SPX.

The ISDN connection should drop when the line is idle and automatically reconnect when activity is detected. If the ISDN device does not support spoofing, the connection will never drop. Both TCP/IP and SPX have standard, well known, stay-alive packets that most ISDN devices are capable of spoofing.

Using IPX with WinFrame over an ISDN connection can pose a problem because ISDN routers cannot spoof the ICA IPX packets. In this situation, it is necessary to utilize a workaround that is provided in WinFrame Service Pack 5. This workaround allows the system to synchronize its polling time to the WinFrame clients and poll only at a predetermined time interval. This allows the administrator to adjust the polling time so that the ISDN connection only needs to come up for a few minutes at a given time interval to poll the WinFrame clients. This simulates the spoofing configuration, allowing the ISDN connection to drop when the line is idle without dropping any of the WinFrame sessions. Instructions for configuring the IPX spoofing workaround are listed below.

1.	Make sure Service Pack 5 is installed on the WinFrame server.

2.	Start the Registry Editor, REGEDT32.EXE.

3.	Locate the Registry key:

\\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Control\Citrix\Pds\ipx

4.	From the Edit pull-down menu, select Add Value.

5.	For the Value Name, type poll time.

6.	For the Data Type, select REG_DWORD.

7.	Click on OK.

8.	In the Data field, enter a numerical value representing the number of minutes between polling times; for example, 60 for 60 minutes or one hour.

9.	In the Radix area, select the Decimal radio button.

10.	Click on OK to save the changes. Exit the Registry Editor.


Supported ISDN Connectivity Products

Vendor	Model	Version
Digi International	Datafire ISA ISDN U Adapter	Internal
Digi International	IMAC Bridge	External
Digi International	Retoura ISDN Router	External
Gandalf	LANLine Bridge	"i" Series
Note  A blinking cursor on the remote session will cause continuous ISDN data transmission, which may incur excessive line charges over time. The cursor blink can be disabled by setting the cursor blink rate to its minimum value in the desktop settings using the Control Panel.


Digi International Datafire ISA ISDN U Adapter

Overview

The Digi International Datafire ISDN U adapter is an ISA bus ISDN adapter with built in termination that supports two 64Kbps B-channels and one 16Kbps D-channel. The two B-channels can be bonded to create a single 128Kbps channel.

When installed in a WinFrame server, the Datafire adapter can be configured as a dial-in or dial-out RAS port. A remote user using ISDN can use PPP client software to dial in to an ISDN RAS port on the WinFrame server. Once the RAS connection is established, the user can run the WinFrame client software and establish a network (IPX, TCP/IP, or NetBIOS) connection over the ISDN PPP RAS connection at 64 or 128Kbps.

When a RAS connection is configured between two WinFrame servers using Digi Datafire ISDN adapters, users on both sides of the LAN/WAN can run several simultaneous WinFrame sessions to a server over the ISDN line with good performance.

Requirements

Hardware Requirements

WinFrame server with a Digi Datafire ISDN U ISA adapter revision D or higher

ISDN phone line (obtained from your local ISDN service provider)

Software Requirements

WinFrame Version 1.6 with Service Pack 5 or WinFrame Version 1.7 and Remote Access Service (RAS) support installed

Latest Digi Datafire drivers for Windows NT build 1119

Installation

To Install the Digi Datafire Adapter and Software on a WinFrame Computer

1.	Before beginning installation, contact your ISDN provider and find out your SPID (Service Profile Identification) number(s) and the switch type being used. Some switch types may require a TID (Terminal ID) number.

2.	Install WinFrame following the instructions in the Installation Guide.

3.	Download the latest Datafire drivers from the Digi International FTP site. At the time of this application note, the latest driver file was 1119.EXE, which is a self-extracting file.

4.	Create a directory called \TEMPDIR\I386 in the root of a drive with available disk space. Execute the self-extracting file in that directory to decompress the driver files.

5.	Start Control Panel. Double-click on Network. The Network Settings dialog box appears.

6.	Select Add Adapter. Select <Other> Requires Disk From Manufacturer from the pull-down list.

7.	Enter the path to the directory created in Step 4; for example, c:\tempdir\i386.

8.	Select the Datafire ISA/U adapter from the selection list.

9.	Select the I/O port address configured for the adapter as described in the Datafire documentation.

10.	Select the switch type obtained from your ISDN provider.

11.	Select the required line options. Set the number of logical terminals to 2 if your BRI has two SPID numbers.

12.	Enter the SPID, including the area code. Note that the terminal ID (TID) must be included for some switch types.

13.	Enter the local telephone number (without an area code) in the telephone number field.

14.	If the number of logical terminals selected above was 2, enter the SPID and phone number for the second logical terminal.

15.	The installation will automatically start RAS configuration or RAS installation. You will need the WinFrame CD-ROM for RAS installation.

16.	Select the pcimacisdn1 port and select OK.

17.	Select Dial Out And Receive Calls and click on OK.

18.	Select Add and enter the second pcimacisdn2 entry. Select Dial-Out And Receive Calls.

19.	Repeat above steps for a second WinFrame server that has no network connection to the first WinFrame server.

20.	If any WinFrame Version 1.6 service packs were previously applied, you must now reapply them and reboot the machine. The Digi Datafire installation writes over files that are included in the service packs.

The WinFrame servers are now configured for RAS dialin and RAS dialout. A WinFrame server may only have one dialout RAS session but may have more than one dialin session.

Usage

To Establish a Connection Between two WinFrame Servers Using Digi Datafire Adapters

1.	Logon at the console of the first WinFrame server as an administrator.

2.	Select the RAS program group and run RAS Administration.

3.	Select Users and give RAS dial-in permission to a user (for example, the system administrator).

4.	Select the RAS server and view the port status.

5.	Logon to the console of the second WinFrame server as a user.

6.	Select the RAS program group and double-click on Remote Access.

7.	Create a dialin entry for the first WinFrame server. Enter a dialin entry name and the telephone number of the first WinFrame server.

8.	Select the port to be pcimacisdn1.

9.	If the two ISDN channels will be bonded together, select Advanced button and choose ISDN. Set channels to Two.

10.	Select OK to create the dialin entry.

11.	From the main RAS menu of the second WinFrame server, select the entry just created and click Dial.

12.	Enter the username, password, and domain of a user who has been granted dial-in permission on the first WinFrame server and click on OK.


DigiBoard IMAC Bridge

Overview

The DigiBoard ISDN IMAC provides remote Ethernet network bridging over standard basic rate 2B+D (2 x 64Kbps data channels) ISDN lines. The IMAC is protocol independent and can bridge the IPX, SPX, TCP/IP, NetBIOS, and NetBEUI protocols. Ethernet frames are transparently transmitted between the local and remote networks over the ISDN line. The DigiBoard ISDN products allow two-way access between the local and remote networks. The two LANs, or PC and LAN, appear as one contiguous network. The WinFrame client can establish a network remote control session on a WinFrame server as if it were on the local LAN.

Requirements

Hardware Requirements

DigiBoard IMAC ISDN/MAC layer bridge on the remote and local side

ISDN lines installed at both the local and remote sites

Software Requirements

WinFrame server and client software

Installation

1.	Install the DigiBoard IMAC bridge by following the "Sample Installation" section in the DigiBoard IMAC manual.

2.	Install and configure the WinFrame client software on the client PC. Refer to the WinFrame Client User's Guide for detailed information.

Configuration

The tested configuration used a copy of the Listen2 profile, which controls incoming Ethernet traffic by using two B channels.

When configuring a profile on the IMAC, the following settings give the best performance (options are set via the IMAC's SET PROFILE command):

/FILTER_LOGIC=SOFT (maintains a filter table of up to 2047 MAC addresses) /NUMBER_OF_CHANNELS=2 (use both channels for the bridging)
/CHANNEL=B1:B2 (use both B1 and B2 channels)

Usage

1.	If the DigiBoard IMAC bridges are operating and the ISDN lines are active, the remote network should appear as if it is local. Depending on the DigiBoard IMAC bridge equipment purchased, your bandwidth will be either 64Kbps or 128Kbps. WinFrame compression provides excellent performance connection over the bridge.

2.	The IMAC bridges can be remotely configured and managed by any SNMP management system or via TCP/IP commands.

3.	After the ISDN connection is established, start the WinFrame client on the client PC. You may now connect to a remote application using the network protocols supported by your installation.

Notes  The DigiBoard IMAC bridge products are an excellent way to access remote LANs. Special features on the IMAC series bridges allow connections to be initiated or dropped transparently to users, giving the remote office a virtual presence on the central site LAN while keeping line charges at a minimum.

WinFrame greatly improves performance of the ISDN bridge because the execution of the applications is performed on the WinFrame server, requiring only screen updates, keystrokes, and mouse activity to be sent across the bridge.


DigiBoard Retoura ISDN Router

Overview

This section describes how to install and configure the DigiBoard Retoura ISDN Router for use with WinFrame. The Retoura ISDN router provides remote Ethernet network routing over standard basic rate 2B+D (2 x 64Kbps data channel) ISDN lines. Ethernet_II frames are transmitted between the local and remote networks over the ISDN line, making the remote PC or LAN appear as one contiguous network. The Retoura routes the TCP/IP protocol, keeping local IP traffic on each side of the Retoura and sending only those packets that need to reach machines on the other segment. This enhances performance by not using network bandwidth for unnecessary traffic. A remote WinFrame client PC can establish a TCP/IP remote control session on a WinFrame server as if it were on the local LAN.

Requirements

Hardware Requirements

Two DigiBoard Retoura ISDN Routers (hardware revision R1480 or higher), one on each side

ISDN phone lines (obtained from your local ISDN provider)

Software Requirements

WinFrame server and client software, Version 1.6 or higher

TCP/IP support installed on client and server PCs

Installation

1.	Install and configure the Retoura routers following the instructions in the DigiBoard documentation.Your ISDN provider should supply you with the following information for configuring the Retoura:

Service Provider Identification (SPID) Number

Switch type

{bmc square.bmp}	Area code and phone number

2.	Install and configure your WinFrame server. The WinFrame server should have TCP/IP networking installed.

3.	Install and configure the WinFrame Client software on the client PC. Configure a TCP/IP remote application on the client machine, using the DNS name or IP address of the WinFrame server configured in Step 2.

4.	Attempt to establish a connection between the two Retoura routers. Once the bridge between the two networks is established, use the ping command (usually supplied with your TCP/IP networking software) to ping the WinFrame server on the other side to verify network connectivity; for example, if the WinFrame server is named main01, enter ping main01 to test the connection.

5.	Start the WinFrame client on the client PC and connect to the WinFrame server using the remote application defined in Step 3.


Gandalf ISDN Bridges

Overview

The Gandalf LANLine remote access products provide remote Ethernet network bridging over standard basic rate 2B+D (2 x 64Kbps data channels) ISDN lines. They are protocol independent and can bridge the IPX, SPX, TCP/IP, NetBIOS, and NetBEUI protocols. Ethernet frames are transparently transmitted between the local and remote networks over the ISDN line. The Gandalf LANLine products allow two-way access between the local and remote networks. The two LANs, or PC and LAN, appear as one contiguous network. The WinFrame client can establish a network remote control session on a WinFrame server as if it were on the local LAN.

Requirements

Hardware Requirements

Gandalf LANLine Series Intelligent Bridge on both the remote and local sides

ISDN lines installed at both the local and remote sites

Software Requirements

WinFrame server and client software

Installation

1.	Install the LANLine series bridges following the steps in the Gandalf User's Manual.

2.	Install and configure the WinFrame client software on the client PC. Refer to the WinFrame Client User's Guide for detailed information.

Usage

1.	Once the Gandalf bridges are operating and the ISDN lines are active, the remote network can be accessed. Depending on the Gandalf bridge equipment you are using, your bandwidth will be either 64Kbps or 128Kbps uncompressed. Gandalf's data compression combined with the WinFrame compression provide excellent performance for several simultaneous connections over the bridge.

2.	The LANLine bridges can be configured and managed remotely by any SNMP management system.

3.	After the ISDN connection is established, start the WinFrame client on the client PC. You may now connect to a remote application using the network protocols supported by your installation.

Notes  The Gandalf LANLine series bridge products are an excellent way to access remote LANs. Special features on the LANLine series bridges allow connections to be initiated or dropped transparently to users, giving the remote office a virtual presence on the central site LAN while keeping line charges at a minimum. Combined with data compression rates of up to 8:1, LANLine solutions can make ISDN an affordable alternative.

WinFrame greatly improves the performance of the ISDN bridge because the execution of the applications is performed on the WinFrame server, requiring only screen updates, keystrokes, and mouse activity to be sent across the bridge.


X.25 Connectivity and WinFrame

Overview

X.25 is the ITU-T (formerly CCITT) standard that defines the connection between a terminal and a public packet-switched network. X.25 describes the electrical connections, the transmission protocol, error detection and correction, and other aspects of the link. X.25 networks are normally accessible through asynchronous modems; an interface between the modem and the terminal - a packet assembler/disassembler (PAD) - is required. This interface may be internal or external. External and internal PAD solutions are supported by WinFrame servers.

An internal PAD is an intelligent adapter installed in the application server that connects to the public packet-switching network via a modem and provides X.25 services by appearing as a collection of COM ports. An external PAD is a stand-alone unit that connects to the public packet-switching network via a modem. It has multiple asynchronous RS-232 ports that can be connected to asynchronous ports on the application server.

Ports on an external PAD can be connected to multiple application servers to provide load balancing. This requires that the same users and applications be accessible from all application servers.

X.25 technology requires advanced knowledge and skill. This integration should be attempted only by engineers and technicians already familiar with X.25 technology. Each proposal should be preceded with a pilot test to verify the specific configurations and functions.

A typical X.25 configuration, showing both internal and external PADs, is shown below.

Configuring X.25 for WinFrame

X.25 was originally developed for dumb terminals using 7-bit ASCII and ASCII control characters to perform control functions such as flow control and link maintenance. The protocols used to control an X.25 link are X.29 and X.3. X.29 defines the procedures used to connect two separate packet switched networks; X.3 defines the protocol and parameters used to configure and control the operation of an X.25 link. Use X.29 on the host PAD to set the X.3 PAD parameters to values that allow data to flow properly between the WinFrame server and the client PCs.

The ICA protocol used by WinFrame uses 8-bit binary data and has its own set of non-ASCII control sequences that are not compatible with the default X.3 settings. Some of the changes required for WinFrame servers are:

Disable the Escape to Command Level character (DLE, CTRL-P)

Disable Echo

Disable XON/XOFF Flow Control

Use hardware flow control

Enable 8-bit data transfer

Some X.25 products may require user interaction before making a connection to the WinFrame server, for example to enter X.3 commands.

If you are using the WinFrame Win16 or Win32 clients, you can set the Display Terminal Window When Making Dial-In Connections option in the Preferences tab of the Remote Application Manager Settings menu. This will let you enter ASCII commands. Once the connection to the WinFrame server is initiated, the client will automatically switch to ICA mode when ICA data is detected.

The WinFrame DOS Client automatically switches to ASCII mode when ASCII data is detected. This allows you to type in any X.29 and X.3 data required to establish a connection to a remote WinFrame server. Once the connection is established, the WinFrame client automatically switches back to ICA mode when ICA data is detected. No automated scripting facility is available in the WinFrame client Remote Application Manager; however, the WinFrame client Dial-Up Manager and some RAS solutions do offer scripting facilities that can be used to automate the connection process.


WinFrame Server Configurations

Overview

The following sections contain information about installing WinFrame on the systems listed below:

ALR Revolution

Citrix WinFrame and Compaq Servers

Compaq Proliant 4500

Compaq Proliant 5000

Compaq Proliant 6000

Dell PowerEdge 4100

Hewlett-Packard NetServers

IBM PC Server 330

IBM PC Server 704

NetFrame NF9000


ALR Revolution

Overview

ALR manufactures high-end computer systems. Their Revolution series system provides scalability in the processing, memory, and disk subsystems that allow significant growth. Other available features, such as error correcting memory, hot swappable RAID configurations, and compact rack mounted systems, provide a powerful computing environment for running the WinFrame operating system.

Software Requirements

WinFrame Version 1.7 or higher

ADAC RAID adapter driver, if using the ADAC RAID controller

Before Installing WinFrame

If the ADAC RAID controller is not used, proceed to the next section.

If the ADAC RAID controller is being used:

1.	During the Power On Self Test (POST), make sure that the on-board Adaptec AHA-7880 recognizes the CD-ROM and that the ADAC RAID controller is also detected.

2.	During the POST, press CTRL+M to enter and configure the RAID environment.

Note  For performance reasons, it is not recommended to install the WinFrame operating system on hard drives that are in the RAID configuration. Use the RAID configured hard drives to store data.

Installing WinFrame

If the ADAC RAID controller is not used, install WinFrame following the directions in the WinFrame Installation Guide.

If the ADAC RAID controller is used:

1.	During the installation, after WinFrame detects the Adaptec AHA-7880 controller, press S to specify another device. Select Other and insert the ALR-supplied disk with the ADAC RAID controller driver.

2.	Continue installing WinFrame, following the directions in the WinFrame Installation Guide.


Citrix WinFrame and Compaq Servers

Note  This application note was supplied by Emerging Markets and Advanced Technology, Compaq Computer Corporation, Houston, TX. This document dated November, 1997 replaces any and all previous versions of this document.

Introduction

This white paper is intended for Compaq Field Systems Engineers (FSEs), resellers, and customers who install and maintain Citrix WinFrame thin-client/server software on Compaq server products. The white paper is the second release of the previous document "Configuring Compaq Servers in a Citrix WinFrame Environment" and provides additional up-to-date guidelines and configuration information to help you optimally configure Compaq servers in a WinFrame multiuser Windows application server environment.

Compaq has joined Citrix's Business Alliance Program to promote WinFrame software and Compaq server hardware as a low-cost ownership model for mission-critical enterprise computing. Together, Citrix WinFrame thin-client/server software and Compaq hardware offer customers an outstanding solution for high-performance computing and a cost-effective way to deploy, access, and manage business-critical applications throughout an enterprise.

Compaq is working closely with Citrix on future technologies for reducing Total Cost of Ownership (TCO) and providing complete end-to-end solutions. Certification and testing of current and future Compaq server platforms with WinFrame is a continuing commitment to assure compatibility and performance unmatched by other vendors.

WinFrame provides multiple users the ability to remotely execute Windows NT applications on a server over virtually any communications transport. WinFrame provides the familiar interface of Windows running on a Symmetrical Multiprocessing (SMP) system while reducing support and administrative costs associated with any network operating system.

WinFrame Version 1.7 New Features

WinFrame 1.7 is a multiuser Windows application server based on Windows NT 3.51 under license from Microsoft that supports enterprise application deployment using a thin client architecture. This network-centric approach includes Citrix ICA-based universal client software that works together with WinFrame multiuser application server software.

Enterprise Ready

Load balancing features allow multiple servers to be grouped and thus appear as a single server entity. When combined with support for SMP hardware that enables a single server to support hundreds of concurrent users, WinFrame now supports thousands of concurrent users for enterprise-wide scalability.

New License Scheme

WinFrame licenses are now serial numbers that are entered using the WinFrame Licensing utility. A "key diskette" is no longer required for installation, which greatly increases the ease of use. This also enables network-based installations or the loading of a server across the network. When the serial number is entered, an 8-character code is appended to the license number, which makes it unique. You must then contact Citrix to obtain an activation key. The activation key is based on the product's serial number and is used by the WinFrame Licensing program to enable the product. See the Citrix WinFrame Version 1.7 Activation Guide for additional information about WinFrame's activation key-based licensing system.

License Pooling

License pooling maximizes the license investment that an organization has made in WinFrame. Purchased licenses can now be spread across multiple servers in an organization, simplifying administration and utilizing resources more efficiently.

Load Balancing

This separately available option allows the creation of WinFrame server farms that dynamically route users either locally or across subnets with ICA gateways to maximize the performance to users by grouping servers and connecting users to the least loaded server in the group. Server farms help IS organizations more easily and cost-effectively service thousands of concurrent users across multiple WinFrame servers from a single point. The load balancing option also features "single system image" management, allowing administrators to manage multiple WinFrame servers as a single entity, including user and application administration and system management.

Increased Performance

Scalability improvements deliver better CPU performance on multiprocessor systems. Better compression has increased bandwidth utilization over LAN and remote node (PPP) connections by enabling ICA protocol compression to be turned on or off based on available bandwidth. For low-bandwidth dial-up and WAN connections, active ICA protocol compression provides reduced bandwidth utilization for LAN-like performance. For high-bandwidth LAN connections, deactivating compression reduces server load, which offers more efficient processor utilization on the server while still providing excellent ICA protocol performance.

Server Solutions

Citrix WinFrame Version 1.7 was used for testing Compaq servers for scalability and performance. Several new key features are supported in this release such as load balancing, which allows multiple servers to be grouped and appear as a single server entity and support hundreds of concurrent users. This document only covers single server configurations.

The test scripts used for testing the systems were created using Microsoft Visual Test 4.0. The Microsoft Office 95 suite of applications was used to simulate two categories of users. The same test scripts were used for all test scenarios documented in this paper.

Typical user - Typical Office 95 user with one instance of Word or Excel running; creating, editing, and saving documents of minimal complexity.

Power user - Office 95 power user with several instances of Word, Excel, and PowerPoint running; creating, editing, and saving complex documents.

Table 1 gives the approximate number of power and typical users supported per server, processor type, processor speed, and number of processors installed.

Figure 1 charts the power user results per server type and Figure 2 charts the typical user results per server type. The results shown are recommendations; the number of users could vary depending on application requirements and type of users.

Table 1 - Approximate Number of Power and Typical Users Supported

Server	Processor Type	Processor Speed	Number of Processors	Number of Typical Users	Number of Power Users
Prosignia 200	Pentium	166MHz	1	40	20
Prosignia 300	Pentium	90MHz	1	20	10
ProLiant 800	Pentium Pro	200MHz/ 256KB	2	65	30
ProLiant 850R	Pentium Pro	200MHz/ 256KB	2	65	30
ProLiant 1500	Pentium	133MHz	2	45	20
ProLiant 2500	Pentium Pro	200MHz/ 256KB	2	65	30
ProLiant 5000	Pentium Pro	200MHz/ 512KB	4	175+	100
ProLiant 6000	Pentium Pro	200MHz/ 512KB	4	175+	100
ProLiant 6500	Pentium Pro	200MHz/ 512KB	4	175+	100
ProLiant 7000	Pentium Pro	200MHz/ 512KB	4	175+	100
The number of power and typical users supported per server type depends on the processor type, speed, and the number of processors supported per server.

The ProLiant 5000, 6000, 6500, and 7000 servers support 175+ typical users and 100 power users. Although the four servers have different features, the servers have a dual-peer PCI bus architecture and support up to four Pentium Pro 200MHz/512KB processors.

The ProLiant 2500, 850, and 850R support two Pentium Pro 200MHz/256KB processors that enable the servers to support up to 65 typical users and 30 power users. The ProLiant 1500 is a dual processing server with slightly less performance due to using two Pentium 133MHz processors.

The Prosignia 200 and Prosignia 300 are uniprocessor servers. The Prosignia 200 supports up to 40 typical users and 20 power users with a single Pentium 166MHz processor, while the Prosignia 300 supports up to 20 typical users and ten power users with a single Pentium 90MHz processor.

Figure 1 - Approximate Number of Power Users Supported

Figure 2 - Approximate Number of Typical Users Supported

Server Performance Considerations

Server performance and the number of users a server supports depend on several factors. Tuning WinFrame involves determining what hardware resources are experiencing the greatest demand. The most critical areas are Processor, Memory, and Hard Disk resources.

Performance Monitor can be used to measure these objects on your WinFrame server and is a valuable tool in determining performance issues that may arise from the lack of these or other server resources. By monitoring and tuning the server, you can make the most efficient use of all the existing resources and upgrade the areas requiring additional resources.

Processor

Each process thread requires a certain number of processor cycles when it runs. If demand exceeds supply, long processor queues develop and system response suffers.

In the Processor object, monitor the following counters:

%Processor Time. Shows the percentage of elapsed time that a processor is busy executing non-idle threads

Interrupts/sec. Shows the number of device interrupts the processor is experiencing

If the %Processor Time counter consistently registers at or near 100%, the processors may be slowing the system response time down. If 100% processor utilization is consistent, check the processor queue length for excessiveness.

Memory

Memory usage is one of the most important factors in system performance. When memory demands exceed supply, the system begins paging to the hard disk. Some paging is acceptable, but excessive paging requires additional resources to be consumed on the system and performance decreases dramatically.

WinFrame memory requirements are for at least 16MB for the operating system, 4MB of memory per typical user, and 8MB per power user. Some applications may require additional memory per user.

The recommended size for the paging file is equivalent to the amount of RAM available in the system multiplied by 1.5.

In the Memory object, check the following counters:

Pages/sec. The number of pages read or written to the disk to resolve memory references to pages that were not in memory at the time of the reference.

Available Bytes. Indicates the amount of free physical memory.

Hard Disk

Good disk performance is an important factor to consider in overall system performance. Hard disk performance affects areas such as virtual memory and the elapsed time required to load applications.

In the PhysicalDisk object, check the following counters:

% Disk Time. Percentage of elapsed time that a selected disk drive is busy servicing read or write requests, including time waiting in the disk driver queue.

Disk Queue Length. Pending disk I/O requests.

Application Considerations

Applications Resource Requirements

32-Bit Applications

Win32 (32-bit) versions of applications should be used whenever possible. They perform much better in a WinFrame environment and require fewer server resources than 16-bit versions.

16-Bit Applications

Win16 (16-bit) applications consume additional resources on the WinFrame server due to a process called WOW (Win16 on Win32) that translates 16-bit applications in enhanced mode. This process reduces the number of users supported per processor by approximately 20% and requires about 25% more memory per user.

Testing Results

Test 1

Server

ProLiant 7000, four Pentium Pro 200MHz processors with 1024KB level 2 cache, 256MB memory, two 4.3GB Wide-Ultra SCSI drives, one Netelligent 10/100 TX PCI UTP controller, one Integrated Wide-Ultra SCSI-3 controller

Clients

Ten Deskpro 2000 Model 5133 with one Pentium 133MHz processor, 16MB memory, one Netelligent 10/100 TX PCI controller, Windows 95, 640x480 resolution, 16 colors

Objective

This power user test scenario shows the effect in Completion Time as users are added to the test configuration. To use as a base line for the Completion Time, a 486/66 Prosignia VS completed the power user test script standalone in 228 seconds. Figure 3 shows the completion time of the ProLiant 7000 server with the 1024KB level 2 cache processors. Figure 4 shows the ProLiant 7000 server with the 512KB level 2 cache processors.

Figure 3 − Number of Power Users

Figure 4 − Number of Power Users

Test 2

Server

ProLiant 7000, 1-4 Pentium Pro 200MHz processors with 1024KB level 2 cache, 256MB memory, two 4.3GB Wide-Ultra SCSI drives, one Netelligent 10/100 TX PCI UTP controller, one Integrated Wide-Ultra SCSI-3 controller

Clients

Ten Deskpro 2000 Model 5133 with Pentium 133MHz processor, 16MB memory, one Netelligent 10/100 TX PCI controller, Windows 95, 640x480 resolution, 16 colors

Objective

Figure 5 shows the results of adding additional processors to the system. Completion time decreases significantly as processors are added.

Figure 5

Test 3

Server

ProLiant 7000, four Pentium Pro 200MHz processors with 1024KB level 2 cache, 256MB memory, two 4.3GB Wide-Ultra SCSI drives, one Netelligent 10/100 TX PCI UTP controller, one Integrated Wide-Ultra SCSI-3 controller.

Clients

Five Deskpro 2000 Model 5133 with Pentium 133MHz processor, 16MB memory, one Netelligent 10/100 TX PCI controller, Windows 95, 640x480 resolution, 16 colors, S3 TRIO GA V2 graphics controller

Five Prosignia VS 486/66MHz processors, 16MB memory, one Netflex-2 ENET-TR controller, Windows 95, 640x480 resolution, 16 colors, Cirrus Logic 5420 graphics controller

Objective

Figure 6 shows that workstations also have an effect on overall test completion time. Workstation processor speed and graphics controllers play a significant roll in time required in completing the power user test script.

Figure 6

Test 4

Server

ProLiant 5000, four Pentium Pro 200MHz processors with 512KB level 2 cache, 256MB memory, two 4.3GB Wide-Ultra SCSI drives, one Integrated Wide SCSI-2 controller, 28.8Kbps external modem

Clients

One Deskpro 2000 Model 5133 with Pentium 133MHz processor, 16MB memory, Windows 95, 640x480 resolution, 256 colors. 28.8Kbps external modem

Objective

Figure 7 charts the results of three methods of remotely accessing the WinFrame server.

Figure 7

High Availability Options

Availability of business-critical applications throughout an enterprise is a crucial requirement. Compaq has developed several features in its server product line to ensure minimal down time and provide the highest availability possible. These features include:

Standby Recovery Server

Standby Recovery Server is the implementation of the Recovery Server Option (RSO) in which two servers are paired and connected to a single storage environment. One of the servers is active while the other remains in idle backup mode. Both servers are attached to a common set of ProLiant Storage Systems/F1 with a single copy of WinFrame and associated system data. If the primary server fails, the recovery server is brought into service and takes the place of the active server. For more information on Standby Recovery Server, refer to the white paper entitled Compaq Standby Recovery Server (document number 287a/1196).

On-Line Recovery Server

On-Line Recovery Server is the implementation of the Recovery Server Option (RSO) in which two servers are paired and connected to a pair of independent storage environments. If one of the servers fails, the other server inherits the storage environment and workload of the failed server. For more information on Online Recovery Server, refer to the white paper entitled Compaq On-Line Recovery Server (document number 286a/1196).

Hot Pluggable Drives

Many Compaq servers are equipped with hot pluggable SCSI drive cages that permit you to plug and unplug SCSI drives from the system while the system is running. This allows you to replace failed drives in RAID disk arrays without shutting down the server.

Network Interface Controller Redundancy

Also known as the Advanced Network Control Utility, this feature provides the ability to merge two similar network controllers into a controller pair. In such a pair, one controller is the active controller while the other remains in standby mode. If the active controller fails, the Advanced Network Control Utility switches all network traffic to the backup controller.

Online Storage Controller Recovery Option (OSCRO)

Compaq Online Storage Controller Recovery Option provides mass storage controller redundancy by merging two SMART-2 controllers into a controller pair. In such a pair, one controller is active while the other remains in standby mode. If a problem occurs with the active controller, the device driver switches traffic to the standby controller without loss of data or interruption of service. Working in conjunction with RAID technology, OSCRO provides extended fault tolerance for mission critical servers.

Redundant Power Modules

Up to three CPU board converters (Power Safe Modules) can be installed on each CPU board, allowing for two independent CPU board converters to service two independent CPUs, with the third acting as a redundant converter that operates only when one or both of the other two converters fails.

Redundant Power Supply

Some Compaq servers allow optional redundant power supplies to ensure that the server continues operating even when a power supply fails.

Redundant Hot Plug Power Supply

Some Compaq servers have the option of being equipped with redundant hot pluggable power supplies. These servers can accept up to three power supply units. One unit acts as the primary power supply, with the others serving as hot spares. If a power supply fails, one of the redundant power supplies takes over. The administrator can replace the failed power supply without shutting down the server or impacting the other power supplies.

Redundant Fans

Some of the Compaq servers are equipped with redundant fans, which ensure proper airflow around temperature-sensitive components in the event of a single fan failure.

Redundant Hot Plug Fans

Some Compaq servers have hot plug fans supporting the ability to replace a fan without shutting the system down.

Compaq Support Software for Windows NT

The Compaq SSD (System Software Diskette) for Windows NT contains device drivers and utilities that enable you to take advantage of specific capabilities offered on Compaq products. These drivers are provided for use with Compaq hardware only.

Citrix WinFrame is a multiuser Windows application server based on Windows NT 3.51 under license from Microsoft. The Compaq SSD for Windows NT 3.51 Version 1.26 A has the needed support drivers to function and complement the features included in the Compaq server platforms in a WinFrame installation.

The Compaq SSD for Windows NT 3.51 Version 1.26 A is packaged into four diskettes. Only the first two diskettes are required to support WinFrame on Compaq server products.

Compaq Support Software for Microsoft Windows NT 3.51 Diskette 1

This diskette contains all the main setup installation files, the help file, and the following drivers for Windows NT 3.51:

Network (NetFlex Family of Controllers)

SCSI (32-Bit SCSI-2 Controllers and Drive Array Controllers)

ProLiant Storage System Support

System Management Support

Compaq Support Software for Microsoft Windows NT 3.51 Diskette 2

This diskette contains:

Uninterrupted Power Supply (UPS)

Online and Standby Recover Server

Remote Insight Management

Hardware Abstraction Layer (HAL) for Windows NT 3.51

Compaq Integrated Management Display Utility (CPQLCD)

The following table lists Compaq controllers and devices that are supported either by the Compaq SSD for Windows NT or by the Windows NT standard product. An X in the Compaq column indicates the device driver must be installed from the Compaq SSD for Windows NT. An X in the WinFrame column indicates the device driver is included in the WinFrame standard product. An I in the WinFrame column indicates that although the standard package contains the device driver, an updated or Compaq-enhanced version is supplied with the Compaq SSD for Windows NT and should be installed.

Table 2 - Supported Compaq Controllers and Devices

Component	Compaq	WinFrame
Hardware Abstraction Layer (HAL) Single Processor Systems Multiprocessor Systems with APIC Support	X X	I I
Drive Array SMART-2DH Controller SMART-2/P and SMART-2/E Controllers SMART/IDA-2/IDA/IAES Controllers SMART-2SL Controller	X X X X	I I I I
SCSI Controllers Integrated 32-Bit Dual Wide-Ultra SCSI-3 Controller Integrated 32-Bit Fast-SCSI-2 Controller Integrated 32-Bit Fast-SCSI-2/P Controller Integrated 32-Bit Fast-Wide SCSI-2/P Controller Integrated 32-Bit Fast-Wide SCSI-2/E Controller Integrated 32-Bit Wide-Ultra SCSI Controller 32-Bit Fast-SCSI-2 Controller Option Board 32-Bit Fast-Wide SCSI-2/P Controller Option Board 32-Bit Fast-Wide SCSI-2/E Controller Option Board 32-Bit Wide-Ultra SCSI-2/P Controller Option Board	X X X X X X X X X X	I I I I I I
SCSI Tape Devices 10/20-GB DLT Drive 15/30-GB DLT Drive 2/8 GB DAT Drive 4/16-GB TurboDAT Drive 5.0-GB DAT Drive 1.3-/2.0-GB DAT Drive 1.2-GB ACA Tape Drive 525-MB ACA Tape Drive 320-/525-MB (Wangtek) Tape Drive 35/70-GB DLT Tape Drive Internal TurboDAT AutoLoaders DLT Tape Array with JETserve DLT Tape Array with no software DLT Tape Array with software		X X X X X X X X X X X X X X
Network Interface Controllers Compaq Netelligent 10 T/2 PCI UTP/Coax Controller Compaq Netelligent 10 T ISA UTP Controller Compaq Netelligent 10 T/2 ISA UTP/Coax Controller Compaq Netelligent 10 T PCI UTP Controller Compaq Netelligent 10/100 TX PCI UTP Controller Compaq Netelligent Dual 10/100 TX PCI UTP Controller Compaq Netelligent 4/16 TR PCI UTP/STP Controller Compaq Netelligent 4/16 TR PCI IBM UTP/STP Controller Compaq Netelligent 4/16 TR ISA UTP/STP Controller NetFlex ENET-TR Controller NetFlex-2 ENET-TR Controller NetFlex-2 TR Controller NetFlex-2 DualPort ENET Controller NetFlex-2 DualPort TR Controller Integrated NetFlex ENET-L Controller Integrated NetFlex ENET/PCI Controller NetFlex-3/P Controller NetFlex-3/E Controller NetFlex ENET/ISA Controller	X X X X X X X X X X X X X X X X	I I I I I I I I I I I I I I X X X
Network Module Upgrade Option 100 VG Module 10/100 TX Module 100 Base-FX Module	X X X
Other ProLiant Storage System and ProLiant Storage System/U System Health Logs/Automatic Server Recovery Compaq Recovery Server Option Compaq Online Recovery Server Option	X X X X
Total Cost of Ownership

WinFrame's thin-client/server design lowers the Total Cost of Ownership through the deployment of business-critical applications over heterogeneous computing environments without loss of application performance, data security, or administrative control.

Enterprise applications execute on the WinFrame application server, while only the graphical user interface displays on client devices. WinFrame's thin-client/server approach to enterprise computing provides the high-performance and universal access needed by users, while the multiuser application server design offers IS professionals the economic benefits of single-point management and control.

WinFrame's single-point application management reduces the cost associated with application ownership because all application additions, updates, user configuration, and support occur centrally from the WinFrame application server.

Together with Compaq's superior Total Cost of Ownership investment protection through planned upgrades to future technologies, Compaq and Citrix have joined forces to reduce the financial burden required to support enterprise-wide application deployment and management, while maintaining a price and performance leadership in the industry.

Conclusion

Compaq servers together with Citrix WinFrame offer customers a proven solution for deploying applications in a thin-client/server architecture. With the outstanding performance delivered by Compaq server products and the WinFrame Version 1.7 operating system, the combined products give the ability to support 175+ users per server. With the optional WinFrame load-balancing feature, multiple servers can be grouped to support the needs of thousands of users.

Traditional application deployment is time consuming and expensive, requiring administrators to spend much time installing and updating applications. Citrix WinFrame addresses these issues by enabling application installation, updates, and additions to be done once at the server and then be instantly available to all users.

The Compaq server product line meets any sizing requirements for deploying Citrix WinFrame thin-client/server solutions for small to medium business needs as well as large enterprise environments. The combination gives the ability to scale from dozens to thousands of users and maintain application consistency throughout the corporation.

Notice

The information in this publication is subject to change without notice.

Compaq Computer Corporation shall not be liable for technical or editorial errors or omissions contained herein, nor for incidental or consequential damages resulting from the furnishing, performance, or use of this material.

This publication does not constitute an endorsement of the product or products that were tested. The configuration or configurations tested or described may or may not be the only available solution. This test is not a determination of product quality or correctness, nor does it ensure compliance with any federal, state, or local requirements. Compaq does not warrant products other than its own strictly as stated in Compaq product warranties.

Product names mentioned herein may be trademarks and/or registered trademarks of their respective companies.

Compaq, Deskpro, Compaq Insight Manager, Systempro, Systempro/LT, ProLiant, SmartStart, and NetFlex are registered at the United States Patent and Trademark Office.

Netelligent, ProSignia, and Systempro/XL are trademarks and/or service marks of Compaq Computer Corporation.

Copyright © 1997 Compaq Computer Corporation. All rights reserved. Printed in the U.S.A.

Citrix, WinFrame, and ICA are registered trademarks of Citrix Systems, Inc.

Microsoft, Windows, Windows NT, Windows NT Server and Workstation are trademarks and/or registered trademarks of Microsoft Corporation.


Compaq Proliant 4500 Server

Overview

This section describes how to install or upgrade WinFrame on a Compaq Proliant 4500 system. Two procedures are documented:

Upgrading from WinFrame Version 1.5 to Version 1.6

Installing WinFrame Version 1.6

Upgrading from WinFrame Version 1.5 to Version 1.6

When upgrading a WinFrame system from Version 1.5 to Version 1.6 on a Compaq Proliant 4500 system, the error: "STOP:0x0000007B - INACCESSIBLE_BOOT_DEVICE" may occur.

This message occurs when WinFrame is unable to load the correct SCSI driver. During the upgrade, WinFrame setup incorrectly removes the Registry key for the Compaq 32-bit SCSI device driver.

Before upgrading WinFrame Version 1.5 to Version 1.6, perform the following steps to apply the latest Windows NT device drivers from Compaq.

1.	Download the file WF_4500R.EXE from the Citrix BBS (954-346-9004) or the Citrix FTP site (ftp.citrix.com/winfrm15). This self-extracting file contains all the files discussed in this section, including:

WF_4500R.DOC	An application note in Microsoft Word 6.0 format
INSPECT.TXT	The Compaq inspection report for the machine used in testing at Citrix
CPQ32FS2.SYS	The Compaq 32-bit SCSI driver from SSD 1.17
TXTSETUP.SIF	Modified file for Disk 1 of WinFrame Version 1.6 boot disks
2.	Download Version 1.17, Revision C of the Compaq Software Support Diskette (SSD) for Windows NT Version 3.5x from the Compaq Web site. The SSD is available as the self-extracting file SP1578.EXE in the Windows NT section on URL http://www.compaq.com.

3.	On the WinFrame Version 1.5 server, start a command prompt session and execute the command setbuild /ms. This step is necessary to avoid the error message "This Compaq SSD for Windows NT Version 1.17 does not support Windows NT 3.1 and cannot be installed" when running the Compaq SSD Setup program.

4.	Run SETUP.CMD from Disk 1 of the Compaq SSD.

5.	When asked which HAL to install, choose Compaq SystemPro Multiprocessor for Windows NT Version 3.51.

6.	If you are using the embedded Fast SCSI-2 controller on the Proliant 4500, install the Compaq 32-bit SCSI-2 controller driver from the SSD.

7.	Install the correct network interface card (NIC) device driver for your specific Compaq NIC; for example, the Compaq NetFlex-3 Controller.

8.	Start a command prompt session. Type setbuild /oem and press ENTER.

9.	Reboot the WinFrame Version 1.5 server and make sure that the SSD drivers function normally.

Before proceeding with the WinFrame Version 1.5 to 1.6 upgrade, you must modify the TXTSETUP.SIF file on the WinFrame Version 1.6 Setup boot disk. Make a backup copy of the existing TXTSETUP.SIF file on Disk 1 of the WinFrame Version 1.6 Setup diskettes. Copy the TXTSETUP.SIF file included in WF_4500R.EXE to Disk 1. Copy the file CPQ32FS2.SYS included in WF_4500R.EXE to Setup Disk 3.

After copying the file TXTSETUP.SIF to Disk 1 and the file CPQ32FS2.SYS to Disk 3, insert the WinFrame Version 1.6 Setup boot diskette in the diskette drive and restart the system. Setup will detect and install the Compaq 32-bit SCSI controller driver (if you are using the embedded SCSI controller). If the Compaq multiprocessor HAL was installed on the WinFrame Version 1.5 partition, the following message may be displayed during the text-based portion of Setup:

"Setup has determined that the following file did not originate from Microsoft: HALL.DLL..."

When this message is displayed, press ESC to retain the Compaq HAL. The rest of the upgrade procedure will proceed normally.

Installing WinFrame Version 1.6

WinFrame Version 1.6 Setup does not detect the Compaq embedded SCSI controller during installation. Therefore, Setup cannot use any SCSI devices that are attached to the embedded SCSI controller.

A new installation may prompt the user for Setup Disk #4 during a CD-ROM installation. This error occurs when Setup fails to detect the Compaq 32-bit SCSI driver. Because the CD-ROM drive is controlled by the SCSI driver, it is not recognized and Setup searches for the next diskette.

The Compaq 32-bit SCSI-2 controller driver must be installed on the WinFrame server during the text-based portion of Setup if the embedded SCSI controller is in use. To install the Compaq SCSI-2 driver, follow the procedure below.

1.	During the text-based portion of installation, Setup attempts to detect all mass storage devices. If any such devices are detected, Setup prompts the user to install any other SCSI device drivers. Type s to install another SCSI device.

2.	From the list, select Other SCSI Devices.

3.	Insert the Compaq SSD Version 1.17 Revision C disk in the diskette drive and press ENTER.

4.	Select the Compaq 32-bit SCSI-2 controller from the list.

5.	The device controller is installed from diskette and Setup continues.

Remarks

If you attempt to install the Compaq Multiprocessor HAL for Windows NT Version 3.51 during a WinFrame installation, you will receive a "STOP: 0x00000079" trap. This trap is due to a HAL mismatch.

During WinFrame installation, do not install the Compaq multiprocessor HAL. If you install a third-party HAL during installation, you must change the machine type during the text-based portion of WinFrame setup. WinFrame Setup detects the Proliant server as a Compaq SystemPro or 100% Compatible. Do not change this machine type. Leaving the machine type as "Compaq SystemPro or 100% Compatible" installs the Microsoft multiprocessor HAL. When installation is complete, install the Compaq multiprocessor HAL by running SETUP.CMD from the SSD diskette.


Compaq Proliant 5000 Server

Overview

This section describes how to install WinFrame on Compaq Proliant 5000 systems.

The Compaq Proliant 5000 implements a symmetrical multiprocessor (SMP) architecture that supports the installation of multiple system processors. For maximum system performance, it is recommended that the Compaq multiprocessor Hardware Abstraction Layer (HAL) available on the Compaq Software Support Diskettes (SSD) be used with WinFrame. However, attempting to install the Compaq multiprocessor HAL for Windows NT Version 3.51 during a WinFrame installation can cause the system to trap with a "STOP: 0x00000079" message. A solution for this problem is documented below.

Installing WinFrame

During WinFrame installation, do not install the Compaq multiprocessor HAL. If you install a third-party HAL during installation, you must change the machine type during the text-based portion of WinFrame Setup. WinFrame Setup detects the Proliant server as a Compaq SystemPro or 100% Compatible. Do not change this machine type. Leaving the machine type as "Compaq SystemPro or 100% Compatible" installs the Microsoft multiprocessor HAL. When installation is complete, install the Compaq multiprocessor HAL by running SETUP.CMD from the Compaq Software Support Diskettes. Use the following procedure to install the Compaq multiprocessor HAL.

1.	Install WinFrame following the directions in the Installation Guide. During installation, WinFrame detects the SCSI driver as NCR PCI 53C810.

2.	During Network installation, when Setup asks if you want to auto-detect your network adapter card, do not choose auto-detect. Instead, choose Manual and select OEM disk. Insert the Compaq SSD diskette into the floppy drive and enter the path to the Compaq NetFlex 3 NIC drivers (A:\Net\Netflx3). Click on OK. The Compaq NetFlex 3 drivers are installed.

3.	After installation is complete, reboot the server and logon as an administrator.

4.	At a command prompt, type setbuild /ms and press ENTER.

5.	Run SETUP.CMD from the Compaq SSD diskette.

6.	Follow the displayed directions to install the Compaq multiprocessor HAL and the appropriate SCSI drivers for your system.

7.	Reboot the server.

Remarks

Compaq recommends using the Compaq multiprocessor HAL with WinFrame because it is designed to take advantage of specific features in the Compaq hardware. The default HAL that ships with WinFrame works with Compaq Proliant servers but it is not as efficient as the Compaq HAL.

The Compaq Proliant 5000 has a dual PCI bus architecture. The first PCI bus uses slots 1 through 4, the second PCI bus uses slots 5 through 8. This allows the Compaq Proliant servers to make very efficient use of PCI peripherals. Compaq recommends that PCI adapters be staggered across the two PCI buses. For example, if the system contains four PCI cards, the first two cards should be positioned in slots 1 and 2 and the second two cards should be positioned in slots 5 and 6. This provides maximum throughput on the PCI buses.

Using EISA cards in the Compaq Proliant 5000 is not recommended. The EISA bus is an extension to the first PCI bus in the system. Data from EISA peripherals must pass from the EISA bus to the PCI bus and then to the system bus, which reduces bus throughput. Compaq recommends the use of PCI peripherals only in the Proliant 5000 server.


Compaq Proliant 6000 Server

Overview

The Compaq Proliant 6000 server incorporates a symmetrical multiprocessor (SMP) architecture that supports the installation of up to four system processors. For maximum system performance, use the Compaq multiprocessor Hardware Abstraction Layer (HAL) supplied on the Compaq Software Support Diskettes (SSD) when installing WinFrame.

Hardware Tested

Compaq Proliant 6000

Four Pentium Pro 200MHz processors

Two Compaq Ultra Wide SCSI controllers (embedded)

Netflex-3 network adapter

Four 4GB SCSI drives

Software Requirements

Compaq Smart Start CD-ROM Version 3.30 or higher with Program Reference disk

WinFrame Version 1.6 or later

Installation Overview

Run Smart Start to prepare the system for installation.

Install the WinFrame server software with Compaq-specific HAL and network drivers.

Smart Start Installation

This section describes how to configure the Compaq Proliant 6000 server with the correct hardware settings for installing WinFrame. This includes adapter card recognition and configuration, and MPS hardware settings. This procedure also creates several diskettes containing device drivers used during WinFrame installation.

1.	Boot the server using the Compaq Smart Start CD-ROM.

2.	Select the US versions for all hardware settings.

3.	Select Manual Installation.

4.	Place the Compaq Program License Diskette into drive A or other appropriate drive.

5.	Select WinFrame as the operating system to be installed from the menu.

6.	Select WinFrame 1.6 (NTver3.51).

7.	You can review and modify hardware settings or install an ISA board. Continue with Smart Start installation when finished.

8.	The system will reboot and partition the system.

9.	Select whether or not to complete registration of the hardware.

10.	Select to create software support diskettes.

11.	Select Create Software Diskettes from CD Only.

12.	Select to create the following diskettes within the COMPAQ folder:

Compaq Support Software for Microsoft Windows NT 3.51 and 4.0, Version 1.21A

Note  At the time this application note was written, SSD version 1.21A was used. Please contact Compaq to receive their latest SSD drivers or download them from Compaq's Web site at http://www.compaq.com.

13.	Obtain four formatted floppy disks and label them with the appropriate disk names. Follow the on-screen instructions for creating the floppy disks.

14.	Select Next until the Compaq installation program requests that you remove the Smart Start CD-ROM from the CD-ROM drive.

15.	Remove the Smart Start CD-ROM and place the WinFrame CD-ROM in the CD-ROM drive. Place the WinFrame setup floppy disk into Drive A.

16.	The system will reboot and start installing WinFrame.

WinFrame Installation

This section describes how to install the HAL provided by Compaq, the SCSI controller driver, and the Compaq network adapter during WinFrame installation.

1.	WinFrame Setup Disk 1 should be in the diskette drive and the WinFrame CD-ROM should be in the CD drive from Step 16 above.

2.	When prompted, insert Setup Disk 2 and press ENTER. Select Custom Setup when prompted for the installation type.

3.	Press ENTER for disk detection and insert Setup Disk 3 when prompted.

4.	Type s to specify additional drivers.

5.	Select Other and place the Compaq SSD disk 1 into the floppy drive.

6.	Select Compaq 32-bit SCSI-2 Controllers for Windows NT. 3.51 from the list.

7.	After the device driver is installed, press ENTER to continue with the WinFrame installation. You will be prompted to place the WinFrame Server Setup disk 3 back into the floppy drive.

8.	The next step is to install the HAL provided by Compaq. The HAL can be selected when the WinFrame installation has determined the hardware and software components of the system. There are five choices that represent Computer, Display, Keyboard, Keyboard layout, and Pointing device. Using UP ARROW, highlight the section under computers that says MPS Multiprocessor PC and press ENTER.

9.	Select Other to install the HAL driver.

10.	Place Compaq SSD Disk 1 into the diskette drive and press ENTER.

11.	Select Compaq MPS Multiprocessor for Windows NT 3.51 from the list.

12.	Press ENTER and continue with the installation as described in the WinFrame Installation Guide.

Note  The Smart Start installation utility creates a 4GB partition on Drive C. It is not recommended that you install WinFrame on a FAT partition greater than 2GB. Partitions greater than 2GB should use the NTFS file system. If you will be using the FAT file system, press d to delete the 4GB partition on Drive C. Create a new partition equal to or less than 2GB for installing WinFrame because the FAT file system does not support a partition larger than 2GB.

13.	The network adapter in the Compaq 6000 server is not detected by WinFrame setup. When the Detecting Network Adapter dialog box appears, select Do Not Detect and choose Continue. From the pull-down menu select <Other> Requires Disk From Manufacturer.

14.	Place the Compaq SSD disk 1 into the floppy drive and type a:\net\netflx3.

15.	Select the Netflex-3 driver.

16.	Continue with the installation as described in the WinFrame Installation Guide.

Remarks

Compaq recommends using the Compaq multiprocessor HAL with WinFrame because it is designed to take advantage of specific features in the Compaq hardware. The default HAL that ships with WinFrame works with Compaq Proliant servers but it is not as efficient as the Compaq HAL.

The Compaq Proliant 6000 has a dual PCI bus architecture. The first PCI bus uses slots 1 through 5, the second PCI bus uses slots 6 through 10. This allows the Compaq Proliant servers to make more efficient use of PCI peripherals. Compaq recommends that PCI adapters be staggered across the two PCI buses. For example, if the system contains four PCI cards, the first two cards should be positioned in slots 1 and 2 and the second two cards should be positioned in slots 6 and 7. This provides maximum bus throughput.

Using EISA cards in the Compaq Proliant 6000 is not recommended. The EISA bus is an extension to the first PCI bus. Data from EISA peripherals must pass from the EISA bus to the PCI bus and then to the system bus, which reduces bus throughput. Compaq recommends the use of PCI peripherals only in the Proliant 6000 server.


Dell PowerEdge 4100/200

Overview

This application note describes how to install WinFrame on a Dell PowerEdge 4100 system.

The Dell PowerEdge series systems are high-speed, upgradeable PC servers designed around the Intel Pentium Pro family of microprocessors. The PowerEdge 4100 systems provide both Extended Industry-Standard Architecture (EISA) and high-performance Peripheral Component Interconnect (PCI) expansion slots. The PowerEdge 4100 series comes in two models: the 4100/180 equipped with one or two 180MHz Pentium Pro processors (each with 256KB of Level 1 cache), and the 4100/200 equipped with one or two 200MHz Pentium Pro processors (each with 512KB of Level 1 cache). The 4100 series has an upper limit of 1GB of RAM. Optionally, the 4100 may also be equipped with the Dell PowerEdge RAID II controller.

Software Requirements

WinFrame Version 1.6 or higher

Dell Server Assistant CD-ROM Version 1.30 or later

Installing WinFrame

1.	Insert the Dell Server Assistant CD-ROM into the CD-ROM drive of the PowerEdge 4100 and power on the Dell machine. The Dell Server Assistant software will boot from the CD-ROM. From the Dell Server Assistant CD-ROM menu, select Create Diskettes. Follow the instructions on screen to create the Dell support diskettes.

2.	Begin installing WinFrame using the instructions in the Installation Guide and Quick Install Guide.

3.	Select Custom Install (not Express Install) when prompted for the installation type and press ENTER to continue.

4.	WinFrame Setup displays all recognized SCSI controllers (there may be none present). Press s to configure additional SCSI controllers.

5.	Expand the list of additional SCSI controllers, select Other (located at the end of the list), and press ENTER. You are prompted for a driver diskette.

6.	Insert the Dell PowerEdge WinFrame 1.6/Windows NT 3.51 Drivers diskette that was created previously, and click OK. The device drivers on the diskette are displayed. Select the Adaptec AHA-2940/AIC-78xx (PCI) NT 3.51 driver and press ENTER to continue.

7.	If the PowerEdge RAID II Controller is installed in the PowerEdge 4100, repeat Steps 4 through 7 and install the Dell PowerEdge RAID II Controller driver from the Dell PowerEdge WinFrame 1.6/Windows NT 3.51 RAID II Controller Driver diskette.

8.	During the network configuration portion of Setup, select Other for the network interface card type and use the Dell PowerEdge WinFrame 1.6/Windows NT 3.51 Driver diskette to install the appropriate network interface card driver for your configuration.

9.	Complete the WinFrame installation and boot WinFrame. Dell provides video device drivers on a separate diskette. The video driver cannot be changed during Setup.

10.	To install the Dell video drivers after installation is complete, logon as an administrator at the console of the WinFrame server. Insert the Dell PowerEdge WinFrame 1.6/Windows NT 3.51 Drivers diskette and double-click on Control Panel in the Main program group. When Control Panel starts, double-click on Display. The Display Settings dialog appears. Select Change Display Type. The Display Type dialog appears. Click on Change. The Select Device dialog appears. Select Other. Type a:\ati in the text box that appears and press ENTER. Select ATI Graphics Accelerators from the list and click Install. Confirm your choice and then select and test a screen resolution, refresh frequency, and color palette. When done, restart WinFrame when instructed.

Installing the Dell PowerEdge RAID II Controller Console

1.	The PowerEdge RAID II Controller console should be installed after WinFrame installation is complete. From the console, logon as an administrator.

2.	From the Program Manager, open the File menu and select Run. Insert the Dell PowerEdge WinFrame 1.6/Windows NT 3.51 RAID II Controller Driver diskette into drive A. Type a:\setup in the text box of the Run menu and press ENTER to begin installation. Follow the displayed instructions.

3.	When the installation is complete, the PowerEdge RAID II Console is in a personal (not common) program group in the Program Manager.


Hewlett Packard NetServers

Note  This application note was supplied by Hewlett Packard, Network Server Division, 5301 Stevens Creek Boulevard, P.O. Box 58059, Santa Clara, CA 95052-8059, USA. All trade names referred to are the Servicemark, Trademark, or Registered Trademark of the respective manufacturers.

The information contained in this document is subject to change without notice.

Introduction

This note describes how to install Citrix WinFrame on Hewlett Packard (HP) NetServer LX and LH Series.

Hewlett Packard NetServers

HP NetServer systems incorporate industry-standard interfaces and include the following features:

Designed with Intel Pentium Pro processors

Bring high availability to mission-critical environments with features such as:

Advanced disk arrays

Hot-swap components

Redundant power supplies

ECC memory

Memory scrubbing

Automatic Server Restart

NetServer Navigator helps with set up and configuration

NetServer Assistant provides proactive alerting and problem resolution

OpenView network management software offers network mapping and alarm management

ClusterView makes monitoring and management of server clusters easy

Remote Assistant (optional) handles emergency access and remote troubleshooting

Installation Instructions

Before Running Setup

WinFrame is based on Microsoft Windows NT 3.51. Before beginning the WinFrame installation, use the HP NetServer Navigator CD-ROM to create a device driver diskette. Be sure to select Windows NT 3.51 when using the HP Navigator CD-ROM to create a driver diskette for WinFrame.

Please refer to the documentation included with your NetServer for detailed instructions on using the HP NetServer Navigator CD-ROM and preparing your system for Windows NT 3.51 installation.

Installing WinFrame

1.	Install WinFrame using the diskettes and CD-ROM shipped in the WinFrame package. Boot your NetServer using the WinFrame Setup Boot Disk.

2.	Follow the WinFrame installation procedures. Be sure to select Custom Setup when prompted.

3.	After selecting Custom Setup, at the next screen, press s to Skip Mass Storage Device Detection.

4.	At the next screen, press s again to configure additional SCSI adapters. WinFrame Setup displays a list of options. Select Other (Requires Disk Provided by a Hardware Manufacturer).

5.	The installation program prompts you to insert the manufacturer-supplied hardware support disk into drive A. Insert the HP NetServer Microsoft Windows NT 3.51 Drivers Diskette and press ENTER.

Note  Use the HP NetServer Navigator CD-ROM to create a Windows NT 3.51 driver diskette. Be sure to select the Windows NT 3.51 environment when using the HP Navigator CD-ROM to create a driver diskette for WinFrame.

6.	A window displays "Adaptec AHA-2940/AIC-78xx (PCI) Windows NT 3.51." Select this driver and press ENTER to install. This driver supports the embedded SCSI controller and the Adaptec 2940 controller.

Repeat Steps 4-6. Select the Hewlett-Packard NetRAID Adapter if your system has the HP NetRAID Adapter. Press ENTER to install.

Repeat Steps 4-6. Select the Hewlett-Packard Disk Array Driver if your system has the HP Disk Array Controller. Press ENTER to install.

Repeat Steps 4-6. Select the Adaptec AHA-2740/AIC 77xx (EISA) Windows NT 3.51 Driver if your system has the HP EISA Fast SCSI-2 controller (D2078B). Press ENTER to install.

Note  Hewlett Packard recommends that you install the driver for the booting SCSI controller first. The driver installation sequence above assumes that the boot drive is attached to the embedded controller.

7.	Continue with WinFrame installation. At the Resource screen, the computer type is identified as Multiprocessor PC or Standard PC. This is correct.

Note  For LS, LX Pro, LXe Pro uniprocessor systems only, HP recommends that you highlight the computer type and select MPS Multiprocessor PC. The system can then be upgraded to multiprocessor in the future without the need to reinstall WinFrame. The MPS Multiprocessor PC selection also fixes a problem with slow keyboard response with old DOS applications.

8.	Proceed with the rest of the installation. If your system includes an HP DeskDirect 10/100 TX PCI LAN adapter card, please see "Installing HP DeskDirect 10/100 TX PCI LAN Adapter" below when the Network Adapter Card Detection screen appears during installation. For additional information, please see the WinFrame Installation Guide.

Installing HP DeskDirect 10/100 TX PCI LAN Adapter

1.	The driver for your network adapter card can be installed as part of the WinFrame installation. During WinFrame installation, the system will reboot and continue with the graphical installation. When you get to the Network Adapter Card Detection screen, WinFrame Setup asks if you want to detect the network adapter card in your computer. Select the Do Not Detect button. On the next screen, choose Continue to pick a network card manually. Setup then displays the Add Network Adapter dialog box and asks you to select an adapter card from a list.

Note  If you want to add the network adapter driver after WinFrame has been installed, select the Network icon in Control Panel. When the Network Settings window appears, select Add Adapter to start the process of adding the LAN adapter network card into your Microsoft Windows NT environment.

2.	Use the arrow keys (or mouse) to go to the end of the Adapters List and highlight <Other> Requires Disk From Manufacturer. Click on Continue to install the driver for the selected network adapter card.

3.	When the Insert Disk window appears, insert the driver diskette for the HP J3171A adapter card into drive A and click OK.

4.	When the Select OEM Option window appears, highlight the HP 10/100 TX PCI LAN Adapter and click OK.

5.	The HPSet Setup program loads all the required driver files and scans computer resources to determine the settings assigned to your adapter.

Note  Although the HPSet Setup program adds an HPSet icon to the Control Panel, this applet is currently not supported by WinFrame. If it becomes necessary to reconfigure your network adapter card, you can use the Network icon in Control Panel.

6.	Click the Test button in the HPSet screen to run diagnostics.

7.	After the adapter test, click OK to exit the Adapter Diagnostics screen and return to the HPSet screen.

8.	Click OK to accept the adapters configuration and exit the HPSet program.

9.	Additional network configuration screens will appear. Configure as needed and restart WinFrame when prompted.

10.	You have completed all the steps required for the installation of network drivers. If you are in the process of installing WinFrame, proceed with Setup.

Notes  Certain network adapter cards do not install properly unless WinFrame is rebooted after each network adapter driver is installed. HP recommends that network adapter drivers be installed one at a time, rebooting the system after each installation.

The installation and/or changes of network configuration will not take effect until you reboot the computer.

Installing HP NetRAID

The HP NetRAID adapter provides an interface between the host system and a disk array storage system. The adapter uses the PCI (Peripheral Component Interconnect) standard to control data transfers on one to three SCSI channels.

HP NetRAID is a high performance, intelligent PCI-to-SCSI host adapter with RAID controller capabilities. Three SCSI channels are available on the adapter. Each channel supports Fast-and-Wide SCSI (at data transfer rates up to 20MB/sec per channel) and Ultra SCSI (at data rates up to 40MB/sec per channel).

The HP NetRAID Assistant (NRAID.EXE) is an object-oriented GUI RAID management utility that runs under Microsoft Windows NT on a server. HP NetRAID Assistant allows you to control and monitor the status of hard disk drives, locally or over a network with several servers.

To generate the NetRAID Assistant for Windows NT and Windows 95 installation diskettes, boot the Navigator CD-ROM and access the Diskette Library from the Main Menu, as follows:

Main Menu/NetServer Utilities/More NetServer Utilities/Diskette Library

Note  For detailed instructions on installing and configuring the HP NetRAID, please refer to the HP NetRAID Installation and Configuration Guide.

Installing HP NetRAID Adapter

Adding the HP NetRAID Adapter During WinFrame Installation

Please see "Installing WinFrame" earlier in this note for instructions on installing the HP NetRAID adapter during WinFrame installation.

Adding the HP NetRAID Adapter to an Existing WinFrame System

Follow these instructions only if WinFrame is already installed on your NetServer.

1.	Open the Main folder. Double click on the WinFrame Setup icon.

2.	Select the Options pull-down menu and then select Add/Remove SCSI Adapters. The SCSI adapter setup program displays a list of all host adapters currently installed.

3.	Click the Add button. A list of additional SCSI adapters appears in the Select SCSI Adapter Option screen.

4.	Expand the list of additional SCSI adapters; go to the end of the list and select Other (Requires a Disk from a Hardware Manufacturer).

5.	When the Insert Disk window appears, insert the HP NetServer Windows NT 3.51 Drivers Diskette into drive A and enter the path name A:\NETRAID. Click OK.

6.	In the Select OEM Option screen, select the Hewlett-Packard NetRAID SCSI Controller and click OK.

7.	In the next screen, select SCSI Adapter Option. The Hewlett-Packard NetRAID SCSI Controller is already selected; simply click Install.

8.	Click Close to exit the SCSI adapters portion of WinFrame Setup and then close the program. Shutdown WinFrame and reboot.

Installing HP NetRAID Assistant

To Install the HP NetRAID Assistant on WinFrame

1.	Select File/Run from the Program Manager.

2.	Insert diskette 1 of NetRAID Assistant for Windows NT and Windows 95.

Note  You can create the NetRAID Assistant for WinNT and Win95 diskettes using the Diskette Library utility on the HP Navigator CD-ROM.

3.	Type a:\setup at the Run prompt and click OK.

4.	Follow the on-screen instructions.

Note  For detailed instructions on configuring Physical Devices and Logical Devices, see the HP NetRAID Installation and Configuration Guide.

Installing HP NSA and ASR

In order to use the HP NetServer Assistant agents and ASR service, you must have already set up your WinFrame server with TCP/IP and SNMP Service. Please see the HP NetServer Assistant Installation Guide, HP Part No. 5965-2375, for a detailed description.

Note  Only Steps 1 and 5 (change user command) are unique to a WinFrame installation.

To install the HP NSA agent and ASR software, do the following from the WinFrame server:

1.	After logging into the server (you must have administrator privileges), type change user /install at a DOS prompt.

Notes  The WinFrame change user command is used to toggle the system between install mode and execute mode. Placing the system in install mode allows WinFrame to keep track of the user-specified application Registry entries or initialization files (.INI files) the application installs during setup. This allows WinFrame to automatically propagate the Registry entries of .ini files to each user as they are needed.

Entering install mode before installing the application causes the application to install to the standard \WINFRAME, \SYSTEM, and \SYSTEM32 directories rather than the administrator's home directory.

2.	Insert the HP NetServer Navigator CD-ROM in the server's CD-ROM drive or logon to a network accessible CD-ROM drive.

3.	Run File Manager and then run the NSA Setup program located in the following subdirectory on the HP NetServer Navigator CD-ROM:

x:\nsa\server\nt\disk1\setup.exe

where x is the drive letter for the CD-ROM drive that contains the HP NetServer Navigator CD-ROM.

4.	If the SNMP service is running, the NSA Setup program can detect it and automatically stop it. Note that the NSA server software cannot be installed with the SNMP service running.

5.	When done, type change user /execute at a DOS prompt.

6.	Restart the server. Once the server has restarted, if the SNMP service is not configured to start automatically, restart it now.

7.	After the NSA software has been loaded on your server, you should see an HP NetServer Assistant program group. The HP NetServer Assistant program group contains the README.WRI and HP NSA Setup program. You can run the HP NSA Setup program at any time and use the Customize option to enable or disable individual agents (you must be logged on as an administrator to do this).

Important  Remember to use the change user /install command prior to (and change user /execute command subsequent to) running the HP NSA Setup program to enable or disable individual agents.

8.	When done, go to your NSA management console and use HP OpenView to find your server.

Note  Although the HP NetServer Assistant agents and ASR service are supported on the WinFrame application server, the console applications, HP OpenView Workgroup Node Manager, and NSA Management Console must be run from a Windows (Windows Version 3.1 Enhanced Mode or higher), Windows 95, or Windows NT PC.

Installing HP Information Assistant

HP NetServer Information Assistant is a comprehensive source of information about the HP NetServer and accessories. Please refer to the HP NetServer User Guide for a detailed description of the HP Information Assistant Software.

To Install the HP NetServer Information Assistant on a WinFrame Application Server

Note  Only Steps 1 and 5 (change user command) are unique to a WinFrame installation.

1.	After logging into the server (you must have administrator privileges), type change user /install at a DOS prompt.

Notes  The WinFrame change user command is used to toggle the system between install mode and execute mode. Placing the system in install mode allows WinFrame to keep track of the user-specified application Registry entries or initialization files (.INI files) the application installs during setup. This allows WinFrame to automatically propagate the Registry entries of .ini files to each user as they are needed.

Entering install mode before installing the application causes the application to install to the standard \WINFRAME, \SYSTEM, and \SYSTEM32 directories rather than the administrator's home directory.

2.	Insert the HP NetServer Navigator CD-ROM in the server's CD-ROM drive, or logon to a network accessible CD-ROM drive.

3.	Run File Manager and then run the Information Assistant Setup program located in the following subdirectory on the HP NetServer Navigator CD-ROM:

x:\infoasst\setup.exe

where x is the drive letter for the CD-ROM drive that contains the HP NetServer Navigator CD-ROM.

4.	Follow the instructions that appear on your screen.

5.	When done, type change user /execute at a DOS prompt.

NetServer Technical Support

The HP NetServer Navigator CD-ROM contains all the software tools needed to simplify the setup, configuration, and management of an HP NetServer. The bootable CD-ROM includes the HP Configuration Assistant, HP Diagnostic Assistant, HP Information Assistant, and HP NetServer Assistant.

HP Configuration Assistant guides the user through the steps necessary to configure the HP NetServer. It provides suggestions for network operating system (NOS) installation and automatically creates a customized diskette with NOS drivers and configuration files for the user's specific operating environment. It can also be used to create a utility partition on the system's hard disk drives to store key utilities for troubleshooting and support.

HP Diagnostic Assistant helps in two ways: after setup and configuration, it verifies that the HP NetServer components are installed correctly via diagnostics that check the entire server, including expansion boards, SCSI subsystems, and cables. In addition, it provides continuous testing with error logging for overnight testing or burn-in of the full server or a subsystem.

HP NetServer Information Assistant gives administrators quick and easy access to a comprehensive reference library of HP NetServer documentation, release notes, and NOS optimization and tuning guides.

HP NetServer Assistant (NSA) is a customizable software tool set that helps monitor and manage servers over the network from an HP OpenView console. The NSA software has a server part and a management console (or client) part. The server part consists of Simple Network Management Protocol (SNMP) agents supported for use on various Network Operating System platforms. The console part consists of the HP NSA application software, HP OpenView software, and a set of server management tools that communicate with the server part to get information, convert traps (notification of changes and events that occur in the server) to OpenView alarms, and perform tasks. Depending on the task, you can manage your servers over a network connection (LAN or WAN).

To ensure that you have the latest versions of the software, obtain the current status report for your Navigator CD-ROM. This report describes any software updates since the CD-ROM was created and it tells you whether you need any updates and how to obtain them.

Please refer to the documentation included with your NetServer for detailed instructions on accessing the current status report for your particular platform.

Note  Hewlett-Packard makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness of a particular purpose. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material.


IBM PC Server 330

Overview

This application note describes how to install WinFrame on an IBM PC Server 330 system.

The IBM PC Server 330 is a high-speed, upgradeable PC server-class system with large data storage capacity and improved system expandability. The PC Server 330 provides both Extended Industry-Standard Architecture (EISA) and high-performance Peripheral Component Interconnect (PCI) expansion slots.

Software Requirements

WinFrame Version 1.6 or higher with Service Pack 5 or later

IBM SurePath BIOS Version 1/21/97

IBM PC ServeRAID Device Driver and Utilities Version 1.40

IBM PC Server AMD PCnet Family Network Drivers Version 3.10

{bmc square.bmp}	Adaptec AIC-7880 device driver Version 1.25

Installing WinFrame

1.	Boot the IBM PC Server 330 from a bootable DOS diskette and run the DOS FDISK utility. Create an active partition that is the size of the partition that you will define to install WinFrame. This partition does not need to be formatted; WinFrame Setup will format the partition.

2.	Begin installing WinFrame using the instructions in the Installation Guide and Quick Install Guide.

3.	Select either Express Setup or Custom Setup when prompted for the installation type and press ENTER to continue.

4.	WinFrame Setup displays all recognized SCSI controllers (there may be none present). Press s to configure additional SCSI controllers.

5.	Expand the list of additional SCSI controllers, select Other (located at the end of the list), and press ENTER. You are prompted for a driver diskette.

6.	Insert the IBM PC ServeRAID Adapter Device Driver/Utilities Diskette and click OK. The device drivers on the diskette are displayed. Select the IBM PC ServeRAID Adapter driver and press ENTER to continue.

7.	During the network configuration portion of Setup, select Other for the network interface card type. Insert the IBM PC ServeRAID Adapter Device Driver/Utilities Diskette and type a:\winnt351 for the device driver path. Select the AMD PCNET Family Ethernet Adapter.

8.	Finish installing WinFrame using the instructions in the Installation Guide and Quick Install Guide.


IBM PC Server 704

Overview

This application note describes how to install WinFrame on an IBM PC Server 704 system.

The IBM PC Server 704 is a high-performance, symmetric multiprocessing (SMP) server that is ideally suited for networking environments requiring superior microprocessor performance, efficient memory management, flexibility, and large amounts of reliable data storage. The PC Server 704 provides both Extended Industry-Standard Architecture (EISA) and high-performance Peripheral Component Interconnect (PCI) expansion slots.

Software Requirements

WinFrame Version 1.6 or higher with Service Pack 5 or later

IBM PC Server 704 BIOS Update Disk (Version 1.00.08 or later)

IBM PC ServeRAID Device Driver and Utilities (Version 2.0 or later)

Adaptec 7800 Family Manager Set AIC-78XX (Version 1.21 or later)

Installing WinFrame

1.	Obtain the IBM PC Server 704 BIOS Update Disk Version 1.00.08 or later by downloading the self-extracting file from http://www.pc.ibm.com/us or by contacting IBM Support.

2.	Obtain the IBM PC ServeRAID Device Driver and Utilities Version 2.00 by downloading the self-extracting file from http://www.pc.ibm.com/us or by contacting IBM Support.

3.	Update the IBM PC Server 704 system BIOS to Version 1.00.08 or later using the file downloaded in Step 1.

4.	Boot from the IBM PC Server 704 SCU diskette (Version 3.4 or 3.5). Select Option 1 (Non-PnP Operating System) and then select Option 3.

5.	Select Edit System Board Configuration and change the MP Spec from 1.1 to 1.4. Exit to the Main Menu and select Save Changes and Exit.

6.	Boot the IBM PC Server 704 from a bootable DOS diskette and run the DOS FDISK utility. Create an active partition that is the size of the partition that you will define to install WinFrame. This partition does not need to be formatted; WinFrame Setup will format the partition.

7.	Begin installing WinFrame using the instructions in the Installation Guide and Quick Install Guide.

8.	Select either Express Setup or Custom Setup when prompted for the installation type and press ENTER to continue.

9.	WinFrame Setup displays all recognized SCSI controllers (there may be none present). Press s to configure additional SCSI controllers.

10.	Expand the list of additional SCSI controllers, select Other (located at the end of the list), and press ENTER. You are prompted for a driver diskette.

11.	Insert the IBM PC ServeRAID Adapter Device Driver/Utilities Diskette and click OK. The device drivers on the diskette are displayed. Select the IBM PC ServeRAID Adapter driver and press ENTER to continue. Press s to configure an additional SCSI controller.

12.	Expand the list of additional SCSI controllers, select Other (located at the end of the list), and press ENTER. You are prompted for a driver diskette.

13.	Insert the Adaptec 7800 Family Device Driver Diskette and click OK. The device drivers on the diskette are displayed. Select the Adaptec AIC-78XX for NT 3.5X driver and press ENTER to continue.

14.	Finish installing WinFrame using the instructions in the Installation Guide and Quick Install Guide.


NetFrame NF9000

Overview

NetFrame Systems Inc. manufactures high-end computer systems. Their 9000 series system provides scalability in the processing, memory and disk subsystems that will allow significant growth. Other available features such as error correcting memory, hot swappable RAID configurations, and compact rack mounted systems provide a powerful computing environment for running the WinFrame operating system.

Software Requirements

WinFrame Version 1.6 and Service Pack 5

Qlogic SCSI controller driver (Version 2.21 or above) as described below

Adaptec SCSI controller driver (Version 1.3 or above) as described below

Before Installation

The NetFrame NF9000 requires several device drivers that are not supplied on the WinFrame installation diskettes. The procedure below obtains these drivers from the manufacturers' FTP sites and copies them to WinFrame Setup Disk 3.

1.	Download the Qlogic SCSI device driver (Ql10NT.EXE) from ftp://ftp.qlc.com.

2.	Execute the Q110NT.EXE self-extracting file to extract the device driver file QL10WNT.SYS. The version of this file used at Citrix was dated 12:36 PM, 6/13/96, size 36,512 bytes, and was Version 2.21 of the driver.

3.	Download the Adaptec SCSI device driver (7800WNT.EXE) from ftp://ftp.adaptec.com.

4.	Execute the 7800WNT.EXE self-extracting file to extract the device driver file AIC7800.SYS. The version of this file used at Citrix was dated 5:27 PM, 4/12/96, size 38,320 bytes, and was Version 1.30 of the driver.

5.	Make a backup copy of WinFrame Setup Disk 3. Copy QL10WNT.SYS and AIC7800.SYS to the backup copy of WinFrame Setup Disk 3. During WinFrame installation, the SCSI controllers will be automatically detected and the correct drivers copied from Setup Disk 3.

Installation

Install WinFrame as described in the WinFrame Installation Manual. Use the modified copy of WinFrame Setup Disk 3 to perform the installation. The SCSI drivers will be automatically copied from Setup Disk 3 during installation.


Software Application Notes

Overview

This chapter contains application notes for popular applications. The application types are broken into categories and the application notes are in alphabetical order by category. Refer to the online Readmes for general information on installing and configuring applications on a WinFrame server.

Note  The products listed in this guide have been tested and found to be compatible with WinFrame. Other products may (and probably will) work, but Citrix cannot guarantee the compatibility of untested products.

Because WinFrame is based on Microsoft Windows NT Server Version 3.51, most Windows NT 3.51 compatible applications can be expected to work. Review the application notes in the Solutions Guide and in the online WinFrame Readme for detailed application integration tips and techniques.

WinFrame supports Windows 32-bit applications, Windows 16-bit applications, DOS text applications, DOS graphical applications (console only), and OS/2 text applications. DOS graphical applications are supported on the console only; ICA WinStations support DOS text-mode programs only. OS/2 graphical programs that make use of the OS/2 graphical user interface (GUI) are not supported. OS/2 text applications, however, are supported. DOS and OS/2 text applications can use their standard installation procedures.

See "Application Integration" in Chapter 1 of this guide and the online Readme for more information about installing and configuring applications for use with WinFrame.


Great Plains Dynamics C/S+ and Dynamics

Overview

Great Plains Software develops, markets, and supports accounting and financial management software worldwide, offering solutions ranging from midrange client/server systems to small business integrated accounting software.

Great Plains Dynamics C/S+ is a client/server financial management suite for Microsoft BackOffice. Dynamics C/S+ offers a complete suite of Internet-ready financial applications and tools in a flexible three-tier client/server architecture. Dynamics C/S+ for SQL Server is exclusively optimized for Microsoft SQL Server. ISAM database options are also available for Dynamics C/S+.

Great Plains Dynamics is an accounting solution for growing companies with $1 to $50 million in revenues seeking financial information access throughout the deployment of strategic technologies and the Internet. Dynamics is a complete financial management solution with more than 20 financial modules and tools and hundreds of Dynamics companion products.

Citrix WinFrame extends Dynamics C/S+ and Dynamics into WAN and dial-in environments without sacrificing performance. By running the client portion of Great Plains Dynamics C/S+ or Dynamics on a WinFrame server, you can use Citrix's advanced ICA protocol to provide local LAN performance to WinFrame client PCs on the local LAN, over a WAN, or even to dial-in users in the field. Using ICA, only the keyboard, mouse, and video information are transferred between the WinFrame server and the WinFrame client; all the interaction between the Great Plains server and client machines takes place over the high-speed LAN.

The two companies' combined products provide customers with a state-of-the-art client/server financial management solution that can be economically deployed enterprise-wide across a wide area network, while delivering a high level of performance to all users, no matter where they are.

Requirements

Hardware Requirements

Server PC with Pentium processor or greater for Dynamics Server; dual-processor SMP system recommended for Dynamics C/S+ Server. See the Great Plains Installation:Procedures manual for detailed system requirements.

WinFrame server with Pentium processor or greater for Dynamics Client; dual-processor SMP system recommended for Dynamics C/S+ Client. The system should contain 32MB RAM plus 8 to 10MB per remote client, and at least 400MB of available disk space.

WinFrame client PCs; see the WinFrame Client User's Guide for client PC requirements.

Software Requirements

WinFrame Version 1.6 or higher

WinFrame Client (DOS, Win16, or Win32) Version 1.6 or higher

Great Plains Dynamics C/S+ or Dynamics

Supported Databases and Operating Environments

Dynamics C/S+ Client/Server Systems

Note  For best performance, implement the WinFrame server on a different physical server than the database engine. It is recommended that customers purchase an application server specifically for WinFrame.

Database Software	Dynamics C/S+ Clients	Database Server	Application Server	Networking Software
MS SQL Server 6.5	Citrix WinFrame	Windows NT Server 3.51 or higher (Intel or Alpha)	Windows NT Server 3.51 or higher (Intel or Alpha) Windows NT Workstation 3.51 or higher (Intel or Alpha)	Windows NT Server 3.51 or higher (Intel or Alpha)
Btrieve Server for NT	Citrix WinFrame	Windows NT Server 3.51 or higher (Intel only)	Windows NT Server 3.51 or higher (Intel only) Windows NT Workstation 3.51 or higher (Intel only)	Windows NT Server 3.51 or higher (Intel only)
Faircom Server	Citrix WinFrame	Windows NT Server 3.51 or higher (Intel or Alpha)	Windows NT Server 3.51 or higher (Intel or Alpha) Windows NT Workstation 3.51 or higher (Intel or Alpha)	Windows NT Server 3.51 or higher (Intel or Alpha)
Dynamics Client/Server Systems

Note  For best performance, implement the WinFrame server on a different physical server than the database engine. By keeping the servers separate, performance on both can be optimized and maintained.

Database Software	Dynamics Clients	Servers	Networking Software
Btrieve Server for NT	Citrix WinFrame	Windows NT Server 3.51 or higher (Intel) Citrix WinFrame	Windows NT Server 3.51 or higher (Intel)
Btrieve Server for NetWare	Citrix WinFrame	NetWare 3.12, 4.10, or 4.11	NetWare 3.12, 4.10, or 4.11
c-tree Plus	Citrix WinFrame	Windows NT Server 3.51 or higher (Intel) NetWare 3.12, 4.10, or 4.11 Citrix WinFrame	Windows NT Server 3.51 or higher (Intel) NetWare 3.12, 4.10, or 4.11
Dynamics Stand-alone Systems

Database	Operating Environments
Btrieve Workstation	Citrix WinFrame 1.6 or higher
c-tree Plus	Citrix WinFrame 1.6 or higher
Installation

To Install Great Plains Dynamics C/S+ or Dynamics

1.	Verify system requirements. Make sure your system meets the recommended minimum requirements for a Dynamics C/S+ or Dynamics system, and that your system is prepared for installation according to the instructions in the Dynamics C/S+ or Dynamics Installation:Procedures manual and the WinFrame Installation Guide.

2.	Install WinFrame. Refer to the WinFrame Installation Guide for detailed installation procedures.

3.	Review database server information, if necessary. Depending on your database server choice, review the Dynamics C/S+ or Dynamics Installation:Procedures manual to properly configure your database.

4.	Install Dynamics C/S+ or Dynamics on one client and on a server. We recommend that you install your Dynamics C/S+ or Dynamics Database Server on a separate machine from your WinFrame server. You should also install your first client on a machine other than the WinFrame server. This will allow you to verify the correct installation of Dynamics C/S+ or Dynamics before you set up your WinFrame server. The WinFrame server can then be set up as another client.

Check the mapped drives or UNC (universal naming convention) pathnames that each client uses to identify the server. Be sure that each client identifies the Dynamics C/S+ or Dynamics folder on the server the same way; for instance, all clients should identify the C:\DYNAMICS\ folder on the server using the same ID, such as F:\Dynamics or F:.

Use one of your client computers to begin the installation program. Install Dynamics C/S+ or Dynamics applications on that client computer and install data on the server computer, using the instructions in the Dynamics C/S+ or Dynamics Installation:Procedures manual.

When installing Dynamics, don't use your server to install data; it will prevent your clients from locating the data and you'll need to enter a location translation.

5.	Use Dynamics C/S+ or Dynamics Utilities. Refer to the Dynamics C/S+ or Dynamics Installation:Procedures manual to define your account framework and synchronize it with your dictionary, and to register Dynamics C/S+ or Dynamics.

6.	Perform initial setup procedures. Complete the instructions in the Dynamics C/S+ or Dynamics Installation:Procedures manual to start the program for the first time and perform initial setup procedures such as creating a company, adding users, and setting user access. You must complete these procedures before you begin using Dynamics C/S+ or Dynamics for your business.

7.	Install and set up Dynamics C/S+ or Dynamics on all additional client computers. Use the Dynamics C/S+ or Dynamics Installation:Procedures manual to set up Dynamics C/S+ or Dynamics on additional clients, including the WinFrame server and the remote WinFrame client workstations.


Inoculan for Windows NT

Overview

Inoculan Version 1.0 for Windows NT is an anti-virus program. It is designed to scan Windows NT and WinFrame servers for viruses.

When Inoculan is installed on a domain controller, it controls all virus scanning and reporting within a given domain from one machine. All machines belonging to the domain that will be scanned must install and run Inoculan. Network virus scans can be done automatically to help decrease the spread of viruses over the network.

Note  Install the Inoculan master server on your primary domain controller (PDC) and make that machine the master Inoculan server. This is helpful for trust relations between workstations and other domains that are running Inoculan servers.

Software Requirements

Inoculan for Windows NT Version 1.0

WinFrame Version 1.5 or greater

Installation

1.	Login at the console as an administrator.

2.	At a command prompt, type change user /install and press ENTER.

3.	Insert Disk 1 into drive A and set the default drive to A. Type setup and press ENTER.

4.	Follow the standard Inoculan installation.

5.	When installation is complete, type change user /execute at the command prompt.


Arcada Backup Exec, Windows NT
Enterprise Edition, Versions 6.1 and 6.11

Overview

Arcada Backup Exec, Windows NT Enterprise Edition, Versions 6.1 and 6.11 are true 32-bit client/server data storage and management solutions offering advanced features such as centralized administration and monitoring, remote administration, global network view, unattended backup, disk grooming, e-mail notification, and compression. Backup Exec can be used to back up FAT, NTFS, and NetWare file systems. In addition, Backup Exec offers optional agents that can be used to backup UNIX, Macintosh, and Windows 95 workstations.

Requirements

Hardware Requirements

A tape drive supported by Arcada Backup Exec that has a Windows NT device driver

Software Requirements

WinFrame Server Software, Version 1.5 or higher

Arcada Backup Exec, Windows NT Enterprise Edition, Version 6.1 or 6.11

System Integration

Prior to installing the Backup Exec software, verify that the WinFrame server is up and running and that the tape backup unit is configured and operational.

Follow the installation directions in the Backup Exec manual.

Note  If the tape backup unit was added after installing WinFrame, you need to load the appropriate tape device driver in order for WinFrame to properly recognize the tape backup unit. Use the Options selection in Windows NT Setup to add the SCSI tape backup unit. You will then need to reboot the server.

Usage

Follow the usage directions in the Backup Exec manual.

Note  Some WinFrame systems may hang when restoring an HPFS system partition to the same WinFrame host. To avoid this problem, use the NTFS or FAT file systems for WinFrame partitions.


Cheyenne ARCserve Enterprise Edition Version 6.0

Overview

Cheyenne ARCserve Enterprise Edition is a data management and backup program that allows you to backup data from WinFrame servers or other machines on your network. ARCserve consists of two components: the ARCserve manager and the ARCserve agent.

ARCserve can be used with WinFrame in one of three ways:

The ARCserve Manager can be installed on a WinFrame server to provide back up support for that WinFrame server as well as other networked servers. In this configuration, the tape backup unit is located in a WinFrame server. Other servers or workstations have an agent installed and their data is backed up to the server through centralized administration from the WinFrame server.

The ARCserve Manager can be installed on a machine other than a WinFrame server. In this configuration, the WinFrame servers run the ARCserve NT agent and are centrally administered for back ups by a Windows NT 3.51 Server that is running the ARCserve Manager software.

The ARCserve Manager is installed on a WinFrame server and used to back up one or more other WinFrame servers. Instead of installing an agent on the other WinFrame servers, all other WinFrame servers create share points to be backed up that are selected by ARCserve Manager from the first server. This configuration can also be used for platforms that do not have an agent or for administrators who do not want to use agents.

ARCserve offers optional agents that can be used to back up NetWare, UNIX, Macintosh, and Windows 3.x and Windows 95 workstations from a server that is running ARCserve Manager.

Requirements

Hardware Requirements

A tape drive supported by ARCserve and WinFrame

Software Requirements

WinFrame Version 1.6 with Service Pack 4a or higher or WinFrame Version 1.7

ARCserve for Windows NT Enterprise Edition, Version 6.0 or greater with ARCserve's latest service pack (available from Cheyenne's Web site at http://www.cheyenne.com)

ARCserve Agent for Windows NT, Version 6.0

Installation

Installing ARCserve Manager on WinFrame

1.	Logon to the WinFrame server as an administrator.

2.	Copy the file MSVCRT20.DLL from the \CHEY-SMM\MWORKS directory on the ARCserve CD-ROM to the %systemroot%\SYSTEM32 directory. If the file already exists, back up the file and, if necessary, replace it after ARCserve is installed.

3.	From a command prompt type change user /install and press ENTER.

4.	Run the Setup Program from the ARCserve installation directory; for
example, x:\ARCSERVE\X86.ENG\setup.exe, where x is the drive letter for the CD-ROM. Follow Cheyenne's instructions for installing the latest service pack (currently Service Pack 3 dated May 27, 1997).

5.	At a command prompt, type change user /execute and press ENTER.

6.	Run the WinFrame SETUP.EXE utility and remove any tape drivers installed that will be used with your ARCserve software (ARCserve provides its own drivers).

7.	Reboot the WinFrame server.

Installing the NT Agent on WinFrame

1.	Logon to the WinFrame server as an administrator.

2.	Copy the MSVCRT20.DLL file from the \CHEY-SMM\MWORKS directory on the ARCserve CD-ROM to the %systemroot%\SYSTEM32 directory. If the file already exists, back up the file and, if necessary, replace it after ARCserve is installed; for example, xcopy MSVCRT20.DLL %systemroot%\SYSTEM32.

3.	From a command prompt, type change user /install and press ENTER.

4.	Run the Setup Program from the ARCserve installation directory that installs the agent; for example, x:\NTAGENT\setup.exe, where x is the drive letter for the CD-ROM.

5.	At a command prompt, type change user /execute and press ENTER.

6.	Reboot the WinFrame server.

Usage

From the machine where ARCserve Manager is installed, run ARCserve Admin to verify the following services are running: Job Engine, Tape Engine, and the Database Engine.

Run the ARCserve Manager to schedule backups.

Example

1.	From the ARCserve Manager, select Manager from the menu, then select Backup.

2.	If an agent will be used at the client machine, follow these steps to configure the agent at the server. If an agent is not being used, skip to Step 3.

A.	From the ARCserve Manager, select Cheyenne Agents.

B.	Select Windows NT agents using the right mouse button to add an object.

C.	Enter the host name and IP address of the machine where the NT agent is installed.

3.	Select Source and the method of backup either from the local drive, the network, or Cheyenne agents.

4.	Select Destination for the backup files. The destination can be a group of tape backup drives or a single tape backup drive.

5.	Select Schedule to choose the time when the backup is to run or to run the backup immediately.

6.	Select Backup from the menu and select Run/Schedule to start the backup process.

7.	Select an object and enter a username and password with rights to the files to be backed up. If an agent was chosen as a backup selection, it is necessary to configure the backup object to use the agent. Click OK when complete.

8.	Add a description to help identify the backup and click OK to send your selection to a backup queue.

Notes

Currently when an agent is installed on a WinFrame server, the client Agent Admin program displays a status of Agent information not available when it should be displaying Connecting to server. This issue is being reviewed by Cheyenne and Citrix. This should not interfere with the back up.

Troubleshooting

I installed an agent on my WinFrame server. My server with the tape backup drive running ARCserve Manager cannot view my agent share points and returns an invalid login.

Verify that all services are started and passwords to start those services match on both machines. If the service is not started, select the service and select Start. Available services are listed below:

On the ARCserve Manager machine:

Alert

ARCserve Database Engine

ARCserve Job Engine

ARCserve Message Engine

ARCserve Tape Engine

Cheyenne Alert Notification Server

On the WinFrame server running the agent:

Alert

Client Agent for ARCserve

The service does not start up when I select to start it.

If the service does not start, verify that the password to start the service is correct. Select the service and then select Startup from Services in the control panel. Select "logon as," choose "this account," and enter a valid administrator level username and password.


Palindrome Storage Manager Version 4.0 for Windows NT

Overview

Palindrome Storage Manager provides high-performance backup, restore, and media management functionality with an easy-to-use interface. Palindrome Storage Manager provides superior departmental and enterprise-wide protection for Microsoft Windows NT and Novell NetWare networks on a variety of platforms, including Macintosh, DOS, OS/2, UNIX, and Oracle for NetWare databases.

Requirements

Hardware Requirements

A tape drive supported by Palindrome Backup Utility

Software Requirements

WinFrame Version 1.6 with Service Pack 3 and Hotfix WF160003, or with Service Pack 4, or WinFrame Version 1.7

Palindrome Storage Manager Version 4.0 for Windows NT

Installation

1.	Prior to installing the Storage Manager software, verify that the WinFrame server is up and running. The Storage Manager program requires that a tape device not be installed under WinFrame prior to the Storage Manager installation. If a tape device is installed, remove it before installing the Storage Manager.

2.	Install Palindrome Storage Manager using the directions in the Storage Manager manual.

3.	Install the hotfix: logon as an administrator and copy WF160003.EXE to a directory on your local hard disk. Execute wf160003 to unzip the hotfix files. Execute hotfix /i to apply the hotfix. Restart your server.

Usage

Follow the usage directions in the Storage Manager Administrator's Guide.


UltraBac for Windows NT

Overview

UltraBac for Windows NT is a comprehensive backup solution for network administrators. Ultrabac can be run on a WinFrame server to back up data on both the local WinFrame server and servers across the network.

The software supports most types of backup devices; however, CD-ROM writers are not supported.

Groups of files and drives (local and remote) can be organized into backup sets that can be easily created and edited with simple mouse clicks. A system's Registry can be included in a backup set as well. Backup sets can be scheduled to run unattended or backed up immediately. Restoring data from a backup device is made easy as well. The files on the backup medium are displayed using the familiar File Manager-type interface that allows administrators the ability to control exactly which files are restored. The program provides several advanced features such as fault tolerance and software compression.

UltraBac provides the ability to back up to locally attached tape devices and backup to either local or network disk drives. See page 1 of the UltraBac manual for a list of industry backup devices that are compatible with UltraBac.

Software Requirements

WinFrame Version 1.6 with Service Pack 5, or WinFrame Version 1.7

UltraBac for Windows NT Version 2.1 and above

Installation

The software may be installed in either execute or install mode. Installing the software in execute mode means that UltraBac will only be available to the domain administrator logon ID that is used to install the software. This is the preferred method for most network administrators. If the network requires multiple domain administrators to be able to use their own copies of UltraBac (possibly concurrently), the software must be installed in install mode. However, there are few scenarios where this type of installation would be needed.

The user mode can be changed by typing change user /install or change user /execute at the command prompt. This command should be entered prior to beginning the installation procedure.

To Install UltraBac on a WinFrame Computer

•	Follow the installation instructions found on pages 3-6 of the UltraBac manual.

Usage

UltraBac is designed to run three different ways:

In the foreground by running UB.EXE as a normal program file

In the background through the BEI Scheduler Service for unattended backups

Through the Command Line interface for organizations with unique requirements and a technical staff

Follow the usage directions found in the UltraBac manual for specifics on each method of using UltraBac.

Troubleshooting

See pages 91-95 of the UltraBac manual for troubleshooting tips.


IBM OS/2 Version 2.1

Overview

This document describes how to use the Citrix WinFrame Win16 Client with IBM OS/2 Version 2.1. The following connectivity methods are supported:

Client	TCP	IPX	SPX	NetBIOS	Async (Direct)	Async (Modem)
Win16	Yes	No	No	Yes	Yes	Yes
In addition to using the WinFrame Win16 Client, you can configure the WinFrame Web Client (Win16 version) for use with the IBM OS/2 Web Explorer.

Software Requirements

IBM Operating System/2 Version 2.1

IBM LAN Server 3.0

IBM TCP/IP 3.0

Citrix WinFrame Version 1.6 or higher

WinFrame Win16 Client Version 1.6, Version 94B and above, or WinFrame Version 1.7

Installation

Before installing the WinFrame Client, decide what network protocols and hardware adapters you will use.

Install OS/2 Version 2.1 following the standard installation procedure. Once the operating system is installed, install the MPTS (Multiprotocol Transport Services), then install the IBM LAN Server 3.0 software. Select the server and domain name. Define server on the Domain Controller after installation. Ensure that you have successfully installed the software by verifying that you can net view or net use in an OS/2 Window or a full screen session.

After verifying that the IBM LAN software is correctly installed, install the TCP/IP software. Under options specify the hostname (usually the same as the workstation name), the IP address, the subnet mask, the router address, the domain name, and name server required by your configuration.

Note  The Client name and password must be the same on both the IBM LAN Server and the WinFrame server.

WINOS2 Setup

Before installing the WinFrame Client, the WINOS2 settings must be set to allow the WinFrame Client to operate properly. Establish the settings as follows:

Note  You may elect not to make these settings if you do not intend to use the DDE or Clipboard functions.

1.	Under OS/2 System Folder, select System Setup and then WIN-OS/2 Setup.

2.	Under WIN-OS/2 Setup Settings, select the Data Exchange tab.

3.	On the Data Exchange settings page, select Public for both selections. This is required for DDE and Clipboard operation.

4.	Close all the previous selections; this portion of the settings is complete.

5.	Under OS/2 System Folder, select Command Prompts.

6.	Go to the Settings page of either the seamless WINOS2 or full screen WINOS2 icon. (The right mouse button brings up a menu; click on Settings.)

7.	Select the Session tab, then select WIN-OS/2 settings. Make sure the All DOS and WIN-OS/2 settings radio button is highlighted and select OK.

8.	Set WIN_RUN_MODE to 3.1 Enhanced Compatibility.

9.	Set WIN_DDE to On.

10.	Set WIN_CLIPBOARD to On.

11.	Select Save and close the notebook.

12.	Close all the previous selections; this portion of the settings is complete.

13.	When using IBM LAN and NetBIOS, the following line must be entered in the AUTOEXEC.BAT:

x:\ibmcom\ltsvcfg n1=1

where x is the OS/2 system drive. This command enables the NAME_NUMBER_1 support required to support NetBIOS connections.

Client Installation on OS/2

Before installing the Client, decide what protocols you will use. Client installation is simple; insert the WinFrame Client diskette in drive A and run setup in a WINOS2 session.

Client Protocol

TCP/IP

If you choose TCP/IP, make sure you have the server hostname available and that OS/2 TCP/IP 3.0 is installed.

IBM LAN

All IBM LAN software must be installed prior to installing the Client. You must know the server name, the Client name, and the password. The following line must be in the AUTOEXEC.BAT to allow NetBIOS to work:

c:\ibmcom\lstvcfg n1=1

Dial-In

When installation starts, you are asked if you wish to select the Dial-In option. Do not select this option at this time. Once installation is complete and you are setting up the local user, you may use the Dial-In option to configure a modem connection.

WinFrame Win16 Client

Before installing the WinFrame Client, decide what network protocols and hardware adapters will be used.

IPX and SPX connections are not supported at this time because OS/2 does not support VxDs. TCP/IP connections are supported without any changes. NetBIOS connections are supported if you load NAME_NUMBER_1 support. Serial Dial-In and direct connect connections are supported without any changes.

WinFrame Win16 Web Client and Web Explorer

The IBM OS/2 Web Explorer is an OS/2-based Web browser. The procedure below describes how to configure the IBM OS/2 Web Explorer for use with the Citrix WinFrame Web Client.

1.	Download the WinFrame Web Client for Windows 3.1 and Windows for Workgroups from the Citrix Demo Web page (www.citrix.com/demoroom/default.asp). Follow the directions on the page to install the Client.

2.	Edit the C:\MPTN\ETC\EXPLORE.INI file. In the [advanced] section, specify a MAILCAP file (if one does not exist) by adding C:\MPTN\ETC\MAILCAP to the end of the mailcap= statement. In the [advanced] section, specify an EXTMAP file if one does not exist by adding C:\MPTN\ETC \EXTMAP to the end of the extmap= statement. Save the file and exit the editor.

3.	Edit or create the C:\MPTN\ETC\MAILCAP file. Add the following line:

application/x-ica; c:\ICAWIN\WFICA16.EXE %s

Save the file and exit the editor.

4.	Edit or create the C:\MPTN\ETC\EXTMAP file. Add the following line

application/x-ica ica

Save the file and exit the editor.

5.	Restart the Web Explorer.

Usage

IPX and SPX connections are not supported at this time because OS/2 does not support VxDs. TCP/IP connections are supported without any changes. NetBIOS connections are supported if you load NAME_NUMBER_1 support. Serial Dial-In and direct connect connections are supported without any changes.

Note  Cut, Copy, and Paste operations only work when cutting or copying data from the WinFrame Client and pasting it to the WINOS2 or OS/2 session. Data cut or copied from the OS/2 or separate WINOS2 session (not the one running the WinFrame Client) cannot be pasted to the WinFrame Client.

A hotfix is available that fixes the problem described above. Contact your Citrix Technical Support representative for details. The DOS Client does not support Cut and Paste operations between OS/2 and WinFrame sessions.

Local Printing

1.	Verify that the WINOS2 printer drivers are installed.

2.	To access your local printer, type net use LPT:x \\client\LPT:y (where x and y are printer ports) at a command prompt and press ENTER.

3.	Create a printer object for the local printer using the WinFrame Client Print Manager. Once the printer object is created, the printer is accessible by the client using WinFrame server applications.

Printing on an IBM LAN Domain/Server

1.	Make sure the printer is physically attached to the IBM LAN server. The IBM LAN server must have the printer driver installed.

2.	The printer must be shared and available to all members. All members must have Create Permissions (CP) print permission granted on the IBM LAN Server.

3.	The printer object for the WinFrame server connection must be created using the WinFrame server Print Manager.

4.	To connect the WinFrame server to the IBM LAN server, use the Print Manager Connect feature. You must type the UNC Share name in the printer box; for example, \\server47\4019. This creates a print object in Print Manager.

5.	When creating the object, select the Share option during object creation.

6.	Once the printer object is created, the printer is accessible by the clients. WinFrame server applications can now print on the IBM LAN server printer.

7.	The client, as a member of the WinFrame server, automatically has a print object created in the Client Print Manager. The client user has to select the print object as default to configure the server printer as the default printer.

Printing On the WinFrame Server

The printer object for a WinFrame printer is created using the WinFrame Print Manager.

1.	Create the printer object as a shared object.

2.	Once the printer object is created, the printer is accessible by the clients. Applications running on the WinFrame server can now print on the server printer. The client, as a member of the WinFrame server, automatically has a print object created in the Client Print Manager. The client user has the option of selecting the print object as default if the server printer needs to be the default printer.

DDE and OLE

DDE and OLE are supported within the WinFrame client. There is no interoperability between the WinFrame client and WINOS2 or OS/2 sessions.

Network and CD-ROM Drives

All non-local drives are supported by executing the following command at the WinFrame client command prompt:

net use x:    \\client\y

where x is the drive to be mapped to and y is the non-local drive supported by OS/2.


IBM OS/2 Warp Connect Version 3.0

Overview

This document describes how to use the Citrix WinFrame Win16 and DOS Clients on an OS/2 Warp Connect Version 3.0 system. The following connectivity methods are supported:

Client	TCP	IPX	SPX	NetBIOS	Async (Direct)	Async (Modem)
DOS	Yes	Yes	No	Yes	Yes	Yes
Win16	Yes	No	No	Yes	Yes	Yes
In addition to using the WinFrame Win16 and DOS Clients, you can configure the WinFrame Web Client (Win16 version) for use with the IBM OS/2 Web Explorer.

Software Requirements

IBM OS/2 Warp Connect 3.0

Virtual TCP/IP for DOS Version 2.1.0.3 (for TCP/IP connections)

TBMI2 for IPX/SPX Version 3.15 (for IPX connections)

NETX for OS/2 MVDM Support Version 3.32 (for IPX connections)

Citrix WinFrame Version 1.6 or higher

WinFrame DOS Client Version 1.6, version 94B or above, or WinFrame Version 1.7

WinFrame Win16 Client Version 1.6, version 94B or above, or WinFrame Version 1.7

WinFrame Win16 Web Client, latest version from www.citrix.com/demoroom/default.asp

Installation

OS/2 Installation

Install OS/2 Warp Connect Version 3.0 following the standard install procedure. Use the default settings. Install networking support for IBM LAN Requester Version 4.0, Novell NetWare Client for OS/2 Version 2.11, and IBM TCP/IP for OS/2 Version 3.0 (including Internet Access). Verify that the network adapter settings are correct. Select the workstation name, description (if desired), and domain name. Choose the protocol you want to use. For TCP/IP, specify the hostname (usually the same as the workstation name), the IP address, the subnet mask, the router address, and the domain name required by your configuration.

IBM OS/2 Warp Connect Version 3.0 includes network and TCP/IP protocols and software as part of the operating system. Follow the instructions for installing the additional network and TCP/IP software as part of the installation of the system. Network and TCP/IP software for WINOS2 and virtual DOS are installed as defaults during the installation.

Note  The Client name and password must be the same on both the IBM LAN Server and the WinFrame server.

WINOS2 Setup

Before installing the WinFrame Client, the WINOS2 settings must be set to allow the WinFrame Client to operate properly with DDE and Clipboard. Establish the settings as follows:

Note  You may elect not to make these settings if you do not intend to use the DDE or Clipboard functions.

1.	Under OS/2 System Folder, select System Setup and then WIN-OS/2 Setup.

2.	Under WIN-OS/2 Setup Settings. select the Data Exchange tab.

3.	On the Data Exchange settings page, select Public for both selections. This is required for DDE and Clipboard operation.

4.	Close all the previous selections; this portion of the settings is complete.

5.	Under OS/2 System Folder, select Command Prompts.

6.	Go to the Settings page of either the seamless WINOS2 or full screen WINOS2 icon. (The right mouse button brings up a menu; click on Settings.)

7.	Select the Session tab, then select WIN-OS/2 settings. Make sure the All DOS and WIN-OS/2 settings radio button is highlighted and select OK.

8.	Set WIN_RUN_MODE to 3.1 Enhanced Compatibility.

9.	Set WIN_DDE to On.

10.	Set WIN_CLIPBOARD to On.

11.	Select Save and close the notebook.

12.	Close all the previous selections; this portion of the settings is complete.

13.	When using IBM LAN and NetBIOS, the following line must be entered in the AUTOEXEC.BAT:

x:\ibmcom\ltsvcfg n1=1

where x is the OS/2 system drive. This command enables the NAME_NUMBER_1 support required to support NetBIOS connections.

Client Installation on OS/2

Before installing the Client, decide what protocols you will use. Client installation is simple; insert the WinFrame Client diskette in drive A and run setup in a WINOS2 session.

Client Protocol

TCP/IP

If you choose TCP/IP, make sure you have the server hostname handy and that OS/2 TCP/IP and DOS TCP/IP are installed.

IBM LAN

All IBM LAN software must be installed prior to installing the Client. You must know the server name, the Client name, and the password. The following line must be in AUTOEXEC.BAT to allow NetBIOS to work:

c:\ibmcom\lstvcfg n1=1

Dial-in

When installation starts, you are asked if you wish to select the Dial-In option. Do not select this option at this time. Once installation is complete and you are setting up the local user, you may elect to use the Dial-In option to allow a modem connection.

WinFrame Win16 Client

Before installing the WinFrame Client, decide what network protocols and hardware adapters will be used.

IPX and SPX connections are not supported at this time because OS/2 does not support VxDs. TCP/IP connections are supported without any changes. NetBIOS connections are supported if you load NAME_NUMBER_1 support. Serial Dial-In and direct connect connections are supported without any changes.

WinFrame Win16 Web Client and Web Explorer

The IBM OS/2 Web Explorer is an OS/2-based Web browser. The procedure below describes how to configure the IBM OS/2 Web Explorer for use with the Citrix WinFrame Web Client.

1.	Download the WinFrame Web Client for Windows 3.1 and Windows for Workgroups from the Citrix Demo Web page (www.citrix.com/demoroom/default.asp). Follow the directions on the page to install the Client.

2.	Edit the C:\MPTN\ETC\EXPLORE.INI file. In the [advanced] section, specify a MAILCAP file if one does not exist by adding C:\MPTN\ETC\MAILCAP to the end of the MAILCAP= statement. In the [advanced] section, specify an EXTMAP file if one does not exist by adding C:\MPTN\ETC \EXTMAP to the end of the EXTMAP= statement. Save the file and exit the editor.

3.	Edit or create the C:\MPTN\ETC\MAILCAP file. Add the line:

application/x-ica; c:\ICAWIN\WFICA16.EXE %s

Save the file and exit the editor.

4.	Edit or create the C:\MPTN\ETC\EXTMAP file. Add the line:

application/x-ica ica

Save the file and exit the editor.

5.	Restart the Web Explorer.

WinFrame DOS Client

Change the DOS_FILES setting for the WinFrame DOS Client session to 40. The default value of 20 causes the WinFrame DOS Client to exit with an "insufficient files" error message.

DOS sessions under OS/2 Warp load NetWare support (TBMI2 and NETX) by default; IPX connections are supported without any changes. SPX is not supported.

TCP/IP support also is loaded by default. When creating a TCP/IP remote application entry, specify TCP/IP-VSL as the connection type. Include the following line in the AUTOEXEC.BAT or in a .BAT file that starts the DOS Client:

x:\wfclient\mibmtcp.com

NetBIOS connections require you to load NAME_NUMBER_1 support before running the Client. This support is not enabled by default. Include the following line in the AUTOEXEC.BAT or in a .BAT file that starts the DOS Client:

x:\ibmcom\ltsvcfg n1=1

where x is the OS/2 system drive. This command enables the NAME_NUMBER_1 support required to support NetBIOS connections.

DOS async connections require changes to the default DOS settings for the session. The following changes support direct connect and modem connections at up to 57.6Kbps:

COM_DIRECT_ACCESS	On
COM_HOLD	On
COM_RECEIVE_BUFFER_FLUSH	None
COM_SELECT	All
DOS_DEVICE	x:/OS2/MDOS/COMDD.SYS (see note below)
DOS_FILES	40
HW_ROM_TO_RAM	On
HW_TIMER	On
IDLE_SECONDS	60
IDLE_SENSITIVITY	100
Note  x is the OS/2 system drive. Add this device driver statement to the list of device drivers.

Usage

The WinFrame Win16, DOS, and Win16 Web Clients are supported on OS/2 Warp Connect Version 3.0. The sections below discuss the compatibility issues for each Client.

Note  Cut, Copy, and Paste operations only work when cutting or copying data from the WinFrame Client and pasting it to the WINOS2 or OS/2 session. Data cut or copied from the OS/2 or separate WINOS2 session (not the one running the WinFrame Client) cannot be pasted to the WinFrame Client.

A hotfix is available that fixes the problem described above. Contact your Citrix Technical Support representative for details. The DOS Client does not support Cut and Paste operations between OS/2 and WinFrame sessions.

Printer Setup

Local Printing

1.	Verify that the WINOS2 printer drivers are installed.

2.	To access your local printer, type net use LPT:x \\client\LPT:y (where x and y are printer ports) at a command prompt and press ENTER.

3.	Create a printer object for the local printer using the WinFrame Client Print Manager. Once the printer object is created, the printer is accessible by the client using WinFrame server applications.

Printing on an IBM LAN Domain/Server

1.	Make sure the printer is physically attached to the IBM LAN server. The IBM LAN server must have the printer driver installed.

2.	The printer must be shared and available to all members. All members must have Create Permissions (CP) print permission granted on the IBM LAN Server.

3.	The printer object for the WinFrame server connection must be created using the WinFrame server Print Manager.

4.	To connect the WinFrame server to the IBM LAN server, use the Print Manager Connect feature. You must type the UNC Share name in the printer box; for example, \\server47\4019. This creates a print object in Print Manager.

5.	When creating the object, select the Share option during object creation.

6.	Once the printer object is created, the printer is accessible by the clients. WinFrame server applications can now print on the IBM LAN server printer.

7.	The client, as a member of the WinFrame server, automatically has a print object created in the Client Print Manager. The client user has to select the print object as default to configure the server printer as the default printer.

Printing On the WinFrame Server

The printer object for a WinFrame printer is created using the WinFrame Print Manager.

1.	Create the printer object as a shared object.

2.	Once the printer object is created, the printer is accessible by the clients. Applications running on the WinFrame server can now print on the server printer. The client, as a member of the WinFrame server, automatically has a print object created in the Client Print Manager. The client user has the option of selecting the print object as default if the server printer needs to be the default printer.

DDE and OLE

DDE and OLE are supported within the WinFrame client. There is no interoperability between the WinFrame client and WINOS2 or OS/2 sessions.

Network and CD-ROM Drives

All non-local drives are supported by executing the following command at the WinFrame client command prompt:

net use x:  \\client\y

where x is the drive to be mapped to and y is the non-local drive supported by OS/2.


IBM OS/2 Warp Version 4.0

Overview

This document describes how to use the Citrix WinFrame Win16 and DOS Clients on an OS/2 Version 4.0 system. The following connectivity methods are supported for the WinFrame Win16 and DOS Clients:

Client	TCP/IP	IPX	SPX	NetBIOS	Async (Direct)	Async (Modem)
DOS	Yes	Yes	No	Yes	Yes	Yes
Win16	Yes	No	No	Yes	Yes	Yes
In addition to using the WinFrame Win16 and DOS Clients, you can configure the WinFrame Web Client (Win16 version) for use with the IBM OS/2 Web Explorer.

Software Requirements

IBM OS/2 Warp 4.0

File and Print Client Services

TCP/IP Services

NetWare Client Services

Citrix WinFrame Version 1.6

WinFrame DOS Client Version 1.6, version 94B or above

WinFrame Win16 Client Version 1.6, version 94B or above

WinFrame Win16 Web Client, latest version from www.citrix.com/demoroom/default.asp

Installation

OS/2 Installation

Install OS/2 Warp Version 4.0 following the standard install procedure. Use the default settings. Install networking support for File and Print Client Services, Novell NetWare, TCP/IP Client Services, and the NetWare client. Verify that the network adapter settings are correct. Select the workstation name, description (if desired), and domain name. Choose the protocol you want to use. For TCP/IP, specify the hostname (usually the same as the workstation name), the IP address, the subnet mask, the router address, and the domain name required by your configuration, or use DHCP if a DHCP server is present on the LAN.

IBM OS/2 Warp Version 4.0 includes network and TCP/IP protocols and software as part of the operating system. Follow the instructions for installing the additional network and TCP/IP software as part of the installation of the system. Network and TCP/IP software for WINOS2 and virtual DOS are installed as defaults during the installation.

Note  The Client name and password must be the same on both the IBM LAN Server and the WinFrame server.

WINOS2 Setup

Before installing the WinFrame Client, the WINOS2 settings must be set to allow the WinFrame Client to operate properly with DDE and Clipboard. Establish the settings as follows:

Note  You may elect not to make these settings if you do not intend to use the DDE or Clipboard functions.

1.	Under OS/2 System Folder, select System Setup and then WIN-OS/2 Setup.

2.	Under WIN-OS/2 Setup Settings. select the Data Exchange tab.

3.	On the Data Exchange settings page, select Public for both selections. This is required for DDE and Clipboard operation.

4.	Close all the previous selections; this portion of the settings is complete.

5.	Under OS/2 System Folder, select Command Prompts.

6.	Go to the Settings page of either the seamless WINOS2 or full screen WINOS2 icon. (The right mouse button brings up a menu; click on Settings.)

7.	Select the Session tab, then select WIN-OS/2 settings. Make sure the All DOS and WIN-OS/2 settings radio button is highlighted and select OK.

8.	Set WIN_RUN_MODE to 3.1 Enhanced Compatibility.

9.	Set WIN_DDE to On.

10.	Set WIN_CLIPBOARD to On.

11.	Select Save and close the notebook.

12.	Close all the previous selections; this portion of the settings is complete.

13.	When using IBM LAN and NetBIOS, the following line must be entered in the AUTOEXEC.BAT:

x:\ibmcom\ltsvcfg n1=1

where x is the OS/2 system drive. This command enables the NAME_NUMBER_1 support required to support NetBIOS connections.

Client Installation on OS/2

Before installing the Client, decide what protocols you will use. Client installation is simple; insert the WinFrame Client diskette in drive A and run setup in a WINOS2 session.

Client Protocol

TCP/IP

If you choose TCP/IP, make sure you have the server hostname handy and that OS/2 TCP/IP and DOS TCP/IP are installed.

IBM LAN

All IBM LAN software must be installed prior to installing the Client. You must know the server name, the Client name, and the password. The following line must be in AUTOEXEC.BAT to allow NetBIOS to work:

c:\ibmcom\lstvcfg n1=1

Dial-In

When installation starts, you are asked if you wish to select the Dial-In option.
Do not select this option at this time. Once installation is complete and you are setting up the local user, you may elect to use the Dial-In option to allow a modem connection.

WinFrame Win16 Client

Before installing the WinFrame Client, decide what network protocols and hardware adapters will be used.

IPX and SPX connections are not supported at this time because OS/2 does not support VxDs. TCP/IP connections are supported without any changes. NetBIOS connections are supported if you load NAME_NUMBER_1 support. Serial Dial-In and direct connect connections are supported without any changes.

WinFrame Win16 Web Client and Web Explorer

The IBM OS/2 Web Explorer is an OS/2-based Web browser. The procedure below describes how to configure the IBM OS/2 Web Explorer for use with the Citrix WinFrame Web Client.

1.	Download the WinFrame Win16 Web Client from the Citrix Demo Web page (www.citrix.com/demoroom/default.asp). Follow the directions on the page to install the Client.

2.	Edit the file C:\MPTN\ETC\EXPLORE.INI. In the [advanced] section specify a MAILCAP file if one does not exist by adding C:\MPTN\ETC\MAILCAP to the end of the mailcap= statement. In the [advanced] section, specify a EXTMAP file if one does not exist by adding C:\MPTN\ETC \EXTMAP to the end of the EXTMAP= statement. Save the file and exit the editor.

3.	Edit or create the file C:\MPTN\ETC\MAILCAP. Add the line:

application/x-ica; c:\ICAWIN\WFICA16.EXE %s

Save the file and exit the editor.

4.	Edit or create the file C:\MPTN\ETC\EXTMAP. Add the line:

application/x-ica ica

Save the file and exit the editor.

5.	Restart the Web Explorer.

WinFrame DOS Client

Change the DOS_FILES setting for the WinFrame DOS Client session to 40. The default value of 20 causes the WinFrame DOS Client to exit with an "insufficient files" error message.

DOS sessions under OS/2 Warp load NetWare support (TBMI2 and NETX) by default; IPX connections are supported without any changes. SPX is not supported.

TCP/IP support also is loaded by default. When creating a TCP/IP remote application entry, specify TCP/IP-VSL as the connection type. Include the following line in the AUTOEXEC.BAT or in a .BAT file that starts the DOS Client:

x:\wfclient\mibmtcp.exe

NetBIOS connections require you to load NAME_NUMBER_1 support before running the Client. This support is not enabled by default. Include the following line in the AUTOEXEC.BAT or in a .BAT file that starts the DOS Client:

x:\ibmcom\ltsvcfg n1=1

where x is the OS/2 system drive. This command enables the NAME_NUMBER_1 support required to support NetBIOS connections.

DOS async connections require changes to the default DOS settings for the session. The following changes support direct connect and modem connections at up to 57.6Kbps:

COM_DIRECT_ACCESS	On
COM_HOLD	On
COM_RECEIVE_BUFFER_FLUSH	None
COM_SELECT	All
DOS_DEVICE	x:/OS2/MDOS/COMDD.SYS (see note below)
DOS_FILES	40
HW_ROM_TO_RAM	On
HW_TIMER	On
IDLE_SECONDS	60
IDLE_SENSITIVITY	100
Note  x is the OS/2 system drive. Add this device driver statement to the list of device drivers.

Usage

The WinFrame Win16, DOS, and Win16 Web Clients are supported on OS/2 Warp Version 4.0. The sections below discuss the compatibility issues for each Client.

Note  Cut, Copy, and Paste operations only work when cutting or copying data from the WinFrame Client and pasting it to the WINOS2 or OS/2 session. Data cut or copied from the OS/2 or another WINOS2 session (not the one running the WinFrame Client) cannot be pasted to the WinFrame Client.

A hotfix is available that fixes the problem described above. Contact your Citrix Technical Support representative for details. The DOS Client does not support Cut and Paste operations between OS/2 and WinFrame sessions.

Printer Setup

Local Printing

1.	Verify that the WINOS2 printer drivers are installed.

2.	To access your local printer, type net use LPT:x \\client\LPT:y (where x and y are printer ports) at a command prompt and press ENTER.

3.	Create a printer object for the local printer using the WinFrame Client Print Manager. Once the printer object is created, the printer is accessible by the Client using WinFrame server applications.

Printing on an IBM LAN Domain/Server

1.	Make sure the printer is physically attached to the IBM LAN server. The IBM LAN server must have the printer driver installed.

2.	The printer must be shared and available to all members. All members must have Create Permissions (CP) print permission granted on the IBM LAN Server.

3.	The printer object for the WinFrame server connection must be created using the WinFrame server Print Manager.

4.	To connect the WinFrame server to the IBM LAN server, use the Print Manager Connect feature. You must type the UNC Share name in the printer box; for example, \\server47\4019. This creates a print object in Print Manager.

5.	When creating the object, select the Share option during object creation.

6.	Once the printer object is created, the printer is accessible by the clients. WinFrame server applications can now print on the IBM LAN server printer.

7.	The client, as a member of the WinFrame server, automatically has a print object created in the Client Print Manager. The client user has to select the print object as default to configure the server printer as the default printer.

Printing On the WinFrame Server

The printer object for a WinFrame printer is created using the WinFrame Print Manager.

1.	Create the printer object as a shared object.

2.	Once the printer object is created, the printer is accessible by the clients. Applications running on the WinFrame server can now print on the server printer. The client, as a member of the WinFrame server, automatically has a print object created in the Client Print Manager. The client user has the option of selecting the print object as default if the server printer needs to be the default printer.

DDE and OLE

DDE and OLE are supported within the WinFrame client. There is no interoperability between the WinFrame client and WINOS2 or OS/2 sessions.

Network and CD-ROM Drives

All non-local drives are supported by executing the following command at the WinFrame client command prompt:

net use x:  \\client\y

where x is the drive to be mapped to and y is the non-local drive supported by OS/2.


Trumpet WinSock Version 2.1

Overview

Trumpet WinSock Version 2.1 can be used to give a Windows Version 3.1 or Windows for Workgroups Version 3.11 client TCP/IP support. Trumpet can be used instead of the Dial-Up Manager for situations where you want easy access to both a local IPX network and a remote WinFrame RAS IP network through Windows without having to disable your local network. Trumpet also provides useful scripting capabilities. Trumpet WinSock can be used on a network over a packet driver or it can be used over a Trumpet PPP connection to WinFrame RAS. Once a TCP/IP connection is established with the WinFrame server, the WinFrame Win16 Client Remote Application Manager can be used to connect to a remote control session on the WinFrame server. The following information describes how to install Trumpet WinSock 2.1 for use with the WinFrame Win16 Client Remote Application Manager and WinFrame.

Note  Trumpet WinSock Version 2.1 is primarily a Windows and Windows for Workgroups 16-bit stack. Although Trumpet WinSock can be used with Windows 95, it is not always the best solution. Windows 95 is shipped with Dial-Up Networking PPP client and TCP/IP that provide a 32-bit solution for Windows 95. Using Trumpet on Windows 95 is not necessary and users should make use of the standard Windows 95 Dial-Up Networking PPP client and TCP/IP support if at all possible. Trumpet WinSock cannot be used on Windows NT 3.5 or WinFrame. Note that Trumpet WinSock does not support DOS. If you need a DOS PPP client, use the WinFrame Client Dial-Up Manager DOS and 16-bit Windows. This provides a DOS and Windows solution and supports both TCP/IP and IPX.

Requirements

Hardware Requirements

See Windows Version 3.1 and Trumpet WinSock Version 2.1 requirements

Software Requirements

WinFrame Version 1.5 or higher

Windows Version 3.1 or Windows for Workgroups Version 3.11

Trumpet WinSock Version 2.1 (available from http://www.trumpet.com.au)

Packet driver (if using Trumpet on a network LAN)

Installation

The Trumpet WinSock stack can be installed on a Windows 3.1 or Windows for Workgroups 3.11 client. The Trumpet WinSock stack can be installed in one of two ways: as a PPP client for use with WinFrame RAS or with a LAN adapter using a packet driver.

Installing the Trumpet WinSock Stack for a PPP Connection to WinFrame

A PPP to RAS setup consists of two parts. First, the NT RAS server must be installed on the WinFrame server. Next, the Trumpet WinSock PPP client must be installed on the client system. This section describes how to install and set up Trumpet WinSock as a PPP client that supports the IP protocol on the user's client system. Refer to the Remote Access Services manual and the section "RAS Tips and Techniques" in the online Readme for information on installing and configuring WinFrame RAS. When configuring RAS, you must set Encryption to "Require any authentication including clear text." Encryption CANNOT be set to "Require Microsoft encrypted authentication" or Trumpet WinSock will not operate properly. Verify the Encryption setting using the Remote Access Server software in the Network applet in Control Panel on the WinFrame server.

1.	Make sure you have Windows Version 3.1 or Windows for Workgroups Version 3.11 installed on the client PC. No network software should be installed on the client; if there is, disable it. The use of other network stacks with the Trumpet WinSock stack is beyond the scope of this document. If you are interested in doing this, see the Windows installation manuals and the Trumpet WinSock Version 2.1 manual for details.

2.	Create a directory on the Windows client called \TRUMPET, copy the file TWSK21F.ZIP into this directory, and unzip the file using PKUNZIP. When the unzip is complete, the \TRUMPET directory should contain the files TCPMAN.EXE, WINSOCK.DLL, HOSTS, SERVICES, PROTOCOL, SENDREG.EXE, SETUP.CMD, LOGIN.CMD, BYE.CMD, and TRUMPWSK.HLP, plus some Trumpet TCP utilities. You can download the TWSK21F.ZIP file from various sources including http://www.trumpet.com.au

3.	Edit AUTOEXEC.BAT and add C:\TRUMPET to the end of your PATH statement. For example, PATH C:\WINDOWS;C:\DOS becomes PATH C:\WINDOWS;C:\DOS;C:\TRUMPET. Once you have made this change, save the AUTOEXEC.BAT file and reboot the client system.

4.	Start Windows on the client and create a new Windows program group. You can name this group "TRUMPET." Once this group is created, click New from the Windows Program Manager File menu to add a new program item. Specify C:\TRUMPET\TCPMAN.EXE as the executable file name. This is the Trumpet TCP Manager utility used to create connections.

5.	Double-click on the Trumpet TCP Manager icon. The first time the Trumpet TCP Manager runs, it starts the Trumpet setup program. If you need to use setup again at a later time, select the Setup option under the File menu. When the setup panel appears, enter the IP address of your DNS server and your domain name, if you have one. Check the Internal PPP check box and set the SLIP port to the COM port your modem is connected to. Leave the IP address, net mask and IP gateway values at 0.0.0.0; these values are supplied by the WinFrame server when a connection is made. Click OK to save your configuration values. Exit Trumpet TCP Manager and then restart it to load your new values.

6.	When TCPMAN.EXE restarts, select PPP Options from the File menu. Turn off the Use Password Authentication Protocol (PAP) check box. Enter your WinFrame username and password so that you can log into RAS. If you are using a domain user name, append the domain separated by a back slash from the username in the Username field. For example:

For a local WinFrame user:

Username:	BOBW

Password:	xxxxxx

For a Windows NT or WinFrame domain user:

Username:	DOMAIN\BOBW

Password:	yyyyyy

You must use the Remote Access Administrator to grant RAS access to each user who will access the WinFrame server using RAS.

7.	The default login script that comes with Trumpet WinSock is not suitable for Windows NT or WinFrame RAS. To change it, start a DOS prompt and change to the \TRUMPET directory. Create a backup copy of the original LOGIN.CMD file to LOGIN.BAK by typing copy login.cmd login.bak.

Once you have created a backup copy, edit the LOGIN.CMD file using DOS EDIT or Windows Notepad. Change the LOGIN.CMD file to resemble the following example:

#

# Trumpet WinSock 2.1 Login.cmd

#

# Copyright (C) 1994,1995 Peter R. Tattam &
# Trumpet Software International Pty Ltd (TSI)
# All rights reserved.

#

# Unless TSI has given prior written consent to such use, no permission is granted to distribute or
# otherwise make available to the public modified versions of this script for commercial purposes.
# Any permitted distribution of modified versions of the script must retain the copyright notice at the
# start of this file and must clearly identify those parts of the file that have been modified.

#

#trace on

#

# set up some strings for dialing up

query $number "Enter your dial up phone number"

$modemsetup = "&c1&k3"
$prompt = ">"
$userprompt = "Accepted:"
$passprompt = "assword:"
$slipcmd = "slip"
$addrtarg = "our address is"
$pppcmd = "ppp"
$pppready = "PPP."
%attempts = 10

###############################################

# timeouts for various sections of the script #

###############################################

# timeout for busy tone... adjust this until the BUSY string is detected.

#

%busytimeout = 10

#

# time between successive busy attempts.

#

%busywait = 30

#

# time to wait for a CONNECT string to be received

#

%connecttimeout = 60

#

# time to wait until DCD is detected

#

%onlinetimeout = 60

#

# time to wait for username & password prompts

#

%logintimeout = 60

#

# time to wait for server prompt to appear

#

%prompttimeout = 30

#

# time to wait for a SLIP address to be parsed

#

%addresstimeout = 30

#

#

#

#

#----------------------------------------------------------

#

# initialize modem

#

status "Initializing modem..."
output "atz"\13
if ! [input 5 OK\n]
 message "Modem is not responding"
 abort
end

#

# setup our modem commands

#

output "at"$modemsetup\13
if ! [input 10 OK\n]
 message "Modem is not responding"
 abort
end

#

# send phone number

#

%n = 0
repeat
 %n = %n + 1
 if %n > %attempts
  message "Too many dial attempts"
  abort
 end
 status Dialing $number...(attempt %n)
 output "atdt"$number\13
 %busy = [input %busytimeout BUSY]
 if %busy
  status "The line is busy...pausing for a while"
  sleep %busywait
  %ok = 0
 else
  %ok = [input %connecttimeout CONNECT]
 end
until %ok
input 10 \n

#

# wait until it's safe to send because some modems hang up
# if you transmit during the connection phase

#

wait %onlinetimeout dcd

#

See the Trumpet WinSock documentation for more information on how to customize and change the LOGIN.CMD script. You can customize the initialization string for your modem, as well as any other modem or line settings, using the Trumpet scripting language. When you have changed the LOGIN.CMD file, save it and exit the DOS session to get back to Windows.

8.	Start the Trumpet TCP Manager. From the Dialer menu, select Login. You are prompted for the phone number of the WinFrame RAS server. Enter the phone number and press the ENTER key. At this point, the modem dials and connects to the WinFrame RAS server, and TCPMAN logins and establishes a TCP/IP connection. At this point you can use the Trumpet ping utility to verify the connection.

Installing the Trumpet WinSock Stack for Use With a LAN Adapter

1.	Make sure you have Windows Version 3.1 or Windows for Workgroups Version 3.11 installed on the client PC. No network software should be installed on the client; if there is, disable it. The use of other network stacks with the Trumpet WinSock stack is beyond the scope of this document. If you are interested in doing this, see the Windows installation manuals and the Trumpet WinSock Version 2.1 manual for details.

2.	Create a directory on the Windows client called \TRUMPET and copy the TWSK21F.ZIP and WINPKT.ZIP files into this directory. You can download these files from various sources, including http://www.trumpet.com.au. Unzip these files using PKUNZIP. When done you should have at least these files in the \TRUMPET directory: TCPMAN.EXE, WINSOCK.DLL, HOSTS, SERVICES, PROTOCOL, SENDREG.EXE, SETUP.CMD, LOGIN.CMD, BYE.CMD, TRUMPWSK.HLP, and WINPKT.COM, as well as some Trumpet TCP utilities.

3.	Edit AUTOEXEC.BAT and add C:\TRUMPET to the end of your PATH statement. For example, PATH C:\WINDOWS;C:\DOS becomes PATH C:\WINDOWS;C:\DOS;C:\TRUMPET. Once you have made this change, save the AUTOEXEC.BAT file and reboot the client system.

4.	Start Windows on the client and create a new Windows program group. You can name this group "TRUMPET." After this group has been created, click New from the Windows Program Manager File menu to add a new program item. Specify C:\TRUMPET\TCPMAN.EXE as the executable file name. This is the Trumpet TCP Manager utility used to create connections.

5.	Double-click on the Trumpet TCP Manager icon. The first time the Trumpet TCP Manager runs, it starts the Trumpet setup program. If you need to use setup again at a later time, select the Setup option under the File menu. Once in the setup panel, make sure that Internal PPP and Internal SLIP are NOT checked. Enter the IP address for your Windows client as well as the net mask and the default IP gateway. Next, enter the IP address of your DNS server and domain name if applicable. Click OK to save your configuration values. Exit Trumpet TCP Manager and then restart it to load your new values.

6.	You can either use only IP with your LAN adapter using a packet driver, or you can use the ODIPKT.COM driver to link into your NetWare IPX ODI driver. Using the ODIPKT.COM driver will give you both IP and IPX connectivity on your network, while using a packet driver alone provides only IP connectivity. Your LAN adapter may have come with a packet driver; if it did, use this driver. The ftp site ftp.crynwr.com has packet drivers for many different network cards in the /DRIVERS directory. If you cannot find a packet driver for your network card or you would rather use the ODI driver for your network card to get IPX as well as IP, you can get the ODIPKT.COM driver from many places on the Web, including hsdndev.harvard.edu in the /PUB/ODIPKT directory. Once you have obtained the correct packet driver, copy it into the \TRUMPET directory.

7.	If you are installing a packet driver for your LAN adapter, you must add the packet driver command and the Trumpet WinSock WINPKT command to the end of your AUTOEXEC.BAT. The packet driver command line must contain the vector, interrupt level, and I/O port address values used for the LAN adapter. For example, for a NE2000 adapter running on interrupt level 2 and I/O port 300:

NE2000 0x60 2 0x300
WINPKT 0x60

If you are installing the ODIPKT.COM driver for use with your standard ODI driver, you must first install the Novell NetWare client with your ODI driver for IPX support. You can then edit your network batch file (usually STARTNET.BAT) to load the drivers in this order:

C:\NWCLIENT\LSL

C:\NWCLIENT\NE2000

C:\NWCLIENT\IPXODI

C:\TRUMPET\ODIPKT

C:\TRUMPET\WINPKT 0x69

C:\NWCLIENT\VLM

This example uses VLMs but you can use NETX instead if you wish. Your NET.CFG should be edited to load the frame types in the right order and to set the Buffers and MemPool settings correctly. For example:

Link Support

Buffers 8 1586

MemPool 16384

Link Driver NE2000

Port 300

Int 2

Frame Ethernet_II

Frame Ethernet_802.3

Protocol IPX 0 Ethernet_802.3

When STARTNET.BAT runs, it loads IPX and the ODIPKT.COM driver. You can then start Windows and the Trumpet TCP Manager to load TCP/IP. Run the Trumpet ping utility to ping the WinFrame server to verify a connection.

Usage

Once the client has IP support, either by use of Trumpet WinSock as a PPP client or directly on a LAN using a packet driver, use the WinFrame Win16 Client Remote Application Manager to connect to any WinFrame server on the remote network via IP. If you are using PPP and you wish to disconnect from the RAS server, choose Bye from the Dialer menu of the Trumpet TCP Manager.

Troubleshooting

Why does my user login fail to authenticate on the RAS server when I dial in using PPP?

This is caused either by not using a valid username on the WinFrame server or by not granting the username RAS access permissions. See the WinFrame manuals for information on setting up users and granting them RAS access permissions.

The packet driver loads, but when I run TCPMAN in Windows it gives an error and says "TCP unable to load." What's wrong?

This is usually caused by not specifying the correct vector, interrupt level, or I/O port address when loading the packet driver, by not using the same vector when loading WINPKT, or by an error in your NET.CFG. If you are using the ODIPKT driver, make sure the Frame Ethernet II frame type is loaded before the Frame Ethernet_802.3 frame type.


Advanced Revelation Version 3.1

Overview

Advanced Revelation 3.1 for DOS is a database application that supports multiple users.

Software Requirements

Advanced Revelation 3.1 for DOS

WinFrame

Installation

Follow the installation procedure in the Advanced Revelation 3.1 manuals and installation documentation.

Usage

The default DOS keyboard polling detection does not prevent Advanced Revelation 3.1 for DOS from trying to use all the available CPU in the system. Before running Advanced Revelation, run AREVFIX in the DOS window in which you will run Advanced Revelation. AREVFIX is a TSR that prevents Advanced Revelation from using all the CPU in the system. An Advanced Revelation .PIF file can be set up to point to a custom AUTOEXEC.NT file that runs AREVFIX before running Advanced Revelation so that a Windows icon can be used.


Borland Paradox for Windows and Delphi BDE

Overview

Paradox for Windows and Delphi BDE are popular database applications.

Software Requirements

Paradox for Windows or Delphi BDE

Installation

Logon as an administrator. Start a command prompt session. Type change user /install and press ENTER. Install Paradox for Windows and the Delphi BDE, following the manufacturer's directions. When installation is complete, type change user /execute and press ENTER.

Usage

Paradox for Windows and the Delphi BDE are designed to work in a network environment.  Both applications control locking of database records from a common file, PDOXUSRS.NET, located on the network in a common location where all users can access it.  This causes a problem, however, on WinFrame because these applications are not designed to operate on a multiuser operating system such as WinFrame. Users accessing the Paradox tables and the PDOXUSRS.NET file across the network will work correctly; however, multiple users on a WinFrame server will cause the Paradox tables to become corrupted.

To avoid this problem, all Paradox database tables and the PDOXUSRS.NET lock file must be placed on a network share point.  There are two ways to do this. The first way is to place the Paradox tables and the PDOXUSRS.NET file on another network file server, which can be a stand-alone Microsoft Windows NT file server, another WinFrame server, or a NetWare file server. The second method is to create a network share point pointing to one of the WinFrame server's local hard disks and then net use this share point as another drive letter.

For example, the administrator can create the directory C:\PDOX, and use the command net share pdoxshare=c:\pdox to create a network share point. Each Paradox user can then map this share point; for example: net use x: \\winframe_server\pdoxshare.

All Paradox tables and the PDOXUSRS.NET lock file can then be placed in the shared directory. The shared directory acts like a network drive even though it is on the local WinFrame server. Users can access these tables as normal from the mapped network drive, in this case drive X, and file locking will function correctly.


FoxPro for Windows

Overview

FoxPro for Windows is a database application that can support multiple users.

Software Requirements

FoxPro for Windows

WinFrame Version 1.6 with Service Pack 4a or higher

Installation

1.	Execute change user /install before installing FoxPro.

2.	Follow the installation procedure in the FoxPro for Windows manuals and installation documentation.

3.	Execute change user /execute after installing FoxPro.

Usage

FoxPro for Windows does not perform like a true Windows application because it does not utilize basic Windows displays such as buttons and dialog boxes to create its screen display. It acts more like a DOS application because its display window is actually a bitmap in a video buffer. When any changes are made to the bitmap, the entire bitmap is sent to the display. This may cause some dialogs to paint slowly. The FOXPFIX.EXE utility is used to fix this problem. Follow the steps below to troubleshoot FoxPro for Windows application performance problems.

1.	Run FOXPFIX.EXE.

Note  This fix is included in Service Pack 4a. It is enabled by default.

2.	Run FOXPFIX.EXE with the /Q option to query the state of the executable. To see the effect on performance, try the enabled mode first and then the disabled mode.

3.	Test the performance of FoxPro for Windows on the console and the client.

4.	If the performance problem is a client issue, it is probably related to video or screen updates. In order for WinFrame to compensate for this behavior, the screen design guidelines below are suggested:

Keep screens as simple as possible. Limit colors and color changes.

Limit actions to 25% of the active screen area. For example, if an action changes a field or a background, make sure that the changes are kept within the same 25% of the screen area.

Do not overrun the area you are working in. If you are working with a 640x480 screen, do not let your screen displays stray outside of this area. Document windows must fit entirely within the main window.

5.	If the performance problem is a console or server issue, use Performance Monitor to verify CPU utilization. If CPU utilization is high, try disabling the FOXPFIX utility by executing foxpfix /disable. For additional information, refer to "Application Performance Tuning" in the WinFrame Readme (WFREADME.HLP).


Microsoft Access Version 2.0

Overview

Microsoft Access Version 2.0 for Windows is a database management system that allows the user to design and customize databases. The following is for user-specific installations. User-global installations should not have this problem. See the online Readme "General Installation of Applications on WinFrame" for information on the preferred user-global install method.

Software Requirements

Microsoft Access Version 2.0 for Windows

WinFrame Version 1.5 or higher

Installation

Follow the installation procedure in the Microsoft Access documentation.

Configuration

If the Output To option in the File menu returns No Output Formats Installed, copy the file MSACC20.INI, found in the user's \WINDOWS directory, to the %systemroot% directory on the Windows NT boot drive. After copying the MSACC20.INI file to the system directory, the Output To option in the File menu will function correctly.


Microsoft SQL Server Version 6.00.21 (BackOffice Version 1.5)

Overview

Microsoft SQL Server is a back-end database that runs as a service on WinFrame. Once the service is running, multiple users can run front-end applications to access the database. The SQL service is available not only to users on the WinFrame server, but also to network client workstations running front-end software on their local client machines. Users who log on the a WinFrame server can access the database server with increased performance because there is no network overhead.

Software Requirements

Microsoft SQL Server Version 6.00.21(BackOffice Version 1.5)

WinFrame Version 1.6 and above

Installation

Microsoft SQL Server can be installed on a WinFrame server in three different configurations: as an SQL Server, as an SQL Client, or as both SQL Server and SQL Client.

WinFrame servers support SQL front-end and back-end applications. For large database systems, running the back-end SQL server on dedicated hardware may provide better performance.

SQL Server Installation on WinFrame

To Install Microsoft SQL Server

1.	Logon as an administrator at the WinFrame system console.

2.	At a Command Prompt, type change user /install. This places the user session in the install mode.

3.	Install Microsoft SQL Server as described in the Microsoft SQL Server Installation Guide.

4.	At the end of the SQL setup procedure, do not choose to reboot the machine. Exit Microsoft SQL Server Setup.

5.	Run File Manager. Double-click on the file \SQL60\DLL\SQLOLE.REG. This step registers some OLE objects required for proper operation of Microsoft SQL Server.

6.	Reboot the server.

Installation Verification

To Verify Your SQL Server Software is Installed Properly

1.	Run the SQL Service Manager found in the SQL program group to verify that the SQL service is started. The traffic signal displays a green light if the service is started. If the service is not started, use the Services applet in Control Panel to manually start the service. You may also set the service to automatically start up at boot time from this applet.

2.	Once you have verified the service is started, double-click on the ISQL icon in the SQL program group.

3.	Connect to the SQL server using a default username of "sa" with no password.

4.	Select the database "pubs" from the pull-down menu.

5.	Enter the command select ∗ from authors in the working window. Press the Play button in the upper right hand corner of the window.

6.	You should now be able to view data in the sample database included with SQL.

SQL Client Software Installation on WinFrame

Refer to the online Readme "General Installation of Applications" for information about installing the front-end software on WinFrame.


Microsoft Exchange Server (Enterprise Edition) Version 4.0 and Microsoft Exchange Mail Client Version 4.0

Overview

This discusses the installation of the Microsoft Exchange Server on WinFrame. Microsoft Exchange Server is a client/server corporate messaging system that incorporates e-mail, scheduling, electronic forms, document sharing, and custom applications in a single product. Microsoft Exchange consists of two parts: Exchange Server and Exchange Client. Both Exchange Server and Exchange Client can be run on a WinFrame server.

In a standard configuration, Microsoft Exchange Server is installed and run as a service on the primary domain controller (PDC), which can be a WinFrame server or a Microsoft Windows NT 3.51 server. The Exchange Client is installed on all other WinFrame servers. WinFrame client connections to any of the WinFrame servers execute the Microsoft Exchange Client software, which then connects to the Microsoft Exchange Server.

Installing Microsoft Exchange Server

Hardware Requirements

WinFrame server

100MHz Pentium or better

Minimum of 32MB RAM

Software Requirements

Microsoft Exchange Server Version 4.0 (Enterprise Edition)

WinFrame Version 1.6 with Service Pack 4 or higher installed

Installation

1.	WinFrame Version 1.6 with Service Pack 4 should be installed and configured as a primary domain controller. Make sure that the page file size is equal to at least 100MB more than the amount of physical RAM, and that there is at least 250MB of free hard disk space.

2.	Logon to the WinFrame server as an administrator.

3.	At a command prompt, type change user /install and press ENTER. This places the user session into install mode.

4.	Install the Microsoft Exchange Server as described in the Microsoft Exchange Server Installation Guide.

5.	At a command prompt, type change user /execute and press ENTER. This returns the user session to execute mode.

Installing Microsoft Exchange Client

Hardware Requirements

WinFrame server

Pentium 100MHz or better

Minimum of 32MB RAM

Software Requirements

Microsoft Exchange Client Version 4.0

WinFrame Version 1.6 with Service Pack 4 or higher installed (can be the server that the Exchange server resides on or another WinFrame server)

Installation

1.	Logon to the WinFrame server as an administrator.

2.	At a command prompt, type change user /install and press ENTER. This places the user session into install mode.

3.	Install Microsoft Exchange Client as described in the Installation Guide.

Note  After installation there is a "setup0,0,0,0" error popup. This can be ignored.

4.	At a command prompt, type change user /execute and press ENTER. This returns the user session to execute mode.

Configuration

After the Microsoft Exchange Server and Client are installed, the system administrator must create mailboxes for current users on the system. There is a migration utility for migrating users from Microsoft Mail to Exchange that creates the new post offices and transfers the old mail files to the Exchange files. A mailbox is created by default when a new user is created in User Manager for Domains.

Once a mailbox is configured for a user, the user can log in to the WinFrame server and run Microsoft Exchange and Microsoft Schedule. The first time a user runs these programs, the user must specify the Post Office Server, Post Office Box name, the location of the Personal Address Book (.PAB) file, and the location of the Calendar (.CAL) file.


Microsoft Exchange Server (Enterprise Edition) Version 5.0 and Microsoft Exchange Client Version 5.0

Overview

Microsoft Exchange Server is a client/server corporate messaging system that incorporates e-mail, scheduling, electronic forms, document sharing, and custom applications in a single product. Microsoft Exchange consists of two parts: Exchange Server and Exchange Client. Both Exchange Server and Exchange Client can be run on a WinFrame server.

In a standard configuration, Microsoft Exchange Server is installed and run as a service on the primary domain controller (PDC), which can be a WinFrame server or a Microsoft Windows NT 4.0 server. The Exchange Client is installed on all other WinFrame servers. Users connect to the WinFrame servers and run the Microsoft Exchange Client, which then accesses the Microsoft Exchange Server.

Software Requirements

WinFrame Version 1.6 with Service Pack 5 or WinFrame Version 1.7

Microsoft Exchange Server and Client Version 5.0

Installing and Configuring Microsoft Exchange Server 5.0

Installing Microsoft Exchange Server 5.0

1.	Install and configure WinFrame as a primary domain controller (PDC). Make sure that the page file size is equal to at least 100MB more than the amount of physical RAM and that there is at least 250MB of free hard drive space.

2.	Logon to the console of the WinFrame server as an administrator.

3.	At the command prompt, type change user /install and press ENTER. This places the user session in install mode.

4.	Insert the Microsoft Exchange Server 5.0 CD-ROM into the CD-ROM drive.

5.	From the Program Manager Main menu, double click on File Manager.

6.	Use the Browse button to select your CD-ROM device (or other device containing the Microsoft Exchange 5.0 software). The Exchange 5.0 Setup program is in SETUP\I386\SETUP.EXE. Select Next to proceed.

7.	Microsoft Exchange Setup offers three choices:

Typical Installation

Complete/Custom Installation

Minimum Installation

If you are installing Exchange 5.0 for the first time, select Typical Installation. Typical Installation was chosen for this test.

8.	Enter the CD Key and click OK.

9.	Click OK in the WinFrame Server Licensing Mode window.

10.	Enter the required information in the Choose Licensing Mode window.

11.	Check I Agree in the Per Server Licensing window and then click OK.

12.	Add the number of licenses purchased or required for this Exchange Server and select Continue.

13.	If Microsoft Exchange 5.0 was previously installed on your system, at this point you can make changes to an existing site that you may already have created. For new installs, select Create a New Site. Enter your organization name and a user-defined site name. Record this data for future use.

14.	Setup confirms the creation of a new site.

15.	Setup asks for an account name that will be used to logon to the system to start Exchange services when the system boots. Although this can be any user account, it is recommended that the administrator account be used.

16.	Source files are now copied to your system.

17.	When installation is completed, you may run the Optimizer immediately or run it later at your convenience.

18.	At the command prompt, type change user /execute and press ENTER.

Installation of Microsoft Exchange Server 5.0 is now complete.

Verifying Installation of Microsoft Exchange Server 5.0

Use the following procedure to verify that Microsoft Exchange Server 5.0 is correctly installed and configured.

1.	From the Main program group, double-click on Control Panel and then on Services. Scroll down the Services list and verify that the following services are listed and are automatically started:

Microsoft Exchange Directory

Microsoft Exchange Information Store

Microsoft Exchange Message Transfer Agent

Microsoft Exchange System Attendant

2.	Double click on the directory where Microsoft Exchange Server 5.0 was installed. Verify that this directory contains the following icons:

Microsoft Exchange Administrator

Microsoft Exchange Migration Wizard

Microsoft Exchange Optimizer

Microsoft Exchange Server Health

Microsoft Exchange Server History

Microsoft Exchange Server IMS Queues

Microsoft Exchange Server IMS Statistics

Microsoft Exchange Server IMS Traffic

Microsoft Exchange Server Load

Microsoft Exchange Server Queues

Microsoft Exchange Server Users

Configuring Microsoft Exchange Server 5.0

After installing Microsoft Exchange Server 5.0, the server needs to be configured for users to login and retrieve mail. Because Microsoft Exchange Server resides on a WinFrame server, all users with mailboxes on this Microsoft Exchange Server will also be WinFrame users. However, WinFrame users do not automatically have Exchange mailboxes. Use the following procedure to configure Exchange users.

1.	Double-click on the program group containing Microsoft Exchange Server 5.0 and select Microsoft Exchange Administrator.

2.	Type the server name that you want to connect to or use the Browse button. This is typically the name of the WinFrame server on which Microsoft Exchange has been installed.

3.	From the File menu, select New Mailbox to create mailboxes for users already on the domain. Use the Primary Windows NT Account button to associate this new mailbox with an existing account on the domain. If an account does not exist, the form allows creation of new accounts.

Installing and Configuring Microsoft Exchange Client 5.0

Special Considerations

If Microsoft Exchange Client 5.0 is being installed on the WinFrame server containing the Microsoft Exchange 5.0 Server, perform the following steps to ensure a successful Exchange Client installation. If Microsoft Exchange Client 5.0 is being installed on any other WinFrame servers, go to "Installing Microsoft Exchange Client 5.0" below.

1.	Logon to the WinFrame server as an administrator.

2.	From the Main program group, double-click on Control Panel, then on Services.

3.	Select the following services and stop them:

Messenger

Microsoft Exchange Directory

Microsoft Exchange Information Store

Microsoft Exchange Message Transfer Agent

Microsoft Exchange System Attendant

4.	Click Close to return to the Program Manager.

5.	Install Microsoft Exchange Client 5.0 as described below.

Installing Microsoft Exchange Client 5.0

1.	Install and configure WinFrame.

2.	Logon to the console of the WinFrame server as an administrator.

3.	At the command prompt, type change user /install and press ENTER. This places the user session in install mode.

4.	Insert the Microsoft Exchange Client 5.0 CD-ROM into the CD-ROM drive.

5.	From the Program Manager Main menu, select File Manager.

6.	Use the Browse button to select your CD-ROM device (or other device containing the Microsoft Exchange Client 5.0 software) and find the Setup program. If you are installing an English language version, the Exchange Client is in the ENG/I386/SETUP.EXE directory. Select Next to proceed.

7.	After accepting the copyright policies, enter your name and company information.

8.	Change the default installation path if desired.

9.	Microsoft Exchange Setup offers three choices:

Typical Installation

Complete/Custom Installation

Minimum Installation

If you are installing Exchange 5.0 Client for the first time, select Typical Installation.

10.	Source files are now copied to your system while Microsoft Exchange Information appears on the screen.

11.	When installation is complete, a dialog box appears informing you that Microsoft Exchange Setup was completed successfully.

12.	At the command prompt, type change user /execute and press ENTER.

13.	Double-click on the directory where Microsoft Exchange Client 5.0 was installed. Verify that this directory contains the following icons:

Microsoft Exchange Inbox

Microsoft Exchange Services

Inbox Repair Tool

Microsoft Exchange Setup

Microsoft Schedule+

Note  If Microsoft Exchange Server 5.0 was installed on the same system where the Exchange Client was installed, make sure that the Exchange Server services you stopped during installation are started again before proceeding to the next section. To do this, double-click on Services in Control Panel, select the services, and click Start or you can start the services again by rebooting the system.

14.	Verify that the permissions for Everyone in the %systemroot%\FORMS folder are Change.

15.	Verify that the permissions for Everyone in the %systemroot%\SYSTEM32\OLEAUT32.DLL folder are Read.

Configuring Microsoft Exchange Client 5.0

Once Microsoft Exchange Server and Client are installed and configured, users can login to a WinFrame server on the network and access their mailboxes on the Microsoft Exchange 5.0 Server using the Microsoft Exchange 5.0 Client.

Before a user can access e-mail, the user must perform the following steps to configure Microsoft Exchange 5.0 Client.

1.	Logon to a WinFrame server that has Exchange Client 5.0 installed and configured.

2.	From the Program Manager, select the program group where Microsoft Exchange Client 5.0 was installed and double click on Microsoft Exchange.

3.	Three options are displayed. Select Microsoft Exchange Server. Make sure that Microsoft Mail and Internet Mail are not checked and select Next.

4.	Enter the name of the Microsoft Exchange Server. This is typically the name of the WinFrame server on which Microsoft Exchange 5.0 Server was installed. Also enter the mailbox name; this is typically the username.

5.	Select Next to proceed. Follow the displayed instructions and configure user preferences.

6.	Select if you travel with the computer and click Next.

7.	In the Personal Address Book window, save MAILBOX.PAB in the user's home directory.

8.	After completing the Setup Wizard, the Exchange inbox will appear.

Setup of Microsoft Exchange 5.0 Client is now complete.


Microsoft Outlook 97

Overview

Microsoft Outlook is a desktop information management program that helps you manage your messages, appointments, contacts and tasks, as well as track activities, open and view documents, and share information to various users on the network. A centralized information store gives users the flexibility to access messages, information, and data while at work, home, or on the road.

Software Requirements

WinFrame Version 1.6 with Service Pack 5 or WinFrame Version 1.7

Microsoft Outlook 97

Installing Microsoft Outlook 97

1.	Install and configure WinFrame 1.6 or 1.7 as a stand-alone server or a domain controller.

2.	Logon to the console of the WinFrame server as an administrator.

3.	At the command prompt, type change user /install and press enter. This places the user session in install mode.

4.	Insert the Microsoft Outlook 97 CD in the CD-ROM drive.

5.	At the Program Manager Main menu, double click on File Manager.

6.	Select the CD-ROM. Double-click on SETUP.EXE. Click Continue to proceed with the installation.

7.	At the Name and Organization Information dialog box, enter the appropriate information. Record this for future use.

8.	Setup asks you to enter an 11-digit CD-key. This information is on the CD case.

9.	Setup searches for already installed components of Microsoft Outlook 97 and displays a default destination folder; for example, Microsoft Office. Change the destination folder if desired.

10.	Microsoft Outlook Setup offers two choices:

Typical Installation

Complete/Custom Installation

If you are installing Outlook 97 for the first time, select Typical Installation.

The default Program Group is Microsoft Office. Program Manager displays this icon on the desktop.

11.	Source files are copied to your system.

12.	When installation is completed, reboot your system for the changes to take effect.

Configuring Microsoft Outlook 97

Once Microsoft Outlook 97 is installed, users can login to the WinFrame server, connect to a Microsoft Exchange server (either on the local server or on the network), and access their mailboxes using Microsoft Outlook 97.

Before you can access e-mail, you must perform the following steps to configure Microsoft Outlook 97:

1.	Logon to a WinFrame server that has Microsoft Outlook 97 installed.

2.	From Program Manager, select the program group where you installed Outlook 97 and double-click on Microsoft Outlook.

3.	Select Exchange Server. Make sure that Microsoft Mail and Internet Mail are not checked and select Next.

4.	Enter the name of the Exchange server. This is typically the name of the server on which the Exchange Server is installed. Enter the mailbox name; this is typically the username.

5.	Select Next to proceed. Follow the on-screen instructions and configure user preferences.

Verifying Installation of Microsoft Outlook 97

Follow the procedure below to verify that Outlook 97 is correctly installed and configured:

1.	From Program Manager, double-click on Microsoft Office (or the program group where Outlook 97 was installed).

2.	Verify that this program group contains at least the following icons:

Microsoft Outlook Setup

Microsoft Outlook

3.	From Program Manager, double-click on the Startup program group and verify that it contains at least the following icons:

Office Startup

Microsoft Find Fast


Global Village FaxWorks Server for Windows NT Version 2.0

Note  This application note was supplied by Global Village Communication, Inc., 1144 East Arques Avenue, Sunnyvale, CA 94086. All trade names referred to are the Servicemark, Trademark, or Registered Trademark of the respective manufacturers.

Overview

FaxWorks Server for Windows NT is a powerful 32-bit fax server for the Windows NT or Citrix WinFrame operating systems. FaxWorks Server has been certified by Microsoft to be BackOffice compatible. The FaxWorks client, Version 3.00k or higher, and the FaxWorks Server, Version 2.10 or higher, have been specially modified to provide enhanced functionality in the WinFrame environment.

When running under WinFrame, the FaxWorks client uses the WinFrame user name as the FaxWorks user name. FaxWorks stores all non-shared user information in the WinFrame server's registry on a per-user basis and gives each FaxWorks user a private phone book and file cabinet.

Software Requirements

WinFrame Version 1.6 with Service Pack 5 or later, or WinFrame Version 1.7

FaxWorks Server for Windows NT, Version 2.10 or higher

A free update to FaxWorks Server 2.10 is available to all users of FaxWorks Server 2.00 or higher. This update is available in the form of a patch. The patch file is located on the Global Village ftp site at ftp://ftp.globalvillage.com/pub/software/nt/prolanj2.exe.

Installing and Configuring FaxWorks Server 2.10

Installing FaxWorks Server 2.10 is an eight step process. The steps are outlined below. A detailed description is given of the actions that must be taken to complete each step.

These installation notes are intended to supplement the FaxWorks Server for Windows NT Administrators Guide, not replace it. Familiarity with FaxWorks Server is assumed throughout the balance of this application note.

For an example, let's assume that FaxWorks Server 2.10 is being installed on a WinFrame Version (Service Pack 5) machine where WinFrame is located on C:\WINFRAME. The example WinFrame server also has a drive D where the majority of user-accessible applications and data are located.

1.	Install the WinFrame server. Verify that it is Version 1.6 with Service Pack 5 or higher, or WinFrame Version 1.7 or higher.

2.	At a command prompt, type change user /install and press ENTER. This turns WinFrame's INI file mapping off.

3.	Run the Administrative Installation of FaxWorks Server. Run SETUP.EXE from the Disk1 directory of the FaxWorks Server CD-ROM. During this install, the installation program prompts for the path to the FaxWorks Administrative directory. Under WinFrame, the FaxWorks Administrative directory is usually located on one of the WinFrame server's hard drives; for example, D:\FWLAN. If Novell NetWare support has been installed on the WinFrame server, the installation program will ask whether FaxWorks should use the NetWare bindery as the FaxWorks user list. For most WinFrame installations, FaxWorks should be configured to use the FaxWorks User List. Do not use the NetWare Bindery option unless you fully understand the interaction between FaxWorks PRO LAN and the NetWare Bindery.

4.	If necessary, install the FaxWorks Server 2.10 and FaxWorks Client 3.00k patch. Instructions for obtaining and loading the patch are detailed in "Software Requirements" earlier in this note.

5.	Create a unique home directory for each WinFrame user. To view or modify WinFrame user information, run User Manager for Domains located in the Administrative Tools program group. One at a time, highlight each user name and select Properties from the User menu. Click on the Profile button located at the bottom of the pop-up window. In the box labeled Home Directory, specify a unique home directory for the user. This home directory can be located on the local WinFrame server's hard drive or on a network directory. Each WinFrame user must have a unique home directory. Repeat this process for each WinFrame user.

6.	Install the FaxWorks client on the WinFrame server. The FaxWorks client installation program is located in a subdirectory called WINSTALL or the FaxWorks Administrative directory. In our example, the client setup program is D:\FWLAN\WINSTALL\SETUP.EXE. Follow the setup wizard prompts and fill in the information as requested. Midway through the installation, the setup wizard asks what type of modem is installed on the current system. The fax server portion of FaxWorks can be installed on the WinFrame server or run on a separate Windows NT system. If the fax server will run on the WinFrame server, select NT Fax Server (disk required). If the fax server will run on a separate system, select No Modem Installed. Most of the information supplied to the install program is used as default values. Each WinFrame user will be able to configure personal settings that override these default values.

7.	Start the FaxWorks PRO LAN client software. FaxWorks PRO LAN is located in a program group called FaxWorks PRO LAN. If the user logged onto WinFrame is not the administrator, you may get an error message stating that the FaxWorks user matching the logged on user could not be found. This is normal. Once the FaxWorks client is running, go to the Network menu and select User Maintenance. A FaxWorks user must be created for each WinFrame user who wishes to use FaxWorks. The FaxWorks user name must match the user's WinFrame user name. When a user logs onto the WinFrame server, either at the console or through an ICA client, the FaxWorks application will try to match the logged on WinFrame user name to the FaxWorks user name. If no match is found, an error message is generated.

8.	At a command prompt, type change user /execute and press ENTER. This turns WinFrame's INI file mapping back on.

FaxWorks is now ready for use by the WinFrame clients.

Additional Notes

FaxWorks does not allow the same user name to be logged into FaxWorks more than once simultaneously. Attempting to log onto WinFrame from multiple workstations with the same user name and send faxes or use the FaxWorks client may cause Btrieve errors, file sharing errors, or file copying errors. To use FaxWorks, each workstation logging onto WinFrame must use a unique WinFrame user account.

Each time a new WinFrame user is added to the system, or whenever a WinFrame user is to be granted access to FaxWorks, you must repeat Steps 5 and 7 above.

Each user may alter his or her own parameters for settings such as cover page and banner information. If these settings are not altered, FaxWorks will use the default values as specified during the installation. To change the settings, invoke any of the setup menu options, change any desired values, and click OK. Any per-user settings will automatically be saved into the WinFrame registry.

By default, FaxWorks changes its user to match that of the logged on WinFrame user. If this behavior is not desired, manually edit the master FAXWORKS.INI file located in the master WinFrame directory. In the [Program] section, add a line that reads Impersonate User=0.

Error Messages

Most errors that occur while running the fax server portion of FaxWorks Server are logged in the WinFrame event log. These messages can be viewed and managed through the WinFrame Event Viewer utility found in the Administrative Tools program group.

Repeat Steps 5 and 7 above if you get the following error message when starting the FaxWorks client:

"The logged on Windows user [John Smith] could not be found in the FaxWorks user file."

Global Village Technical Support

World Wide Web	http://www.globalvillage.com/
Internet file transfer	ftp://ftp.globalvillage.com/pub/software/win
Internet e-mail	lan_support@globalvillage.com
Technical Support Fax	1 (770) 984-9956
Fax on Demand	1 (800) 890-4562, 24 hours (United States only)
	1 (408) 523-2402, 24 hours (International)
BBS	1 (770) 984-9926, 24 hours
Telephone	1 (888) 417-0502 (toll-free in United States and Canada)


Optus FACSys Fax Messaging Gateway Version 4.1

Note  This document was written by Optus Software, Inc. of Somerset, New Jersey. This publication contains information that is the property of Optus Software. No part of this document may be copied or stored in a retrieval system without the written permission of Optus Software.

Please contact your FACSys Authorized Reseller for assistance with your FACSys product.

FACSys Fax Messaging Gateway provides fax server functionality to distributed and remote users in a Citrix WinFrame environment. WinFrame connects to clients across a LAN or through a router to a WAN and gives remote users immediate access to Windows 95 and Windows NT applications, regardless of their client hardware. WinFrame provides the distributed and mobile clients complete access to system resources such as remote printers and database information. With Optus FACSys, these remote WinFrame clients can also send, view, and print faxes through the network fax servers.

This document provides instructions on installing FACSys Fax Messaging Gateway in a WinFrame environment. Refer to the WinFrame documentation for information on installing and configuring the Citrix software and configuring user accounts.

Note  FACSys Fax Messaging Gateway is not supported on Citrix WinFrame Version 1.5 or earlier.

Installing the FACSys Fax Server Software

The computer on which you install the FACSys Fax Server software depends on your version of WinFrame.

WinFrame/Enterprise

The FACSys fax server may be installed on either the server or on another networked computer. However, due to the huge workload that may be required to host 15 or more simultaneous remote users, it is not recommended that you install the fax server on a WinFrame/Enterprise server.

WinFrame/Access

Because this version of WinFrame does not support file or print server functions, the FACSys fax server cannot be installed on a WinFrame/Access server. The fax server must be installed on another networked computer.

WinFrame for Terminals

Because this version of WinFrame does not support file or print server functions, the FACSys fax server cannot be installed on a WinFrame for Terminals server. The fax server must be installed on another networked computer.

To install the FACSys server software, follow the installation instructions in Chapter 2 of the FACSys Fax Messaging Gateway manual. Follow all instructions for installing the server software and creating the Windows NT (or WinFrame) user account that the Optus Fax Server service will log on as.

Installing the FACSys 32-bit Client Software on the Citrix WinFrame Server

Regardless of your version of WinFrame, you must install the FACSys Fax Messaging Gateway client software (32-bit) on the WinFrame server.

To install the FACSys client software, follow the installation instructions in Chapter 2 of the FACSys Fax Messaging Gateway manual. Each user should install the FACSys client software to the Windows directory in his/her home directory.

Installing the FACSys 32-bit Client Update Software for Citrix

When using FACSys in a WinFrame environment, you must apply the FACSys client software update that Optus has developed specifically for WinFrame servers. If you do not have the WINDD.ZIP file, you can download the file from the Optus FTP site at ftp.facsys.com. The WINDD.ZIP file resides in the /Version41/Server/Utils directory.

The WINDD.ZIP file consists of two files: FAXMON32.EXE and FXMON32.DLL.

After you have installed the FACSys client software, copy the FACSys/ WinFrame updated files to the appropriate directories:

Replace the FAXMON32.EXE file in the Windows directory of each user's home directory.

Copy the FXMON32.DLL file to the %systemroot%\System32 directory.

Defining a "Print to Fax" Printer for Each WinFrame User

If the WinFrame users will be printing to fax (as described in Chapter 13 of the FACSys Fax Messaging Gateway manual), you must define a FACSys printer for each user.

To define a FACSys print driver for a WinFrame user, log onto the WinFrame server as the user and follow the instructions for configuring a printer on a Windows NT Workstation in Chapter 2 of the FACSys Fax Messaging Gateway manual. Do this for each WinFrame user.

Note  To use the print to fax capability, the FACSys fax monitor application must be running at the WinFrame workstation. To start fax monitor, double click on the fax monitor desktop icon.

Before you Call for FACSys Technical Support

Verify that you are using Citrix WinFrame Version1.6. To find out the version, choose the Help/About command from Program Manager. To find out which Citrix service packs or hotfixes you have applied, enter hotfix /l at a DOS prompt.

Verify that you have installed the FACSys client 32-bit software and the updated FACSys client files on the WinFrame server in the correct directory as defined above.

Verify that you have not applied the Windows NT Service Pack 5 on your WinFrame server. This service pack is not allowed by Citrix. To find out which service packs or hotfixes you have applied, enter hotfix /l at a DOS prompt. Citrix has its own Service Pack 5 available from their Web site (www.citrix.com).

If the FACSys Schedule Fax dialog box does not appear or is appearing at the WinFrame server instead of the user's workstation, verify that the user is only logged onto one workstation when trying to send a fax.

Try the following to verify connectivity:

From the WinFrame server, can you connect to the FACSys fax server? If not, check the LAN cables.

From the WinFrame client, can you dial into the WinFrame server and print to the network printer? If not, check printer ports.

From the FACSys fax server, can you logon to FACSys? If not, check login rights and verify the Optus Fax Server service login account.

Before you call technical support, know the answers to the following questions:

What version of WinFrame are you using?

Which service packs or hotfixes are included?

What network protocols are you using?

What other services are on the WinFrame server?

What types of clients are there: dial up, LAN, WAN, MAC, UNIX?

What version of FACSys do you have?


Zetafax Version 5.0

Overview

Zetafax software allows users connected to a network to fax documents from within applications such as Word or Excel. Once Zetafax is installed, a user can fax a document by selecting Zetafax FaxMerge Printer from the print menu. This causes the file ZETAFAX.SPL to be created and spooled to a directory where it is collected by the Zetafax application and faxed.

WinFrame extends Zetafax's capabilities by allowing multiple users to send faxes concurrently.

Software Requirements

WinFrame Version 1.6, Service Pack 5 or greater and Hotfix SE165058.EXE

Zetafax Version 5.0

The file that needs to be updated by installing Hotfix SE165058.EXE is LOCALMON.DLL. If this file is dated after May 28, 1997, no further patches are necessary. If not, apply the appropriate hotfix. At the time of the printing of this document, Hotfix SE165058.EXE was the latest to include the updated file. If this hotfix is no longer available, please contact Citrix Technical Support for the applicable replacement.

Without the hotfix installed, the following error message from the Win32 spooler is received:

"Error writing to z:\zetafax.spl for Document document: Access is denied."

Installing and Configuring Zetafax 5.0

With the standard Zetafax configuration, spooled fax files are sent to a common location. To prevent concurrent WinFrame users from overwriting each other's spooled files, each user's home directory is mapped to a common drive letter.

Having a common drive letter mapped to a user's home directory accomplishes two things. It allows the spooling from the Zetafax FaxMerge Printer queue to be set to one location, the single mapped drive letter, and still have the files sent to each user's home directory. Similarly, it allows the Zetafax workstation to look for the spooled files in one location and find them in each user's home directory.

The following instructions assume each user has an assigned home directory with full rights to that directory.

Preliminary Home Directory Setup

For each user, including the administrator:

1.	Share the user's home directory and set the share name to the user's name.

2.	In User Manager for Domains, open Properties.

3.	Under Profile, connect Drive Z (or another unused drive letter) to \\server\%username%.

4.	Next, logout and log back in. Drive Z should now be accessible to each user.

Installing Zetafax Software

1.	At the command prompt, type change user /install.

2.	Install the Zetafax software as directed by the Zetafax instructions.

3.	Open Zetafax Workstation Setup, select Install Workstation - standard settings, and follow the installation instructions.

4.	In Workstation Setup, select Edit Configuration - advanced settings.

A.	In the first window, select Neither Of The Above (Uses USERNAME Variable Instead).

B.	In the next window, leave the field blank and select OK.

C.	Select OK to use the English language.

D.	Enter Z: for the storage destination of the spooled print files and workstation log.

E.	Click OK to exit the configuration editor.

5.	After installation is complete, type change user /execute at the command prompt.

Printer Setup

1.	Open Print Manager.

2.	Select Printer and then Properties for the Zetafax FaxMerge Printer queue.

3.	Select Other under Print To.

4.	Select Local Port for Print Destination.

5.	Enter Z:\zetafax.spl for the port name.


ChameleonNFS for Windows NT

Overview

ChameleonNFS for Windows NT provides a suite of Internet and TCP/IP applications for Windows NT. Because most of the applications provided in this suite are useful only in a single-user environment, only the NFS Server support is discussed here. ChameleonNFS includes support for exporting (sharing) and using drives.

Software Requirements

NetManage ChameleonNFS for Windows NT Version 5.0

Citrix WinFrame Version 1.6

Installation

1.	At a Command prompt, type change user /install and press ENTER. This places the session in install mode.

2.	Insert the ChameleonNFS Setup Disk 1 in drive A. Switch to drive A, type setup and press ENTER.

3.	The ChameleonNFS setup program begins. Enter the ChameleonNFS serial number and key when prompted. These values are case sensitive and must be entered exactly as they appear. Choose the directory to install ChameleonNFS to. Setup copies the appropriate files.

4.	Before rebooting the server, start the Registry Editor by typing regedt32 at a command prompt and pressing ENTER. Edit the Registry key \\HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services \NMNfsRedirector\DependOnService and change the value from "Tcpip Mup" to "Tcpip." If this change is not made, the Service Control Manager (SCM) attempts to start the Mup service. SCM returns an error message that the Mup service is already running and the NMNfsRedirector service will not start.

Usage

As previously mentioned, the primary tools of interest are the NFS file sharing services. The individual applications provided with this package are not discussed here because they are not intended for multiuser environments. There are three main NFS services: exporting drives and directories, securing access to drives and directories, and connecting to the exports.

Exporting Drives and Directories

Use the NFS Server program to export drives and directories. Click on Exports. The Exports dialog appears. On the left side of the dialog is the listing of available drives to export. Select the specific path you wish to make available on the left side of the dialog, then select Add in the center. The path appears on the right side of the dialog using NFS naming conventions. For example, if the path D:/this/that/share on the left side of the dialog is exported, it appears as /d/this/that/share on the right side of the dialog in order to adhere to the NFS naming convention. When you have exported a drive and path and it appears on the right side of the dialog, it is available to users as described in the next section.

Securing Access to Drives and Directories

User access to exports is handled as follows:

1.	The user must be defined on the local system. A domain user does not have access. In addition, the user must be mapped to a unique UID and GID in the NFS Server utility. To map a user to a unique UID and GID:

A.	Start the NFS Server program.

B.	Select Users.

C.	A list of the local users defined on the system, their passwords, and their UID and GID mappings (blank, by default) appears.

D.	Select a user who you want to have access to exports; his information will appear in the editable fields above the list. Specify a unique UID for the user. The GID field must be specified but does not need to be unique. The password must match the password defined for the user in the User Manager.

2.	There are two methods for securing access to the exports at this point.

A.	You can allow any user who has been properly defined and mapped in Step 1 to access the exports, in which case no changes are necessary.

B.	You can allow only specific users access to the exports. To allow only specific users access to exports:

(1)	Start the NFS Server program.

(2)	Select Exports.

(3)	Select the export you wish to define specific access to on the right hand side of the dialog box, then select Access in the center of the dialog box.

(4)	A new dialog box listing all currently defined users on the system (regardless of UID mappings) appears on the left and a blank list appears on the right. Select the users you wish to add to the specific security for this export and click on Add to add each person to the list on the right. Click on OK when finished.

(5)	At the Exports menu, click on OK to exit.

At this point, you should have an export defined as well as users who can access it. The next section describes how to access the exports.

Connecting to Exports

1.	Start File Manager and select Connect Network Drive from the Disk pull-down menu. The new network drive type NetManage Chameleon32NFS appears in the Shared Directories list.

2.	Double-click on NetManage Chameleon32NFS to display the servers on the network sharing NFS exports. If double-clicking does not work, you may need to specify the server name and path in the Path text field. For example, if the path called /d/stuff/ is exported from server exserve1, accessible from IP address 128.5.4.3, you could specify any of the following for the path:

128.5.4.3:/d/stuff
exserve1:/d/stuff
\\exserve1\d\stuff

3.	If the exported directory is located on a UNIX host, be sure to enter a valid UNIX username. If the export directory is on a WinFrame or Windows NT server, specify a valid username for that server. Enter the username in the Connect As field.

4.	Check the Reconnect at Logon checkbox if you wish this drive to be reconnected every time you logon. Select OK to exit.

5.	You are prompted for the password for the specified username. If the exported directory is on a UNIX host, use the UNIX password. If the exported directory is on a WinFrame or Windows NT server, use the password you provided in both the User Manager and the NFS Server utility. The drive is then mapped to the specified drive letter.

Troubleshooting

I have a user being granted access to an export. I put the username in the Connect As: box but I still can't map the drive in File Manager.

Be sure that you have given that user UID and GID mapping in the NFS Server utility because the Exports access dialog allows you to specify any local user regardless of UID/GID mappings.


File and Print Services for NetWare

File and Print Services for NetWare enables users of NetWare client computers to access volumes and printers shared on WinFrame. This requires no changes or modifications to the software on the NETX or VLM clients.

If your system is a WinFrame Version 1.5 system, you must install WinFrame Service Pack 3 for WinFrame Version 1.5 before proceeding. This is not required for a WinFrame Version 1.6 system because Service Pack 3 is part of WinFrame Version 1.6. If additional hardware or software is installed on a WinFrame 1.5 server after Service Pack 3 is installed, you must reinstall Service Pack 3 to make sure that the latest copies of the system files are present.

When File and Print Services for NetWare is installed on a WinFrame server, certain WinFrame-specific files are overwritten, causing incorrect system operation. The version of the User Manager program (USRMGR.EXE) supplied with File and Print Services is used to maintain NetWare-specific user information. This program must be renamed and the original WinFrame-specific USRMGR.EXE retained. The following installation procedure addresses these problems.

Requirements

WinFrame Version 1.5 or 1.6 server

File and Print Services for NetWare

Installation

1.	If your system is a WinFrame 1.5 system, you must install the Citrix WinFrame Service Pack 3 for WinFrame 1.5 before proceeding. This is not required for a WinFrame 1.6 system, because Service Pack 3 is part of WinFrame 1.6.

2.	Back up the following files before installing File and Print Services for NetWare. You must back up these files, because the File and Print Services for NetWare installation overwrites them. The files to back up are:

%systemroot%\SYSTEM32\USRMGR.EXE
%systemroot%\SYSTEM32\NETMSG.DLL
%systemroot%\SYSTEM32\DRIVERS\NWLNKIPX.SYS

%systemroot% is the disk drive containing the WinFrame system files. A sample set of commands (assuming your system drive is drive C) is:

cd %systemroot%\system32
copy usrmgr.exe usrmgr.ctx
copy netmsg.dll netmsg.ctx
copy drivers\nwlnkipx.sys drivers\nwlnkipx.ctx

3.	Install File and Print Services for NetWare following the documentation supplied with the software. DO NOT reboot the WinFrame server after the installation is completed. The following steps must be performed first.

4.	After File and Print Services for NetWare is installed, rename the \%systemroot%\SYSTEM32\USRMGR.EXE file to NWUSRMGR.EXE using the following command: ren usrmgr.exe nwusrmgr.exe.

5.	Create a program item in the Administrative Tools group for NWUSRMGR.EXE. Name this program item NetWare User Manager.

Note  The NetWare User Manager should only be used to configure NetWare parameters for users. Do not use the NetWare User Manager for any other user maintenance activities because it may adversely affect WinFrame-specific user configuration data.

6.	Restore the files backed up in step 2 to their original directories, overwriting the files installed by File and Print Services for NetWare installation. A sample set of commands (assuming your system drive is drive C) is:

cd %systemroot%\system32
copy usrmgr.ctx usrmgr.exe
ren netmsg.dll netmsg.fpn
copy netmsg.ctx netmsg.dll
ren nwlnkipx.sys nwlnkipx.fpn
copy drivers\nwlnkipx.ctx drivers\nwlnkipx.sys

Note  You must rename NETMSG.DLL before you copy NETMSG.CTX. If you do not, NETMSG.DLL will return a message that says it is in use when you try to overwrite it.

7.	It is necessary to register FPNW.DLL as system global. Perform the following command at a prompt (assuming %systemroot%\SYSTEM32 is still the current directory):

register fpnw.dll /system

8.	Reboot your WinFrame server and verify that the system and File and Print Services for NetWare operate normally.


IBM OS/2 LAN Server 4.0

Overview

This section discusses the integration of WinFrame servers with IBM OS/2 LAN Server 4.0 servers. The information also applies to IBM LAN Manager 2.x.

IBM OS/2 LAN Server is a server product that allows users to share directories, printers, and serial devices with other workstations on the LAN. The LAN Server program is installed on a system that has an OS/2 operating system as a base. Servers belong to logical groups called domains. Within each domain, one server is assigned as the domain controller. The domain controller manages information about users, groups, and workstations in the domain. Other servers can be a part of the domain but only one is designated as the domain controller. This concept of domains, users, and shareable resources is currently implemented by IBM as their LAN Server Product and Microsoft as their Microsoft NT network, upon which the WinFrame server product is based. Unfortunately, IBM LAN Server 4.0 cannot participate in Microsoft domains or share account information with a Microsoft domain controller or a WinFrame server. This section discusses ways to bridge these incompatibilities.

Software Requirements

WinFrame server software, Version 1.5 or higher

IBM OS/2 operating system

IBM OS/2 LAN Server, Version 4.0

Installation

The following sections describe how to make browsing available between the clients and servers of the IBM LAN Server domain and the clients and servers of the WinFrame domain.

Note  IBM LAN Server domains are viewed and treated as workgroups under WinFrame.

To let users with accounts on other systems access WinFrame and Windows NT resources, you can create local accounts for those users in WinFrame domains containing those resources. You can then place those accounts in local or global groups in the domain and assign necessary permissions to those groups. Although you can give permissions directly to local accounts, it is not recommended - it would be difficult to maintain if you later upgrade those other systems to WinFrame and no longer require the use of local accounts.

If you do replace other systems with WinFrame after giving those users local accounts, you can then delete the local accounts and begin using those users' WinFrame accounts.

Local accounts are different from other user accounts in one important way - a local account in one domain cannot be used in domains that trust that domain. Therefore, if a user from another network operating system needs to access several domains, you must create a local account for the user on each of those domains.

To Make IBM LAN Server Domains Visible to a WinFrame Browser Using the Control Panel

1.	On the WinFrame server, double-click the Networks option in Control Panel to display the Network Settings dialog box.

2.	Select Computer Browser from the Installed Network Software box and then choose the Configure button to display the Browser Configuration dialog box.

3.	For each LAN Manager domain you want to add, type the LAN Server domain name in the box on the left and then choose the Add button.

4.	When finished adding up to four domains, choose the OK button.

To Make LAN Server Domains Visible to a WinFrame Browser Using the WinFrame Registry

1.	Run the REGEDT32.EXE file from File Manager or Program Manager of the WinFrame browser to start the Registry Editor.

2.	Locate the following key:

\\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LANmanServer\Parameters

3.	In the Other Domains entry, add the names of the LAN Server domains that you want to be made visible to the WinFrame browser. A WinFrame server can connect to standalone LAN Server 4.0 servers and LAN Server 4.0 servers participating in a LAN Server 4.0 domain. LAN Server 4.0 and WinFrame servers interoperate because they both use server message blocks (SMBs) to communicate between the redirector and server software. The NetBEUI frame (NBF) and TCP/IP protocols used by WinFrame are also interoperable with NetBEUI and TCP/IP protocols written for LAN Server 4.0.

Note  LAN Server 4.0 servers can act as backup domain controllers in a WinFrame server domain. Both local and global user accounts are replicated to LAN Server 4.0 servers acting as BDCs. Because LAN Server 4.0 does not support trust relationships or local groups, a LAN Server 4.0 server can never be a primary domain controller.


Intergraph DiskShare for Windows NT

Overview

This application note describes using Intergraph DiskShare for Windows NT on the WinFrame platform. Using this product, users on UNIX platforms can view and share files on WinFrame servers. Data security is managed through utilities that manage file security by UNIX users. Intergraph DiskShare does not currently allow WinFrame users to view or use drives on a UNIX server.

Software Requirements

Intergraph DiskShare for Windows NT Version 2.01.01.22

WinFrame Version 1.6 or higher

Installation

At a command prompt, type change user /install and press ENTER to place the system in install mode. Install Intergraph DiskShare, following the instructions in the provided documentation. When DiskShare installation is completed, type change user /execute and press ENTER to place the system in execute mode.

By default, the pcnfsd service is configured for manual startup. If you want the NFS sharing services to be started when the system starts, double-click on the Services applet in Control Panel. The Services dialog appears. Scroll through the service list until you locate the pcnfsd service. Click on the pcnfsd service to highlight it. Click on Startup; the Service Startup dialog appears. Select Automatic and click on OK. Click on Close to save the change. The next time the WinFrame server starts, the pcnfsd service will start automatically.

Usage

The most important consideration when sharing drives on a WinFrame server is file security. DiskShare provides a mechanism for mapping UNIX users (using their userIDs and groupIDs) to WinFrame usernames. This mapping is accomplished by providing the WinFrame server with a UNIX-style password file. The simplest method is to copy the file /ETC/PASSWD from the UNIX server in question to the %systemroot%/SYSTEM32/DRIVERS/ETC directory of the WinFrame server. If the /ETC/PASSWD file on the UNIX host changes, you will need to refresh the copy of the PASSWD file on the WinFrame server.

Domain users are not granted access; only local usernames are allowed security access. If the WinFrame server is the domain controller, it does not grant access to all other machines in the domain. Only the WinFrame server's drives can be shared. By default, a share is set up to allow everyone access. To share a drive:

1.	In File Manager, select the drive and directory you wish to share. Select Share As from the Disk pull-down menu. The Share Provider dialog appears:

2.	Select NFS and click OK. A dialog appears displaying the path you selected as well as the default security ( Read/Write). Click on Permissions to change permissions to that share. When done setting permissions, click OK. The share point is now accessible, using the mount command on the UNIX system.

Troubleshooting

I do not want to go through an extra level of menus in File Manager to access existing LAN Manager shares, perhaps to avoid modifying desktop macros. Is there an alternate method?

An alternate File Manager DiskShare user interface is enabled if a value is found in the Registry at:

\\HKEY_LOCAL_MACHINE\Software\Intergraph\DiskShare\Defaults\AlternateFMUI

The default Share As and Stop Sharing menu items and toolbar buttons are not modified in File Manager. Instead, control of NFS Shares is done through a separate top level menu named DiskShare and with separate toolbar buttons.


PeopleSoft 5.x Application Note

Introduction

Note  This application note may contain obsolete information. Please contact PeopleSoft or Citrix for the latest information.

PeopleSoft provides industry leading client/server based human resources and financial applications for Fortune 500 companies. These applications are typically deployed in a LAN environment with a Microsoft Windows-based client front-end program and an SQL relational database server backend such as provided by Oracle. The PeopleSoft application typifies the classic two-tier client/server application model.

While two-tier client/server applications perform well on the LAN, they are not optimized for low bandwidth phone or WAN connections. Furthermore, they tend to demand high powered client workstations and often present a client workstation software distribution and maintenance challenge.

WinFrame enables these human resource and financial solutions to take advantage of a three-tiered client/server architecture without any code changes to the PeopleSoft applications. WinFrame and this three-tiered architecture provide:

Fast remote Windows support of the PeopleSoft client software, even over low-speed phone or WAN connections.

Reduced data traffic over WAN connections, which minimizes bandwidth requirements while increasing performance.

Simplified administration of end-user software by minimizing workstation hardware and software requirements, while leaving the PeopleSoft client software centrally located on the corporate LAN/WAN.

Fast Remote Access via Phone Lines

Prior to WinFrame, remote access to the PeopleSoft application meant using a purely remote node solution. With a client/server application, keeping remote client software up to date and trying to deliver personnel and financial information from a large database through low speed remote node connections is cumbersome. WinFrame overcomes these problems and enables employees to work at home and dial in from the road with the speed of a LAN.

Dramatically Improved WAN Performance

Because PeopleSoft is a client/server application, the client portion routinely gets updated by distribution across the WAN, which can be very time consuming. One solution to this problem is to place Novell file servers in each of the remote offices, allowing the PeopleSoft applications to be loaded to the client workstations at local LAN speeds. While this method works, it adds cost in the form of additional file servers and keeping the PeopleSoft applications on these servers up-to-date becomes unwieldy.

This solution does not address the issue of limited network bandwidth to support the extensive SQL dialogs and the transmission of application data across the WAN. These WAN problems are slowing down the deployment of PeopleSoft and other client/server solutions in many companies. WinFrame application server-based solutions, when applied to these problems, reduce WAN traffic, increase application performance, and allow for the immediate deployment of these applications to remote branch offices.

Testing by both Citrix and PeopleSoft on actual WANs showed performance improvements of up to 400% with WinFrame versus native IP calls running over the WAN. Using the Citrix Independent Computing Architecture (ICA) 3.0 protocol, a presentation layer protocol that runs on almost any transport, bandwidth utilization decreased by as much as 400%. This has a significant impact on monthly costs for telecom bandwidth. For example, up to 12 users can run PeopleSoft concurrently over an ISDN connection if they use WinFrame, versus two or three concurrent users in the traditional two-tier approach. Performance improves dramatically over multiple router hops and low speed leased lines, as well as T1, Frame Relay, or ATM links.

Simplify Administration and Preserve Investment in Low Powered Workstations

Like many other client/server applications, PeopleSoft requires a client system to have a minimum 486 CPU with 8-16MB of RAM. LAN and WAN users with 286 and 386 workstations or notebook/laptop computers are unable to run PeopleSoft with their existing hardware. This delays the full deployment of PeopleSoft applications until the workstations can be replaced.

When you deploy a WinFrame application server-based solution, PeopleSoft is installed once on the corporate backbone. There are no PeopleSoft files to maintain at the remote locations. Adding PeopleSoft users is as simple as having the end users install the WinFrame client on their workstations. Because the WinFrame client is easy to install, PeopleSoft administrators may not need to travel to the remote sites as they did in the past. In addition to simplifying the initial setup, ongoing support, administration, and backup are centralized and made more manageable.

Installation Overview

The basic steps to install PeopleSoft are:

1.	Install WinFrame, the network subsystem, and the TCP/IP subsystem.

2.	Install and configure the SQL client for WinFrame users (for example, Oracle SQL*NET for Windows with TCP/IP transport).

3.	Install and configure the PeopleSoft client for WinFrame users.

Detailed Technical Instructions

This application note is intended to assist trained WinFrame installers and Microsoft Windows NT administrators in deploying PeopleSoft using Citrix WinFrame application server technology. This note outlines the concepts and lists the steps that should be considered during the planning, design, and implementation phases of your project. It is recommended you have the local network administrator and experienced People Soft and Oracle personnel available to assist you during configuration. Remember that each network environment has similarities as well as significant differences, so it is important to document any unique changes you make.

These instructions are for a People Tools 5.01 implementation on WinFrame 1.5 or higher with an Oracle 7 database on a separate server or host system. Access to the Oracle operating system platform is a transparent function of the TCP/IP protocol services running on the WinFrame server.

For purposes of discussion, it is assumed that new users are created on the WinFrame server exclusively to use PeopleSoft and other software providing add-in functionality to PeopleSoft, such as Microsoft Excel.

Concepts and Planning Considerations

In each case, the following issues should be discussed with a group of professionals from the organization engaged in the application.

1.	What type of access method will the users require?

LAN

WAN

Dial-Up or Internet

Remote Node Gateway

Third-Party Service Provider

2.	What type of client workstations will be used?

Low-end PCs (DOS, 16-bit Windows, Windows for Workgroups)

32-bit enabled workstations (Windows 95 or NT Workstation)

Terminals

3.	What standards are in place in the organization?

Network Operating System(s)

Routed Protocols and Addressing

Naming Conventions

Domain Policies

Application Licensing

Backup

Security

Procedures for adding new host systems

4.	How are users managed?

Where are shared Windows files kept

Where are user profiles loaded

How are applications shared on the network

How freely do users customize their own environment

Scaling the Environment

After studying the behavior of PeopleSoft on WinFrame in various lab and test environments, as well as at several installed customer sites, PeopleSoft and Citrix engineers recommend the following guidelines be followed to obtain optimum performance. PeopleSoft has officially stated that they will support ten concurrent users per Pentium processor on WinFrame. Because each network differs in relative performance expectations, modify these guidelines as necessary to address specific network performance issues.

There are many options in choosing a server platform. Scaleable SMP hardware is recommended to allow for future expansion (refer to the following guidelines):

Concurrent Users	Processor	RAM
25	2 P100	300MB
45	4 P133	500MB
60	6 P133	700MB
100+	16 P100	1GB
Server Hardware

1.	Support for Ten Concurrent Users

Single Processor 100MHz Pentium

2GB SCSI-2 Hard Disk Drive

128MB RAM

One 32-bit NIC

Mouse

VGA display

2.	Support for 50 Concurrent Users

Four Processor 133MHz Pentium SMP

4GB RAID 5 Array

500MB RAM

Two 32-bit NICs

Mouse

VGA display

3.	Tested SMP Server Hardware

Hewlett-Packard Netserver LS series (1, 2, and 4 processors)

DEC (six processor)

Compaq Proliant (1, 2, and 4 processors)

Network Configuration

Bind the first NIC to the IP LAN subnet to isolate traffic between the WinFrame host and the database server. If possible, the subnet should be isolated.

Configure the second card on the same segment as inbound user traffic.

Use 100 Base-T or FDDI between servers and backbone.

Use up to four NICs in the WinFrame server to load balance traffic and I/O.

Resource Utilization

1.	RAM

People Tools 5.01 is a 16-bit Windows implementation. Allocate RAM as follows:

16MB for base WinFrame operating system requirements
1MB for each WinStation configured 10MB for each concurrent user

Additional RAM should be allocated if other 16-bit applications will be used. When using 32-bit versions of applications such as Excel, economies of scale are realized because certain resources may be reused.

2.	CPU

PeopleSoft is a processor-intensive application that requires fast local access to its own swap files. These swap files are stored in a unique directory for each user, generally in a subdirectory of the user's home directory. It is possible, when performing certain queries against the database server, that a user's session could peak the processor utilization for several seconds. There is little impact on the other concurrently connected users when this happens. It is for this reason, however, that PeopleSoft recommends no more than ten users be active on a single Pentium processor so that none experience any performance degradation.

In a highly-utilized CPU situation, users are still able to access the system and work normally. The only noticeable effect is on the amount of time it takes for a new user to logon while the CPU remains at 100% utilization. Normally logon takes 1-5 seconds once the connection is established. At 100% utilization, it make take up to 30 seconds for a new user to logon to the system while resources are reallocated. Once connected, the user will be able to work at a pace consistent with the other users already on line.

Therefore, ten concurrent users can be supported on a single 100MHz Pentium processor running PeopleSoft on WinFrame.

Pre-Implementation Steps

After all planning decisions have been resolved, you are ready to proceed with the actual system set up. Use the WinFrame Installation Pre-Planning Guide below to ensure that you have captured all the necessary information. After successful completion of this phase of the project, you will be ready to install PeopleSoft client on the server.

It is highly recommended that you install Windows NT on your computer before installing WinFrame. Ensure that Windows NT is fully operational and compatible with the hardware you are using. This allows a smooth WinFrame installation.

You may skip Steps 1 and 2 and proceed immediately with WinFrame installation (Step 3) if you are certain each hardware component you are using has been thoroughly tested with Windows NT and that you have obtained the latest hardware abstraction layer (HAL), controller, and NIC drivers required for your hardware configuration.

1.	Check hardware stability:

Install and configure Microsoft NT Server Version 3.51 on the server.

Ensure all devices are configured properly.

Ensure system configuration meets minimum requirements.

Enable disk monitor.

2.	Establish network access point:

Configure network services for TCP/IP. It is recommended that you use existing DHCP servers.

Configure additional NICs or protocols.

Configure multiport board, if any.

Verify connectivity from network.

3.	Install and configure the WinFrame server:

Install WinFrame software.

Configure WinStations.

Verify that network services are enabled.

Troubleshoot any errors reported by the Event Viewer before proceeding.

Configure one or two clients to be used as test workstations.

Note  Make sure you install WinFrame on drive C because some applications; for example, Oracle, must be installed on drive C.

PeopleSoft Installation

1.	Create a WinFrame user account

Call this account PeopleSoft User Manager (PSUSRMGR). Give this account administrator privileges (this is required to allow you to save the user profile). This will either be a local account or a domain account depending on your implementation.

Note  Give the administrator full control to \USERS and all its subdirectories. By default WinFrame does not do this.

2.	Clone a User

Use the CHANGE USER /INSTALL utility to place the system in install mode. This ensures that application user profile changes (primarily .INI files) are made to a master system directory that can later be automatically replicated for new users:

A.	Login as PSUSRMGR (the administrator).

B.	At a command prompt, type change user /install to place the system in install mode.

C.	This command is in effect only until this user session ends or the CHANGE USER /EXECUTE command is performed. CHANGE USER /INSTALL causes the .INI files for subsequent application installs to be created in the WinFrame system directory. These files are then used by the system as master copies for any subsequent user-specific .INI files that are created. The first time a user runs an application, the application makes a system request for the .INI file information. If the .INI files are not found in the user's home directory but are present in the WinFrame system directory, WinFrame copies the .INI files to the user's home directory. This ensures that each user has a unique copy of the application's .INI files.

Note  After all applications have been installed you can either logout or issue the CHANGE USER /EXECUTE command to disable the .INI mapping function.

3.	Determine Exact Configuration Details

At this point, the details of the configuration vary depending upon the integration requirements concerning the location of the system and application- and user-specific files and data. This includes determining where the PeopleSoft executable files are stored; for example, on a disk in the WinFrame server or on a network file server. You should create a map defining the location of each category of program files and associated data files as supporting documentation for your installation of WinFrame and PeopleSoft.

Example:

Drive Mappings	Directory Structure
Server = HQ-DC/FS-01
Drive U = Unique User Share	\Profiles - domain user-profiles
Drive R = PeopleSoft Share	\Users - user loginnames
Drive O = Office Automation Applications	\HR400 - PSTools and applications \Apps - Office applications, Excel, Mail
4.	Install Application Software

While you are logged into the WinFrame server as PSUSRMGR, install any client software or other tools required by the PeopleSoft applications. These include software components such as Oracle SQL*Net for Windows or SQLPlus.

Note  In WIN.INI, the [Oracle] section points to the location of ORACLE.INI, which contains specific information on the Database Server Name and TCP vendor information. ORACLE.INI then acts as a pointer to the appropriate entry in VSL.INI. These .INI files are in the \WINNT35 directory and may be shared.

A full installation is recommended. It is possible to copy the \ORAWIN directory from an existing install and modify the path and TCP vendor information in the .INI files. However, special care should be taken and all actions reviewed by someone with significant Oracle expertise if a full install is not attempted.

In addition to having \ORAWIN\BIN in the search path, you should also review the TCP/IP name resolution process for this installation. One approach is to simply add the database server name to the local HOSTS file.

5.	Check Environment Variables for PeopleTools 4.x

Identify all the DOS environment variables that may need to be initialized for the PeopleSoft application. One way to do this is by examining the PeopleSoft initialization batch scripts; for example, PSVER.BAT, because these variables and paths are referenced in the command lines of the PeopleSoft program icons. You may need to change several of the variables to set the paths to match the actual location of the PeopleSoft files in your implementation. An example of a batch file used to launch PeopleSoft is provided in "Maintenance of Individual User Accounts for PeopleTools 4.x on WinFrame" later in this note.

6.	Set up Access to the PeopleSoft Environment

Logon to the WinFrame server as the PeopleSoft User Manager (PSUSRMGR). Execute the CHANGE USER /INSTALL command. Set up the environment so this user is able to access the PeopleSoft application:

A.	Create a PeopleSoft Program Manager group.

B.	Create any required PeopleSoft application icons within the above program group.

C.	Set all required user environment variables via the System tool in Control Panel.

D.	Add the directory \ORAWIN\BIN to the PATH variable if it is not already present.

E.	Make sure the \WINNT35\ORACLE.INI file is in the \USERS \PSUSRMGR\WINDOWS directory. You may need to run the CHANGE USER /EXECUTE command and run SQL*Net once to make sure the .INI file is copied to the PSUSRMGR directory. Return to the CHANGE USER /INSTALL mode and continue.

F.	Edit the \USERS\PSUSRMGR\WINDOWS\ORACLE.INI file to set up connectivity to the database server if it is not already set that way.

G.	Test Oracle database connectivity via SQL*Net using \ORAWIN\BIN \NETTEST.EXE.

H.	Install or establish access to the PeopleSoft application software. Assign appropriate file permissions for users to get access to PeopleSoft and other software tools installed on WinFrame or other Windows NT or Novell file servers. (If PeopleSoft is installed directly on WinFrame, this is in the \PS directory and its subdirectories.)

I.	Make sure the PSTOOLS.INI file has been installed in the \USERS \PSUSRMGR\WINDOWS directory. Make sure a PeopleSoft swap file directory (\USERS\PSUSRMGR) has been created. A unique PSTOOLS.INI must be created for each user. It defaults to the path \PS\SWP\MU (if it is the multiuser or network version). USERS \username\SWP and the PSTOOLS.INI must be modified appropriately for each user to reflect this location.

J.	Edit PSTOOLS.INI and make sure the correct swap file path has been set.

K.	Test PeopleSoft application execution.

7.	Set the Paths

While still logged into the PeopleSoft User Manager account, set the path for the account's user profile to C:\ADMIN\PROFILES\%USERNAME%.USR or a directory appropriate for your implementation. Save the User Profile as the Default User Profile utilizing the User Profile Editor tool in the Administrative Tools program group. Select FILE / SAVE AS / USER DEFAULT. This will cause any new user accounts to adopt the user profile that will allow them to execute the PeopleSoft application.

Another way to do this is to log in as PSUSRMGR, configure the desktop, and save the profile to \PROFILES\PSUSER.USR using Profile Admin. Give "Change" access to \PROFILES to group everyone.

8.	Create a Template PeopleSoft User Account

With User Manager for Domains, create a template user account, PSUSER. Assign a home directory (the directory created in Step 7). Ensure it is not a member of the Admin group. Make sure that this template account has a correctly edited copy of the ORACLE.INI and PSTOOLS.INI files as well as a SWP directory. Clone the \WINDOWS directory and all subdirectories from the Profile Administrator user. Test application execution.

9.	Create User Accounts

Create user accounts for actual users by copying the PeopleSoft User Template account using the User Manager for Domains tool in the Administrative Tools program group. Select the PeopleSoft User Template account from the list of user accounts. Press F8 or select User / Copy from the menu bar. The \WINDOWS\[subdirectories] will have to be cloned. If common directory paths have not been used, you may need to edit the PSTOOLS.INI for each user.

You may now create multiple WinFrame user accounts that are able to execute the PeopleSoft application without conflicts.

Samples

Sample Domain User Profiles

Establish the following Connection To for each user:

User Profile Path	\\HQ-DCFS1\Profiles\%UserName%.usr
User Home Directory	Connect U on \\HQ-DCFS1\Users\UserName
Domain Login Script	Store in a directory called PSoft_Users\login.bat
Sample User Profile Dialog Box

Note  PSoftUser is the default user for account testing and troubleshooting. It is used as a template account for creating all users with the same profile. PSoft_Users is the directory where the PSoft users have rights to execute the batch files.

Maintenance of Individual User Accounts for PeopleTools 4.x on WinFrame

When implementing WinFrame to support a PeopleTools 4.x version, it is recommended to begin by establishing the correct PeopleSoft paths each time the application is launched. This will establish a unique PeopleSoft session for users accessing the database via WinFrame. Below is a sample Windows batch file that can be run from the PSTOOLS icon.

Note  HR400 is used in this sample to represent the database location.

Sample 400PROD.BAT

@echo off
:SETUP
set BASEDRIVE=C:
set COBDIR=R:\HR400\cblbin
set COBPOOL=80
set COBSW=+s5/s20480
set CRWBIN=C:\crw
set CRWRPTPATH=R:\HR400\crw
set DB=ORA
set DBBIN=C:\orawin\bin
set EDIT=edit
set MODE=reg
set NETDRIVE=r:
set
Path=C:\WINNT35\system32;c:\WINNT35; C:\orawin\bin;C:\orawin\plus31;C:\WINNT35\system32;
C:\WINNT35;c:\orawin\bin\;c:\orawin\plus31;R:\HR400\BAT;R:\HR400\ONLNHELP\HLP; Z:.
set PRDBIN=R:\HR400\cblbin
set PSDDRIVE=R:
set PSBAT=R:\HR400\bat
set PSCFG=HR400
set PSINI=R:\HR400\ini
set PSSQL1=R:\HR400\user\sql
set PSSQL2=R:\HR400\sql
set PSSQL3=R:\HR400\user\sql
set PSSQL4=R:\HR400\sql
set PSSQR1=R:\HR400\user\sqr
set PSSQR2=R:\HR400\ sqr
set PSSQR3=R:\HR400\user\sqr
set PSSQR4=R:\HR400\sqr
set PSSQR5=R:\HR400\sqr
set PSUSER=R:\HR400\user
set PSVER=R:\HR400
set SQRBINW=R:\HR400\sqrw
set SQRDIRW=R:\HR400\sqrw
set
SQRDOSFLAGS=iR: \HR400\user\sqr\;R:\hr400\sqr\;R:\HR400\user\sqr\;R:HR400\sqr\set
SQRFLAGS=-iR:\HR400\user\sqr\;R:\HR400\sqr\;R:\HR400\user\sqr\;R:\HR400\sqr;
set
SQRWFLAGS=iR:\HR400\user\sqr\;R:\HR400\sqr\;R:\hr400\user\sqr\;R:\
HR400\sqr\
set TEMP=c:\users\%username%\Temp
set TMP=C:\user\%username%\Temp
set TOOLBIN=R:\HR400\bin
set USERBAT=R:\HR400\bat
set windir=C:\users%username%\windows

:LAUNCH
start /shared R:\HR400\\bin\pstools.exe

Troubleshooting Oracle-Specific Application Execution Errors

You may encounter errors when executing various components of this configuration, especially if this is the first time you have attempted it or if you do not have the support of skilled Oracle and PeopleSoft programmers to assist you. Citrix recommends that you troubleshoot these specific messages generated by Oracle SQL*Net (example ERROR: ORA 3108, ORA 6120, ORA 6110) by using an Internet browser to access the Oracle WEB server. The address for the Oracle WEB server is http://www.oracle.com There is a wealth of information detailing these errors and their cause. You can read the text online or download the most pertinent files and keep them in your own tool kit. The notes include background information detailing all the DLLs required to run the application, sequencing, and how the programs interface with each other.

WinFrame Installation Pre-Planning Guide

It is essential to establish the scope of the customer's requirements. This can range from demonstrating multiple concurrent users running the corporate applications to addressing issues like optimum hardware configuration, server/application tuning, client software distribution (and automatic updates), ongoing maintenance, disaster recovery, etc. Keep the following guidelines in mind:

1.	Set up a test environment that emulates actual field conditions.

2.	Use the server and client hardware/software configurations that will actually be deployed.

3.	Agree on a prioritized set of success criteria. Some examples of these are:

Applications that need to be tested

Acceptable performance results based on clearly defined benchmarks

Printing requirements

Authentication and security mechanisms

Event logging, auditing, and reporting requirements

4.	Select several users to help you streamline the client software distribution and configuration process, and maintain a log that records common questions and problems.

5.	Set up a contingency plan in the event of failure; for example, server, communication lines, modems, power.

Capacity Planning

Characterize the resource requirements of a typical user utilizing Performance Monitor, network analyzers, etc. The most important categories to monitor are:

CPU

Memory

Paging file

Disk subsystems

NIC

LAN/WAN bandwidth utilization

Based on the above criteria, you should be able to arrive at the following:

Optimum server configuration (CPU, RAM, disk, NICs, protocols, services)

Number of servers required

Number of users per server

Network design considerations (backbone segments, multiple NICs/protocols)

Deployment

Here are a few important considerations to ensure a smooth deployment:

Document server hardware/software set up

Ensure adequate trained staff to administer the system

Distribute client software with clear documentation on set up/usage

Set up Help desk with trained staff to handle questions and problems

Establish a weekly review meeting to monitor the operation and resolve open issues

Maintenance

Plan for the following:

Help desk, escalation procedures, reseller/Citrix direct support

Procedures for testing interim fixes and loading software upgrades prior to deployment

Maintenance contracts for support, notification of fixes, and software upgrades

Disaster recovery procedures like backup/restore and hot spares

Acknowledgments

Citrix Systems, Inc. would like to thank the following individuals and organizations who contributed ideas, resources, and information instrumental to the development of this Application Note:

AT&T Wireless Services - Steve Chadley

PeopleSoft - Michael DaSilva

Hewlett-Packard


PeopleSoft 6.x Application Note

Note  This application note was written by David Hamilton, PeopleSoft Corporate Sales Support, PeopleSoft, Incorporated, Pleasanton, CA. PeopleSoft, the PeopleSoft logo, PeopleTools, PS/nVision, and PeopleCode are registered trademarks and PeopleBooks and PeopleTalk are trademarks of PeopleSoft, Incorporated. All other company and product names may be trademarks of their respective owners.

This document describes the steps to install PeopleSoft Version 6.01 Financials running on Oracle Version 7.3.2 on a WinFrame 1.6 or 1.7 server. The only version of PeopleSoft applications that is certified for use on WinFrame servers is 6.x. Although there have been many successful PeopleSoft 5.x installations on WinFrame, the steps to install Version 5.x applications are discussed earlier in this chapter. This document can be used as a guide to install other PeopleSoft 6.x applications, but it is not intended to guide in the installation of PeopleSoft 5.x applications.

Basic Installation Prerequisites

The Oracle database host should be up and running before attempting any installation or configuration described in this document. A standard PeopleSoft LAN client should already be configured and be able to successfully connect to the PeopleSoft database without error. This ensures basic connectivity to the host has already been established.

Software Requirements

PeopleSoft Version 6.x

WinFrame Version 1.5 or higher with Service Pack 4a or higher, or WinFrame Version 1.7

PeopleSoft on WinFrame Utility Program Availability

Several "freeware" utilities were developed by PeopleSoft to support the internal use of PeopleSoft on WinFrame. PeopleSoft has made these available to customers who are implementing PeopleSoft/WinFrame environments on a "freeware" basis. These are not official supported utilities and source code is included with them so the user can make any modifications that may be needed specific to his or her installation.

These utilities can be obtained by contacting the PeopleSoft Global Support Centre through the normal channels and asking for the PeopleSoft/ WinFrame Support Utilities.

Environment Type and Scalability

You will need to know what type of WinFrame environment is required by the customer to correctly design it for future expansion and scalability. This decision is based on what type of users this environment is going to support. Some of the questions to ask are:

Will the clients be dialup or WAN, or a combination of both?

How many concurrent users are expected?

Will users be connected for long amounts of time or will they be logging in and out frequently?

What types of operations are being performed with the PeopleSoft application?

Will this environment be supporting Web-enabled functionality?

Will users need to print to locally connected client printers?

Will most of the PeopleSoft Process Scheduler jobs be run on the server, on the client, or both?

This document's intent is not to dictate concrete parameters to the installer about what has to be done, but rather to provide a set of guidelines to assist in the successful implementation of PeopleSoft 6.x applications in a WinFrame environment. Answers to the questions above will determine in part what type of WinFrame installation path you should follow. Sizing requirements are discussed in several sections of this document and are to be used only as a guideline. The installer should evaluate and benchmark the applications in the environment after initial installation and revise them accordingly. Based on the amount and type of processing that each of the users are attempting to accomplish, along with all the other variables, can greatly affect the overall performance on this type of installation.

The configurations described in this document are based on a scalable WinFrame server model that has multiple WinFrame servers and a common Windows NT file server. This is the most common installation type.

Note  Before you start installing either the WinFrame or PeopleSoft products, take time to read through this document.

WinFrame Server Environment Sizing Suggestions

Sizing is a relative process. Depending on your specific requirements, these numbers can slant either way. The suggested sizing guidelines for the average PeopleSoft 6.x applications running on a WinFrame server are as follows:

Concurrent Users	Processor Required	RAM
10-12	(1) P5/P6 166 or above	256MB+
20-24	(2) P5/P6 166 or above	512MB+
30-36	(3) P5/P6 200 or above	768MB+
40-48	(4) P6 200 or above	1GB+
48+	Add WinFrame servers based on the above model.
The basic rule of thumb is one P5/P6 processor with 256MB RAM per 10-12 concurrent users. This depends greatly on the tasks that the users will actually be performing; memory requirements can be reduced for users doing relatively small amounts of work.

The difference between the WinFrame servers running on P5 versus P6 processors is quite significant in a PeopleSoft implementation. If P6 equipment is available, it is recommended that you use it.

100 Base-T network interface equipment is essential to the backbone between the database host and the WinFrame servers. It is required for the multiple WinFrame server environment where there is a common Windows NT file server.

Installing Single WinFrame Server Environments

Install WinFrame using either of the following platform options, depending on which type of environment is required.

A single WinFrame server environment is one where you are planning to have only one WinFrame server; for example, dialup access for a small group with not much chance of further expansion.

The multiple WinFrame server environment is for those users who may have only one WinFrame server but are planning on scaling the environment later to additional WinFrame servers.

The main difference is the presence of a common file server that also acts as the PDC (Primary Domain Controller). Constructing the environment in this way promotes the future scalability of the domain by allowing any user in the domain to connect to any of the WinFrame servers and retain the same set of PeopleSoft cache files. It also promotes the ability to easily add WinFrame servers as needed or for redundancy if a WinFrame server goes down for any reason.

Test Set Up

Dual Pentium 166MHz or above (for approximately 20 concurrent users; add one processor for each additional 10-12 users)

256MB RAM per processor installed

WinFrame Version 1.6 with Service Pack 5 or WinFrame Version 1.7

FDDI, 100 Base-T backbone to File/Database Server - PCI based network interface cards (NICs)

Test Configuration

WinFrame boot drive = M

Partition Size = greater than or equal to 1GB

File System = NTFS

Permissions

Administrators = Full Control

Everyone = Read and Execute

Application data drive = N

Partition Size = greater than or equal to 2GB

File System = NTFS, mirroring if desired

Permissions

Administrators = Full Control

Everyone = Read and Execute

Setting up the WinFrame servers this way allows easy scalability to additional WinFrame servers as they are required. The WinFrame administrator needs only to copy the contents of M:\WINFRAME\SYSTEM32 and drive N to the new WinFrame server. No user-specific files are retained on the WinFrame servers, which allows any user to connect to any WinFrame server and receive the same environment, desktop, and settings from the last user session.

The configuration of drive N for each user when he or she logs on to any of the WinFrame servers will be identical and can be duplicated easily for scalability. This read-only share will have a tree structure somewhat like the following:

Installation Guidelines

1.	When installing WinFrame, choose the WinFrame Custom Setup option.

2.	Specify all partitions on the WinFrame server as NTFS. Refer to the WinFrame Installation Guide under "Selecting a File System for the WinFrame Partition" for more information. (NTFS provides file security for the volumes.)

3.	Install the WinFrame server as the PDC of its own domain. Refer to the WinFrame Installation Guide under "Setting Up a Primary or Backup Domain Controller" for more information. PDC is only for single server environments.

4.	Install WinFrame on drive M. Refer to the WinFrame Installation Guide for more information.

5.	Complete installing WinFrame as described in the Installation Guide.

6.	After installing the WinFrame server, configure the remainder of the WinFrame server options in accordance with the WinFrame Installation Guide.

7.	Configure and install a WinFrame client and make a test connection using TCP/IP or direct Dial-In.

8.	Format the data drive(s) as NTFS and assign the drive letter N to the set.

Installing Multiple WinFrame Server Environments

Test Set Up

Single or dual Pentium 166MHz or higher (depending on environment size)

256MB RAM or higher

FDDI, or equivalent 100 Base-T backbone to WinFrame servers - PCI based network interface cards (NICs)

Microsoft Windows NT Server Version 3.5x or higher

Install as the Primary Domain Controller

Test Configuration

WinFrame boot drive = M

Partition Size = greater than or equal to 2GB

File System = NTFS

Permissions

Administrators = Full Control

Everyone = Read-Execute

Application data drive = D

Partition Size = greater than or equal to 20GB (depending on user requirements, estimate 1040MB per user)

File System = NTFS, RAID 5, striped with parity

Permissions

Administrators = Full Control

Everyone = Read-Execute

UserOwner = Change

Shares - Root share C:\USERS as USERS

Under C:\USERS, create individual user shares with the username/logon name

This configuration supports each user's drive C mapped as the home directory each time the user logs on to any of the WinFrame servers. These shares will have a tree structure somewhat like the following:

The following is an example of what files would be located in the user's private C:\WINDOWS subdirectory share:

INIFILE.UPD

RPSCLIENT.INI

LOTUS.INI

SQR.INI

NOTES.INI

SYSTEM.CTX

PROSTART.INI

SYSTEM.INI

PSTOOLS.CFG

WIN.INI

WinFrame Server Requirements

1.	When installing WinFrame, choose the WinFrame Custom Setup option.

2.	Specify all partitions on the WinFrame server as NTFS. See the WinFrame Installation Guide for more information.

3.	Add the WinFrame server to the domain. See the WinFrame Installation Guide for more information.

4.	Install WinFrame on drive M. See the WinFrame Installation Guide for more information.

PeopleSoft Application Setup Overview

Installing PeopleSoft applications on Citrix WinFrame servers does not differ greatly from any other network based PeopleSoft installation. The PeopleSoft applications are installed to the local WinFrame data drive. All of the user-specific files such as cache files are stored on a common file server data drive mapped as the user's drive C. The reason for placing the PeopleSoft cache files on a common file server is to ensure scalability and redundancy of the PeopleSoft/WinFrame environment.

PeopleSoft uses cache files to cache panel information for the user. These files cannot be shared between users because the file contention will cause the files to become corrupt. In a WinFrame environment, these files are retained on a common file server so that no matter what WinFrame server users log in from, they will always receive the same cache files. This provides economy of scale because the WinFrame servers do not need large disk arrays to enable them to handle the user files, nor is there any duplication of data across many WinFrame servers.

In a single WinFrame server environment, these files can be stored locally and then moved later to a common file server if expansion of the environment is needed. Having these files on a network drive does not seem to have a great impact on network traffic; however, it is recommended that the backbone of any PeopleSoft/WinFrame environment be 100 Base-T or higher. This provides the "back-channel" for the WinFrame servers to communicate to the database server where most of the traffic usually occurs.

Several installations have physically isolated the traffic between the database server and the WinFrame clients by installing two separate network cards in the WinFrame servers, where one acts as the database server channel on its own subnet and the other subnet provides communication to the WinFrame client machines. Depending on the type of installation and the bandwidth of the network infrastructure, this might be a viable option to reduce back-channel traffic.Default User Account Naming Conventions

The suggested naming conventions for usernames in a WinFrame environment should be something like the first initial of the first name and the first seven letters of the last name; for example, DHAMILTO, JSMITH, and so forth. Any names that are similar can be appended with a numeral such as JSMITH1, JSMITH2.

It is important that the username follows a certain standard to ensure the domain is easy to maintain.

Creating the PeopleSoft Administrator User - PSUSRMGR

To facilitate the configuration of the WinFrame/PeopleSoft environment, create an administrative user for the PeopleSoft domain. By default, the administrator is named PSUSRMGR, which stands for PeopleSoft User Manager. Give this account administrator rights on the WinFrame domain to allow data to be written to both drives M and N. This username is the account by which all the PeopleSoft applications will be installed.

After creating the PSUSRMGR account and assigning it administrative rights, log off the WinFrame server and log back on using that new username and password.

Using User Profiles in PeopleSoft/WinFrame

The most powerful method you have of managing PeopleSoft user environments is through user profiles. A user profile is a file that serves as a snapshot of a user's desktop environment. With profiles, you can also restrict users' ability to change these settings. You can create profiles for users who have domain accounts and store these profiles on the common file servers. Each user must have a unique profile that is loaded when the user logs on.

This section describes how to create user profiles for single users and for groups of users. Two specific processes are covered:

Using a default user template for profiles

Using mandatory profiles and group templates

These procedures allow you to create and maintain user configurations with standard default profiles that are designed by the administrator.

For additional information, see Chapter 5, "Managing User Environments," in the WinFrame Concepts and Planning Guide. Also see Chapter 13, "User Manager for Domains" and Chapter 14, "User Profile Editor" in the WinFrame System Guide.

Types of User Profiles

There are two types of server-based user profiles: personal profiles and mandatory profiles. With each type of profile, you assign a profile to a user by specifying the location and filename of the profile in the user's account. Each user can have only one profile assigned.

Users of personal profiles can permanently change their profiles. A user may not consciously change the personal profile, but every time the user logs off, any changes made to the per-user settings are saved. When the user logs on again, the environment that existed the last time the user logged off is restored. Because the user can change the personal profile, each user must have a unique copy of the personal profile. Personal profiles are useful when you want to allow users to customize their desktop environments.

Users of mandatory profiles cannot permanently change their profiles. Although a user with a mandatory profile may be able to change the per-user settings during one session, these changes are not uploaded to the user's profile when the user logs off. When the user logs on again, the profile's original settings are reestablished. In a PeopleSoft/WinFrame environment, mandatory profiles can be used but each user must have his or her own profile. The reason for this is the location of specific user files that are on a per-user basis. It is best to use the personal profiles in these environments.

Using Profiles to Restrict Users' Abilities

In both personal and mandatory profiles, you can prevent the user from doing one or more of the following:

Creating program items

Creating program groups

Changing the contents of program groups

Changing program item properties

Running programs from the File menu in Program Manager

Making connections to network printers (other than the connections already configured)

Imposing some or all of these restrictions is useful in a secure environment.

User Home Directories

Each user on a PeopleSoft/WinFrame computer must have a unique home directory. A user's home directory gives that user private storage space for data and application-dependent workspaces (for example, temporary files). Each user has control over the contents of and access to his/her home directory.

Note  In a multiuser environment such as WinFrame, it is very important that each user have a unique home directory. If several users share the same directory, changes made by one user may adversely affect the other users.

Using the Template to Create a New PeopleSoft User

Note  Steps 1 through 5 only need to be completed once.

1.	Logon to the system as PSUSRMGR.

2.	In the Administrative Tools group, double-click on User Manager for Domains.

3.	Double-click on the TEMPLATE user.

4.	Choose Groups.

5.	Remove Administrators from the Member Of Group window and click OK.

6.	Click OK in the User Properties Window.

7.	Highlight the Template User, TEMP, and select Copy from the User pull-down menu.

8.	Use the following information as an example:

Username	User1
Full Name	Test User 1
Description	(optional)
Password	User1
Confirm Password	User1
9.	Select the password settings you want and then click on Add.

This creates a new user called User1 with the properties of the template user. This allows the administrator to configure one default user template and create new users by copying the Template User account and supplying a new username.

Creating the Default User's Desktop

To create a default user desktop, you need to understand a bit about standard Windows NT user profiles. These files are usually retained on the common file server so each user gets the same desktop and environment each time he/she logs on, regardless of which WinFrame server was used last. User profiles are very powerful tools in the configuration of WinFrame environments.

There are two types of user profiles: personal (.USR) and mandatory (.MAN). It is suggested that you utilize the personal type for most PeopleSoft/WinFrame installations. The main reason for this is that so much PeopleSoft-specific information is retained in the Registry and user profiles. The PeopleSoft application as of Version 6.x requires that almost every user entry be placed in the Registry. These settings will vary by user and can be easily maintained using the .USR profiles. For example, when initially delivering the client to a user, that user can be provided a default desktop that looks and operates exactly like everyone else's in the domain. Each time the user logs off, the changes that the user made during the session are kept in the .USR profile. One of the most important things that is kept in the Registry and user profiles is the location of the user's private cache files. This needs to be totally different for each user who operates in the domain. The use of mandatory profiles restricts the user from being able to save any desktop changes by essentially write protecting the settings. If mandatory profiles are chosen, there must be a .MAN file for each user in the domain to allow you to specify the location of certain files.

When initially creating a WinFrame/PeopleSoft environment, several tasks are accomplished to ease the configuration of additional users in the environment. The term "seed" user is used in this document to refer to a template user from which other additional users are created.

Creation of Private User Share Drives

Each user in a WinFrame/PeopleSoft environment needs a private user drive that is mapped either locally in a single WinFrame server environment or to a common file server in a multiple WinFrame server environment. This share should be assigned permissions of Read/Execute for Everyone and Change for the user to whom it belongs.

1.	On the common file server or local share, create a subdirectory from the root named PSUSERS and share it as the same name, PSUSERS.

2.	Create a subdirectory from the PSUSERS share named DEFUSER. This will be used for the default user seed files.

3.	For each user in this new WinFrame environment, create a subdirectory from the PSUSERS share including one for PSUSRMGR; for example, BSMITH, JMILLER, LJONES would look similar to the following dialog:

4.	Create another directory from the root called PROFILES and share it as PROFILES. This is where the user's Windows NT User Profiles will be stored. Ensure that the group Everyone has Change rights to this directory.

Creating a Share for Centrally Managed Home Directories and User Profiles

1.	From File Manager, select Create Directory from the File pull-down menu. Create a directory called \PROFILES from the root drive of the WinFrame server.

2.	Share the \PROFILES directory by selecting Share As from the Disk pull-down menu.

3.	Enter Profiles for the Share Name.

4.	Enter a number for User Limit (optional).

5.	Set permissions for the users. The default is EVERYONE.

6.	Click OK.

Using a Default User Template for Profiles

A default user template allows the administrator to create a default configuration for new users. When a new user is added to the system, the user can use the default template to set the default user configuration. There are four steps to creating and implementing user profiles using a default user template:

Create a share point for centrally managed home directories and user profiles

Create and configure a default user template

Create and configure a group profile for users

Use the template to create a new user

Creating and Configuring the Default User Template

1.	From the Administrative Tools Group, choose User Manager for Domains.

2.	Select New User from the User pull-down menu.

3.	Use the following information to create the template user:

Username	TEMPLATE
Full Name	Template for PS User
Description	Template for Default
Password	password
Confirm Password	password
User Cannot Change Password	Check
Password Never Expires	Check
4.	Click the Groups button, add Administrators to the Member Of group, and click OK.

5.	Click on the Profile button.

6.	In the User Profile Path, type \\servername\profiles\%username%.usr, where servername is the name of the common file server.

7.	In the Home Directory, Connect dialog, type \\servername \%username%, where servername is the name of the common file server and click on OK.

8.	In the New User window, click on Add to create the template user.

Creating the User Environment Profile in this way allows this profile to be easily copied to another user. The user profile share is located on the common file server and allows all users to receive the same desktop and Registry settings no matter which WinFrame server they are logged onto. Using the Home Directory Connect path promotes scalabiltity in the same way.

Creating and Configuring a PeopleSoft User Group Profile

1.	Logon to the system as the PSUSRMGR user.

2.	The following message appears: "Loading User Profile. Your user profile cannot be loaded. A copy of the default profile will be loaded instead." Ignore this message.

3.	Adjust the desktop settings (for example, background, available applications, and application groups).

4.	Close all open programs and open Windows except for Program Manager.

5.	Select Run from the File pull-down menu in Program Manager.

6.	In the Command Line field, type upedit.exe and click OK. Running the User Profile Editor from the File pull-down menu in this way allows you to save the user profile without having the Administrative Tools group open.

7.	Click on the gray button next to the Permitted To Use Profile field.

8.	Click on Show Users in the User Browser window.

9.	Select the PSUSRMGR user created above. Select Add and click OK.

10.	In Program Manager Settings, choose a setting for the default profile:

11.	Disable Run in File Menu (optional).

12.	Disable Save Settings Menu Item and Never Save Settings (optional).

13.	Show Common Program Groups (optional).

14.	In Program Group Settings, choose whether you want the program group to be locked or unlocked.

15.	In the File pull-down menu, save the profile and select one of the save options:

Save to Current Profile

Save as User Default (global for all users)

Save as System Default (global)

Save as File (specific for individual user)

16.	Log off.

Installing the WinFrame Client on the WinFrame Server

Log in as the PSUSRMGR user and at a DOS command prompt type change user /install.

The system should respond with "User Session is ready to install applications." Now you are ready to install the PeopleSoft applications. This option is required by the WinFrame operating system and should be used any time any applications are being installed to the WinFrame servers. See the WinFrame online help for additional information.

Installing a local copy of the WinFrame client and creating a connection entry allows you to configure and test the installation as you go along to verify the environment.

1.	Create a new entry for connecting to the WinFrame server via TCP/IP and connect to the server with the PSUSRMGR username and password. This gives you administrator rights when you logon.

2.	Upon connecting, you may receive a warning message that you do not have a user profile and that the default profile will be used. Ignore this message.

Installing the Database Connectivity Client on the WinFrame Server

1.	At a DOS prompt, type change user /install.

2.	Locate the database connectivity install CD; that is, Oracle, and install it to the local WinFrame server's drive N under N:\APPS\DB\SQLNETNT. See the PeopleSoft Installation and Administration for Oracle Guide for detailed information.

3.	Install the following products from the Oracle Client CD and establish the SQL*Net Connectivity using NETTEST to verify the connection

Installing the PeopleSoft Client on the WinFrame Server

1.	Locate and mount the PeopleSoft PeopleTools Installation CD and place it in the server's CD-ROM drive and execute SETUP.EXE. The following screen appears:

2.	Install PeopleTools Version 6.01 just as you would in any other installation to the local WinFrame data drive. Select or unselect products as you normally would.

3.	Install the PeopleSoft Application to the drive on the local WinFrame server.

4.	Install other support applications as desired. Some examples are listed below.

Lotus Notes Version 4.0 (for Workflow)
Microsoft Office Version 7.0 for Windows95 (Word and Excel only)
Tuxedo Server
Red Pepper Client (RPS Client)
Visio Version 4.1 (HRMS only)
Crystal Reports Version 5.0
SQR Version 3.0

This completes the administrative portion of the setup. Now you need to create the seed user account, profile, and files.

New WinFrame/PeopleSoft User Setup Procedures

1.	Logon as the WinFrame domain administrator.

2.	Execute User Manager for Domains.

3.	Select the WinFrame domain from the list.

4.	Select User, New User.

5.	Enter the new user's Username, Full Name, Description, and Password. Make sure you type the password in lowercase.

6.	Check User Must Change Password at Next Logon and uncheck Password Never Expires.

7.	Next select the Groups icon and add the new user to the ESDS group using the Add function.

8.	Next select the Profile icon from the User Properties dialog box. The following screen appears with the new user's name. You may use the %USERNAME%.USR variable to make it easier to maintain. The home directory should point to the common file server, in this case SERVER, and to the user's new share.

9.	The next step is to create the user's private share drive on the common file server \\SERVER. To do this, connect as an administrator to the root and create \USERS. From this share, create a new subdirectory using the user's first initial and seven characters of the last name. Now share the newly created subdirectory using the same naming convention.

10.	Select the security permissions icon and set the permissions for the share. These permissions will allow other users to Read and Execute, and the owner user to Change. A screen similar to the one below will appear. After making sure the permissions are correct, be sure to "push" the permissions down the directory tree by selecting the Replace Permissions on Subdirectories option before selecting OK.

11.	The default template files must be added to the new user's share directory. Connect to //SERVER\DefUsers to copy these files. Copy the entire contents of the desired profile directory tree into the user's share drive using the File Manager.

12.	Other changes that must be made are two other utilities: ProStart and GetRep. ProStart is a utility to start a specified Process Scheduler on the host machine. It looks for PROSTART.INI in the C:\UTILS subdirectory that tells the program what database to look for to start. This utility only looks at the first line in this .INI file and it must contain the desired host name (sunsparca) and the desired user's database (HRFG510) separated by a single space.

The GetRep utility works in the same way using an .INI file for information to connect to a host using FTP and retrieve a list of available output files with the extension of .LIS. The user is presented with a list of available files. By selecting one of the list items, the program retrieves the file to the user's drive C and displays it in Windows Notepad.

These two .INI files must also be changed to reflect the user's default database name.

13.	Once this is done a default user script must be created on the master file server \\SERVER\PROFILES subdirectory. Connect through File Manager to \\SERVER\PROFILES. There should be template .usr files here such as:

hr510.usr	for HRMS 5.10
hr512.usr	for HRMS 5.12

The appropriate file must be copied to username.usr, where username is the desired user's network name - the same used in the profile creation. Once this has been completed, you are ready to test the connection.

14.	Start the Remote Application Manager from a client and add a new entry for the new user; be sure to include the username and connection type in the description line. You will logon to the WinFrame server without errors. You will see the proper default desktop with the appropriate group open depending on what application the new user is requesting.

15.	Verify that the session has correctly connected the home directory to drive C by starting the Windows File Manager and looking at the contents of drive C.

16.	Once this has been completed, execute CSDS Utilities to initialize the default environment to the Registry. Start the EnvSet32 program, select the proper application, click on Add/Change, and then click OK. This writes the default environment to the user's Registry. To verify this, click on Control Panel on the Main pull-down menu to inspect the Environment.

17.	Logoff and reconnect to initialize the environment, and then execute the PeopleSoft application.

Standard Configurations - Default Client Hotkey Preferences

When you are logged into a WinFrame session, WinFrame intercepts special keys like CTRL+ALT+DEL and remaps them to specific keys to control the remote application. By default, the WinFrame client maps CTRL+F1 to toggle the task list on the remote machine. This needs to be changed to accommodate the internal help functions within PeopleSoft applications. To change the default hotkey settings, run the Remote Application Manager and select one of the connection entries with a single mouse click. This selects the entry but does not connect you to the WinFrame server.

Select Options, Settings and the following screen appears:

The first entry in the dialog lists CTRL+ESC to bring up the local task list; leave this as the default. Change the CTRL+ALT+DEL entry from CTRL+F1 to CTRL+F3. This removes any overmapping from the default PeopleSoft Help function. Change ALT+BACKTAB to F11.

Select the Apply button to make the changes effective and return to the Remote Application Manager. Connect to the server; you now should be able to correctly use the context-sensitive help from within PeopleSoft.

PSWFVer Utility

This utility is used in PeopleSoft/WinFrame installations to automatically set up the PeopleSoft environment in the Registry. It was originally designed only for the Enterprise Demo System at Corporate. Make sure the end user/customer knows that this program is essentially "freeware" and PeopleSoft does not guarantee its performance or reliability.

All source code is included (PSWFVER.WBT). You may alter the program any way you like; however, it is a good idea to make a copy of it first.

The program must be installed on drive N under N:\UTILS\PSWFVER. This can be changed by altering the program and recompiling the executable. The programming language used here and the compiler can be obtained from Wilson WindowWare at www.windowware.com.

This program queries the Windows NT Registry Environment \\HKEY_CURRENT_USER \Software\PeopleSoft\PSVerTag and returns the current PeopleSoft environment. It does this by adding a descriptive key and value under the PeopleSoft section of the Registry. Once added it will always reflect what the current environment is for that specific user.

If the user has not run this utility before, the dialog will display "New User - Choose an Environment" the first time until the user selects an environment.

The program displays a list of all available environments based on whatever .REG files it finds under N:\UTILS\PSWFVER. Several examples of these files are included. (Keep in mind that you will have to customize these files for each installation by verifying the paths and settings made by the .REG file.)

By default, after a user selects a new environment, the program allows the user to choose a new default database, userid, and password, but only if it sees a database name that ends in XXX. If this option is not desired, just make sure the default database name in the .REG file does not end in XXX.

Also, be sure that the NEWUSER.REG file is placed under a subdirectory called N:\UTILS\PSWFVER\USER. This is to separate it from the real .REG files.

File Listing

PSWFVER.EXE	Compiled Executable of this utility
PSWFVER.WBT	Source Code of the entire program
PSCACHE.INI	File containing the common file server UNC and local cache path
fs601ora.reg	Financials 6.0 Oracle example .reg file
hr600ora.reg	HRMS 6.0 Oracle example .reg file
hr603ora.reg	HRMS Public Sector example .reg file
sa600ora.reg	Student Admin example .reg file
mf610ora.reg	Manufacturing 6.10 example .reg file
README.TXT	This file
WBDBP32I.DLL	.DLL required by WinBatch
\user\newuser.reg	Newuser initialization file
GetRep32 Utility

This utility was written for PeopleSoft/WinFrame environments to facilitate the quick retrieval of SQR reports that are written back to a UNIX host.

This program relies on an INI file that is located in the working directory called GETREP32.INI. The first line in this file should contain the actual hostname of the server desired, or the IP address followed by a single space, and then the name of the PeopleSoft database; that is, 207.135.48.50 fs510c01 or csds01 hr510c02.

All other data in the INI file is ignored.

The program opens an FTP session with the named host from the INI file and attempts a logon using the database name as the username and password.

It then changes directory to /ps/cdemo/xxxxx/yyyyyyyy/tmp, where xxxxx is the first five characters of the PeopleSoft database name, and yyyyyyyy is the entire database name. For example, if the INI file contains the following information: csds01 fs510c01, the program will attempt to change directory to /ps/cdemo/fs510/fs510c01/tmp. If that is successful, the program FTPs a directory listing back to the remote user. The FTP session is then closed. The program then opens the newly created DIRLIST.TXT file and parses the filenames from each line.

Each line is read and the filenames are written to a new local file on the local drive called FILES.LIS. This file contains only the filenames without any other information.

The retrieved DIRLIST.TXT file is then deleted from the local drive and the new file is used for input to the user display dialog where the user is prompted to select a file from the list. If the user does not select a file or selects cancel, the program terminates.

If the user selects one of the files from the list, the program reconnects to the server via FTP and retrieves the selected file to the local drive, preserving the filename. The FTP session is then closed, and the file is run with Notepad.


Hummingbird eXceed 5 for Windows NT

Overview

Hummingbird eXceed 5 for Windows NT is a comprehensive X Window Server application for Windows NT (and WinFrame) servers. eXceed works with your TCP/IP network to access X applications (also known as X clients) on host computers running X Windows. The eXceed software turns your system into a PC X server. In the X Windows environment, a PC X server may also be referred to as an X Windows terminal or server. The X Windows desktop runs as an application on the WinFrame server. A WinFrame client WinStation connected to the WinFrame server can use eXceed to run X Windows based applications on a host computer running the X Window environment. The benefits of using Hummingbird eXceed for Windows NT on a WinFrame server include:

The ability to deliver an X Windows desktop over a low bandwidth connection with excellent performance

The WinFrame server and WinStations can replace expensive X Terminals

Software Requirements

Hummingbird eXceed 5 for Windows NT Version 5.0.1

WinFrame Version 1.6 with Service Pack 4a or greater

Installation

There are three steps to the installation and configuration.

Installing the Hummingbird Application Software on the WinFrame server

Installing the Client software for each user

Configuring the Client software for each user

Hummingbird Application Software Installation

The first step in installing eXceed 5 is to install the shared server portion of the Hummingbird Application Software on the WinFrame server.

1.	Log on to the WinFrame server as an administrator.

2.	From a command prompt session, type change user /install and press ENTER.

3.	Insert the Hummingbird eXceed 5 CD-ROM into a CD-ROM drive attached to the WinFrame server.

4.	From a command prompt session, change the working directory to the \EXCEED directory on the eXceed5 CD-ROM.

5.	Type expand msvcrt20.dl_ %systemroot%\system32\msvcrt20.dll and press ENTER.

6.	Run setup located in the \EXCEED directory on the CD-ROM.

7.	When the setup program starts, select shared user installation and then Express. Specify a local directory on the WinFrame server (for example, C:\WIN32APP\EXCEED).

8.	When the installation is complete, type change user /execute and press ENTER.

The eXceed 5 shared server is now installed. Each user who will use eXceed must perform an installation from the C:\EXCEED\USERINS directory. This process is detailed in the next section. Because the administrator has already installed the client software, go directly to the client configuration section. All other users must perform a client software installation from the shared directory.

Hummingbird Client Software Installation

This section describes the client-side installation of the Hummingbird Application Software. This must be done by each WinFrame user who will run the Hummingbird eXceed application.

1.	Log in as a user to the WinFrame server.

2.	Run setup from the \EXCEED\USERINS directory created in Step 7 of the server software installation procedure above.

3.	The first setup popup asks you to specify the eXceed home directory. Specify the directory created in Step 7 of the server software installation procedure above.

4.	The next popup asks you to specify the user's home directory. Specify the user's home directory, for example: \USERS\JOHN\EXCEED.

5.	Each user must select a password to configure the X configuration setup.

6.	The installation asks if you wish to tune the video display. You may select Yes if MSVCRT20.DLL was copied into the %systemroot%\SYSTEM32 directory. If it was not, select No.

7.	Continue to the Client configuration section.

Client Configuration

This section describes the client-side configuration of the Hummingbird Application Software and must be done by each WinFrame user who will run eXceed.

1.	After the user has installed the eXceed client software, double-click on the Xconfig icon in the eXceed program group.

2.	Select the Communication icon.  Set the mode to XDMCP-indirect, and select a unique display number for each user.

Note  Each user must have a unique display number.  If two users have the same user number, incorrect program operation may occur.

3.	Select configure and enter the IP address of the X server running XDM.

4.	Select OK twice.

5.	Select the Windows Mode icon and set the Window mode to single.

6.	Select OK.

7.	Select the Transports icon, enter the broadcast address, and select OK.

8.	Close the Xconfig window and run the eXceed icon in the eXceed program group to run an X-Windows session from the selected XDM server.

Note  At this time eXceed does not support multiuser 3270 connectivity under WinFrame.


Reflection Products and Citrix WinFrame

Note  The information in this WRQ Technical Note No. 1097, dated December 16, 1997, was supplied by Darren Tonnessen, WRQ, Inc., Seattle, WA.

The information below applies to the following WRQ software in a WinFrame environment:

Reflection 1, 2, and 4 for Windows 95 and Windows NT Version 5.21

Reflection for IBM for Windows 95 and Windows NT Version 6.1

Reflection Suite for TCP for Windows 95 and Windows NT Version 6.5

Reflection Suite for TCP for Windows 95 and Windows NT Version 6.6

Reflection X for Windows 95 and Windows NT Version 6.1

The newer versions of Reflection will not install or function properly under Citrix WinFrame Versions 1.6 or 1.7. These versions of Reflection take advantage of many Windows NT 4.0 features that are not present in Windows NT 3.51 derivatives such as WinFrame 1.6 and 1.7.

The information in this technical note does not apply to these versions of Reflection:

Reflection for HP, UNIX, or Digital Hosts Version 6.0

Reflection for IBM Version 6.2

Reflection X Version 6.2

Reflection Suite for TCP Version 6.7

Overview

WRQ has thoroughly tested Reflection products running on WinFrame 1.5, 1.6, and 1.7 servers. This technical note provides general instructions for installing applications on a WinFrame server, information about obtaining a hotfix needed to install 32-bit Reflection products on a WinFrame 1.6 server with Service Pack 5, and information about using specific Reflection products.

Citrix WinFrame/Enterprise is an application server based on Windows NT 3.51 Server code. Citrix Systems, Inc. has obtained a license from Microsoft to modify the Windows NT Server to deliver 16-bit and 32-bit applications to remote DOS, Windows 3.1, Windows 95, and Windows NT clients. The WinFrame server executes the application while the client displays the application output.

Installing Applications on a WinFrame Server

Note  If you are using WinFrame Version 1.6 with Service Pack 5, you must obtain and install Hotfix SE165074 as described in the section below before installing 32-bit Reflection products.

Use the following procedure to install Reflection on a WinFrame server. This type of installation is called a user-global installation.

1.	Log on as an administrator at the WinFrame console.

2.	At a DOS prompt, type change user /install.

3.	Install the application.

4.	When installation is complete, at a DOS prompt type change user /execute.

Note  It is recommended that the administrator write-protect the application and the following directories: \WINNT35, \SYSTEM, and \SYSTEM32.

5.	For additional information about installing applications, see the WinFrame online Help.

Hotfix for WinFrame Version 1.6 With Service Pack 5

Citrix has identified an installation problem with Reflection 32-bit on WinFrame Version 1.6 products and has developed a "hotfix" solution. The fix is available on the Citrix WinFrame FTP server as Hotfix SE165074.EXE. At the time this technical note was published, the file was available at ftp://ftp.citrix.com/winfrm16/se165074.exe.

For information about applying the hotfix to the WinFrame server, contact Citrix or see "Extracting, Installing, and Removing Hotfixes" in Chapter 2 of the Citrix WinFrame Solutions Guide.

After the hotfix is installed, install your 32-bit Reflection product following the procedure in the previous section.

Note  This hotfix is included in WinFrame Version 1.7.

Reflection X

The information below is useful when configuring Reflection X for a WinFrame client session.

Because the WinFrame server can allocate only one IP address for all WinFrame clients, it is necessary to configure a unique display number for each user; for example, 100.1.1.125:0.0, 100.1.1.125:1.0, and so forth. That is, User 1 has display 0.0 and User 2 has display 1.0. Valid display numbers range from 0 to 255. The WinFrame system administrator must assign a unique display number for Reflection X WinFrame logins. This display number must be modified in the Window category of Reflection X Settings the first time Reflection X is run from the end user's WinFrame login. Reflection X will save the display setting for all subsequent operations.

Note  Reflection X Version 6.11 (Reflection for WinFrame Version 2.0) automatically determines unique display numbers for each WinStation. It is not necessary to manually configure each client session with this version designed specifically for WinFrame environments.

If Reflection X Version 5.x is being used, only one Reflection X session may access the UDP port of the TCP/IP stack. Reflection X Version 5.x locks this port when making an XDMCP connection. Version 6.0 and higher of Reflection X do not lock the port. WRQ recommends that you use Reflection X Version 6.0 in a WinFrame environment.

The WRQ startup screen (mountain bitmap) may be disabled by using the -NM switch on the command line (for example, RX.EXE -NM).

Reflection for IBM

The WRQ startup screen (mountain bitmap) may be disabled by using the /N switch on the command line (for example, R8WIN.EXE /N).

Reflection for AS/400

Transport types MPTN and Microsoft SNA both provide terminal and printer sessions in a WinFrame environment. Telnet also provides terminal sessions; however, due to the nature of how Telnet was written, it cannot provide printer sessions.

Client access is based on NS/Router software. Both transport types can provide connectivity to only one user at a time in the WinFrame environment. This renders the multiuser capability of WinFrame ineffective for these products.

NetWare SAA requires the installation of IntraNetWare Client software (Versions 4.10 or 4.11) on the WinFrame server. Neither Citrix nor Novell encourage or support this WinFrame/NetWare installation.

Reflection for the Mainframe

Transport types 802.2 DLC and Coax DFT can be configured to provide terminal and printer sessions in the WinFrame environment. Please consult the directions that follow the Summary Tables for setup information.

Transport types Microsoft SNA, NetWare SAA, and Telnet Extended provide terminal and printer sessions in the WinFrame environment to the mainframe. Telnet also provides terminal sessions; however, due to the nature of how Telnet was written, it cannot provide printer sessions.

NetWare SAA (NDS) and NetWare SAA (LUA) both require the installation of IntraNetWare Client software (Versions 4.10 or 4.11) on the WinFrame server. Neither Citrix nor Novell encourage or support this WinFrame/NetWare installation.

Summary of Reflection for IBM Connections

The following tables summarize the compatibility of Reflection for IBM Version 6.11 (Reflection for WinFrame Version 2.0) and lists specific requirements:

AS/400	Terminal Session	Printer Session
Client Access	No	No
MPTN	Yes. Unique location and device names	Yes. Unique location and device names
Microsoft SNA Server	Yes	Yes. Unique device name
NetWare SAA	No	No
NS/Router	No	No
Telnet	Yes	N/A
Mainframe	Terminal Session	Printer Session
802.2 DLC	Yes	Yes
Coax DFT	Yes	Yes
Microsoft SNA Server	Yes. Unique LU name	Yes. Unique LU name
NetWare SAA	Yes	Yes. Unique LU name
NetWare SAA (NDS)	No	No
NetWare SAA (LUA)	No	No
Telnet	Yes	N/A*
Telnet Extended	Yes	Yes. Unique host LU name

*3287 Open Connect Printing is supported by Reflection for IBM and does work in the WinFrame environment.

Reflection for IBM 802.2 and DFT Connections

With SNA connections, only one 802 and/or DFT link can be established at a time for all WinFrame users. Multiple users can still connect to the mainframe at the same time. Each user can use a different LU on the link. For example, User A could use LU2 while User B uses LU3.

Installation

Perform a user global installation of Reflection for IBM for Windows NT. After this is done, the SNA engine executable and DLLs must be registered as system global. Follow the steps below to accomplish this:

1.	After installing Reflection for IBM, logon as an administrator.

2.	If you are going to be running a DFT connection, at a DOS prompt type: change user/ install. Start Reflection for IBM and configure your DFT link. This process updates the Registry.

3.	At a DOS prompt, type the following from your Reflection product directory:

CHANGE USER /EXECUTE

REGISTER SNADFT.DLL /SYSTEM

REGISTER SNADLC.DLL /SYSTEM

REGISTER SNAKSM.DLL /SYSTEM

REGISTER SNALOG.DLL /SYSTEM

REGISTER SNARUI.DLL /SYSTEM

REGISTER SNARUIS.DLL /SYSTEM

REGISTER SNASNAP.DLL /SYSTEM

REGISTER SNASMGR.DLL /SYSTEM

REGISTER SNATCL.DLL /SYSTEM

REGISTER SNAENG.EXE /SYSTEM

4.	Reboot the WinFrame server before running DFT.

5.	In order to use Reflection for IBM with these transports, always load SNAENG.EXE on the server.

Troubleshooting 802.2 and/or DFT Connections

If two or more users are configuring or connecting to an 802.2 or DFT connection at the same time, they will each get the entire list of currently available LUs. They might pick the same LUs. In this case, one will connect and the other will get a "Resource in Use" message. The users can re-enter the Session Setup menu to get an updated list to try to connect to a different LU.

Reflection Network Series LAT Connection for Windows NT

WRQ is currently investigating the use of Reflection LAT Connection for Windows NT with Citrix WinFrame . Please contact WRQ technical support for the latest information. In the United States, call (206) 217-7000.

Reflection 1/2/4 Performance Hints

WRQ suggests that the Jump Scroll Speed in Reflection 1, 2, or 4 be set to Page or Unlimited for best performance with multiple users. This setting is located on the Setup, Terminal, Display Tab. This setting must be saved to a settings file (*.r1w, *.r2w, *.r4w file) for all users.

The WRQ startup screen (mountain bitmap) may be disabled by using the /N switch on the command line (for example, R1WIN.EXE /N).

WinFrame Derivative Products

The following products are based on WinFrame . WRQ products have not been tested on these derivatives but Reflection is expected to perform as it does on WinFrame servers.

WinDD by Tektronix (see the section below to install applications on a WinDD server)

WinCenter by NCD

Installing Applications on a WinDD Server

To install applications on a WinDD server, you must install WinDD Service Pack 5 and then apply the WinDD Hotfix SE305048.EXE. You can download both the service pack and the hotfix from the following Tektronix FTP sites:

Service Pack 5

ftp.tek.com/nwd/WinDD/service_packs/WinDD30/WIN3SP5.exe

Note  You must install Service Pack 5 before you apply the hotfix.

Hotfix SE305048.EXE

ftp.tek.com/nwd/WinDD/hot_fix/WinDD30/se305048.exe

For more information about WinDD, see the Tektronix Web site at www.tek.com. For technical support on WinDD, contact Tektronix directly at (800) 547-8949.

Citrix WINVIEW (OS/2-based Server)

For information about Citrix WinView, see WRQ Technical Note 2005.

Reflection for Citrix and Reflection With Citrix Version 2.0

WRQ has developed Reflection for Citrix, which is essentially a suite of Reflection products with WinFrame-specific modifications, if necessary. For instance, Reflection X has the ability to automatically provide a display number for each WinFrame client.

Another product, Reflection with Citrix, includes Reflection for Citrix along with the WinFrame 1.7 server.

For more information, contact your local reseller or contact WRQ Customer Service directly at (800) 872-2829.

Related WRQ Technical Notes

1110, Express Meter and Citrix WinFrame Servers

2005, Reflection, OS/2, and Networking

Copyright (©) 1997 by WRQ, Inc. May be reproduced without penalty but may not be resold. Product specifications subject to change without notice. WRQ, the WRQ logo, Reflection, Reflection Network Series, Express Meter, and Express Meter Audit Kit are registered trademarks, and Reflection Suite for the Enterprise and Enterprise Optimization Module are trademarks of WRQ, Inc. Other brand and product names are trademarks of their respective owners. These technical notes are standardized tips. Their general nature may or may not satisfy your technical requirements.


Tun PLUS for WinFrame

Note  This application note was supplied by Esker Inc., 222 Kearney Street, Suite 500, San Francisco, CA 94108. All trade names referred to are the Servicemark, Trademark, or Registered Trademark of the respective manufacturers.

The information contained in this document is subject to change without notice.

Overview

Tun PLUS for WinFrame is a terminal emulation application designed specifically for Citrix WinFrame that delivers transparent access to host applications from WinFrame clients. Optimized to ensure compatibility with WinFrame Versions 1.5, 1.6, and 1.7, Tun PLUS for WinFrame provides easy installation, a centralized point of control for application deployment and upgrades, concurrent multihost access, support for 21 UNIX and IBM terminal emulations, and an LPR printer client.

Software Requirements

WinFrame Version 1.5, WinFrame Version 1.6 with Service Pack 3 or greater, or WinFrame Version 1.7

Installing Tun PLUS for WinFrame

1.	Logon to the console as an administrator.

2.	Run install.exe from the root directory of the Tun PLUS for WinFrame CD.

3.	When installation is complete, reboot the WinFrame server.

What Happens During Installation

Installation creates a program group called Tun PLUS for WinFrame. Within that group are five icons:

Emulator. This provides access to 21 asynchronous terminal emulations such as ANSI, the DEC VT range, and Wyse50 and Wyse60, which are typically used to access legacy character applications on UNIX systems.

5250 Emulator. This is the synchronous emulator used to connect to an IBM AS/400.

3270 Emulator. This is the synchronous emulator used to connect to an IBM mainframe.

3287 Printer. This is used to print from an IBM mainframe to your local Windows print spooler.

Panel Editor. Used to create function key panels that can be linked to an emulation session to allow simple mouse functionality to drive the application.

All of these programs can be run from a network computer or WinFrame client.

Using Tun PLUS for WinFrame

To start an emulation session, double-click the icon of choice. Click on New Session, TCP/IP, and fill in the appropriate information for host name terminal type and display settings, if any.

This connects you to the server.

Notes Specific to Tun PLUS for WinFrame in a WinFrame Environment

Depending on the configuration of both the WinFrame server and the WinFrame client, you may notice a delay of between 10 and 20 seconds when launching the emulations. This is due, in part, to the number of files that may be included in an emulation configuration. For example, you may have several function key panels, macros for automated login, bitmap background, etc.

If using the function panels, especially to chain other function panels, try to refrain from including bitmaps on the buttons because this can cause a delay when moving from one panel to another.

To reduce load time of the emulator, you can rename or delete the bitmap files used as a splash screen. These are in the TUN\COMMON directory; the filename for asynchronous emulation is UNIX.BMP and for synchronous emulation, 3270.BMP.


Comtrol RocketModem

Overview

The Comtrol RocketModem is a multimodem, ISA bus expansion card. This document describes a tested configuration of Comtrol RocketModem with WinFrame Version 1.7.

Requirements

Hardware

Dell OptiPlex GXi with one Pentium processor

Comtrol RocketModem card with four modems

Software

WinFrame Version 1.7

Comtrol RocketModem Device Driver Version 3.14

Installing Comtrol RocketModem Card

1.	Turn the computer off, remove the computer cover, and select a slot to install the controller.

2.	Remove the expansion slot cover and insert the RocketModem card.

3.	Replace the cover and restart the system.

Installing Comtrol RocketModem Device Driver

1.	In Control Panel, double-click Network.

2.	Click Add Adapter.

3.	Select <Other> Requires Disk From Manufacturer and click Continue.

4.	Enter the path of the installation files and click OK.

5.	In the Select OEM Option dialog box, select Comtrol RocketPort/RocketModem and click OK.

6.	In the RocketPort/RocketModem NT Setup window, select an I/O address range (180-1c3 hex default was chosen for this installation) and select the starting COM port for the first controller.

Note  Make sure that these selections do not conflict with an existing I/O address range or with COM ports already in use.

7.	In the remaining RocketPort/RocketModem Setup windows, click OK.

8.	Close Network Settings.

9.	Click Yes to reboot the system.

Setting up Comtrol RocketModem

1.	With a text editor, open ROCKET35.INF located in the installation files.

2.	With a text editor, open \SYSTEM32\RAS\MODEM.INF.

3.	Copy the contents of the ROCKET35.INF file and paste them in the MODEM.INF file. When pasting, maintain the alphabetical order of the modems.

4.	Close the ROCKET35.INF file and save and close the MODEM.INF file.

WinStation Configuration using Comtrol RocketModem

1.	In the Administrative Tools group, double-click on WinStation Configuration.

2.	Select New from the WinStation menu.

3.	Enter a connection name, select Citrix ICA 3.0 for type, select async for transport, select one of the RocketModem COM ports for device, click on the Modem button and select RocketModem, and click OK.

4.	Repeat Steps 1-3 for additional terminal connections.

Configuring WinFrame Client to use Comtrol RocketModem

1.	Using a text editor, open \SYSTEM32\RAS\MODEM.INF.

2.	Using a text editor, open \PROGRAM FILES\CITRIX\WINFRAME CLIENT\MODEM.INI.

3.	Maintaining alphabetical order, add the name of the RocketModem that is listed in the MODEM.INF file to the top portion of the MODEM.INI file and add an equal sign at the end of the modem name; for example, Comtrol RocketModem=.

4.	Copy the initialization strings from the MODEM.INF file and paste them at the end of the MODEM.INI file.

5.	Close the MODEM.INF file and save and close the MODEM.INI file.

6.	With the text editor, open \PROGRAM FILES\CITRIX\WINFRAME CLIENT\WFCLIENT.INI.

7.	Below the last COM port listed in the Windows COM Port Name section of the WFCLIENT.INI file, add the COM port followed by an equal sign for each port to be used by the RocketModems; for example, COM5=.

8.	Save the WFCLIENT.INI file and close the text editor.

WinFrame Clients can now access the RocketModems.

Verifying the Installation of Comtrol RocketModem

Follow the procedure below to verify that the Comtrol RocketModem is correctly installed and configured:

1.	Connect the modem ports to phone ports.

2.	In the Accessories group, double-click Terminal.

3.	Grom the Settings pull-down menu, select Communications.

4.	Select one of the RocketModem COM ports and click OK.

5.	From the Phone pull-down menu, select Dial. Enter a phone number that can be used for testing, and click OK.

6.	Verify the connection is made.

7.	Repeat Steps 1-6 for each RocketModem.


ESDL Net2Com for Windows NT Version 2.0.1

Overview

ESDL's Net2Com modem pooling software for Windows NT uses the latest in client/server technology to make a modem available to every computer on your local area network, providing the following benefits:

Cost savings, because there is no longer a need to purchase a modem for every workstation.

Centralized management of modems using a simple interface.

Software Requirements

Net2Com Server (Intel) Version 2.0.1

Net2Com Clients Version 2.0.1

WinFrame Version 1.6 or higher

Installation

Server Software Installation

1.	At a command prompt, type change user /install.

2.	Switch to drive A and type setup.

3.	Proceed with the installation as documented in the ESDL Installation Guide. When installation is complete, return to the command prompt and type change user /execute.

Type net start net2com at a command prompt to start the Net2Com Server service, or manually start the Server service from either the Control Panel Services applet or with the provided Net2Com Administration program.

You need to define a port to be shared, either as a portion of the installation or subsequent to the installation. For this step, follow the provided instructions; be sure to note the name you provide as the Share Name (not the Local Name). This will be used in the client software installations detailed below.

Client Software Installation

DOS

1.	Place the Clients diskette in drive A and type a:\net2com.dos\setup.

2.	Follow the instructions in the ESDL Installation Guide.

Note  It is important to remember that when you are asked for the Share Name, you are not being asked for a full UNC style name. Use the name you provided in the Server Software Installation above.

3.	Reboot the machine. If you chose that the DOS client installation should modify the AUTOEXEC.BAT, the shared COM port is now ready for use (see "Usage" below). Otherwise, type the following commands (this assumes default installation directories):

c:\net2com.dos\net2com ini
c:\net2com.dos\net2com.ini

Windows

1.	From Program Manager or File Manager, select File, Run, from the File pull-down menu, type  a:setup in the text box provided, and click OK.

2.	Follow the procedures outlined in the ESDL Installation Guide.

3.	When Windows restarts, the program icon for Net2Com Workstation is minimized in the lower left corner of the desktop. When you open the application, you can specify to "hide" this application. See "Usage" below for instructions on using the shared port.

Usage

Server

Disable the WinStation and the shared modem will work fine. You can also remove the shared modem and re-enable the WinStation to restore it as a WinStation.

DOS

After installation, enter into any INT 14 compliant communications program and use the port you have redirected. If this program is WFCLIENT (DOS WinFrame client software), be sure to specify INT 14 - BIOS as the device type. The modem type should be that of the host modem being shared.

Windows

After installation, use any Windows communications program to dial out of the shared port. Verify that the utility is in remote mode and that the LED labeled LC (local) is not red. If it is, you may be in local mode, and the modem is not accessible. Select Remote from the Net2Com utility.

If you are going to use the WinFrame client software for Windows, select Standard COM port as the device type. The modem type should be the modem being shared on the host.

Troubleshooting

I get an error when I try to use the net2com init command for the DOS redirector.

A common mistake is to provide a full UNC name for the specified Share Name. The Share Name should be the same as the name provided during installation. It should not include the server's name.


ESDL Net2Com for Windows NT Version 2.2.0

Overview

This application note describes how to install and use the ESDL Net2Com modem pooling software for Windows NT on WinFrame. The Net2Com modem pooling systems make modems available to every computer on your local area network, providing the following benefits:

Cost savings (there is no longer a need to purchase a modem for every workstation)

Centralized management of modems using a simple interface

In addition, this version of the server also supports Telnet redirection. With Telnet redirection, a user can use the TCP/IP telnet program to access a modem, as well as allow a NetBIOS network workstation to access a modem on a network multiport serial device such as a DigiBoard Portserver or 3Com Access Builder.

Software Requirements

Net2Com Server (Intel) Version 2.2.0

Net2Com Clients Version 2.2.0

WinFrame Version 1.6 or higher

Installation

Server Software Installation

1.	From a command prompt, type change user /install and press ENTER.

2.	Install Net2Com using the procedure in the ESDL Installation Guide.

3.	When control returns to the command prompt, type change user /execute and press ENTER.

Type net start net2com at a command prompt to start the Net2Com Server service, or manually start the Server service from either the Control Panel Services applet or with the provided Net2Com Administration program.

You need to define a port to be shared, either as a portion of the installation or subsequent to the installation. For this step, follow the provided instructions; be sure to note the name you provide as the Share Name (not the Local Name). This will be used in the client software installations detailed below.

Client Software Installation

Install the client software using the procedures in the ESDL Installation Guide.

Usage

The following table shows the connectivity methods supported:

	DOS	Windows 3.1	Windows NT/95
Net2Com port	Yes	Yes	*
NetBIOS port	No	Yes	*
Telnet port	**	**	**

*Currently there is no Windows NT or Windows 95 redirector, although there is a beta version available on the ESDL Web site (http://www.esdl.com/). When the Windows NT/Windows 95 redirector is released, anyone dialing in or connecting to a WinFrame server will have access to Net2Com ports for dialout purposes.

**The Telnet redirector is available to any client machine (or WinFrame machine) that has TCP/IP installed. Telnet is usually provided with any TCP/IP stack, including the one installed by default with Windows NT or WinFrame if TCP/IP is selected during installation. The Telnet redirector is intended for text (for example, ANSI and VT100) connections only. This is currently the only method a WinFrame user can use to gain access to Net2Com ports.

WinFrame Server

The WinFrame administrator should be aware that although the Net2Com server is capable of recognizing when a port is being used as a RAS dial-in (or dial-in and dial-out) port, it is not capable of detecting when a modem is being used by a WinFrame Dial-In WinStation.

If you attempt to share a modem that is already being used by a WinStation, the modem will begin resetting itself indefinitely, and WinStation Administration will report it as being down if a connection is made through the Net2Com share. Disable the WinStation to eliminate this problem. Removing the share and re-enabling the WinStation will restore it for use as a WinStation.

DOS

After installation, you can start any INT 14 compliant communications program and use the redirected port. For example, to use the WinFrame DOS Client, specify INT 14 - BIOS for the device type and the type of the host modem associated with the redirected port.

Windows

To use the WinFrame Windows Client, select Standard COM port as the device type and the type of the host modem associated with the redirected port.

Troubleshooting

I get an error when I try to use the net2com init command for the DOS redirector.

A common mistake is to provide a full UNC name for the specified Share Name. The Share Name should be exactly the same as the name provided during installation. It should not include the server's name.

I can't seem to dial out in Windows.

Make sure the port is in Remote mode. Use the Net2Com Administration program on the Windows client to check the Status of the port and verify that it is in Remote mode. If it isn't, click the Advanced button, and then select Remote Mode. Local Mode implies that you are using the COM port for local serial communications and the redirector is disabled.


SpartaCom SAPS/Citrix WinFrame

Overview

Note  Portions of this application note were supplied by TSP Companies of Duluth, Georgia, the supplier of SAPS, Zetafax, and other software solutions for Microsoft Windows NT in North America. TSP Companies is a Citrix Business Alliance member. Citrix and TSP Companies co-market SAPS and WinFrame to customers and resellers in the United States and Canada.

SpartaCom Asynchronous Port Sharing (SAPS) software provides a solution to the long-standing problem of modem sharing. It allows LAN users to access a pool of modems for outbound calls. SAPS is compatible with both Microsoft Remote Access Service (RAS) and Zetafax fax software for PC networks. The SAPS Client software is available for Windows, Windows 95, and Windows NT 3.51 and 4.0.

Citrix WinFrame supports several types of remote connections, including Microsoft RAS. A customer configuration might include a combination of WinFrame Dial-In WinStations for remote control sessions and RAS for remote node access to LAN resources such as shared disks and printers. Typically, Citrix includes RAS in the WinFrame Enterprise edition, but it is an option for other versions of WinFrame.

Software Requirements

WinFrame Version 1.7 or higher

SpartaCom SAPS Server Version 3.20

SpartaCom SAPS Client Version 3.20

Installation

SAPS Server for Windows NT Installation

1.	At a command prompt, type change user /install.

2.	Insert the SAPS installation diskette in drive A. Switch to drive A and type setup.

3.	Proceed with the installation as documented in the SAPS User Guide.

4.	When installation is complete, return to the command prompt and type change user /execute.

Type net start spsrvnt at a command prompt to start the SAPS server service or manually start the service from either the Control Panel Services applet or with the provided SAPS Server Manager program.

Using the SAPS Server Manager program, define one or more ports to be shared. Please follow the instructions provided in the SAPS User Guide.

SAPS Client for DOS Installation

Please follow the instructions provided in the SAPS User Guide.

SAPS Client for Windows 3.1x Installation

Please follow the instructions provided in the SAPS User Guide.

SAPS Client for Windows 95 Installation

Please follow the instructions provided in the SAPS User Guide.

SAPS Client for Windows NT Installation

Please follow the instructions provided in the SAPS User Guide.

Note  Although SAPS Server is capable of recognizing when a port is being used by Microsoft RAS for dial-in or both dial-in and dial-out, it is not capable of detecting when a modem is being used by a WinFrame Dial-In WinStation. Only SAPS and RAS can use the same ports. In other words, SAPS works with WinFrame as long as Microsoft RAS is used or ports for dial out are dedicated to the SAPS Server.

SpartaCom SAPS Limitations

SpartaCom SAPS Server does not support COM port pooling on WinFrame. This is a limitation of the SAPS software, not WinFrame, and also occurs on Windows NT 3.51. If a SAPS client tries to access a port that is in use, pooling will automatically find an unused port and assign it to the SAPS client. This feature works correctly unless a SAPS client tries to use more than one shared port from the same machine. In this case, pooling will fail and the SAPS client receives an Access is Denied message when trying to access the second port. With WinFrame, multiple sessions can run on the same machine so pooling will fail.

Contact

For further information on SAPS, Zetafax, and other software solutions for Windows NT, please contact TSP Companies at 770-622-2800 or visit www.tspco.com.


Microsoft Windows NT Multi-Protocol Routing Service

Overview

Multi-Protocol Routing enables small- to medium-sized organizations to deploy a WinFrame server as a low cost LAN-to-LAN routing solution for TCP/IP and IPX networks, eliminating the need for a dedicated router. The Multi-Protocol Routing Service can also be used to link LANs that have different network topologies (such as Ethernet and Token Ring). Each packet sent over a LAN has a packet header that contains source and destination address fields. Using the packet header information, the routing service receives network packets from a source and routes them to their destination using the shortest path available. This reduces network traffic on other LAN segments, optimizing network performance.

The Multi-Protocol Routing Service allows the WinFrame server to act as a router for the network. Any WinFrame Client on any attached network loop can establish a remote session from a WinFrame server on any other network loop using the TCP/IP and IPX protocols.

The Multi-Protocol Routing Service consists of three services:

Routing Information Protocol (RIP) for TCP/IP

BOOTP relay agent for the Dynamic Host Configuration Protocol (DHCP)

RIP for NWLink IPX/SPX Compatible Transport

RIP is a protocol used by routers to dynamically exchange routing information. After installing RIP for IP and IPX, WinFrame routes these protocols and dynamically exchanges routing information with other routers running the RIP protocol. The BOOTP relay agent allows the WinFrame router to forward DHCP requests to DHCP servers on other subnets. This allows one DHCP server to service multiple IP subnets.

Requirements

Hardware Requirements

WinFrame server with two or more network cards for full Multi-Protocol Routing functionality

Software Requirements

WinFrame Version 1.6 with WinFrame Service Pack 5

Installation

1.	Insert the Multi-Protocol Router disk from Service Pack 5 in drive A. Copy the Multi-Protocol Router file, MPR.EXE, to a temporary directory on the hard disk. Run MPR.EXE; this extracts all the files into the temporary directory. From the temporary directory, run the program UPDATE.EXE. This copies files to your WinFrame server and adds several new software choices to the Network option of Control Panel.

2.	Double-click on Control Panel in the Main program group. Double-click on Network. The Network Settings window appears. Select Add Software. The Add Network Software dialog box appears. Install the following services:

RIP for Internet Protocol

BOOTP Relay Agent

RIP for NWLink IPX/SPX compatible transport

When prompted, enter the path of MPR distribution files; for example, the temporary directory where you extracted all the MPR files.

3.	After installing the BOOTP Relay Agent, a configuration screen appears. You must enter the IP address of DHCP servers that you would like to send DHCP requests to. Maximum Hops and Seconds Threshold can be left at the defaults.

Configuration and Troubleshooting

RIP for IP

No manual configuration is needed. After RIP for IP is installed, the Enable IP Routing box in Advanced TCP/IP configuration is automatically checked. RIP for IP runs as a service and can be stopped and started via Control Panel\Services. To see what routes your machine has, type route print from a command prompt. You can also use the ping and tracert commands to troubleshoot or verify that the Multi-Protocol Routing service is working for TCP/IP.

Note  After installing RIP, your WinFrame server will start exchanging routing information with other RIP Routers. For more information on TCP/IP, refer to the WinFrame TCP/IP manual.

RIP for NWLink IPX/SPX Compatible Transport

When installing RIP for IPX, Setup displays a message that NetBIOS Broadcast Propagation is currently disabled. If you are using NetBIOS over IPX or are unsure, choose YES to enable broadcast of type 20 packets. Reboot the WinFrame server as directed. The Enable RIP Routing box in the NWLink IPX/SPX configuration is automatically checked when installing RIP for IPX. SAP is a service that can be started and stopped from Control Panel\Services. If no network number is defined for the segment tht the WinFrame server is connected to, you must define a unique network number for that segment. For example, if you have a WinFrame server with two network interface cards and the first network card is connected to an existing Novell network, you can leave the network number blank because the WinFrame server auto-detects the network number for that segment. The second network card is connected to the Microsoft network; currently no IPX network number is defined for this segment. You must type in a unique network number for this segment. Use IPXROUTE.EXE to determine the network number of your network adapter. Ensure that the same frame types are selected for both network adapters.


Lotus Notes 3.3 and a Sample Large-Scale Deployment

Background

At the recent IBM/Lotus Lotusphere conference in Orlando, Florida, a Microsoft Windows-based kiosk system was set up. This system supported a 250 workstation network used by attendees at the conference to access Lotus cc:Mail, Notes mail, and Notes-based applications. Conference attendees could communicate with one another, access information about conference sessions, activities, and participating vendors through the kiosks, as well as by dialing in to the network.

Citrix Systems, Inc. was invited to participate in the conference to provide a remote computing solution for the kiosk system, called "Lotusphere Unplugged." The goal was to give attendees access to the kiosk applications by dialing into the network from their hotel rooms and other remote locations using notebook computers. This section describes how this system was deployed and discusses the techniques used to solve some of the technical issues encountered.

Objectives of the Installation

The objectives of the system configuration were:

Support a very large number of users (over 10,000).

Support a wide variety of remote users and platforms with minimal workstation hardware configuration issues.

Transparently support more concurrent Dial-In users than can be run on a single WinFrame server.

Allow users to access Lotus Notes applications directly from Windows 95 PC-based kiosks or over Dial-In connections to a Citrix WinFrame server, and transparently access the same set of applications (not including multimedia video).

All users to have the same execution environment though a common program manager desktop with specific icons for Lotus applications.

The environment to be managed and secured by using built-in security facilities to restrict access and execution rights to programs, files, and accessories.

In this configuration, each user already had a loginID in a Windows NT server domain. A special technique described below was used to avoid a complete Notes node (client) installation for each user. The users were configured to run Notes from both Windows 95 (kiosk) and Windows NT (WinFrame Dial-In) workstations.

Implementation Planning and Steps

The following planning and implementation issues had to be defined and resolved:

Software and Hardware Requirements

Special WinFrame Configuration Techniques

User Profile Considerations

Application Installation Issues

Security Considerations

Miscellaneous WinFrame Configuration Considerations

The following sections describe these decisions.

Requirements

Hardware Requirements

100 analog phone lines on a hunt group with a single master telephone number

100 rack-mounted MultiTech 28.8Kbps modems

DigiBoard X/EM intelligent multiport RS-232 subsystems

Five IBM 320 dual 100MHz Pentium SMP servers with 256MB of RAM and 1GB FAST SCSI-2 hard disk

100MB HP VG-AnyLAN EISA network adapters

Software Requirements

Lotus Notes 3.3

WinFrame

The equipment was configured and WinFrame installed on each dual-processor IBM server. Load distribution across all five machines was accomplished by alternating the phone line connections. Line 1 was connected to machine 1, line 2 to machine 2, etc., with line 6 connected to machine 1. This was done for all 100 lines. In this way users were spread fairly evenly across all five servers.

Note  The dual-processor Pentium servers described above are adequate to run 20 simultaneous users with a light-weight Lotus Notes application. Other more CPU-intensive Notes applications may get better performance by reducing the user count to 12-15 on a similar machine. Acceptable performance for a specific combination of applications, hardware, and network environment can only be determined with an on-site pilot project and careful performance benchmarking.

Special WinFrame Configuration Techniques

Lotus Notes node (client) installation typically includes a set of program and data files that are installed on each user's workstation. These files include USER.ID, NOTES.INI, NAMES.NSF, and DESKTOP.DSK. Notes is designed to assume that only one user at a time is using these files. There are at least two ways to solve this problem when users are running WinFrame.

The first method is to manually place a copy of these files in each user's home directory. For a relatively small number of users, this may be the simplest approach, but it requires manual set up for each user added.

The second way is to organize the files so that there are enough unique copies for the number of concurrent users who are running Notes via the WinFrame server. To avoid consuming the disk space necessary for each user to have a personal copy of these files in his/her home directory, the second approach was used in this configuration. Because a maximum of 20 users were expected to run on a specific WinFrame server, 20 subdirectories were created. The subdirectories were named sequentially (ant001, ant002, etc.) with names that matched the names given to the 20 WinStations configured on the WinFrame server. As users connected to a WinFrame server, their unique WinStation names were used to determine a path name to a unique subdirectory containing the specific files for each concurrent user.

In this configuration, an application was run from the Startup program group for each user via a customized, minimal user profile. One function of this application was to set the correct paths that included the WinStation-specific Notes directory for each user as the user logged into a WinFrame server.

A common INI file was read by the startup application that gave the base directory locations for the various applications (Notes, cc:Mail 6.0, etc.; for example c:\apps\lotus\PvtNotes). This meant that each application server had to have the same directory structure for these applications.

The files that must be unique for each user include USER.ID, NOTES.INI, NAMES.NSF, and DESKTOP.DSK.

These files fall into two categories: files that have user-specific information and must be unique for each user and files that can be executed by only one user at a time but are not unique to a specific user.

The user-specific files were placed in each user's home directory. Each user's home directory was created on a common network share point.

U:\HOMEDIR\USERS\%USERNAME%\USER.ID
U:\HOMEDIR\USERS\%USERNAME%\WINDOWS\NOTES.INI

Twenty copies of the non-user-specific files were stored in subdirectories on the WinFrame server. The directory names included the WinFrame WinStation name used to derive unique sets of file names for each concurrent user running on the WinFrame server.

D:\NOTES\PORT\(WinStation name)\DESKTOP.DSK
D:\NOTES\PORT\(WinStation name)\NAMES.NSF
D:\NOTES\PORT\(WinStation name)\<OTHER NOTES FILES FROM THE NOTES "NODE" INSTALLATION>

The Notes program files were installed on each WinFrame server in the \NOTES directory.

User Profile Configuration

Users were created in a Windows NT domain with separate primary and backup domain controllers. (WinFrame servers can be used as domain controllers, but were not in this configuration.) For the purposes of this application note, it is assumed that the users were created using the User Manager for Domains. Users can then login to the domain via a Windows 95 workstation or by running a session on a WinFrame server. Users running on WinFrame appear as Windows NT users from a network and application program perspective.

There are several ways to control aspects of a user's execution environment such as the programs the user can run. One way is to replace the default Program Manager with a custom front-end application. This application can then be used to launch programs by displaying a menu or set of icons. The approach used in this project was to customize the existing Windows NT Program Manager to include just the icons for the applications to be deployed. The User Profile Editor was utilized to restrict the user's desktop environment by removing items other than the specific programs deployed. Each user was given a unique home directory. All user's home directories were kept on the same NT server for consistency and simplicity.

A common Windows NT user profile was shared by all WinFrame users. It was kept in a shared directory on the network. The only icons available to Lotusphere attendees were Notes, cc:Mail, and Logout (a program that logs the user out).

The users were configured by the following procedure:

1.	Login as an administrator. Start the User Profile Editor in the Administrative Tools group. Make the following changes to the profile fields (any fields not mentioned can be left in the default state):

Permitted to use profile: Domain Admins group

Disable Run in File Menu: Enabled

Disable Save Settings Menu Item and Never Save Settings: Enabled

Show Common Program Groups: Disabled

Lock all program groups so users cannot make any changes to the program groups.

Allow User to Connect/Remove Connections in Print Manager: Disabled

Save this profile in a file named ATTENDEE.USR. This profile is used with the user created in Step 2.

2.	Start the User Manager for Domains. Create a new user (for example, a user named ATTENDEE). This user is the Lotus Notes prototype user. Make sure the group memberships for this user include the Domain Admins group. Use the ATTENDEE.USR profile created in Step 1 as the user profile.

3.	Login as the user created in Step 2. Remove unneeded program groups and program items from the Program Manager desktop. Add the Lotus Notes applications to the Startup group.

Important  Set the working directory for the Lotus Notes program item to %HomeDrive%%HomePath%\WINDOWS. This ensures that the user-unique NOTES.INI file is used. The NOTES.INI file points to the USER.ID file. Save the Program Manager settings using the Save Settings Now option on the Options pull-down list and then logout.

4.	Login as an administrator. Start User Manager for Domains and edit the user created in Step 2. Remove membership in the Domain Admins group and make the account a member of the Domain Users group only. Save the changes and exit the User Manager for Domains.

5.	Start the User Profile Editor. Update the Permitted to use profile field of the ATTENDEE.USR profile file to Domain Users. This allows the user created in Step 2 to access and use this profile.

6.	Login as the user created above and verify that this user can execute Lotus Notes and that other resources are properly secured.

7.	If the resulting desktop or environment is incorrect, change the user back to a Domain Admin, use the User Profile Editor to change the Permitted to use profile field in ATTENDEE.USE to Domain Administrator, and repeat Steps 3 through 6 until this user can execute Lotus Notes and is properly secured.

Application-Specific Considerations

Both the Lotus Notes "server" and "node" installs were performed on the WinFrame server. The WinFrame CHANGE /INSTALL utility was used to ensure that user profile changes made by the install process were directed to the system default user profile.

Begin by performing a Notes "server-install" (in this situation the WinFrame server appears like a file server to Notes), then perform a "node-install" to one "private" notes directory. It is the "node install" that places various programs and DLLs in the appropriate application and system directories.

Note  The Lotus Notes install attempts to replace MPR.DLL in the SYSTEM32 subdirectory. It is important that you do not change or replace the version of the DLL that is shipped with WinFrame.

Note  In the version of Lotus Notes used in this configuration, there seemed to be a problem in the Node install when a non-default installation directory was specified. In this scenario, some portion of the install appeared to ignore the directory path specified and put some files in C:\Notes; the resulting install will not work. A workaround is to accept the defaults and move the directories later.

After testing the initial install, the "node-installed" directory was xcopied 19 times per server. This resulted in 20 "node" installations that could support the maximum 20 concurrent users on the WinFrame server.

Additional servers were brought online by replicating these 20 directories on the other WinFrame servers used to support the remote Notes users. For each additional WinFrame server, the programs and DLLs in the SYSTEM32 and SYSTEM directories were also copied to each of the corresponding directories. These files were replicated manually to the other WinFrame servers in this configuration using the REPLACE command: REPLACE source destination /A /P. The /A switch indicates to add new files to the destination directory instead of replacing existing files. The /P switch prompts for confirmation before replacing a destination file or adding a source file. As with any application, the System Integrator must avoid allowing an application to replace key Windows NT files that include important WinFrame extensions. This rarely occurs but needs to be understood and monitored.

Note  This technique of replicating an application installation, although convenient, may not always work. In some instances it may be necessary to run the application installation procedure on each WinFrame server.

Security Considerations

Once the users are configured and the applications installed, the File Manager is used to modify users' access to files on the system.

User security is provided by making all Lotus Notes users members of the Domain Users group and by modifying the user profile. Some specific permissions were removed to secure the system, such as removing the ability to access and run CMD.EXE.

For example, one approach is to remove "Everyone" from any access to the application directories, add the "Domain Users" to the access list, and then change permissions on all application files and subdirectories in a tree structure similar to the one below.

In the example below the Notes node files that are required to be separate for each concurrent user are contained in the antxxx subdirectories. This naming convention is also used to name the WinStations.

These per-user Notes directories had to be given the following permissions for Notes to run correctly: Read, Execute, Delete, Create, and Write.

c:\apps

+Lotus

+Notes (the "server-install" with additional subdirectories)

+PvtNotes

+ant001 (the "node-install", with additional subdirectories)

+ant002 (xcopy of ant001)

. . .

+ccMail

+wMail (cc:Mail wrapper application)

This "one-root-directory" structure is not required but does make setting permissions easier.

WinFrame Configuration Considerations

Several features of WinFrame were utilized to secure the system for remote access by a diverse and uncontrolled group of users. Several settings in WinStation Configuration and Advanced WinStation Configuration were utilized to limit a user's ability to make changes to the system. These settings include:

Turn off all (inherit user configuration) settings

Turn off all client device connections

Reset workstation on broken or timed-out connection (don't leave session running for possible reconnect)

Set the Idle timeout to five minutes

Overview and Benefits of the Synergy Between Notes and WinFrame

Lotus Notes is an environment for developing applications that enable groups of people to share information and work together. There are two main parts to Notes. The first is the Notes Server program for NT, which can run on a WinFrame server. The second part is the Notes Workstation program for Windows, which can also run on a WinFrame server. Most times, an environment will have a Notes Server running on one system. This will either be a NetWare, Windows NT, or WinFrame server. The Notes Workstation program can then be set up for Windows workstations on the network or for users on WinFrame WinStations.

Lotus Notes is an industry-leading client/server application development platform. Notes applications are typically deployed in a LAN environment with a Microsoft Windows-based client front-end program and a back-end database server. A Lotus Notes application represents an advanced two-tier client/server application model.

While two-tier client/server applications perform very well on a high-bandwidth LAN, they are typically not optimized for low-bandwidth telephone or wide-area network (WAN) connections. Furthermore, they tend to demand high-powered client workstations and often present a client workstation software distribution and maintenance challenge.

Lotus Notes has the unique advantage of supporting a database replication capability. This enables the deployment of a distributed database architecture that can alleviate many of the WAN and dialin bandwidth problems that plague many two-tier client/server applications.

However, the amount of distributed data needed by certain applications can result in network bandwidth problems even with Lotus Notes. In addition, even when network bandwidth is not an issue, the distribution and maintenance of software and hardware at remote sites can become expensive and unwieldy.

WinFrame enables Lotus Notes-based solutions to take advantage of a three-tiered client/server architecture without any code changes to the Notes applications. WinFrame and this three-tiered architecture provide the following benefits:

Reduces or eliminates the need for Notes database replication when a user has no need to operate when disconnected.

Supports fast remote execution of the Notes node (client) software even over low-bandwidth phone or WAN connections.

Reduces data traffic over WAN connections, which minimizes bandwidth requirements while increasing performance.

Simplifies administration of end-user software by minimizing the workstation hardware and software requirements while leaving the Notes client software centrally located on the corporate LAN/WAN.

Scalable to hundreds or even thousands of concurrent users.

Additional Installation Notes

Installing Lotus Notes Server for Windows NT on WinFrame

1.	It is recommended that you create an administrative user specifically for Lotus Notes on the WinFrame server that will run the Lotus Notes Server. Once you have created this user, login at the WinFrame console under this administrative username.

2.	Proceed with the standard Lotus Notes Server for NT installation. See the Lotus Notes documentation for specifics of the Lotus Notes Server installation.

3.	During the install, do not add the Notes data directory to the system path. You must add it to the Lotus Notes administrator's private path. Do this by clicking on the System application in the Windows Control Panel. Once there, select the Path statement in the User environment variables for administrator text box, where administrator is the name of the Lotus Notes administrator you are currently logged in as. Add the path of the Notes data directory, usually C:\NOTES\DATA, and click the Set button. Do not change the Path statement in the System Environment Variables text box. Make sure the path statement in the System Environment Variables text box does not have the Notes data path in it. When done, click the OK button to save your changes.

Installing the Lotus Notes Workstation Program for Windows

Note  The Lotus Notes Workstation program for Windows allows you to do a public install. It is suggested that you do a single public install to the WinFrame server or to any available network server. Users who want to set themselves up for Lotus Notes access can then run the standard Lotus Notes Workstation Setup program from the public install by changing into that directory and running the Setup program. If you do a public installation of the workstation program, each user must Net Use the directory in order to install it if it is on the network. You cannot use the UNC name to install.

1.	Login as the user for which you want to set up the Lotus Notes Workstation for Windows program.

2.	If you did a public install of the Lotus Notes Workstation for Windows program, Net Use the directory if on the network; change into the public directory, and run the Setup program. If a public install was not done, load the CD-ROM or floppies as normal and do a normal install of the Workstation program.

3.	Repeat Steps 1 and 2 for each of the users for which you want to set up the Lotus Notes Workstation program for Windows.

Usage

Although both the Lotus Notes Server and many copies of the Lotus Notes Workstation for Windows can run on a single WinFrame server, this is not always the best solution. If the system you are running WinFrame on is a high end, SMP system with a large amount of RAM and a very fast hard disk subsystem, you may be able to do this. If you are working with smaller systems, you will get better performance splitting up the two parts of Lotus Notes.

For example, you might have a standalone Windows NT server that runs the Lotus Notes Server and install the Lotus Notes Workstation for Windows client programs on the WinFrame servers on the network. This gives the Lotus Notes Server a system to itself, allowing it to use all of the system resources of the Windows NT server. The WinFrame server can then concentrate on supporting many remote users, or those on the network who want to access the Lotus Notes Server elsewhere on the network.

If the Lotus Notes Server is run on the WinFrame server where users are trying to access it, you may find that performance is below average because WinFrame is on an under-powered computer that cannot support both the Lotus Notes Server and many copies of the Lotus Notes Workstation. For that reason, the Lotus Notes Server should be given its own NT-based system, unless you are sure that the computer you are installing WinFrame on can handle the extra load. WinFrame is scalable and can handle both Notes Server and Notes Workstation, but performance depends on the computer WinFrame is running on.


Lotus Notes 4.0 for Windows NT

Overview

This application note describes how to integrate Lotus Notes 4.0 server and workstation software with WinFrame. Lotus Notes is a workgroup environment for developing applications that enable groups of people to share information and work together. Lotus Notes enables you to communicate with colleagues, collaborate in teams, and coordinate strategic business processes.

There are two parts to the Notes installation. The first part is installing the Notes server program for Windows NT on a Windows NT or WinFrame server. The second part is installing the Notes workstation program for Windows that can also run on a WinFrame server.

If a Lotus Notes server is already running in your network and you are not installing Notes on a WinFrame server, proceed to the Installing Lotus Notes workstation section of this section. If you plan on running Lotus Notes server and Lotus Notes workstations on a WinFrame server, you will need to follow both the server and workstation Install sections below.

Installation Note  Although both the Lotus Notes server and many copies of the Lotus Notes workstation for Windows can run on a single WinFrame server, this may not be the best solution. If the system running WinFrame is a high end, multiprocessor machine with a large amount of RAM and a very fast hard disk subsystem, this configuration may work fine. But if the WinFrame servers are configured to meet only the WinFrame needs, as per the Installation Guide, you will need to add more computing resources to that machine or consider running the Lotus Server on a separate machine. You might have a stand alone Windows NT server that runs the Lotus Notes server and use the WinFrame servers to run the Lotus Notes workstation client. This allows the Lotus Notes server to use all of the system resources of a separate machine. The WinFrame server(s) with the Lotus Clients can then support multiple remote or network users who want to access the Lotus Notes server.

The Lotus Notes workstation program for Windows allows you to do a public install. It is suggested that you do a single public install to the WinFrame server or to any available network server. Users who want to set themselves up for Lotus Notes access can then run the standard Lotus Notes workstation Installation program from the public install by changing into that directory and running the Setup program.

Requirements

Hardware Requirements (choose one of the following setups)

One WinFrame server configured per the Installation Guide

One WinFrame server and one Windows NT 3.51 server configured per the Installation Guide

Software Requirements

WinFrame Version 1.6 or greater

WinFrame Client Version 1.6 or greater

Lotus Notes Release 4.0

Installation

To Install Lotus Notes Server for Windows NT on a WinFrame Server

1.	It is recommended that you create an administrative user specifically for Lotus Notes on the WinFrame server that will run the Lotus Notes server. Once you have created this user, logon under this administrative user name.

2.	Before proceeding with the Notes server installation, you must run change user /install from the command prompt, if you wish to run Notes server as an automatic service. However, this will not allow you to run the Administrators Personal Workstation at the same time that the Notes server is running. Therefore, it is recommended that you run the Administrators Personal Workstation from a workstation rather than the Notes server.

3.	Proceed with the Lotus Notes server for NT installation. Run install from the WIN32\INSTALL directory on the Lotus Notes 4.0 CD-ROM or from the floppies made from the WIN32\DISK_KIT directory. Register software and proceed to the Install Options screen. Choose Server Install and pick directories, then the group you wish to install under.

4.	After you successfully install the Notes server program, Notes places the Notes server and the Notes workstation icons in a Common program group on your desktop. These icons should be moved to a Personal Program Group to avoid confusion on the part of the client workstation installation. This situation only arises if you are using a single WinFrame box for the Notes server and client workstation installs (see "Installation Note" above).

5.	The first time you double-click the Notes workstation icon, the Notes setup program automatically starts. You must complete the server setup program before working in Notes. If you try to start the Notes server without first completing the Notes server setup program, the server exits with the message: You must first run the workstation server setup program to set up your system. To restart the setup process, double-click the Notes workstation icon.

6.	Proceed with the Lotus Notes Installation. See Lotus Notes documentation for specifics of the Lotus Notes server setup.

7.	When server set-up is complete, you will need to name the port (SPX; LAN0) under Tools, Server Administration, Servers, Servers View. Double-click the appropriate server and Edit Server and Network Configuration.

8.	Running Notes as an automatic service is useful if you need to start the server from a remote location or to restart automatically after a system failure. You can install the Lotus Notes server as a service from the Notes program directory (C:\NOTES). At the command prompt, type cd \notes and press ENTER. At the C:\NOTES prompt, type ntsvinst -c and press ENTER. From the Program Manager, double-click the Control Panel icon. Double-click the Services icon. Select Lotus Notes server - Manual. Select Automatic as the startup type and select System Account in the Log On As dialog box. Select Allow Service to Interact with Desktop.

9.	At this point, reboot the WinFrame server to start the Lotus Notes server, or run change user /execute from the command prompt and start the Notes server manually by double clicking the Notes server icon.

To Install the Lotus Notes Workstation Program for Windows on a WinFrame Server

1.	Logon to the WinFrame 1.6 server that you are going to install the clients on using the desired WinFrame client (DOS, Win16, or Win32). Logon as the user for whom you want to set up the Lotus Notes workstation for Windows program.

2.	If you did a public install of the Lotus Notes workstation for Windows program, net use the directory on the network, change into the Notes public directory, and run the Install program. If a public install was not done, load the CD-ROM or floppies and do a normal install of the workstation program. Install should be run from the WIN32\INSTALL directory or from the floppies created from the WIN32\DISK_KIT directory.

3.	When the install program is launched, you may be prompted telling you there are multiple copies of Notes for Windows on the hard disk. This is to be expected because there may be many clients using this particular WinFrame server as a Notes workstation.

4.	At the Install Options panel, choose the Standard Install button and point your Program and Data drive paths to the Users Windows directory; for example, \USERS\STUARTG\WINDOWS\LOTUS\NOTES and \USERS\STUARTG\WINDOWS\LOTUS\NOTES\DATA. Select Program Group and proceed with workstation installation.

5.	Repeat Steps 1 through 4 for each user who wants to set up the Lotus Notes workstation program for Windows.


Lotus SmartSuite Version 4.0 for Windows 3.1

Overview

Lotus SmartSuite 4.0 is an integrated application suite for Windows 3.1. It includes Lotus 1-2-3 R.5, a spreadsheet application; Lotus Word Pro 96, a word processor; Freelance Graphics 2.1, a graphical presentation manager; Lotus Organizer 2.1, a personal information manager; Approach 3.0, a database application; SmartCenter 2.1, a desktop application manager; and Lotus ScreenCam 2.0, a windows movie recorder.

Software Requirements

WinFrame Version 1.5 or higher

SmartSuite Version 4.0

Installation

Run SETUP.EXE from the root directory of the CD-ROM to begin SmartSuite installation.

After you enter your name and company, SmartSuite 4.0 displays a "16-bit Windows Subsystem" error message. This is due to an attempt to directly access the hard disk from the installation program and does not prevent proper installation of SmartSuite. Select Ignore to continue; the installation will complete successfully.

Caution  When asked to select which applications to install, do not select SmartSuite DocOnline. SmartSuite DocOnline uses Acrobat Reader, which relies upon Adobe Type Manager, which is not supported by WinFrame. Access Help for the SmartSuite applications from within each specific application by clicking on Help while in the application.

SmartSuite can be installed from the CD-ROM to a network server or to the local WinFrame server.


Lotus SmartSuite 97

Overview

This application note describes how to install Lotus SmartSuite 97 on a WinFrame Version 1.6 server.

Lotus SmartSuite 97 is a package of 32-bit software applications that operate together to make work easier and communication more effective. The package includes Lotus SmartCenter 97 and SuiteStart 97 (command centers that access desktop applications and application files), Lotus 1-2-3 97 (a spreadsheet program), Lotus Word Pro 97 (a word processor), Lotus Approach 97 (a database), Lotus Freelance Graphics 97 (a presentation graphics package), Lotus Organizer 97 (a personal information management tool), and Lotus ScreenCam 97 (a show-and-tell communication tool).

SmartCenter 97 and SuiteStart 97 will not run under WinFrame Version 1.6 or Windows NT 3.51 or earlier. During installation, the user is prompted as to whether to install the files anyway. No errors in installation are caused by this message.

ScreenCam 97 will not record under WinFrame Version 1.6 with Service Pack 5 or Windows NT 3.51. During installation, the user is prompted as to whether to install the files anyway. Errors in installation do occur if these files are installed.

Software Requirements

WinFrame Version 1.6 with Service Pack 5 or higher

Lotus SmartSuite 97

Installation

There are three ways to install Lotus SmartSuite 97: Standard, File Server, or Network Distribution.

A Standard Install installs the product to the WinFrame server's hard disk. This allows WinFrame clients to access the applications from the WinFrame server desktop.

A File Server Install allows Lotus applications to be shared by multiple "node" users on networks such as Windows NT or Novell NetWare. The main portion of the applications reside in one location, or sharepoint, and all node users are configured to use the applications from that location. All users must have access to this shared location through a network or on a local machine.

A Distribution Install copies the contents of the Lotus diskettes or CD-ROM to the WinFrame server. You can then use the copy on the WinFrame server to perform subsequent standard, file server, or network distribution installs. This installation is useful if you will be running several standard installs to other machines. You can run Install from the distribution location on the WinFrame server or network sharepoint rather than having to bring the diskettes or the CD-ROM to the other machines.

To Execute a Standard Installation of Lotus SmartSuite 97 on a WinFrame Server

1.	Log onto the WinFrame server as a local administrator.

2.	At the command prompt, type change user /install.

3.	Run INSTALL.EXE from the SmartSuite 97 CD-ROM.

4.	Continue the installation following the directions in the SmartSuite 97 manual, noting the following two exceptions:

A.	SmartCenter 97 and SuiteStart 97 do not run under WinFrame Version 1.6 with Service Pack 5 or Windows NT 3.51.

B.	ScreenCam 97 does not run on WinFrame 1.6 with Service Pack 5 or Windows NT. Do not install the files. If the files are installed, the installation will abnormally terminate with the error: "CAM+1359: Path/file access error."

5.	After installation, the program will prompt the user to restart the computer. Click on the Restart button.

To Execute a File Server Installation of Lotus SmartSuite 97 on a WinFrame Server

1.	Log onto the WinFrame server as a local administrator.

2.	Run INSTALL.EXE from the SmartSuite 97 CD-ROM.

3.	Click the File Server or Multiple User Install check box at the bottom of the initial Welcome screen and then continue.

4.	Click on the File Server Install radio button when prompted for the type of network installation.

5.	Continue the installation following the directions in the SmartSuite 97 Network Administrator manual or the SmartSuite 97 READNET.TXT file.

6.	The client can now run the applications by accessing the sharepoint where Lotus SmartSuite 97 was installed.

To Execute a Network Distribution Installation of Lotus SmartSuite 97 on a WinFrame Server

1.	Log onto the WinFrame server as a local administrator.

2.	Run INSTALL.EXE from the SmartSuite 97 CD-ROM.

3.	Click the File Server or Multiple User Install check box at the bottom of the initial Welcome screen and then continue.

4.	Click on the Network Distribution Install radio button when prompted for the type of network installation.

5.	Continue the installation following the directions in the SmartSuite 97 Network Administrator manual or the SmartSuite 97 READNET.TXT file.

6.	The client can now install SmartSuite 97 by accessing INSTALL.EXE using the sharepoint on the network or by logging onto the WinFrame server where the installation was executed and running INSTALL.EXE from there. When running Install, follow the procedures contained in this application note.


Microsoft Office 97

Overview

This section describes how to install Microsoft Office 97 on a WinFrame server. Note that Service Pack 5 for WinFrame is required.

There are five outstanding issues with Office 97 at the present time:

Error initializing the Visual Basic environment with a user who does not have administrative rights

Insufficient memory error when opening an Office document from a client WinStation A or B drive

Office Startup icons are not added to a common Startup Group on the WinFrame server

Clip art insertion from client does not work due to read-only permissions

Hyperlink insertion for users produces Internet Explorer (IE) error

Solutions to these problems are presented below.

Software Requirements

WinFrame Version 1.6 or higher with Service Pack 5

Microsoft Office 97

Installation

To Install Microsoft Office 97 on a WinFrame Server

1.	Logon to the console as a local administrator.

2.	Make sure Service Pack 5 has been installed on the WinFrame server.

3.	At a command prompt, type change user /install.

4.	Run SETUP.EXE from the Office 97 CD-ROM.

5.	Continue the installation following the directions in the Office 97 manual.

6.	After setup, the program will prompt you to restart the computer. Click on the Restart Windows button.

When installation is complete, each user must follow the procedure below

1.	Copy Microsoft Office\Templates\NORMAL.DOT to each user's profile directory.

2.	Log on to the WinFrame host and open Word 97.

3.	From the Tools pull-down menu, select Options, File Locations, User Templates and change the directory to the user's own home directory.

System Integration

Error Initializing the Visual Basic Environment

General users who do not have administrative rights will receive this error message when they try to run the Visual Basic Editor included in Office 97 or when they try to run a macro in an Office program. This error is generated because the user does not have Read permission for the OLEAUT32.DLL file. This problem is resolved as follows:

1.	Logon as a local administrator.

2.	Open File Manager.

3.	Open the System Root directory; for example; C:\WINFRAME.

4.	Open the SYSTEM32 directory.

5.	Click on the OLEAUT32.DLL file.

6.	Select Permissions under the Security Menu.

7.	Add the Everyone group and give it Read permission.

8.	Click on OK and exit File Manager.

Insufficient Memory Error

Users will receive this error message when they try to open a document from the A or B drives of a client WinStation using the UNC name shortcuts in the File Menu of any of the Office applications. This is caused by an error in the UNC naming convention. To resolve this error, download the CDMPROV.DLL file dated 7/9/97 or later from the Citrix FTP site (ftp.citrix.com).

Office Startup Icons are not Added to the Startup Group

Offfice Startup icons are not created in a Common Startup Group. So that all users can use the startup programs in Office 97, the icons must be put into a Common Startup Group. Add the icons to the Common Startup Group as follows:

1.	Logon as a local administrator.

2.	If a Common Startup Group does not exist, create one by selecting New under the File Menu in Program Manager. Select Common Group and name it Startup.

3.	At a command prompt, type change user /install.

4.	Move the selected Office Startup icons from the Startup Group to the Common Startup Group.

5.	At a command prompt, type change user /execute.

6.	The Office Startup programs will now run at startup.

Clip Art Insertion from Client Does Not Work Due to Read-Only Permissions

Office 97 keeps track of clip art used in a file called ARTGALRY.CAG. The Everyone group does not have write access to this file. To change the permissions on this file:

1.	Log onto the console as a local administrator.

2.	Open Excel 97.

3.	From the Insert pull-down menu, select Object and then Microsoft ClipArt Gallery. Click on the Close button to exit ClipArt.

4.	Click on File Manager in the Main group.

5.	Locate and highlight the %SYSTEMROOT%\ARTGALRY.CAG file.

6.	From the Security pull-down menu select Permissions.

7.	Highlight the Everyone group.

8.	Change the permissions to Special Access.

9.	Read and Execute permissions should already be selected. Add Write permissions only. The only permissions that should be selected are Read, Write, and Execute.

10.	Click OK to exit.

Hyperlink Insertion for Users Produces Internet Explorer (IE) Error

Office 97 allows the insertion of hyperlinks into documents or spreadsheets. Clicking on a hyperlink from Internet Explorer automatically opens the browser and loads the target destination. When a normal user (not an administrator) inserts one of these hyperlinks, the following error message appears: "Error initializing the cache. Shutdown all programs and run scandisk or chkdsk. Delete the cache, cookies, and history directories in your Windows directory and then restart IE. If the problem persists, reinstall IE."

This message apppears because the user does not have rights to certain directories accessed by the hyperlink insertion operation. If you click OK, the hyperlink is added to the document or spreadsheet and operates correctly.

To prevent this error from constantly occurring, the system administrator may give full control permission to the Everyone group for the following directories:

\%SYSTEMROOT%\TEMPORARY INTERNET FILES

\%SYSTEMROOT%\COOKIES

\%SYSTEMROOT%\HISTORY

However, the system administrator should carefully decide as to whether users should have full control over these directories.

Remarks

Find Fast builds indexes to speed up finding documents from the Open dialog box in any Microsoft Office program. When Find Fast is installed with Office, it automatically creates an index on each local drive of your computer to cover all of your Office documents. Find Fast indexes are not created on removable drives or read-only media, such as CD-ROM drives. Once created, an index is automatically updated for faster searching.

In the WinFrame environment, Find Fast runs independently for each user. When Find Fast is triggered, the application uses about 95-100% of the CPU, resulting in unneeded and unwanted load on the system. If Find Fast is triggered by multiple users, the system becomes temporarily unresponsive. Therefore, system administrators should consider removing Find Fast from the server.

To Remove FindFast

1.	Log onto the console as an administrator.

2.	Double-click on the common Startup group to display the Program group.

3.	Highlight the FindFast icon.

4.	Press the DELETE key.

5.	Click OK.


Microsoft PowerPoint Version 4.0

Overview

Microsoft PowerPoint Version 4.0 is a presentation tool used to generate slideshow presentations. The following procedure is for user-specific installations, and is not required for user-global installations. See the online Readme "General Installation of Applications on WinFrame" for information on the preferred user-global install method.

Software Requirements

Microsoft PowerPoint Version 4.0

WinFrame Version 1.5 or higher

Installation

Refer to the Microsoft PowerPointVersion 4.0 documentation. It is preferable to do a network server install and then allow individual users to set themselves up by running the Setup program from the network server directory.

Configuration

Because this is a 16-bit application, each user must be set up for this application individually. Once the server install is completed on a network server or the local WinFrame system, each user should run the PowerPoint Setup program. This will configure the correct .INI files and settings needed to run the application.

Usage

Although the application has full functionality as installed, there is one additional note about its use. If installed correctly, when the application starts, the user will receive a popup error message claiming the application could not find the POWERPNT.INI file. As a result, no startup information will be saved. This includes, for instance, removing the Show Tips at Startup option. This is due to an installation bug in PowerPoint 4.0. To fix this problem, place a blank file called POWERPNT.INI in the main \WINFRAME directory. To do this:

1.	Log in as an administrator at the WinFrame console. Start a Command Prompt session.

2.	Type copy con powerpnt.ini and press ENTER. Press CTRL+Z and press ENTER. Type exit and press ENTER.

PowerPoint Version 4.0 will now load and function normally.


ONYX Customer Center in a Citrix WinFrame/Insignia NTrigue Environment

Note  This application note was written by Ken Machtley, MCSE, of ONYX Software Corp., Bellevue, WA. ONYX is a registered trademark and ONYX Customer Center is a trademark of ONYX Software Corp.

Overview

ONYX Software Corporation is a leading provider of enterprise-wide customer management software for Microsoft Windows NT and SQL Server, and the pioneer of the Total Customer Management business strategy. ONYX's products reorient the flow of customer information within a corporation through a single customer-centric interface for all employees, enabling organizations to track the entire customer life cycle through all departments.

ONYX Customer Center (OCC) is a software package that provides marketing, sales, service, and support teams with a comprehensive tool for managing, sharing, and viewing all customer information. ONYX Customer Center uses leading technologies including the Internet, mobile computers, and smart cellular telephones.

The WinFrame/NTrigue platform provides a cost-effective way to deliver a data-intensive application to remote users without incurring high WAN costs. We have found that there are many ways to configure WinFrame to run ONYX Customer Center. This document describes the issues encountered in our internal testing and how we have dealt with these issues, and provides recommendations on setup.

Software Requirements

ONYX Customer Center Version 3.5

Citrix WinFrame Version 1.6 with Service Pack 5

General Notes on ONYX in a WinFrame Environment

The following are general notes and observations that we made during our informal testing. It is important to note that ONYX Customer Center has not been "officially" tested with WinFrame by the ONYX Software QA team and therefore carries no guarantees. We have fully tested ONYX Customer Center on Windows NT Version 3.51 however, which is what WinFrame 1.6 is based on. In addition, at least one customer has successfully implemented this environment and is using it in production.

OCC cannot be shared from one application directory. The NCOMPASS.EXE file accesses two files that prevent this:

NCOMPASS.LOG: The log file for the application.

NCOMPASS.MDB: The access database that stores both language and user information (such as grid column sizings).

Users are required to have minimum permissions set to Read and Write to the application directory and its contents.

It is recommended that you provide users with a pre-configured user profile that starts them in a limited Program Manager if you will be providing them access to Office and/or e-mail/scheduling facilities. However, if you automatically launch OCC on the user logon:

Do not set a disconnection time-out period.

Set the option for a timed-out or disconnected session to RESET. If the session is held in memory, the next time the user logs in and tries to automatically launch OCC, the user will receive an error saying that the NCOMPASS.LOG file is already in use. The user will then need to wait until the disconnected session is reset before continuing.

Performance of OCC as a graphical application can be enhanced by educating users on two user-defined connection settings:

Run in 640x480 mode. 800x600 mode is also acceptable and preferable for the application itself, but make the user aware of the extra pixels being transmitted.

Run in 16-color mode. This enhances performance considerably. OCC does not use colors outside of the 16-color spectrum.

Configure global settings for your users by using the Advanced WinStation button in the WinStation Configuration application. The settings below are recommended:

Idle timeout = 30 minutes. Disconnect users not actively using the system.

Connect both client drives and printers at logon.

Set initial program and working directory if you plan to automatically launch the application upon startup. Be sure to use system variables (that is, %username%).

Require Level 1 encryption and disable encryption after logon. If you will be traversing the public Internet, we do not recommend disabling encryption after logon.

Disable Wallpaper because this consumes bandwidth on initial downloads and screen redraws.

On a broken or timed out connection, reset the connection. You may prefer to set this at the user level.

Shadowing may be configured either at the global or at the user level.

Setting up the WinFrame Environment for ONYX

1.	Install WinFrame onto a 300-500MB system partition (drive C) and leave another partition for application installations and user data (drive D).

2.	Create the directory D:\ONYX\_Template. Permissions for the entire drive, specifically the \Users directory, should be:

Administrators = Full Control (All)

Domain Users = List (RX)

System = Full Control (All)

Account Operators = Special Access (RWXD)

3.	At a command prompt, type change user /install.

4.	Run SETUP.EXE from the ONYX setup directory.

Install into the \ONYX\_Template directory you created above.

Choose the net library that you use on your network - TCP/IP Sockets is preferred for performance reasons.

5.	At a command prompt, type change user /execute.

6.	Create a directory under \ONYX for each login account to be granted access to ONYX on the WinFrame server. Grant permissions for each of these directories to the following users. Note that Domain Users are not included.

Administrators = Full Control (All)

<Specific user> = Full Control (All)

System = Full Control (All)

Account Operators = Special Access (RWXD)

7.	Copy the contents of the _Template directory to each of the user directories.

8.	Within Program Manager, change the command line for OCC and the help file icons to read d:\onyx\%username%\ncompass.exe and d:\onyx\%username%\ncompass.hlp respectively.

9.	Evaluate other applications that will be needed within the environment. For example, e-mail /Schedule+ integration, OLE attachments that may be launched from OCC, ONYX Seeker, and other applications launched from Application Shortcuts.

Setting up User Accounts in a WinFrame/ONYX Environment

1.	Set up users as you normally would in your domain. If you have installed the WinFrame server in its own domain, you will need to establish the appropriate trust relationships.

2.	Start User Manager for Domains on the WinFrame server.

3.	Highlight all of the users in your domain and press ENTER. Press the Config button. Uncheck the Allow Logon to WinStations checkbox to disallow access unless you will be providing access to Everyone.

4.	Highlight all of the users you will be providing WinFrame access to and press ENTER. Press the Config button. Check the Allow Logon to WinStations checkbox to grant access.

5.	Decide how you want to implement OCC in your environment. Keep the following in mind as you do your configuration:

Implement truly global settings at the global level.

Remember that you can highlight multiple users at once in User Manager to apply a change to all of them at once.

Use Windows NT environment variables wherever possible (for example, %username%, %homeshare%, %homepath%). This reduces the amount of customization required for a given user.

Read through the general notes in the first section and the Citrix WinFrame documentation for more information.

Upgrading the ONYX Environment

To avoid overwriting individual user settings when installing ONYX upgrades, it is recommended that each user install the upgrade on his/her own machine. In the WinFrame environment, it is necessary to use the change user /install command to properly register DLLs and work with the Registry.

1.	At a command prompt, type change user /install.

2.	Install the new version of OCC onto the d:\onyx\_template directory.

3.	At a command prompt, type change user /execute.

This process properly upgrades the system files required by OCC.


WordPerfect for Windows, Version 6.1

Overview

WordPerfect for Windows is a word processing application. The following information is for both user-specific and user-global installations. See the online Readme "General Installation of Applications on WinFrame" for more information.

Software Requirements

WordPerfect for Windows

WinFrame

Installation

To do a user-specific installation for one user (not recommended), follow the standard installation procedure outlined in the WordPerfect documentation.

To do a User-Global Installation (Recommended Method)

1.	Logon as an administrator at the console.

2.	At a command prompt, type change user /install.

3.	Install WordPerfect following the standard installation procedure outlined in the WordPerfect documentation.

4.	At the command prompt, type change user /execute.

All users on the system should now be able to run WordPerfect. Please read the General Installation of Applications on WinFrame for more information.

Usage

If you are using a Hewlett Packard (HP) LaserJet 4 printer and have the HP LaserJet 4 printer driver, you may experience long delays while printing very large print jobs. To fix this problem, an older version of the HP LaserJet 4 printer driver is provided for your use on the WinFrame installation CD-ROM in the path:

\SUPPORT\CITRIX\HPPCL5MS.DLL

Replace the driver and the problem should resolve itself. If you are not experiencing any of these problems, use the default driver. If you still have a problem, contact your HP dealer or HP support for the latest Windows NT driver for HP LaserJet 4 printers.


Microsoft Visual Basic Version 5.0 Enterprise Edition

Overview

Microsoft Visual Basic Version 5.0 allows users to create applications for Microsoft Windows. WinFrame Version 1.7 extends Visual Basic's capabilities by allowing multiple users to concurrently create, modify, and run Visual Basic applications. This document describes a tested method for installing and using Microsoft Visual Basic Version 5.0 Enterprise Edition on a WinFrame Version 1.7 server.

Hardware Requirements

WinFrame Version 1.7 server

Software Requirements

WinFrame Version 1.7

Microsoft Visual Basic Version 5.0 Enterprise Edition

Installing Microsoft Visual Basic

1.	Logon to the console of the WinFrame server as an administrator.

2.	At a command prompt, type change user/ install and press ENTER. This places the user session in install mode.

3.	Run SETUP.EXE.

4.	Enter the appropriate information in the Name and Organization Information window.

5.	Enter the installation location.

6.	Select the type of installation: Typical, Compact, or Custom. (For this installation, Typical was chosen.)

7.	When installation is complete, click OK, exit the setup window, and type change user/ execute at a command prompt.

8.	Reboot the computer.

Verifying Installation of Microsoft Visual Basic Version 5.0

To verify that Visual Basic Version 5.0 is correctly installed and configured:

1.	Start Visual Basic by double-clicking on the Visual Basic 5.0 icon.

2.	In the New Project window, click Existing.

3.	In the Directories window, select x/Vb/samples/Pguide/Biblio, where x is the directory that Visual Basic was installed in.

4.	In the File Name window, double-click BIBLIO.VBP.

5.	After the file loads, expand the Forms directory in the upper right side window.

6.	Double-click Form1.

7.	When the form loads, verify that the form can be changed and saved.

8.	From a WinFrame session, verify that a user without administrative rights can repeat Steps 1 through 7.

Notes

Visual Basic 5.0 must be installed in a directory where users without administrative rights have Change or Full Control permissions. Without these permissions, users will be unable to create applications that contain databases.

The Visual Basic 5.0 Help menu contains a listing for Microsoft on the Web. This feature is not available for WinFrame Version 1.7 because Internet Explorer has limitations when run on a Windows NT 3.51-based system.


NCR Server Manager Standard/Extended Release 5.0

Overview

The NCR Server Manager Extended provides a method for managing servers in a heterogeneous operating environment. It includes the LANDesk Console, which allows the system administrator to manage Windows NT and certain RAS servers from a single graphical user interface.

Server Manager is the interface from which you monitor and configure any accessible server running Server Manager. It allows you to connect to another server running Server Manager and quickly and easily determine its status.

Server Manager allows the system administrator to preconfigure filters and alerts so that if there is a change in the status of a given server, the system administrator can be notified automatically in a variety of ways including e-mail, pager, or SNMP trap.

Software Requirements

WinFrame Version 1.6 with Service Pack 5 or later

NCR Server Manager Release 5.0

The following WinFrame hotfixes:

SE165039.EXE

SE165048.EXE

SE165055.EXE

Installation

Important  WinFrame Version 1.6 Service Pack 5 must be installed and configured on the Sequent Server prior to the installation of NCR Server Manager 5.0.

Important  The hotfixes listed above must also be installed prior to the installation of Server Manager. To install a hotfix, execute the self-extracting file (FILENAME.EXE) and run hotfix /i.

1.	In User Manager for Domains, create a local group called remote.

2.	Create a local user called sam50 and add this user to the Administrators and Remote groups.

3.	In User Manager For Domains, select Policies and then User Rights and Policies. Check Show Advanced User Rights. From the Rights pull-down bar select Logon as Service Right.

4.	Use the Add button to add the Remote group and the sam50 user that you created earlier.

5.	The SNMP service must be stopped if it is running. Double-click on the Services icon in Control Panel. Highlight SNMP services and select Stop.

6.	Place the NCR ValuePlus 5.0 CD into the CD-ROM drive.

7.	In File Manager, select the CD-ROM drive and execute Setup.

8.	Select Server Manager Extended from the options.

9.	If Server Manager is already installed, the form displays three options: Upgrade, Overwrite, and Restore. Select Upgrade and click Next to continue.

10.	On the Components form, select NCR 4300.

11.	Select Next and continue with the installation.

12.	At the Login Account Information Form, enter domain_name\sam50 and the password, as recorded earlier.

13.	In the LanDesk Server Manager dialog box, check only the following items:

Server Manager Console

Server Manager NT Service

SNMP Event Forwarder

Server Monitor Module Driver

Select Continue to proceed.

14.	You are given an option to change the directory where the software will be installed. Enter a directory name and click Continue to proceed.

15.	The setup program starts copying files to the installation area and updates DLLs. During this phase, there are three instances where Setup will be unable to copy files and update DLLs because the administrator is currently using those files. Click Ignore for these cases.

16.	When you are prompted for authorized users/groups, enter remote.

17.	At the end of the installation a success message is displayed.

18.	Reboot the system.

Verifying Installation

Login to the system as an administrator and follow the procedure below to ensure that the installation of NCR Server Manager 5.0 was successful.

1.	Double-click on the Services icon in Control Panel and verify that the following serivces are listed:

Intel Alert Handler	Started	Automatic
Intel Alert Originator	Started	Automatic
Intel Message Service	Started	Automatic
Intel PDS	Started	Automatic
Intel Server Monitor	Started	Automatic
Intel WUSER Agent	Started	Automatic
NCR Alert Listener		Manual
NCR Hardware Monitor	Started	Automatic
NCR System Monitor	Started	Automatic
2.	From Program Manager, double-click on NCR Server Manager and verify that the following icons exist:

Server Manager

Event Simulator

Remote Shutdown

Configuration Replicator

SNMP Event Forwarder Configuration

SNMP Event Viewer

Net Pager

Service Remover

Server Manager Release Notes

Server Manager Uninstaller

Known Problems

If you get one of the following error messages after installing NCR Server Manager, perform the following procedures:

"An error has occurred while loading library .\4300.hwx, err_code = 6"

"Unable to load hardware DLLs"

"Memory range 000xxx000 is not accessible"

1.	Copy all files from the Windows subdirectory under the administrator's home directory to the %systemroot% area.

2.	In the BOOT.INI file add the following statement to the end of the WinFrame boot item (after the double quotes): /maxmem=512

3.	Copy BOUNCER.DAT from the Windows subdirectory under the administrator's home directory to %systemroot% and the directory where Server Manager files were copied (default: smm32). This file will enable administrators to log into Server Manager.

4.	Reboot the system.

Usage

1.	Logon to the WinFrame server as an administrator.

2.	Verify that all services are started and that there are no error messages on the console.

3.	In Administrative Tools, double-click on Server Manager and then select NCR Server Manager.

4.	Double-click on Microsoft Windows Network. This will display all domains on the network. Double-click on the domain where your WinFrame server is located.

This displays all servers currently in this domain. Double-click on your WinFrame server.

5.	Type in root for the initial userid and calvin for the initial password.

If login is successful, various options are displayed for your WinFrame server. If login is unsuccessful, a message will appear detailing the reason for the failure.

See the NCR Server Manager User's Guide for more information about using NCR Server Manager.


TaskTool Enterprise

Overview

TaskTool by Newtonian Software, Inc. is a utility that provides the look and feel of the Windows95/Windows NT 4.0 "Start" button menu and task bar to WinFrame. The task bar provided by TaskTool allows quick switching between windows within the WinFrame interface. The "Start" button menu functionality makes finding and executing heavily used applications faster and easier.

TaskTool is available in two forms: a standard shareware version meant for single users and an Enterprise version meant for use by large corporate networks and multiuser environments. The standard version of TaskTool requires that each user have a separate registration number and a separate copy of the executable in order to have personal menus. In contrast, TaskTool Enterprise allows groups of users to register. The Enterprise version of TaskTool also allows all users to use the same executable because the users' personal menu settings are kept in the users' home directories as defined by the users' Windows NT profiles. In addition, TaskTool Enterprise allows the definition of user group-wide menu configurations so that every user who is part of the same user group can be given the same menu in addition to the user's own personal settings. TaskTool Enterprise also allows the definition of a global menu for all users. The user group menu configurations can remain static because they can be secured using standard Windows NT file security. The Enterprise version of TaskTool is more useful than the standard version in a WinFrame environment. This document details the installation of TaskTool Enterprise.

Requirements

WinFrame Version 1.6 or higher

TaskTool Enterprise Version 2.2

Installation

To Install TaskTool Enterprise

1.	Login to the WinFrame server as an administrator.

2.	At a DOS command prompt, type change user /install and press ENTER.

3.	Change to the directory where the TaskTool Enterprise installation file is located.

4.	Type setup and press ENTER.

The TaskTool 2.2 Enterprise Edition installation begins.

5.	At the first dialog box, click OK to proceed with the installation.

6.	Select a folder where TaskTool will reside.

The TaskTool Enterprise installation copies the TaskTool files to the specified location and creates a common program group with four icons:

The TaskTool 2.2 - Enterprise Edition

TaskTool Help

Notes for Administrators

Getting Started

7.	During installation, the following files are placed in the destination directory:

ADMIN.DAT	The administrator user group sample menu configuration
ADMIN.TXT	Notes for Administrators
GLOBAL.DAT	The global sample menu configuration
INSTALL.LOG	Log file of events during the installation of TaskTool
README.TXT	Brief overview of TaskTool's capabilities
TASKT32.BMP	The bitmap seen whenever TaskTool is first executed
TASKT32E.EXE	The TaskTool Enterprise executable
TASKTOOL.HLP	TaskTool Windows Help file
TASKTOOL.MAP	TaskTool menu sample configuration map
8.	At a command prompt, type change user /execute and press ENTER.

Usage

1.	For detailed information on the configuration and use of TaskTool Enterprise, read the README.TXT file in the TaskTool Enterprise installation directory. This file is also accessible by selecting Getting Started in the TaskTool (Common) program group.

2.	For detailed information on the administration and security of TaskTool Enterprise, read the ADMIN.TXT file in the TaskTool Enterprise installation directory. This file is also accessible by selecting Notes for Administrators in the TaskTool (Common) program group.

3.	When the menus are configured, create a common program group called Startup. Hold down the CTRL key and drag the TaskTool Enterprise icon into the new Startup (Common) group. This will allow all users who logon to the WinFrame server instant access to the new menus because TaskTool will launch automatically.

Troubleshooting

If the TaskTool Enterprise menus are not functioning properly for users, check the following:

1.	Make sure the user groups are named precisely within the TaskTool Enterprise configuration map (TASKTOOL.MAP). Because group name entries are case-sensitive, it is important that the case for each named group is identical to its Windows NT user group name.

2.	The menu configurations named for each user group must have the appropriate file permissions in place for the corresponding configuration file named in the TaskTool Enterprise configuration map.

For example:

TASKTOOL.MAP Group Name Entry	Read Windows NT File Permission Entry
Global: \\server\datafiles\global.dat	Everyone
Administrators: \\server\datafiles\admin.dat	Administrators
Sales: \\server\datafiles\sales.dat	Sales
Users: \\server\datafiles\users.dat	Users
Additional Information

The Run selection available by default on the TaskTool button menu cannot be removed in this release.

Using TaskTool Enterprise as a replacement for the Program Manager is not recommended. Microsoft has advised that the usage of any shell other than Program Manager in Windows NT may result in a compromise in security.

To purchase TaskTool Enterprise, contact:

Newtonian Software, Inc.

2820 Trawick Road

Raleigh, NC 27604

Phone: 1-919-790-8894

Sales: 1-888-790-8898

Fax: 1-919-790-8895

http://www.newtonian.com/shareware/tasktool/


Hardware Application Notes

Overview

This chapter contains application notes for popular applications. The application types are broken into categories and the application notes are in alphabetical order by category. Refer to the online Readmes for general information on installing and configuring applications on a WinFrame server.

Note  The products listed in this guide have been tested and found to be compatible with WinFrame. Other products may (and probably will) work, but Citrix cannot guarantee the compatibility of untested products.

Because WinFrame is based on Microsoft Windows NT Server Version 3.51, most Windows NT 3.51 compatible applications can be expected to work. Review the application notes in the Solutions Guide and in the online WinFrame Readme for detailed application integration tips and techniques.

WinFrame supports Windows 32-bit applications, Windows 16-bit applications, DOS text applications, DOS graphical applications (console only), and OS/2 text applications. DOS graphical applications are supported on the console only; ICA WinStations support DOS text-mode programs only. OS/2 graphical programs that make use of the OS/2 graphical user interface (GUI) are not supported. OS/2 text applications, however, are supported. DOS and OS/2 text applications can use their standard installation procedures.

See "Application Integration" in Chapter 2 of this guide and the online Readme for more information about installing and configuring applications for use with WinFrame.


Digi AccelePort PCI Host Adapter with AccelePort Modem/4em

Overview

The Digi AccelePort PCI adapter card together with the AccelePort Modem/4em provides four external modems in one box. When installed and configured on a Citrix WinFrame 1.7 server, the AccelePort system can be used for incoming remote asynchronous ICA sessions and as an outgoing modem pool. This document describes a tested configuration of Digi AccelePort Modem/4em with Citrix WinFrame.

Requirements

Hardware

Dell OptiPlex GXi with one Pentium processor

Digi AccelePort PCI host adapter card

AccelePort Modem/4em

Software

Citrix WinFrame Version 1.7 or higher

Digi AccelePort Modem/4em Device Driver Version 2.3.0

Installing Digi AccelePort Adapter Card and Modem/4em

1.	Turn the computer off, remove the computer cover, and select a PCI slot to install the controller.

2.	Remove the expansion slot cover and insert the AccelePort host adapter card.

3.	Replace the cover.

4.	Connect the modem cable from the modem to the AccelePort adapter card and the power supply.

5.	Restart the system.

Note  With the system used for the test, conflicts with other PCI devices caused the system to freeze. The other PCI cards installed on the test configuration were an onboard video card, a SCSI adapter, and a multiport adapter. Information provided with the Digi AccelePort adapter suggested adding the /PCILOCK option to the end of the WinFrame boot entry in the BOOT.INI file. This stopped the system from freezing but the video adapter no longer functioned. The problem was corrected by switching the PCI slots for the AccelePort adapter card and the multiport adapter card.

Installing Digi AccelePort Device Driver

1.	In Control Panel, double-click Network.

2.	Click Add Adapter.

3.	Select <Other> Requires Disk From Manufacturer and click Continue.

4.	Insert the driver diskette and enter A:\i386 for the path. Click OK.

5.	In OEM Option, select Digi AccelePort Xem-PCI Adapter and click OK.

6.	In Adapter Configuration Wizard, select Modem/4em Module, click Add, and then Next.

7.	Enter the starting COM port (COM3 was used in this test).

8.	Click OK in the Digi Xem (PCI) Adapter Setup window.

9.	Close the Network window.

10.	Restart the system.

Setting up Digi AccelePort Modem/4em

1.	In Control Panel, double-click Modems.

2.	Click Add.

3.	Allow the modem installation procedure to detect the modem.

4.	Select the first COM port used for the AccelePort Modem/4em and click Next.

5.	When the Digi Modem/4em is found, click Next.

6.	Select all ports in the range assigned to the AccelePort Modem/4em and click Next.

7.	Enter location information and click Next.

8.	Click Finish to complete the setup.

9.	Click Close.

WinStation Configuration Using Digi AccelePort Modem/4em

1.	In the Administrative Tools program group, open WinStation Configuration.

2.	From the WinStation menu, select New.

3.	Enter a connection name, select Citrix ICA 3.0 for type, select async for transport, select the COM port to be used for device, select Digi from the AccelePort Modem/4em COM ports for modem, and then click OK.

4.	Repeat Steps 1-4 for additional terminal connections.

5.	Reboot the server.

Verifying the Installation of Digi AccelePort Modem/4em

Follow the procedure below to verify that the Digi AccelePort Modem/4em is correctly installed and configured:

1.	Connect the modem ports to phone ports.

2.	From the Accessories program group, open Terminal.

3.	From the Settings menu, select Communications.

4.	Select the first of the Modem/4em COM ports and click OK.

5.	Type atdt followed by the phone number of another modem.

6.	Verify the connection is made.

7.	Repeat Steps 1-7 for each AccelePort Modem/4em.


DigiBoard RightSwitch Switched Ethernet NIC

Overview

This section describes how to integrate the DigiBoard RightSwitch Ethernet NIC with a WinFrame server. The RightSwitch enables small- to medium-sized organizations to deploy a WinFrame server as a low cost Ethernet LAN solution, thereby eliminating the need for an Ethernet switch.

The RightSwitch replaces your EISA or PCI server's existing Ethernet adapter and connects directly to the server's bus. The bus bandwidth can be as high as 256Mbps in EISA systems and 1Gbps for PCI computers. The bottleneck between the switch and the server is reduced, allowing each port to simultaneously process data at the full 10Mbps bandwidth. The resulting performance is equal to, or better than, switched intelligent hubs at a fraction of the cost.

Many Ethernet switches are designed to solve the problem of enterprise network bottlenecks. While these switches can handle a large amount of traffic, they are not a cost-effective solution for workgroup network congestion. The 4-port EISA and 6-port PCI card solutions provide 10Mbps non-blocking switching. In addition, they offer store and forward processing, automatic self-learning addressing, full 802.1D Spanning Tree Protocol, and Simple Network Management Protocol. These capabilities make the RightSwitch ideal for use in workgroup environments running a variety of high-end applications on a WinFrame server.

RightSwitch Specifications

Direct connection to server bus

6-port PCI interface card

4-port EISA interface card

Supports 10 Base-T Ethernet LAN segments

SNMP manageable

Requirements

Hardware Requirements

WinFrame server with a DigiBoard RightSwitch LAN adapter card

Software Requirements

WinFrame Version 1.6 or higher

DigiBoard RightSwitch NT Driver (supplied by DigiBoard)

Driver Installation

1.	Insert the DigiBoard RightSwitch NT Driver Disk into drive A.

2.	From the Windows Control Panel, open the Windows NT Networks Control Program Panel.

3.	Click on the Network icon. The Network Settings window appears.

4.	Click on Add Adapter. Select Other Network Adapter Card. The Add Network Adapter window appears.

5.	Select Other from the pull-down list and click on Continue. The Insert Disk dialog box appears. Specify A:\ in the text box and choose OK to install.

6.	From the Select OEM Option box, select the RightSwitch option from the DigiBoard Driver Disk and click OK.

7.	Select Close or OK to complete the Network Setting initialization.

Note  Additional configuration dialog windows may appear.


Digi PortServer and RealPort Software for Windows NT

Overview

The Digi PortServer intelligent terminal server gives you the ability to connect up to 16 high speed RS-232 asynchronous serial devices (such as terminals and printers) to a TCP/IP Ethernet network. Both Twisted Pair (10 Base-T) and Thinnet (10 Base-2) cabling standards are supported by the appropriate connectors on the side of the PortServer box. Each surge protected serial port terminates in a standard 10-pin RJ-45 jack that provides full modem control and hardware flow control. Each port supports connections at up to 57.6Kbps. Network management using industry standard SNMP with MIB II is also supported.

The RealPort Software provides local access to serial ports on PortServer as if the ports were physically contained within the host system and controlled by the WinFrame operating system. Multiple WinFrame servers can share one or more PortServer units simultaneously. Users can use Windows NT RAS, WinFrame dial-in, dial-out modem pooling applications such as SAPS, Net2Com, or WinPort, and terminal server applications such as Point-of-Sale (POS) with the flexibility of directly connected devices.

Requirements

Hardware Requirements

Digi PortServer /16 unit

Software Requirements

WinFrame Version 1.6 or higher

Digi RealPort Service for Windows NT 3.51 and 4.0 Version 1.0.0.2

Installation

Connecting and Configuring a PortServer Unit

1.	Connect the PortServer unit to the Ethernet LAN using either 10 Base-T or 10 Base-2 cabling to the appropriate connector on the left side of the PortServer unit.

2.	Connect a null modem cable between a PC's COM port and the Port 1 socket of the PortServer unit.

3.	Run a terminal emulation program on the PC such as the Terminal application supplied with Windows. Set the terminal parameters to VT-100 emulation, 9600 baud, 8 data bits, 1 stop bit, and no parity.

4.	Turn the PortServer unit on.

5.	After the letters AC appear on the screen of the PC connected to the PortServer, press ENTER; a login prompt will appear. Type root. When asked for the root password, type dbps.

6.	A unique IP address is required for each PortServer unit. To configure the IP address, at a PortServer command prompt, type set config ip=xxx.xxx.xxx.xxx.

7.	Type exit at the prompt to log off the PortServer.

Installing Digi RealPort Service on WinFrame

1.	Login to the WinFrame console as an administrator.

2.	From the Main menu, double-click the Control Panel icon and then the Network icon.

3.	Click the Add Software button and select <Other> Requires Disk From Manufacturer from the list.

4.	Insert the Digi RealPort Service disk into a floppy drive and press ENTER to install.

5.	Enter the assigned IP address of the PortServer unit when prompted.

6.	Provide a name for the PortServer unit for future reference.

7.	Select the default port mapping or remap the communication ports.

8.	Reboot the server for the changes to take effect.

Usage

Connect serial devices such as printers or modems to the PortServer unit. Only one WinFrame server can utilize a serial port on the PortServer at a time. For example, if COM 11 on one WinFrame server is mapped to port 1 on the PortServer, no other WinFrame server can map to port 1 on the Port Server. More than one WinFrame server can be configured to use the same PortServer but not the same ports simultaneously. The administrator must keep track of the port connections manually. An administrator can check the status of a serial port from the front control panel of the PortServer.

When adding the same PortServer to the RealPort Software on multiple WinFrame servers, each server will receive the same number of additional serial ports. It is also possible but not advisable to give different names to the same PortServer unit when shared among multiple servers.

Troubleshooting

The beta version of RealPort Software drivers from Digi has a minor script bug in the OEMSETUP.INF file that prevents the administrator from installing the software. To fix this problem, use a text editor to edit the OEMSETUP.INF file. Search for the word TAGFILE and delete it.

Occasionally, when detecting a PortServer/16 unit on the network, it reports a
64-port PortServer rather than a 16-port one. During installation, when "64 ports" appears on the screen, click Back and then Next. This returns the PortServer to a 16-port configuration.

Notes

PortServer does not have the capability to detect the presence of a DHCP server under WinFrame and Windows NT, but DHCP service is available for UNIX systems.

In addition, the RealPort Software does not have the capability to automatically search and list all the PortServer units on the network and their corresponding assigned IP addresses. You need to know the IP addresses of the PortServer units prior to the detection time.


Equinox SST Modem Pool

Overview

This application note describes the installation and configuration of the Equinox SST Modem Pool Expansion Chassis. The Expansion Chassis houses up to sixteen 8-bit ISA bus internal modems and connects to a WinFrame server through an Equinox SST multiport adapter card. The primary advantage of using the Expansion Chassis with WinFrame is the elimination of multiple external modems and cables.

Requirements

Hardware Requirements

SST adapter card

Modem Pool Expansion Chassis (Fuse Map BIOS Version 527/c or higher)

Expansion cable between the SST adapter and modem chassis

One or more third-party 8-bit internal modems

Software Requirements

WinFrame Version 1.6 or higher

Equinox SST Driver for Windows NT (Version 3.20 or higher)

Installation

1.	Make sure you have the latest SST driver for Windows NT from Equinox. The Equinox BBS number is (954) 791-1633.

2.	Shut down the WinFrame server.

3.	Install an Equinox SST adapter in the WinFrame server and connect the Modem Pool Expansion Chassis.

4.	Install one or more 8-bit ISA internal modems in the Modem Pool Expansion Chassis.

5.	Reboot the server and log on as an administrator.

6.	Start the Control Panel application in the Main program group. Double-click on the Network icon. The Network Settings screen appears.

7.	Click on Add Adapter. The Add Network Adapter dialog appears.

8.	Select Other from the Network Adapter Card pull-down list. Place the Equinox driver in drive A:\ and select OK.

9.	Select COM3 to be the starting COM port address for your SST modem. Note this is usually standard because most machines contain two COM ports.

Configuration

Note  You may assign a modem port to either ICA Dial-In or RAS. You may mix modem ports between the two in the modem chassis; however, each port can be dedicated to only one purpose.

ICA Dial-in

1.	Logon to the WinFrame server as an administrator. From the Administrative Tools group, select WinStation Configuration and create your ICA Dial-In WinStations.

2.	When configuring a Dial-In WinStation, select an available COM port and modem type that correspond to a modem in the Equinox Modem Pool Expansion Chassis.

RAS

1.	Logon to the WinFrame server as an administrator. Start the Control Panel application in the Main program group. Double-click on the Network icon. The Network Settings screen appears.

2.	Click on Add Software. The Add Network Software dialog box appears. Choose Remote Access Service from the Network Software pull-down list and select Continue to install RAS.

3.	During RAS installation select a COM port and modem type that correspond to a modem in the Equinox Modem Pool Expansion Chassis.


Stallion Technologies EasyConnection and Easy IO Multiport Serial Adapters

Note  This document was written by David Tuffley, Stallion Technologies, Brisbane, Australia. Copyright Stallion Technologies Pty. Ltd., 1997. This publication is a copyright and contains information that is the property of Stallion. No part of this document may be copied or stored in a retrieval system without the written permission of Stallion.

The Stallion EasyConnection is a modular multiport (8 or 16) serial adapter that connects serial devices to WinFrame systems. EasyConnection offers a range of configurations to suit local connectivity needs; RJ45 or DB25 connectors, RS-232, RS-422, RS-422-A, or RS485. The 8 or 16 port modules can be added to incrementally via additional clip-on modules. Two configurations of EasyConnection are available: 8/32 and 8/64 supporting 32 and 64 ports respectively.

The Stallion EasyIO is an affordable high-speed serial communications device suited to Pentium and Pentium Pro systems. EasyIO provides four serial ports via adapter mounted RJ45 connectors or eight ports via either RJ45 or DB25 connector modules. EasyIO is capable of sustaining up to 145Kbps on all ports and minimizes the load serial I/O places upon the system.

Requirements

Software Requirements

WinFrame Version 1.6 or higher

WinFrame Client, Version 1.6 or higher

Stallion Windows NT driver, as supplied with EasyConnection and EasyIO

Hardware Requirements

A WinFrame server

A Stallion EasyConnection or EasyIO with at least one modem

A client machine with a modem able to dial the EasyConnection or EasyIO

A network linking the WinFrame host and the EasyConnection or EasyIO

Installation

Use the following procedure to install the EasyConnection or EasyIO. Install the Stallion hardware in the system before attempting to install the driver.

1.	From the Main menu, click on Control Panel and then Network.

2.	Click on the Add Adapter button.

The system will display a list of network adapter cards. Select <Other> Requires disk from manufacturer and click on the Continue button.

3.	Insert the driver diskette and specify the path to the driver directory; for example A:\I386, and press OK.

4.	The system will display a list of Stallion adapter cards. Select the correct adapter type and press OK.

If your system has multiple buses and the card you select is compatible with more than one bus, you will be asked to select the bus type (for example ISA, MCA, EISA, PCI) and the bus number.

You will need to provide different configuration information depending on the bus type. Complete these details and press OK.

5.	Specify the panel configuration and determine the COM port names (default names are allocated, but you may change these if you wish). Select the Panel1, Panel2 radio buttons in turn to configure each module. Select the number of ports (8 or 16) for each module and press OK.

Installation will continue without further user input. The driver will be started automatically when the system is rebooted. Configured serial ports will be available for use as WinFrame ports.

Driver Utilities

Port Monitoring and Driver Statistics

A Stallion diagnostics tool is available to monitor various port statistics and to assist in troubleshooting serial problems. The Easyadmw utility is found in Control Panel. The All Ports Display dialog shows signal states and statistics for each port. Individual port details can be displayed by first selecting a port and then clicking on the Detail button. This dialog box shows port configuration, signal states, and graphical display of input and output. The Host and Slave dialog boxes are for driver debug purposes.

The Report dialog box saves all port information to a user-specified file. This report, along with the Windows NT system configuration, may be requested by Stallion Support to resolve serial problems.


U.S. Robotics Total Control EdgeServer

Overview

The U.S. Robotics Total Control EdgeServer provides both Windows NT Server functionality and high speed communication features in a single, self-contained platform. The EdgeServer combines a PC running Windows NT Server 4.0 and Remote Access Service (RAS) and a variety of U.S. Robotics products, including T1 CSU/DSU interface cards, quad modem cards, Ethernet and Token Ring NICs, SCSI interfaces, and X.25 PADs in a single chassis. The EdgeServer can be used as a network front-end processor to provide RAS dialin support and secure Internet connectivity.  See the figure below for a sample configuration.

By running Windows NT Remote Access Service (RAS) on the Edge Server, remote users can establish a remote node connection and use the WinFrame Client to start a network remote control session on the WinFrame server.

The Edge Server can be configured with the following hardware options:

Edge Server 486 DX4 100 CPU with 64MB RAM

X.25 PAD/V.35 NIC

Single/Dual T1 Card providing an EIA RS232 connector and two RJ48C connectors for CSU

T1 NIC provides a single EIA RS232 connector

Quad port modem cards (both analog and digital) with four RS232 ports and/or four RJ11 Jacks

Ethernet or Token Ring NIC

The Edge Server can be configured with the following software options:

Windows NT Server Version 4.0 with Windows NT Service Pack 2

Checkpoint Firewall-1 software

Total Control Management software

Usage

When Windows NT RAS is installed on the Edge Server, users can dial in and access the local network as well as obtain network access to Internet and Intranet resources. Windows NT RAS runs on the Edge Server, which off-loads the RAS overhead from other servers on the network. The Edge Server can also be configured as a front end to the Internet allowing authorized users inbound access from the Internet to the Intranet and outbound access from the Intranet to the Internet, using Checkpoint Firewall-1 software to provide Internet security.


Using Multiple Matrox Video Adapters

Overview

This section describes how to use multiple Matrox video adapters with a WinFrame server or a WinFrame client to provide more usable video area than is available with a single monitor.

Many video card manufacturers, such as Matrox, now have Microsoft Windows NT device drivers that allow up to four video adapters in a single machine. These can be used to "extend" the displayed area to multiple monitors, so that each monitor displays a portion of the entire screen area. Multiple displays can be used in a WinFrame server, or in a Windows NT or WinFrame client machine running the WinFrame Win32 Client.

Requirements

Hardware Requirements

Video adapter cards that support multiple display configurations (Citrix tested the Matrox Millennium and Mystique PCI video adapters)

Software Requirements

WinFrame Version 1.6 or higher for server system

Windows NT (Server or Workstation) or WinFrame for client PC

Matrox device drivers

Installation

The procedures for installing multiple video cards in a WinFrame server or a Microsoft Windows NT system are identical. You can install the video adapters before or after installing the operating system. Follow the documentation provided by Matrox to install the video cards and drivers.

If you install the video adapters after installing the operating system, set the display to use the standard VGA driver before you shut down the system by using the Display application in Control Panel.

When installing more than one video board in a machine, all of the boards must be identical. One adapter is designated the "master." All other adapters are "slaves" and their VGA jumpers must be set to "disabled."

You must remove or disable the original video adapter card. If your system has an integrated video adapter, it must be disabled. An integrated video adapter can usually be disabled through a jumper on the system board or by using the BIOS Setup utility.

When connecting the monitors, the master video adapter displays the upper left portion of the screen.

After the video boards are installed and the monitors are connected, turn the machine on. The machine should start with video displayed by only the master video adapter.

Follow the video card manufacturer's instructions for installing the Windows NT drivers and selecting video resolutions that will display across multiple monitors.

Note  The WinFrame server can support any screen resolutions the adapter is capable of. The WinFrame client can support screen resolutions up to 1280x1024.


Xircom Netaccess MultiPort Modem Card

Overview

This application note describes how to install and use the Xircom Netaccess MultiPort Modem Card in a WinFrame server. Each Xircom card contains four or eight V.34 modems and allows the user to access server- and LAN-based applications through Microsoft Remote Access Service (RAS) on the server and WinFrame Client Dial-Up Manager, Windows 95 Dial-Up Networking, or RAS provided with WinFrame Server or Windows NT on the client PC.

Once a RAS connection to the WinFrame server is established, the remote user can use the WinFrame Client to start a network remote control session.

Requirements

Hardware Requirements

WinFrame server

Xircom Netaccess MultiPort Modem Card

Software Requirements

WinFrame Version 1.6 or higher

WinFrame Client (DOS, Win16, or Win32)

Xircom Driver and Utility Disk Release 1.13

Connectivity Usage Chart

A RAS dial-up connection to the WinFrame server must first be established between the client machine and the WinFrame server. The WinFrame Client can then be used to start a network remote control session. The column headings list the available remote node connection types. The row headings identify the WinFrame Client these remote node connections can be used with to establish a network remote control connection to a WinFrame server.

	WinFrame DOS Client	WinFrame Win16 Client	WinFrame Win32 Client
WinFrame DOS Client Dial-Up Manager	Yes	Yes	No
WinFrame Win16 Client Dial-Up Manager	No	Yes	No
Windows 95 Dial-Up Networking	No	No	Yes
WinFrame or Windows NT Remote Access Service (RAS)	No	No	Yes
Installation

1.	Configure and install the Netaccess Multiport Modem Card in an available ISA slot as described in the Netaccess Multiport Modem Card Installation and Reference Guide.

2.	Set the rotary switch on the card to select the I/O port address to be used with the card. This port address must not be used by any other card or device. Rotary switch settings 0 through 7 can be used with WinFrame. See below for a list of rotary switch settings and their associated I/O port addresses.

3.	Power up the WinFrame system.

4.	To add the adapter device drivers, logon as an administrator. Start the Network applet in Control Panel.

5.	When the Network Settings dialog box appears, click on Add Adapter in the Network Software and Adapter Cards box.

6.	Select <Other> Requires disk from manufacturer from the network adapter selection list and choose Continue. The Insert Disk prompt appears.

7.	Insert the Xircom driver disk in drive A, type a:\ndis_wan in the path text box, and select OK. Select the type of modem card installed in your system (4-port or 8-port) and choose OK.

8.	Select rotary switch and other settings that match the configuration settings for your adapter and do not conflict with any other devices present in your system. When you are done configuring the adapter, exit the Network Settings dialog.

If you are installing more than one card, repeat the above steps for each additional card. Note that each card must use a different I/O port, memory address, and interrupt channel.

9.	Install the RAS support. Do not reboot or close WinFrame at this time. If you do, you will not be able to see the Xircom ports and will have to remove and reinstall the Multiport Modem support. If Remote Access Service has not been installed, you can install it at this point.

10.	Start the Network applet in Control Panel, found in the Main program group.

11.	Select Configure for RAS under Network Settings.

12.	Select Add. Open the PORT window and select XMPMPORT1. Select OK.

13.	If the settings selected for the first port are the same for the rest of the ports, select Clone to duplicate the settings for each port.

14.	When all the ports are configured select Continue. Under Network Settings select OK and wait for the system to update the configuration.

15.	Respond appropriately to any Protocol questions and select OK. At the Network Settings Change screen, select Restart. (This is the first time that you have rebooted the system since you added the adapter.)

16.	When WinFrame restarts, you may select Remote Access Service and Remote Access Administration. This screen displays the number of ports and their condition.

Additional Notes

Several helpful tools are included in WinFrame.

Use Windows NT Diagnostics in the Administrative Tools group to check for potential interrupt, I/O port, DMA channel, and memory address conflicts when determining adapter settings.

Use the Event Viewer in the Administrative Tools group to check for any error events and to see a log of the devices that are loaded. Some error messages provide status information and do not report actual error conditions.

When a local user logon is created for a WinFrame server, the user has remote control access across a network but does not yet have dial in RAS/Remote Node access to that WinFrame server. To give a user RAS access permission, logon to the WinFrame console as an administrator and run the Remote Access Administrator. In the Remote Access Administrator, click on the Select Domain or Server option from the Server menu. When the Select Domain dialog box appears, type: \\wfservername, where wfservername is the name of the WinFrame server the user will be dialing into for remote node access. Click the OK button in the Select Domain dialog box to set the Remote Access Administrator to that WinFrame server. Select the Permissions option from the Users menu. This now shows the local user logins configured for that particular WinFrame server. From here users are granted RAS access. Grant RAS access to the users who will be dialing in and then click the OK button to save the changes. Local users now have remote node access to the WinFrame server and can dial in via RAS.

Troubleshooting

If you encounter any problems, remove RAS and the Netaccess MultiPort Modem adapter driver, exit, and then restart WinFrame. You must configure RAS after adding the MultiPort Modem adapter. If you exit Network Settings before configuring the MultiPort Modem, you will not be able to use the MultiPort Modem adapter ports.

WinFrame components take a few moments to load at startup. If you encounter the error message "The workstation service has not been started," wait for a few seconds and try again.

The registry settings for RAS are maintained by the Registry Editor (REGEDT32.EXE). You can create an icon to invoke REGEDT32.EXE. The Xircom MultiPort Modem adapter settings are contained in \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Xircom 2 [or 3]\Parameters. This is where modem initialization commands may be edited or added. To add a modem initialization string, edit the ModemInit variable. The default settings should rarely need to be changed.

Using the MultiPort Modem (MPM) Card Rotary Switch

The rotary switch on the MPM Card has ten possible settings, of which settings 0 through 7 can be used. Each setting corresponds to a different I/O port address. In a WinFrame system using the Xircom driver (XMPM.SYS), only the I/O port is selected using the rotary switch; the memory address and interrupt channel are software defined.

The rotary switch settings and their corresponding I/O port addresses are:

Setting	I/O Port
0	280
1	2A0
2	2C0
3	2E0
4	300
5	320
6	340
7	360
8	Reserved - do not use
9	Reserved - do not use