VMware Horizon Access Point

 

1Introduction

Access Point is a Unified Gateway from VMware that comes in virtual appliance format and is designed to protect desktop and application resources to enable remote access from the Internet. Access Point is the default gateway for the following products:

  • VMware Horizon View
  • VMware Horizon Air (DaaS)
  • VMware Horizon Air Hybrid-Mode
  • VMware Identity Manager
  • Airwatch Tunnel Gateway/Proxy

The KEMP LoadMaster is used to load balance the VMware Access Point workload. The LoadMaster offers advanced Layer 4 and Layer 7 server load balancing, SSL Acceleration and a multitude of other advanced Application Delivery Controller (ADC) features. The LoadMaster intelligently and efficiently distributes user traffic among the application servers so that users get the best experience possible.

1.1Document Purpose

This document provides the recommended LoadMaster settings used when load balancing the VMware Access Point workload for the Horizon View and Horizon Air Hybrid-Mode use cases. The KEMP Support Team is available to provide solutions for scenarios not explicitly defined. The KEMP support site can be found at: https://support.kemptechnologies.com

1.2Intended Audience

This document is intended to be read by anyone who is interested in configuring the LoadMaster to optimize VMware Access Point Server.

1.3About this Document

This document was written with help from Mark Benson and Vish Kalsi of VMware. Some of the content in this document is based on the following VMware document: https://communities.vmware.com/docs/DOC-32792

In addition, you can find more information at https://www.vmware.com/support/pubs/access-point-pubs.html

2VMware Application Server Template

KEMP has developed a template containing our recommended settings for VMware. You can install this template on the LoadMaster and use it when creating Virtual Services. Using a template automatically populates the settings in the Virtual Services, which is quicker and easier than manually configuring each Virtual Service. If needed, you can make changes to any of the Virtual Service settings after using the template.

Download released templates from the Templates section on the KEMP documentation page: http://kemptechnologies.com/documentation/.

For more information and steps on how to import and use templates, refer to the Virtual Services and Templates, Feature Description.

For steps on how to manually add and configure each of the Virtual Services, refer to Section 5 of this document.

3Architecture

Access Point is typically deployed in a DMZ. For high availability and scalability requirements in a production deployment, several Access Point appliances are usually set up behind a load balancer as shown in Figure 3-1. The LoadMaster is deployed in-line as a proxy for all services including PCoIP. Alternative deployment options could have the secondary Horizon protocols bypass the LoadMaster as it is only the initial session establishment (HTTPS) that can be load balanced.

Figure 3‑1: Multiple Access Point Appliances behind a Load Balancer

This deployment guide focuses on the load balancing requirements for the Horizon View and Horizon Air Hybrid-Mode use cases. It discusses the distinction between the primary and secondary Horizon protocols and describes the three methods for guaranteeing session affinity. The three methods ensure that all protocol traffic from a Horizon client session goes to the same Access Point appliance. This article also covers health monitoring and SSL offload/SSL bridging for load balancers.

4Horizon Protocols

When a Horizon Client user connects to a Horizon environment, several different protocols are used. The first connection is always the primary XML-API protocol over HTTPS. Following successful authentication, one or more secondary protocols are also made.

4.1Primary Horizon Protocol

The user enters a hostname at the Horizon Client and this starts the primary Horizon protocol. This is a control protocol for authentication, authorization and session management. It uses XML-structured messages over HTTPS (HTTP over SSL). This protocol is sometimes known as the Horizon XML-API control protocol. In a load-balanced environment as shown in Section 3, the load balancer routes this connection to one of the Access Point appliances. The load balancer usually selects the appliance based first on availability, and then out of the available appliances will route traffic based on the least number of current sessions. This has the effect of evenly distributing the traffic from different clients across the available set of Access Point appliances.

4.2Secondary Horizon Protocols

After the Horizon Client has established a secure communication to one of the Access Point appliances, the user authenticates. If this authentication attempt is successful, then one or more secondary connections are made from the Horizon client. These secondary connections can include:

  • HTTPS Tunnel used for encapsulating TCP protocols such as RDP, MMR/CDR and the client framework channel (TCP 443).
  • Blast Extreme display protocol (TCP 443 and UDP 443).
  • PCoIP display protocol (TCP 4172 and UDP 4172).

These secondary Horizon protocols must be routed to the same Access Point appliance to which the primary Horizon protocol is routed. This is so that Access Point can authorize the secondary protocols based on the authenticated user session. An important security capability of Access Point is that it will only forward traffic into the corporate datacenter if the traffic is on behalf of an authenticated user. If the secondary protocols were to be misrouted to a different Access Point appliance to the primary protocol one, they would not be authorized and would therefore be dropped in the DMZ and the connection would fail. Misrouting the secondary protocols is a common problem if the Load Balancer is not configured correctly.

5Configure the LoadMaster

The deployed VMware Access Point environment determines which of the following setups is used.

5.1Enable Subnet Originating Requests Globally

It is best practice to enable the Subnet Originating Requests option globally.

In a one-armed setup (where the Virtual Service and Real Servers are on the same network/subnet), Subnet Originating Requests is usually not needed. However, enabling Subnet Originating Requests should not affect the routing in a one-armed setup.

In a two-armed setup where the Virtual Service is on network/subnet A, for example, and the Real Servers are on network B - Subnet Originating Requests should be enabled on LoadMasters with firmware version 7.1-16 and above.

When Subnet Originating Requests is enabled, the LoadMaster routes traffic so that the Real Server sees traffic arriving from the LoadMaster interface that is in that network/subnet.

When Subnet Originating Requests is enabled globally, it is automatically enabled on all Virtual Services. If the Subnet Originating Requests option is disabled globally, you can select whether or not to enable Subnet Originating Requests on a per-Virtual Service basis.

To enable Subnet Originating Requests globally, follow the steps below:

  1. In the main menu of the LoadMaster WUI, go to System Configuration > Miscellaneous Options > Network Options.

Figure 5‑1: Subnet Originating Requests

  1. Select the Subnet Originating Requests check box.

5.2Enable Check Persist Globally

It is recommended that you change the Always Check Persist option to Yes – Accept Changes. Use the following steps:

  1. Go to System Configuration> Miscellaneous Options > L7 Configuration.

Figure 5‑2: Enable Check Persist Globally

  1. Click the Always Check Persist dropdown arrow and select Yes – Accept Changes.

6Session Affinity Options

There are three main configuration options for session affinity. These are:

  • Source IP Affinity
  • Multiple Port Number Groups
  • Multiple VIPs

6.1Method 1 - Source IP Affinity

Method 1 is recommended for all environments where source IP address affinity is possible. Where it is not possible, then either method 2 or method 3 should be used.

Method 1 is the simplest configuration for a load balancer because it uses standard port numbers and a single load balanced VIP. It relies on the load balancer to route secondary protocols to the same Access Point appliance as was selected for the primary Horizon protocol. It does this on the basis of repeat connections coming from the same Horizon client IP address. Unfortunately, this method does not work in all situations. For example, with certain Network Service Providers or NAT devices, the source IP address is not available for this affinity configuration. If source IP affinity cannot be used in your environment, then one of the other two methods should be used as they do not rely on source IP affinity.

Access Point Configuration for External URLs for this configuration is shown in the following table.

In our example, the Fully Qualified Domain Name (FQDN) http://ap.myco.com resolves to 10.1.160.35.

Access Point Appliance

Configuration Item

Value

AP01

tunnelExternalURL

https://ap.myco.com:443

AP01

blastExternalURL

https://ap.myco.com:443

AP01

pcoipExternalURL

10.1.160.35:4172

AP02

tunnelExternalURL

https://ap.myco.com:443

AP02

blastExternalURL

https://ap.myco.com:443

AP02

pcoipExternalURL

10.1.160.35:4172

Table 6‑1: Access Point Configuration for External URLs

Advantages of Source IP Affinity

  • Uses standard port numbers
  • Does not require multiple public virtual IP addresses

Disadvantages of Source IP Affinity

  • Relies on source IP address affinity, which is not always possible.

6.1.1Create the VMware Access Point Source IP Affinity Virtual Services

The following sections describe the recommended settings for the VMware Access Point Source IP Affinity Virtual Services.

6.1.1.1Create a APLB TCP-IP Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the APLB TCP-IP Affinity HTTP Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑1: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 443 as the Port.
  3. Enter a recognizable Service Name, such as APLB TCP-IP Affinity.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Comment

Standard Options

Extra Ports

4172

Click Set Extra Ports.

 

Persistence Mode

Source IP Address

 
 

Timeout

6 minutes

 
 

Scheduling Method

least connection

 

Advanced Properties

Add a Port 80 Redirector VS

 

Click the Add HTTP Redirector button. This automatically creates a redirect on port 80.

Real Servers

Real Server Check Method

HTTPS Protocol

 
 

URL

/favicon.ico

 

Table 6‑2: APLB TCP-IP Affinity Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

Create an APLB TCP-IP Affinity HTTPS HTTP Redirect Virtual Service

Clicking the Add HTTP Redirector button automatically creates a port 80 redirect Virtual Service. This is optional, but the purpose of this Virtual Service is to redirect any clients who have connected using HTTP to the HTTPS Virtual Service.

6.1.1.2Create an APLB UDP 443 Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the APLB UDP 443 Affinity Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑2: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 443 as the Port.
  3. Enter a recognizable Service Name, such as APLB UDP 443 Affinity.
  4. Select udp as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

 

Persistence Mode

Source IP Address

 

Timeout

6 minutes

Advanced Properties

Port Following

tcp/10.1.160.35:443

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑3: APLB UDP 443 Affinity Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.1.1.3Create an APLB - UDP 4172 - Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the APLB - UDP 4172 - Affinity Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑3: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 4172 as the Port.
  3. Enter a recognizable Service Name, such as APLB - UDP 4172.
  4. Select udp as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

 

Persistence Mode

Source IP Address

 

Timeout

6 minutes

Advanced Properties

Port Following

tcp/10.1.160.35:443

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑4: APLB UDP 4172 Affinity Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2Method 2 - Multiple Port Number Groups

Multiple port group affinity does not rely on source IP address for affinity. Instead, the load balancer is configured to route the secondary Horizon protocols based on a group of unique port numbers assigned to each Access Point appliance. The primary Horizon protocol on HTTPS port 443 is load balanced to allocate the session to a specific Access Point appliance based on health and least loaded. The secondary connections are then routed to the correct Access Point appliance based on the following Load Balancer configuration table.

Virtual IP Address

Primary/Secondary

Protocol

Name

Real Servers

10.1.160.31:443

Primary

TCP

APLB - HTTPS

10.1.160.183:443

10.1.160.184:443

10.1.160.31:10143

Secondary

TCP

AP01 - HTTPS

10.1.160.183:443

10.1.160.31:10143

Secondary

UDP

AP01 - BLAST-UDP

10.1.160.183:443

10.1.160.31:10172

Secondary

TCP

AP01 - PCOIP

10.1.160.183:4172

10.1.160.31:10172

Secondary

UDP

AP01 - PCOIP-UDP

10.1.160.183:4172

10.1.160.31:10243

Secondary

TCP

AP02 - HTTPS

10.1.160.184:443

10.1.160.31:10243

Secondary

UDP

AP02 - BLAST-UDP

10.1.160.184:443

10.1.160.31:10272

Secondary

TCP

AP02 - PCOIP

10.1.160.184:4172

10.1.160.31:10272

Secondary

UDP

AP02 - PCOIP-UDP

10.1.160.184:4172

Table 6‑5: Load Balancer Configuration Table

The same port mapping scheme can be used for additional Access Point appliances 03 > 99. For example, we use the following mapping convention in this document for two access points:

  • 10143 → AP01 443
  • 10172 → AP01 4172
  • 10243 → AP02 443
  • 10272 → AP02 4172

The same convention is used for multiple access points:

  • 10343 → AP03 443
  • 10372 → AP03 4172

The Access Point Configuration for External URLs is shown below.

In our example, the FQDN http://ap.myco.com resolves to 10.1.160.31.

Access Point Appliance

Configuration Item

Value

AP01

tunnelExternalURL

https://ap.myco.com:10143

AP01

blastExternalURL

https://ap.myco.com:10143

AP01

pcoipExternalURL

10.1.60.31:10172

AP02

tunnelExternalURL

https://ap.myco.com:10243

AP02

blastExternalURL

https://ap.myco.com:10243

AP02

pcoipExternalURL

10.1.60.31:10272

Table 6‑6: Access Point Configuration for External URLs

Advantages of Multiple Port Number Groups

  • Does not rely on source IP affinity
  • Does not require multiple public virtual IP addresses

Disadvantages of Multiple Port Number Groups

  • Uses non-standard port numbers from the Internet although the port numbers on the Access Point appliances themselves are standard.

6.2.1Create the VMware Access Point Multiple Port Number Groups Virtual Services

The following sections describe the recommended settings for the VMware Access Point Multiple Port Number Groups Virtual Services.

6.2.1.1Create a APLB – HTTPS – Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the APLB – HTTPS – Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑4: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 443 as the Port.
  3. Enter a recognizable Service Name, such as APLB – HTTPS Multiple Ports.
  1. Click Add this Virtual Service.
  2. Configure the settings as recommended in the following table:

Section

Option

Value

Comment

Advanced Properties

Add a Port 80 Redirector VS

 

Click the Add HTTP Redirector button. This automatically creates a redirect on port 80.

Basic Properties

Service Type

Generic

 

Standard Options

Persistence Mode

SSL Session ID

 
 

Timeout

6 minutes

 
 

Scheduling Method

least connection

 

Real Servers

Real Server Check Method

HTTPS Protocol

 
 

URL

/favicon.ico

 

Table 6‑7: APLB – HTTPS – Multiple Ports Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 443 as the port number.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

Create an APLB – HTTPS – Multiple Ports HTTPS HTTP Redirect Virtual Service

Clicking the Add HTTP Redirector button automatically creates a port 80 redirect Virtual Service. This is optional, but the purpose of this Virtual Service is to redirect any clients who have connected using HTTP to the HTTPS Virtual Service.

6.2.1.2Create an AP01 – HTTPS – Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP01 – HTTPS – Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑5: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 10143 as the Port.
  3. Enter a recognizable Service Name, such as AP01 – HTTPS – Multiple Ports.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Basic Properties

Service Type

HTTP/HTTPS

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

HTTPS Protocol

 

Checked Port

443

 

URL

/favicon.ico

Table 6‑8: AP01 – HTTPS – Multiple Ports Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 443 as the port number.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2.1.3Create an AP01 – BLAST–UDP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP01 – Blast-UDP Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑6: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 10143 as the Port.
  3. Enter a recognizable Service Name, such as AP01 – BLAST-UDP Multiple Ports.

Select udp as the Protocol.

  1. Click Add this Virtual Service.
  2. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑9: AP01 – BLAST-UDP Multiple Ports Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 443 as the Port.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2.1.4Create an AP01 – PCOIP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP01 – PCOIP Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑7: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 10172 as the Port.
  3. Enter a recognizable Service Name, such as AP01 – PCOIP Multiple Ports.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Checked Port

4172

Table 6‑10: AP01 – PCOIP Multiple Ports Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 4172 as the Port.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2.1.5Create an AP01 – PCOIP-UDP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP01 – PCOIP-UDP Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑8: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 10172 as the Port.
  3. Enter a recognizable Service Name, such as AP01 – PCOIP-UDP.
  4. Select udp as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑11: AP01 – PCOIP-UDP Multiple Ports Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 4172 as the Port.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2.1.6Create an AP02 – HTTPS Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – HTTPS Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑9: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 10243 as the Port.
  3. Enter a recognizable Service Name, such as AP02 – HTTPS.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Basic Properties

Service Type

HTTP/HTTPS

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

HTTPS Protocol

 

Checked Port

443

 

URL

/favicon.ico

Table 6‑12: AP02 – HTTPS Multiple Ports Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 443 as the Port.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2.1.7Create an AP02 – BLAST-UDP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – Blast-UDP Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑10: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 10243 as the Port.
  3. Enter a recognizable Service Name, such as AP02 – BLAST-UDP.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

HTTPS Protocol

Table 6‑13: AP02 – BLAST-UDP Multiple Ports Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 443 as the Port.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2.1.8Create an AP02 – PCOIP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – PCOIP Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑11: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 10272 as the Port.
  3. Enter a recognizable Service Name, such as AP02 – PCOIP.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

 

Scheduling Method

round robin

Real Servers

Checked Port

4172

Table 6‑14: AP02 - PCOIP Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 4172 as the Port.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2.1.9Create an AP02 – PCOIP-UDP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – PCOIP-UDP Multiple Ports Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑12: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 10272 as the Port.
  3. Enter a recognizable Service Name, such as AP02 – PCOIP-UDP.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑15: AP02 – PCOIP-UDP Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 4172 as the Port.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.3Method 3 - Multiple VIPs

This method is similar to the multiple port groups method except instead of dedicating a group of port numbers to each Access Point appliance, it dedicates an individual VIP to each appliance in addition to the primary load balanced VIP. If you have two Access Point appliances, then you would set up three VIPs. The primary Horizon protocol on HTTPS port 443 is load balanced to allocate the session to a specific Access Point appliance based on health and least loaded. The secondary connections are then routed to the correct Access Point appliance based on the following Load Balancer configuration table.

Access Point Configurations for External URLs for this configuration are shown in the following table.

Virtual IP Address

Primary/Secondary

Protocol

Name

Real Servers

10.1.160.32:443

Primary

TCP

APLB - HTTPS

10.1.160.186:443

10.1.160.187:443

10.1.160.33:443

Secondary

TCP

AP01 - HTTPS

10.1.160.186:443

10.1.160.33:443

Secondary

UDP

AP01 - BLAST-UDP

10.1.160.186:443

10.1.160.33:4172

Secondary

TCP

AP01 - PCOIP

10.1.160.186:4172

10.1.160.33:4172

Secondary

UDP

AP01 - PCOIP-UDP

10.1.160.186:4172

10.1.160.34:443

Secondary

TCP

AP02 - HTTPS

10.1.160.187:443

10.1.160.34:443

Secondary

UDP

AP02 - BLAST-UDP

10.1.160.187:443

10.1.160.34:4172

Secondary

TCP

AP02 - PCOIP

10.1.160.187:4172

10.1.160.34:4172

Secondary

UDP

AP02 - PCOIP-UDP

10.1.160.187:4172

Table 6‑16: Load Balancer Configuration Table

In our example, the FQDN http://ap1.myco.com resolves to 10.1.160.33 and https://ap2.myco.com:4172 resolves to 10.1.160.34

Access Point Appliance

Configuration Item

Value

AP01

tunnelExternalURL

https://ap1.myco.com:443

AP01

blastExternalURL

https://ap1.myco.com:443

AP01

pcoipExternalURL

10.20.30.33:4172

AP02

tunnelExternalURL

https://ap2.myco.com:443

AP02

blastExternalURL

https://ap2.myco.com:4172

AP02

pcoipExternalURL

10.20.30.34:4172

Table 6‑17: Access Point Configuration for External URLs

Advantages of multiple VIPs

  • Do not rely on source IP affinity
  • Uses standard port numbers

Disadvantages of multiple VIPs

  • Requires an additional public facing VIP for each Access Point appliance in addition to the primary load balanced VIP.

6.3.1Create the Multiple VIPs Virtual Services

The following sections describe the recommended settings for the VMware Access Point Multiple VIPs Virtual Services.

6.3.1.1Create an HTTPS-APLB Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the HTTPS-APLB Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑13: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 443 as the Port.
  3. Enter a recognizable Service Name, such as HTTPS – APLB.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Comment

Advanced Properties

Add a Port 80 Redirector VS

 

Click the Add HTTP Redirector button. This automatically creates a redirect on port 80.

Basic Properties

Service Type

Generic

 

Standard Options

Persistence Mode

SSL Session ID

 
 

Timeout

6 minutes

 
 

Scheduling Method

least connection

 

Real Servers

Real Server Check Method

HTTPS Protocol

 
 

URL

/favicon.ico

 

Table 6‑18: HTTPS – APLB Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

Create a HTTPS - APLB Multiple Ports HTTPS HTTP Redirect Virtual Service

Clicking the Add HTTP Redirector button automatically creates a port 80 redirect Virtual Service. This is optional, but the purpose of this Virtual Service is to redirect any clients who have connected using HTTP to the HTTPS Virtual Service.

6.3.1.2Create an AP01 – BLAST-UDP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP01 – BLAST-UDP Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑14: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 443 as the Port.
  3. Enter a recognizable Service Name, such as AP01 – BLAST-UDP.
  4. Select udp as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑19: AP01 – BLAST-UDP Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.3.1.3Create an AP01 – HTTPS Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP01 – HTTPS Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑15: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 443 as the Port.
  3. Enter a recognizable Service Name, such as AP01 – HTTPS.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

 

Scheduling Method

round robin

Real Servers

Real Server Check Method

HTTPS Protocol

 

Checked Port

443

 

URL

/favicon.ico

Table 6‑20: AP01 - HTTPS Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.3.1.4Create an AP01 - PCOIP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP01 - PCOIP Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑16: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 4172 as the Port.
  3. Enter a recognizable Service Name, such as AP01 - PCOIP.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Comments

Real Servers

Real Server Check Method

TCP Connection only

 
 

Checked Port

4172

Click Set Check Port.

Table 6‑21: AP01 - PCOIP Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Type 4172 as the Port.

e)Complete the other fields as required.

f)Click Add this Real Server then click OK to the pop-up message.

g)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.3.1.5Create an AP01 – PCOIP-UDP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP01 – PCOIP-UDP Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑17: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 4172 as the Port.
  3. Enter a recognizable Service Name, such as AP01 – PCOIP-UDP.
  4. Select udp as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑22: AP01 – PCOIP-UDP Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.3.1.6Create an AP02 – BLAST-UDP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – BLAST-UDP Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑18: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 443 as the Port.
  3. Enter a recognizable Service Name, such as AP02 – BLAST-UDP – Multiple IPs.
  4. Select udp as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑23: AP02 – BLAST-UDP Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.3.1.7Create an AP02 – HTTPS Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – HTTPS Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑19: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 443 as the Port.
  3. Enter a recognizable Service Name, such as AP02 – HTTPS – Multiple IPs.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

HTTPS Protocol

 

Checked Port

443

 

URL

/favicon.ico

Table 6‑24: AP02 - HTTPS Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.3.1.8Create an AP02 – PCOIP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – PCOIP Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑20: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 4172 as the Port.
  3. Enter a recognizable Service Name, such as AP02 – PCOIP.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

TCP Connection Only

 

Checked Port

4172

       

Table 6‑25: AP02 - PCOIP Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

6.3.1.9Create an AP02 – PCOIP-UDP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – PCOIP-UDP Multiple VIPs Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 6‑21: Virtual Service parameters

  1. Type a valid Virtual Address.
  2. Type 4172 as the Port.
  3. Enter a recognizable Service Name, such as AP02 – PCOIP-UDP.
  4. Click Add this Virtual Service.
  5. Configure the settings as recommended in the following table:

Section

Option

Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

Table 6‑26: AP02 – PCOIP-UDP Multiple VIPs Recommended Settings

  1. Add the Real Servers:

a)Expand the Real Servers section.

b)Click Add New.

c)Type the address of the relevant Real Server.

d)Complete the other fields as required.

e)Click Add this Real Server then click OK to the pop-up message.

f)Repeat the steps above to add more Real Servers as needed, based on your environment.

References

Unless otherwise specified, the following documents can be found at http://kemptechnologies.com/documentation.

Virtual Services and Templates, Feature Description

Document History

Date

Change

Reason for Change

Version

Resp.

Oct 2016

First Release

First release of document

1.0

POC

Was this article helpful?

0 out of 0 found this helpful

Comments