VMware Horizon 7

Contents

1 Introduction

VMware Horizon is a virtual desktop infrastructure (VDI) solution that simplifies administration and delivery of personalized virtual desktops. It consists of several components and delivers a secure optimized virtual desktop infrastructure.

This deployment guide focuses on the load balancing requirements for the Horizon and Unified Access Gateway (UAG) use cases. It discusses the distinction between the primary and secondary Horizon protocols and describes the three methods for guaranteeing session affinity. The three methods ensure that all protocol traffic from a Horizon client session goes to the same Unified Access Gateway appliance. This article also covers health monitoring and SSL bridging for load balancers.

Unified Access Gateway (Access Point) is a Unified Gateway from VMware that comes in virtual appliance format and is designed to protect desktop and application resources to enable remote access from the internet. Unified Access Gateway is the default gateway for the following products:

  • VMware Horizon
  • VMware Horizon Air (DaaS)
  • VMware Horizon Air Hybrid-Mode
  • VMware Identity Manager
  • Airwatch Tunnel Gateway/Proxy

Connection Servers are the core component of VMware Horizon. This role defines virtual desktop pools, applications, and permissions.

App Volume Manager is a console for managing configuration, creation of AppStacks, and assignment of AppStacks and writable volumes.

Identity Manager is a portal where users gain access to different types of applications including Software as a Service (SaaS) based, enterprise identity management to sync and extend Active Directory, and single sign on.

The Kemp LoadMaster is used to load balance the VMware Unified Access Gateway, Connection Servers, Identity Manager, and App Volume Manager. The LoadMaster offers advanced Layer 4 and Layer 7 server load balancing, SSL Acceleration, and a multitude of other advanced Application Delivery Controller (ADC) features. The LoadMaster intelligently and efficiently distributes user traffic among the application servers so that users get the best experience possible.

This document provides guidance and recommended settings on how to load balance Horizon 7 with a Kemp LoadMaster. The Kemp Support Team is available to provide solutions for scenarios not explicitly defined.

The Kemp support site can be found at: https://support.kemptechnologies.com.

1.1 Document Purpose

This document provides the recommended LoadMaster settings used when load balancing the VMware Horizon use cases using the Unified Access Gateway. The Kemp Support Team is available to provide solutions for scenarios not explicitly defined. The Kemp support site can be found at: https://support.kemptechnologies.com.

1.2 Intended Audience

This document is intended to be read by anyone who is interested in configuring the LoadMaster to optimize VMware Horizon workload.

1.3 About this Document

This document was written with help from Mark Benson and Vish Kalsi of VMware. Some of the content in this document is based on the following VMware document: https://communities.vmware.com/docs/DOC-32792

2 Template

Kemp has developed a template containing our recommended settings for this workload. You can install this template to help create Virtual Services (VSs) because it automatically populates the settings. You can use the template to easily create the required VSs with the recommended settings. You can install this template to help create Virtual Services (VSs) because it automatically populates the settings. For some workloads, additional manual steps may be required such as assigning a certificate or applying port following, these steps are covered in this document.

You can remove templates after use and this will not affect deployed services. If needed, you can make changes to any of the VS settings after using the template.

Download released templates from the Templates section on the Kemp Documentation page.

Depending on the configuration of Horizon 7 and UAG, the following templates are provided to address the different methods outlined in this guide:

  • Horizon 7: This template includes Virtual Services that support Connection Servers, App Volume Manager, and Identity Manager.
  • UAG - Source IP Affinity: This template includes Virtual Services that support Unified Access Gateway using Method 1 (Source IP Affinity).
    • Advantages of Source IP Affinity:
      • Uses standard port numbers
      • Does not require multiple virtual IP addresses
    • Disadvantages of Source IP Affinity:
      • Relies on source IP address affinity, which is not always possible
  • UAG - Multi-Port Affinity: This template includes Virtual Services that support Unified Access Gateway using Method 2 (Multiple Port Affinity).
    • Advantages of Multiple Port Number Groups:
      • Does not rely on source IP affinity
      • Does not require multiple public virtual IP addresses
    • Disadvantages of Multiple Port Number Groups:
      • Uses non-standard port numbers from the internet. Although the port numbers on the Unified Access Gateway appliances themselves are standard.
  • UAG - Multi-VIP Affinity: This template includes Virtual Services that support Unified Access Gateway using Method 3 (Multiple VIP Affinity).
    • Advantages of Multiple VIPs:
      • Does not rely on source IP affinity
      • Uses standard port numbers
    • Disadvantages of Multiple VIPs:
      • Requires an additional public-facing VIP for each Unified Access Gateway appliance in addition to the primary load-balanced VIP

For more information and steps on how to import and use templates, refer to the Virtual Services and Templates, Feature Description on the Kemp Documentation page.

3 Architecture

Unified Access Gateway is typically deployed in a DMZ. For high availability and scalability requirements in a production deployment, several Unified Access Gateway appliances are usually set up behind a load balancer as shown in Figure 3-1. The LoadMaster is deployed in-line as a proxy for all services including PCoIP. Alternative deployment options could have the secondary Horizon protocols bypass the LoadMaster as it is only the initial session establishment (HTTPS) that can be load balanced.

View7Diagram.png

4 Horizon Protocols

When a Horizon Client user connects to a Horizon environment, several different protocols are used. The first connection is always the primary XML-API protocol over HTTPS. Following successful authentication, one or more secondary protocols are also made.

4.1 Primary Horizon Protocol

The user enters a hostname at the Horizon Client and this starts the primary Horizon protocol. This is a control protocol for authentication, authorization and session management. It uses XML-structured messages over HTTPS (HTTP over SSL). This protocol is sometimes known as the Horizon XML-API control protocol. In a load-balanced environment as shown in the Architecture section, the load balancer routes this connection to one of the Unified Access Gateway appliances. The load balancer usually selects the appliance based first on availability, and then out of the available appliances that will route traffic based on the least number of current sessions. This has the effect of evenly distributing the traffic from different clients across the available set of Unified Access Gateway appliances.

4.2 Secondary Horizon Protocols

After the Horizon Client has established a secure communication to one of the Unified Access Gateway appliances, the user authenticates. If this authentication attempt is successful, then one or more secondary connections are made from the Horizon client. These secondary connections can include:

  • HTTPS Tunnel used for encapsulating TCP protocols such as RDP, MMR/CDR and the client framework channel (TCP 443).
  • Blast Extreme display protocol (TCP 443 or UDP 8443).
  • PCoIP display protocol (TCP 4172 and UDP 4172).

These secondary Horizon protocols must be routed to the same Unified Access Gateway appliance to which the primary Horizon protocol is routed. This is so that Unified Access Gateway can authorize the secondary protocols based on the authenticated user session. An important security capability of Unified Access Gateway is that it will only forward traffic into the corporate datacenter if the traffic is on behalf of an authenticated user. If the secondary protocols were to be misrouted to a different Unified Access Gateway appliance to the primary protocol one, they would not be authorized and would therefore be dropped in the DMZ and the connection would fail. Misrouting the secondary protocols is a common problem if the Load Balancer is not configured correctly.

5 Configure the LoadMaster

The deployed VMware Unified Access Gateway environment determines which of the following setups is used.

5.1 Enable Subnet Originating Requests Globally

It is best practice to enable the Subnet Originating Requests option globally.

In a one-armed setup (where the Virtual Service and Real Servers are on the same network/subnet) Subnet Originating Requests is usually not needed. However, enabling Subnet Originating Requests should not affect the routing in a one-armed setup.

In a two-armed setup where the Virtual Service is on network/subnet A, for example, and the Real Servers are on network B, Subnet Originating Requests should be enabled on LoadMasters with firmware version 7.1-16 and above.

When Subnet Originating Requests is enabled, the LoadMaster routes traffic so that the Real Server sees traffic arriving from the LoadMaster interface that is in that network/subnet.

When Subnet Originating Requests is enabled globally, it is automatically enabled on all Virtual Services. If the Subnet Originating Requests option is disabled globally, you can choose whether to enable Subnet Originating Requests on a per-Virtual Service basis.

To enable Subnet Originating Requests globally, follow the steps below:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to System Configuration > Miscellaneous Options > Network Options.

SOR.png

2. Select the Subnet Originating Requests check box.

5.2 Enable Check Persist Globally

It is recommended that you change the Always Check Persist option to Yes - Accept Changes. Use the following steps:

1. Go to System Configuration > Miscellaneous Options > L7 Configuration.

L7Configuration-Enable_Check_Persist_Globally.png

2. Click the Always Check Persist drop-down arrow and select Yes - Accept Changes.

6 Unified Access Gateway Session Affinity Options

There are three main configuration options for session affinity. These are:

Source IP Affinity

Multiple Port Number Groups

Multiple VIPs

6.1 Method 1 - Source IP Affinity

Method 1 is recommended for all environments where source IP address affinity is possible. Where it is not possible, then either method 2 or method 3 should be used.

Method 1 is the simplest configuration for a load balancer because it uses standard port numbers and a single load balanced VIP. It relies on the load balancer to route secondary protocols to the same Unified Access Gateway appliance as was selected for the primary Horizon protocol. It does this based on repeat connections coming from the same Horizon client IP address. Unfortunately, this method does not work in all situations. For example, with certain Network Service Providers or NAT devices, the source IP address is not available for this affinity configuration. If source IP affinity cannot be used in your environment, then one of the other two methods should be used as they do not rely on source IP affinity.

Unified Access Gateway Configuration for External URLs for this configuration is shown in the following table.

In our example, the Fully Qualified Domain Name (FQDN) https://uag.myco.com resolves to 10.10.10.154.

Unified Access Gateway Appliance Configuration Item Value

UAG01

tunnelExternalURL

https://uag.myco.com:443

UAG01

blastExternalURL

https://uag.myco.com:443

UAG01

pcoipExternalURL

10.10.10.154:4172

UAG02

tunnelExternalURL

https://uag.myco.com:443

UAG02

blastExternalURL

https://uag.myco.com:443

UAG02

pcoipExternalURL

10.10.10.154:4172

The use of Blast port TCP/8443 can be leveraged but is not required.

Advantages of Source IP Affinity

Uses standard port numbers

Does not require multiple public virtual IP addresses

Disadvantages of Source IP Affinity

Relies on source IP address affinity, which is not always possible.

6.2 Method 2 - Multiple Port Number Groups

Multiple port group affinity does not rely on source IP address for affinity. Instead, the load balancer is configured to route the secondary Horizon protocols based on a group of unique port numbers assigned to each Unified Access Gateway appliance. The primary Horizon protocol on HTTPS port 443 is load balanced to allocate the session to a specific Unified Access Gateway appliance based on health and least loaded. The secondary connections are then routed to the correct Unified Access Gateway appliance based on the following Load Balancer configuration table.

Virtual IP Address

Primary/

Secondary

Protocol Name Real Servers

10.10.10.154:443

Primary

TCP

UAGLB - HTTPS

10.10.10.90:443

10.10.10.91:443

10.10.10.154:10143

Secondary

TCP

UAG01 - HTTPS

10.10.10.90:443

10.10.10.154:10143

Secondary

UDP

UAG01 - BLAST-UDP

10.10.10.90:8443

10.10.10.154:10172

Secondary

TCP

UAG01 - PCOIP

10.10.10.90:4172

10.10.10.154:10172

Secondary

UDP

UAG01 - PCOIP-UDP

10.10.10.90:4172

10.10.10.154:10243

Secondary

TCP

UAG02 - HTTPS

10.10.10.91:443

10.10.10.154:10243

Secondary

UDP

UAG02 - BLAST-UDP

10.10.10.91:8443

10.10.10.154:10272

Secondary

TCP

UAG02 - PCOIP

10.10.10.91:4172

10.10.10.154:10272

Secondary

UDP

UAG02 - PCOIP-UDP

10.10.10.91:4172

The same port mapping scheme can be used for additional Unified Access Gateway appliances 03 > 99. For example, we use the following mapping convention in this document for Unified Access Gateway.

The Unified Access Gateway Configuration for External URLs is shown below.

In our example, the FQDN http://uag.myco.com resolves to 10.10.10.154.

Unified Access Gateway Appliance Configuration Item Value

UAG01

tunnelExternalURL

https://uag.myco.com:10143

UAG01

blastExternalURL

https://uag.myco.com:10143

UAG01

pcoipExternalURL

10.10.10.154:10172

UAG02

tunnelExternalURL

https://uag.myco.com:10243

UAG02

blastExternalURL

https://uag.myco.com:10243

UAG02

pcoipExternalURL

10.10.10.154:10272

Advantages of Multiple Port Number Groups:

  • Does not rely on source IP affinity
  • Does not require multiple public virtual IP addresses

Disadvantages of Multiple Port Number Groups:

Uses non-standard port numbers from the Internet although the port numbers on the Unified Access Gateway appliances themselves are standard.

6.3 Method 3 - Multiple VIPs

This method is similar to the multiple port groups method except instead of dedicating a group of port numbers to each Unified Access Gateway appliance, it dedicates an individual VIP to each appliance in addition to the primary load balanced VIP. If you have two Unified Access Gateway appliances, then you would set up three VIPs. The primary Horizon protocol on HTTPS port 443 is load balanced to allocate the session to a specific Unified Access Gateway appliance based on health and least loaded. The secondary connections are then routed to the correct Unified Access Gateway appliance based on the following Load Balancer configuration table.

Unified Access Gateway Configurations for External URLs for this configuration are shown in the following table.

Virtual IP Address Primary/Secondary Protocol Name Real Servers

10.10.10.154:443

Primary

TCP

UAGLB - HTTPS

10.10.10.90:443

10.10.10.91:443

10.10.10.156:443

Secondary

TCP

UAG01 - HTTPS BLAST

10.10.10.90:443

10.10.10.156:8443

Secondary

UDP

UAG01 - BLAST-UDP

10.10.10.90:8443

10.10.10.156:4172

Secondary

TCP

UAG01 - PCOIP

10.10.10.90:4172

10.10.10.156:4172

Secondary

UDP

UAG01 - PCOIP-UDP

10.10.10.90:4172

10.10.10.157:443

Secondary

TCP

UAG02 - BLAST

10.10.10.91:443

10.10.10.157:8443

Secondary

UDP

UAG02 - BLAST-UDP

10.10.10.91:8443

10.10.10.157:4172

Secondary

TCP

UAG02 - PCOIP

10.10.10.91:4172

10.10.10.157:4172

Secondary

UDP

UAG02 - PCOIP-UDP

10.10.10.91:4172

In our example, the FQDN http://uag1.myco.com resolves to 10.10.10.156 and https://uag2.myco.com resolves to 10.10.10.157.

Unified Access Gateway Appliance Configuration Item Value

UAG01

tunnelExternalURL

https://uag1.myco.com:443

UAG01

blastExternalURL

https://uag1.myco.com:8443

UAG01

pcoipExternalURL

10.10.10.156:4172

UAG02

tunnelExternalURL

https://uag2.myco.com:443

UAG02

blastExternalURL

https://uag2.myco.com:8443

UAG02

pcoipExternalURL

10.10.10.157:4172

Advantages of multiple VIPs:

  • Do not rely on source IP affinity
  • Uses standard port numbers

Disadvantages of multiple VIPs

Requires an additional public facing VIP for each Unified Access Gateway appliance in addition to the primary load balanced VIP.

7 Virtual Service - Connection Server

The Connection Server is a core component of VMware Horizon. This role defines virtual desktop pools, applications, and permissions. The initial Primary Horizon Protocol is load balanced between Connection Servers in the environment. The Secondary Horizon Protocols are connected by directly bypassing the load balancer.

This step-by-step setup of Virtual Services (VSs) leverages the Kemp application template for Horizon 7.

The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster Application Programming Interface (API) and automation tools.

SSL/TLS certificates should be added before creating this Virtual Service. For further information on certificates, refer to the SSL Accelerated Services Feature Description.

7.1 Create the Connection Server Virtual Services

The following are the steps involved and the recommended settings to configure the VMware Connection Server Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

ConnectionServerVS.png

2. Type a valid Virtual Address.

3. Select the VMware Connection Server template in the Use Template drop-down list.

4. Click Add this Virtual Service.

5. In the main menu, go to Virtual Services > View/Modify Services.

6. Click Modify on the relevant Virtual Service on TCP port 443.

7. Expand the SSL Properties section.

8. Select the certificate to use from Available Certificates and click the arrow (>) to move it to Assigned Certificates.

9. Expand the Real Servers section.

10. Click Add New.

11. Type the Real Server Address.

12. Confirm that port 443 is entered.

13. Click Add This Real Server.

14. Repeat the steps above to add more Real Servers as needed.

7.1.1 Connection Server Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port 443
prot tcp
VStype http
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
Persist src
PersistTimeout 3600
CheckType https
Checkurl /favicon.ico
CheckUseGet 1

7.1.2 Connection Server Redirect Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

80

prot tcp
VStype http
Forcel7 1
Transparent 0
ErrorCode 302
ErrorUrl https://%h%s
CheckType None

8 Virtual Service - Unified Access Gateway (UAG)

The UAG is a core component of VMware Horizon. This role provides access to virtual desktop pools and applications for external users. The initial Primary Horizon Protocol is load balanced between UAG servers in the environment. The Secondary Horizon Protocols are directed to correct UAG based on the configuration (method) used.

UAGVS.png

The templates to support different UAG methods include different protocols to support different customer environments. In most cases, one or more Virtual Services created by the template are not used. For instance, the following Virtual Services are optional if only the Blast protocol was used in the example provided in the Source IP Affinity UAG Configuration (Method 1) section of this guide.

optionalVSs.png

Kemp recommends all Virtual Services get configured and the connections to these be monitored using the Real Time Statistics. If no connections are being recorded on these optional Virtual Services, they can be disabled or deleted to clean up the LoadMaster configuration.

8.1 Source IP Affinity UAG Configuration (Method 1)

The following is an example of a Unified Access Gateway configuration to support Source IP Affinity:

  • The URL (Horizon-int.kempdemo.com) in this example points to the internal LoadMaster (10.10.10.103) publishing Connection Servers as configured in the Create the Connection Server Virtual Services section.
  • The URL (Horizon.kempdemo.com) in this example points to the public IP address (10.10.10.154) of the external LoadMaster publishing the UAG servers.
  • The IP address (10.10.10.154) in this example would be the public IP address of the external LoadMaster publishing the UAG Servers.

HorizonSettings.png

8.2 Source IP Affinity Virtual Services (Method 1)

This step-by-step setup of Virtual Services leverages the Kemp application template for UAG - Source IP Affinity.

The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster API and automation tools.

8.2.1 Create the UAG Source IP Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the VMware UAG Source IP Affinity Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > Add New.

UAGSourceIPAffinityVS.png

2. Type a valid Virtual Address.

3. Select the UAGLB - Source IP Affinity template in the Use Template drop-down list.

4. Click Add this Virtual Service.

8.2.1.1 Configure the UAG TCP HTTPS - Source IP Affinity Virtual Service

To configure this Virtual Service, follow the steps below:

1. In the main menu of the LoadMaster WUI, select View/Modify Services.

VSs.png

2. Click Modify on the UAGLB TCP HTTPS -Source IP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 443 is entered.

7. Click Add This Real Server.

8. Repeat these steps to add more Real Servers as needed.

8.2.1.1.1 UAG TCP HTTPS - Source IP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

443

prot tcp
VStype http
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
Persist src
PersistTimeout 3600
CheckType https
Checkurl /favicon.ico
CheckUseGet 0

8.2.1.2 Configure the UAG TCP PCoIP - Source IP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, select View/Modify Services.

2. Click Modify on the UAGLB TCP PCoIP -Source IP Affinity Virtual Service.

3. Expand the Advanced Properties section.

AdvancedProperties.png

4. In the Port Following drop-down list, select the Virtual Service with port 443.

5. Expand the Real Servers section.

6. Click Add New.

7. Type the Real Server Address.

8. Confirm that port 4172 is entered.

9. Click Add This Real Server.

10. Repeat these steps to add more Real Servers as needed.

8.2.1.2.1 UAG TCP PCoIP - Source IP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

4172

prot tcp
VStype http
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
Persist src
PersistTimeout 3600
FollowVSID <Specify Virtual Service ID>
CheckType tcp
Checkport 4172

8.2.1.3 Configure the UAG UDP PCoIP - Source IP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAGLB UDP PCoIP -Source IP Affinity Virtual Service.

3. Expand the Advanced Properties section.

UAGUDPPCoIPAdvancedProperties.png

4. In the Port Following drop-down list, select the Virtual Service with port 443.

5. Expand the Real Servers section.

6. Click Add New.

7. Type the Real Server Address.

8. Confirm that port 4172 is entered.

9. Click Add This Real Server.

10. Repeat this step to add more Real Servers as needed.

8.2.1.3.1 UAG UDP PCoIP - Source IP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

4172

prot udp
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
Persist src
PersistTimeout 3600
FollowVSID <Specify Virtual Service ID>
CheckType icmp

8.2.1.4 Configure the UAG TCP Blast - Source IP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services  > View/Modify Services.

2. Click Modify on the UAGLB TCP Blast -Source IP Affinity Virtual Service.

3. Expand the Advanced Properties section.

UAGTCPBlastAdvancedProperties.png

4. In the Port Following drop-down list, select the Virtual Service with port 443.

5. Expand the Real Servers section.

6. Click Add New.

7. Type the Real Server Address.

8. Confirm that port 8443 is entered.

9. Click Add This Real Server.

10. Repeat these steps to add more Real Servers as needed.

8.2.1.4.1 UAG TCP Blast - Source IP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

8443

prot tcp
VStype http
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
Persist src
PersistTimeout 3600
FollowVSID <Specify Virtual Service ID>
CheckType tcp
Checkport 8443

8.2.1.5 Configure the UAG UDP Blast - Source IP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAGLB UDP Blast - Source IP Affinity Virtual Service.

3. Expand the Advanced Properties section.

UAGUDPBlastAdvancedProperties.png

4. In the Port Following drop-down list, select the Virtual Service with port 443.

5. Expand the Real Servers section.

6. Click Add New.

7. Type the Real Server Address.

8. Confirm that port 8443 is entered.

9. Click Add This Real Server.

10. Repeat these steps to add more Real Servers as needed.

8.2.1.5.1 UAG UDP Blast - Source IP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

8443

prot udp
SubnetOriginating 1
ForceL7 1
Transparent 0
Schedule lc
Persist src
PersistTimeout 3600
FollowVSID <Specify Virtual Service ID>
CheckType icmp

8.3 Multiple Port Affinity UAG Configuration (Method 2)

The following is an example of a Unified Access Gateway configuration to support Multiple Port Affinity. Each configuration is set with unique ports to direct clients to the correct UAG node.

  • The URL (Horizon-int.kempdemo.com) in this example points to the internal LoadMaster (10.10.10.103) publishing Connection Servers as configured in the Create the Connection Server Virtual Services section.
  • The URL (Horizon.kempdemo.com) in this example points to the public IP address (10.10.10.154) of the external LoadMaster publishing the UAG Servers.
  • The IP address (10.10.10.154) in this example would be the public IP address of the external LoadMaster publishing the UAG Servers.

UAG1andUAG2Configuration.png

8.4 Multiple Port Affinity Virtual Services (Method 2)

This step-by-step setup of Virtual Services leverages the Kemp application template for UAG - Multiple Port Affinity.

This template deploys Virtual Services to support two UAGs. If the environment requires three or more UAGs, follow the steps in the Duplicate Virtual Service (Optional) section.

The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster API and automation tools.

8.4.1 Create the UAG Multiple Port Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the VMware UAG Multi-Port Affinity Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > Add New.

UAGLBMulti-PortAffinityVS.png

2. Type a valid Virtual Address.

3. Select the UAGLB - Multi-Port Affinity template in the Use Template drop-down list.

4. Click Add this Virtual Service.

8.4.1.1 Configure the UAG TCP HTTPS - Multi-Port Affinity Virtual Service

To configure this Virtual Service, follow the steps below:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

UAGTCPHTTPSMulti-PortAffinityVSs.png

2. Click Modify on the UAGLB TCP HTTPS -Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 443 is entered.

7. Click Add This Real Server.

8. Repeat these steps to add more Real Servers as needed.

This Virtual Service will be the only one with multiple Real Servers.

8.4.1.1.1 UAG TCP HTTPS - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

443

prot tcp
VStype http
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
CheckType https
Checkurl /favicon.ico
CheckUseGet 0

8.4.1.2 Configure the UAG1 TCP Blast - Multi Port Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG1 TCP Blast -Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Update the Real Server Port to 443.

7. Click Add This Real Server.

UAG1 should be the only Real Server added to this Virtual Service.

8.4.1.2.1 UAG1 TCP Blast - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

10143

prot tcp
VStype http
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
CheckType tcp
Checkport 443

8.4.1.3 Configure the UAG1 UDP Blast - Multi Port Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG1 UDP Blast - Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Update the Real Server Port to 8443.

7. Click Add This Real Server.

UAG1 should be the only Real Server added to this Virtual Service.

8.4.1.3.1 UAG1 UDP Blast - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

10143

prot udp
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
CheckType icmp

8.4.1.4 Configure the UAG1 TCP PCoIP - Multi Port Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG1 TCP PCoIP - Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 4172 is entered.

7. Click Add This Real Server.

UAG1 should be the only Real Server added to this Virtual Service.

8.4.1.4.1 UAG1 TCP PCoIP - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

10172

prot tcp
VStype http
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
CheckType tcp
Checkport 4172

8.4.1.5 Configure the UAG1 UDP PCoIP - Multi-Port Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG1 UDP PCoIP -Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Update the Real Server Port to 4172.

7. Click Add This Real Server.

UAG1 should be the only Real Server added to this Virtual Service.

8.4.1.5.1 UAG1 UDP PCoIP - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

10172

prot udp
SubnetOriginating 1
Forcel7 1
Transparent 0
Schedule lc
CheckType icmp

8.4.1.6 Configure UAG2 TCP Blast - Multi-Port Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG2 TCP Blast -Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Update the Real Server Port to 443.

7. Click Add This Real Server.

UAG2 should be the only Real Server added to this Virtual Service.

8.4.1.6.1 UAG2 TCP Blast - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

10243

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

tcp

Checkport

443

8.4.1.7 Configure UAG2 UDP Blast - Multi-Port Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG2 UDP Blast - Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Update the Real Server Port to 8443.

7. Click Add This Real Server.

UAG2 should be the only Real Server added to this Virtual Service.

8.4.1.7.1 UAG2 UDP Blast - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

10243

prot

udp

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

icmp

8.4.1.8 Configure UAG2 TCP PCoIP - Multi-Port Affinity Virtual Service

.Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG2 TCP PCoIP - Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Update the Real Server Port to 4172.

7. Click Add This Real Server.

UAG2 should be the only Real Server added to this Virtual Service.

8.4.1.8.1 UAG2 TCP PCoIP - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

10272

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

tcp

Checkport

4172

8.4.1.9 Configure UAG2 UDP PCoIP - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAGLB UDP PCoIP - Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Update the Real Server Port to 4172.

7. Click Add This Real Server.

UAG2 should be the only Real Server added to this Virtual Service.

8.4.1.9.1 UAG2 UDP PCoIP - Multi-Port Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

10272

prot

udp

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

icmp

8.4.2 Example LoadMaster Configuration - Multiple Port Affinity

image2.png

 

8.4.3 Duplicate Virtual Service (Optional)

To support additional UAG appliances, the Blast and PCoIP Virtual Services must be created for each. This section provides the necessary steps to add the UAG server to the configuration.

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG2 TCP Blast - Multi-Port Affinity Virtual Service.

image3.png

3. Click Duplicate VIP.

image4.png

4. Keep the same Virtual Address and change the port to 10343.

5. Click Duplicate VIP.

6. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

7. Click Modify on the UAG2 TCP Blast - Multi-Port Affinity [1] Virtual Service.

8. Modify the Service Name (for example, UAG3 TCP Blast - Multi-Port Affinity)

9. Expand the Real Servers section.

10. Click Delete to remove the Real Server listed.

11. Click OK on remove Real Server confirmation.

12. Click Add New.

13. Type the Real Server Address.

14. Confirm that port 443 is entered.

15. Click Add This Real Server.

UAG3 should be the only Real Server added to this Virtual Service.

16. Repeat the above steps for:

Virtual Service to Duplicate New Virtual Service Port Real Server Port
UAG2 UDP Blast - Multi-Port Affinity 10343 8443
UAG2 TCP PCoIP - Multi-Port Affinity 10372 1072
UAG2 UDP PCoIP - Multi-Port Affinity 10372 1072

The same port mapping scheme can be used for additional Unified Access Gateway appliances, 103xx - 199xx.

8.5 Multiple VIP Affinity UAG Configuration (Method 3)

The following is an example of a Unified Access Gateway configuration to support Multiple VIP Affinity. Each configuration is set with a unique IP address to direct clients to the correct UAG node.

  • The URL (Horizon-int.kempdemo.com) in this example points to the internal LoadMaster (10.10.10.103) publishing Connection Servers as configured in Create the Connection Server Virtual Services.
  • The URL (Horizon.kempdemo.com) in this example points to the IP address (10.10.10.154) of the external LoadMaster publishing the UAG Servers.
  • The IP address (10.10.10.156) in this example would be the public IP address of the external LoadMaster publishing UAG1.
  • The IP address (10.10.10.157) in this example would be the public IP address of the external LoadMaster publishing UAG2.

This method uses port TCP 443 for Blast. The Virtual Service can be updated to support TCP 8443 should the environment require that configuration.

image5.png

8.6 Multiple VIP Affinity Virtual Services (Method 3)

This step-by-step setup of VSs leverages the Kemp application template for UAG - Multiple VIP Affinity.

Each template configuration can only support a single VIP. Because this method leverages multiple VIPs, two templates must be used.

The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster Application Programming Interface (API) and automation tools.

8.6.1 Create the UAG Multiple VIP Affinity HTTPS Virtual Service

The following are the steps involved and the recommended settings to configure the VMware UAG Multi-VIP Affinity Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image6.png

2. Type a valid Virtual Address.

3. Select the UAGLB HTTPS Multi-VIP Affinity template from the Use Template drop-down list.

4. Click Add this Virtual Service.

8.6.1.1 Configure UAGLB TCP HTTPS - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

image7.png

2. Click Modify on the UAGLB TCP HTTPS -Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 443 is entered.

7. Click Add This Real Server.

8. Repeat this step to add more Real Servers as needed.

This Virtual Service will be the only one with multiple Real Servers.

8.6.1.1.1 UAGLB TCP HTTPS - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

443

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

https

Checkurl

/favicon.ico

CheckUseGet

0

CheckPort 443

8.6.2 Create the UAG1 Multiple VIP Affinity Blast and PCoIP Virtual Service

The following are the steps involved and the recommended settings to configure the VMware UAG Multi-VIP Affinity Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image9.png

2. Type a valid Virtual Address.

3. Select the UAGLB PCoIP and Blast Multi-VIP Affinity template in the Use Template drop-down list.

image10.png

4. Replace the Service Name with unique label to prevent duplicate Virtual Service names (for example, UAG1).

If you skip renaming the Virtual Service, the Virtual Service creation for the remaining UAG applications later in this guide will fail.

5. Click Add this Virtual Service.

8.6.2.1 Configure UAG1 TCP Blast - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

image11.png

2. Click Modify on the UAG1 TCP Blast -Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 443 is entered.

7. Click Add This Real Server.

UAG1 should be the only Real Server added to this Virtual Service.

8.6.2.1.1 UAG1 TCP Blast - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

443

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

tcp

Checkport

443

8.6.2.2 Configure UAG1 UDP Blast - Multi-VIP Affinity

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the on UAG1 UDP Blast - Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 8443 is entered.

7. Click Add This Real Server.

UAG1 should be the only Real Server added to this Virtual Service.

8.6.2.2.1 UAG1 UDP Blast - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

8443

prot

udp

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

icmp

8.6.2.3 Configure UAG1 TCP PCoIP - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG1 TCP PCoIP - Multi-Port Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 4172 is entered.

7. Click Add This Real Server.

UAG1 should be the only Real Server added to this Virtual Service.

8.6.2.3.1 UAG1 TCP PCoIP - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

4172

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

tcp

Checkport

4172

8.6.2.4 Configure UAG1 UDP PCoIP - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG1 UDP PCoIP -Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 4172 is entered.

7. Click Add This Real Server.

UAG1 should be the only Real Server added to this Virtual Service.

8.6.2.4.1 UAG1 UDP PCoIP - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

4172

prot

udp

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

icmp

8.6.3 Create the UAG2 Multiple VIP Affinity Blast and PCoIP Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

CreateTheUAG2MultipleVIPAffinityBlast.png

2. Type a valid Virtual Address.

3. Select the UAGLB PCoIP and Blast Multi-VIP Affinity template in the Use Template drop-down list.

CreateTheUAG2MultipleVIPAffinityBlast-2.png

4. Replace the Service Name with a unique label to prevent duplicate Virtual Service names (for example, UAG2).

5. Click Add this Virtual Service.

If the Virtual Service creation fails, it is possible that you skipped the step to rename the Virtual Service and therefore there is a name duplication error thrown.

8.6.3.1 Configure UAG2 TCP Blast - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG2 TCP Blast -Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 443 is entered.

7. Click Add This Real Server.

UAG2 should be the only Real Server added to this Virtual Service.

8.6.3.1.1 UAG2 TCP Blast - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

443

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

tcp

Checkport

443

8.6.3.2 Configure UAG2 UDP Blast - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG2 TCP Blast -Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 8443 is entered.

7. Click Add This Real Server.

UAG2 should be the only Real Server added to this Virtual Service.

8.6.3.2.1 UAG2 UDP Blast - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

8443

prot

udp

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

icmp

8.6.3.3 Configure UAG2 TCP PCoIP - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAG2 TCP PCoIP - Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Confirm that port 4172 is entered.

7. Click Add This Real Server.

UAG2 should be the only Real Server added to this Virtual Service.

8.6.3.3.1 UAG2 TCP PCoIP - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

4172

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

tcp

Checkport

4172

8.6.3.4 Configure UAG2 UDP PCoIP - Multi-VIP Affinity Virtual Service

Follow the steps below to configure this Virtual Service:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.

2. Click Modify on the UAGLB UDP PCoIP - Multi-VIP Affinity Virtual Service.

3. Expand the Real Servers section.

4. Click Add New.

5. Type the Real Server Address.

6. Update the Real Server Port to 4172.

7. Click Add This Real Server.

UAG2 should be the only Real Server added to this Virtual Service.

8.6.3.4.1 UAG2 UDP PCoIP - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

4172

prot

udp

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

CheckType

icmp

8.6.4 Example LoadMaster Configuration - Multiple VIP Affinity

image14.png

Additional UAG appliances can be added to the configuration by using the Blast and PCoIP template. You must use a unique Virtual Service IPaddress and name.

 

9 App Volume Manager

The App Volume Manager is a console for managing configuration, creation of AppStacks, and assignment of AppStacks and writable volumes.

This step-by-step setup of VSs leverages the Kemp application template for Horizon 7.

The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster Application Programming Interface (API) and automation tools.

SSL/TLS certificates should be added before creating this VS. For further information on certificates, refer to the SSL Accelerated Services Feature Description.

 

9.1 Create the App Volume Manager Virtual Services

The following are the steps involved and the recommended settings to configure the VMware App Volume Manager Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

CreateTheAppVolumeManagerVS.png

2. Type a valid Virtual Address.

3. Select the VMware App Volume Manager template in the Use Template drop-down list.

4. Click Add this Virtual Service.

5. In the left-hand navigation select View/Modify Services.

CreateTheAppVolumeManagerVS-2.png

6. Click Modify on the Virtual Service on TCP port 443.

7. Expand the SSL Properties section.

8. Select the certificate to use from Available Certificates and click the arrow (>) to move it to Assigned Certificates.

9. Expand the Real Servers section.

10. Click Add New.

11. Type the Real Server Address.

12. Confirm that port 443 is entered.

13. Click Add This Real Server.

14. Repeat this step to add more Real Servers as needed.

 

9.1.1 App Volume Manager Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

443

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

Persist

src

PersistTimeout

3600

CheckType

https

Checkurl

/

CheckUseGet

1

9.1.2 App Volume Manager Redirect Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

80

prot tcp
VStype http
Forcel7 1
Transparent 0
ErrorCode 302
ErrorUrl https://%h%s
CheckType None

10 Identity Manager

The VMware Identity Manager provides several functions in relation to the Horizon 7 implementation such as a portal where users gain access to different types of applications including SaaS-based, enterprise identity management to sync and extend Active Directory, and single sign on. There is also a self-service app store that enables users to search and select applications in a simple way.

This step-by-step setup of VSs leverages the Kemp application template for Horizon 7.

The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster Application Programming Interface (API) and automation tools.

SSL/TLS certificates should be added before creating this VS. For further information on certificates, refer to the SSL Accelerated Services Feature Description.

 

10.1 Create the Identity Manager Virtual Services

The following are the steps involved and the recommended settings to configure the VMware Connection Server Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image25.png

2. Type a valid Virtual Address.

3. Select the VMware Identity Manager template from the Use Template drop-down list.

4. Click Add this Virtual Service.

5. In the left-hand navigation select View/Modify Services.

CreateIdentityManagerVSs.png

6. Click Modify on the Virtual Service on TCP port 443.

7. Expand the SSL Properties section.

8. Select the certificate to use from Available Certificates and click the arrow (>) to move it to Assigned Certificates.

9. Expand the Real Servers section.

10. Click Add New.

11. Type the Real Server Address.

12. Confirm that port 443 is entered.

13. Click Add This Real Server.

14. Repeat this step to add more Real Servers as needed.

10.1.1 Identity Manager Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter

API Value

port

443

prot

tcp

VStype

http

SubnetOriginating

1

Forcel7

1

Transparent

0

Schedule

lc

Persist

src

PersistTimeout

3600

CheckType

https

Checkurl

/

CheckUseGet

1

10.1.2 Identity Manager Redirect Virtual Service Recommended API Settings (optional)

This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.

API Parameter API Value
port

80

prot tcp
VStype http
Forcel7 1
Transparent 0
ErrorCode 302
ErrorUrl https://%h%s
CheckType None

Last Updated Date

This document was last updated on 16 October 2020.

Was this article helpful?

0 out of 0 found this helpful

Comments

Avatar
t.aitken

Firstly,

Section 7.1.1 needs a slight update to include "/favicon.ico" instead of "/" - otherwise the kemp device is unaware of the enabled status of the gateway. It needs updating in the template. This is detailed in the VMware documentation at https://kb.vmware.com/s/article/56636

Second,
This article is really (really) difficult to read - it would be worth splitting each different UAG deployment scenario in to a separate page to avoid future confusion.

Avatar
Kemp Knowledge Team

Hi,

Thank you for your feedback. We will discuss your suggestions internally and see if there is a better way to structure this documentation.

Thanks,
Lisa