VMware Horizon View 7

1 Introduction

VMware Horizon View is a virtual desktop infrastructure (VDI) solution that simplifies administration and delivery of personalized virtual desktops. It consists of several components and delivers a secure optimized virtual desktop infrastructure.

This deployment guide focuses on the load balancing requirements for the Horizon View and Horizon Air Hybrid-Mode use cases. It discusses the distinction between the primary and secondary Horizon protocols and describes the three methods for guaranteeing session affinity. The three methods ensure that all protocol traffic from a Horizon client session goes to the same Unified Access Gateway appliance. This article also covers health monitoring and SSL offload/SSL bridging for load balancers.

Unified Access Gateway (Access Point) is a Unified Gateway from VMware that comes in virtual appliance format and is designed to protect desktop and application resources to enable remote access from the internet. Access Point is the default gateway for the following products:

VMware Horizon View

VMware Horizon Air (DaaS)

VMware Horizon Air Hybrid-Mode

VMware Identity Manager

Airwatch Tunnel Gateway/Proxy

Connection Servers are the core component of VMware Horizon View. This role defines virtual desktop pools, applications and permissions.

App Volume Manager is a console for managing configuration, creation of AppStacks and assignment of AppStacks and writable volumes.

The KEMP LoadMaster is used to load balance the VMware Unified Access Gateway, Connection Servers, and App Volume Manager. The LoadMaster offers advanced Layer 4 and Layer 7 server load balancing, SSL Acceleration and a multitude of other advanced Application Delivery Controller (ADC) features. The LoadMaster intelligently and efficiently distributes user traffic among the application servers so that users get the best experience possible.

This document provides guidance and recommended settings on how to load balance Horizon View 7 with a KEMP LoadMaster. The KEMP Support Team is available to provide solutions for scenarios not explicitly defined.

The KEMP support site can be found at: https://support.kemptechnologies.com.

1.1 Document Purpose

This document provides the recommended LoadMaster settings used when load balancing the VMware Horizon View and Horizon Air Hybrid-Mode use cases using the Unified Access Gateway. The KEMP Support Team is available to provide solutions for scenarios not explicitly defined. The KEMP support site can be found at: https://support.kemptechnologies.com.

1.2 Intended Audience

This document is intended to be read by anyone who is interested in configuring the LoadMaster to optimize VMware Horizon workload.

1.3 About this Document

This document was written with help from Mark Benson and Vish Kalsi of VMware. Some of the content in this document is based on the following VMware document: https://communities.vmware.com/docs/DOC-32792

2 Template

KEMP has developed a template containing our recommended settings for this workload. You can install this template to help when creating Virtual Services, as it automatically populates the settings. This is quicker and easier than manually configuring each Virtual Service. If needed, changes can be made to any of the Virtual Service settings after using the template.

Download released templates from the Templates section on the KEMP documentation page: http://kemptechnologies.com/documentation.

For more information and steps on how to import and use templates, refer to the Virtual Services and Templates, Feature Description on the KEMP Documentation Page.

For steps on how to manually add and configure each of the Virtual Services using the recommended settings, refer to the steps in this document.

3 Architecture

Unified Access Gateway is typically deployed in a DMZ. For high availability and scalability requirements in a production deployment, several Unified Access Gateway appliances are usually set up behind a load balancer as shown in Figure 3-1. The LoadMaster is deployed in-line as a proxy for all services including PCoIP. Alternative deployment options could have the secondary Horizon protocols bypass the LoadMaster as it is only the initial session establishment (HTTPS) that can be load balanced.

image31.png

4 Horizon Protocols

When a Horizon Client user connects to a Horizon environment, several different protocols are used. The first connection is always the primary XML-API protocol over HTTPS. Following successful authentication, one or more secondary protocols are also made.

4.1 Primary Horizon Protocol

The user enters a hostname at the Horizon Client and this starts the primary Horizon protocol. This is a control protocol for authentication, authorization and session management. It uses XML-structured messages over HTTPS (HTTP over SSL). This protocol is sometimes known as the Horizon XML-API control protocol. In a load-balanced environment as shown in the Architecture section, the load balancer routes this connection to one of the Unified Access Gateway appliances. The load balancer usually selects the appliance based first on availability, and then out of the available appliances will route traffic based on the least number of current sessions. This has the effect of evenly distributing the traffic from different clients across the available set of Unified Access Gateway appliances.

4.2 Secondary Horizon Protocols

After the Horizon Client has established a secure communication to one of the Unified Access Gateway appliances, the user authenticates. If this authentication attempt is successful, then one or more secondary connections are made from the Horizon client. These secondary connections can include:

HTTPS Tunnel used for encapsulating TCP protocols such as RDP, MMR/CDR and the client framework channel (TCP 443).

Blast Extreme display protocol (TCP 8443 and UDP 8443).

PCoIP display protocol (TCP 4172 and UDP 4172).

These secondary Horizon protocols must be routed to the same Unified Access Gateway appliance to which the primary Horizon protocol is routed. This is so that Unified Access Gateway can authorize the secondary protocols based on the authenticated user session. An important security capability of Unified Access Gateway is that it will only forward traffic into the corporate datacenter if the traffic is on behalf of an authenticated user. If the secondary protocols were to be misrouted to a different Unified Access Gateway appliance to the primary protocol one, they would not be authorized and would therefore be dropped in the DMZ and the connection would fail. Misrouting the secondary protocols is a common problem if the Load Balancer is not configured correctly.

5 Configure the LoadMaster

The deployed VMware Unified Access Gateway environment determines which of the following setups is used.

5.1 Enable Subnet Originating Requests Globally

It is best practice to enable the Subnet Originating Requests option globally.

In a one-armed setup (where the Virtual Service and Real Servers are on the same network/subnet) Subnet Originating Requests is usually not needed. However, enabling Subnet Originating Requests should not affect the routing in a one-armed setup.

In a two-armed setup where the Virtual Service is on network/subnet A, for example, and the Real Servers are on network B - Subnet Originating Requests should be enabled on LoadMasters with firmware version 7.1-16 and above.

When Subnet Originating Requests is enabled, the LoadMaster will route traffic so that the Real Server will see traffic arriving from the LoadMaster interface that is in that network/subnet not the Virtual Service address.

When Subnet Originating Requests is enabled globally, it is automatically enabled on all Virtual Services. If the Subnet Originating Requests option is disabled globally, you can choose whether or not to enable Subnet Originating Requests on a per-Virtual Service basis.

To enable Subnet Originating Requests globally, follow the steps below:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to System Configuration > Miscellaneous Options > Network Options.

2. Tick the Subnet Originating Requests check box.

5.2 Enable Check Persist Globally

It is recommended that you change the Always Check Persist option to Yes – Accept Changes. Use the following steps:

1. Go to System Configuration > Miscellaneous Options > L7 Configuration.

SCMOLC001.png

2. Click the Always Check Persist dropdown arrow and select Yes – Accept Changes.

6 Unified Access Gateway Session Affinity Options

There are three main configuration options for session affinity. These are:

Source IP Affinity

Multiple Port Number Groups

Multiple VIPs

6.1 Method 1 - Source IP Affinity

Method 1 is recommended for all environments where source IP address affinity is possible. Where it is not possible, then either method 2 or method 3 should be used.

Method 1 is the simplest configuration for a load balancer because it uses standard port numbers and a single load balanced VIP. It relies on the load balancer to route secondary protocols to the same Unified Access Gateway appliance as was selected for the primary Horizon protocol. It does this on the basis of repeat connections coming from the same Horizon client IP address. Unfortunately, this method does not work in all situations. For example, with certain Network Service Providers or NAT devices, the source IP address is not available for this affinity configuration. If source IP affinity cannot be used in your environment, then one of the other two methods should be used as they do not rely on source IP affinity.

Unified Access Gateway Configuration for External URLs for this configuration is shown in the following table.

In our example, the Fully Qualified Domain Name (FQDN) http://ap.myco.com resolves to 10.1.160.35.

Unified Access Gateway Appliance Configuration Item Value

AP01

tunnelExternalURL

https://ap.myco.com:443

AP01

blastExternalURL

https://ap.myco.com:443

AP01

pcoipExternalURL

10.1.160.35:4172

AP02

tunnelExternalURL

https://ap.myco.com:443

AP02

blastExternalURL

https://ap.myco.com:443

AP02

pcoipExternalURL

10.1.160.35:4172

Advantages of Source IP Affinity

Uses standard port numbers

Does not require multiple public virtual IP addresses

Disadvantages of Source IP Affinity

Relies on source IP address affinity, which is not always possible.

6.1.1 Create the VMware Unified Access Gateway Source IP Affinity Virtual Services

The following sections describe the recommended settings for the VMware Unified Access Gateway Source IP Affinity Virtual Services.

6.1.1.1 Create a UAGLB TCP HTTPS Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the UAGLB TCP HTTPS Affinity Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image1.png

2. Type a valid Virtual Address.

3. Type 443 as the Port.

4. Enter a recognizable Service Name, such as UAGLB TCP HTTPS - Affinity.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value Comment

Standard Options

Persistence Mode

Source IP Address

 

 

Timeout

1 hour

 

 

Scheduling Method

least connection

 

Advanced Properties

Add a Port 80 Redirector VS

 

Click the Add HTTP Redirector button. This automatically creates a redirect on port 80.

Real Servers

Real Server Check Method

HTTPS Protocol

 

 

URL

/favicon.ico

 

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Complete the other fields as required.

e) Click Add this Real Server then click OK to the pop-up message.

f) Repeat the steps above to add more Real Servers as needed, based on your environment.

Create an APLB TCP-IP Affinity HTTPS HTTP Redirect Virtual Service

Clicking the Add HTTP Redirector button automatically creates a port 80 redirect Virtual Service. This is optional, but the purpose of this Virtual Service is to redirect any clients who have connected using HTTP to the HTTPS Virtual Service.

6.1.1.2 Create a UAGLB TCP Blast Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the UAGLB TCP Blast Affinity Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image.png

2. Type a valid Virtual Address.

3. Type 8443 as the Port.

4. Enter a recognizable Service Name, such as UAGLB TCP Blast Affinity.

5. Select tcp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Persistence Mode

Source IP Address

 

Timeout

1 hour

 

Scheduling Method

least connection

Real Servers

Real Server Check Method

TCP Connection Only

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Complete the other fields as required.

e) Click Add this Real Server then click OK to the pop-up message.

f) Repeat the steps above to add more Real Servers as needed, based on your environment.

6.1.1.3 Create a UAGLB UDP Blast Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the UAGLB UDP Blast Affinity Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image4.png

2. Type a valid Virtual Address.

3. Type 8443 as the Port.

4. Enter a recognizable Service Name, such as UAGLB UDP Blast Affinity.

5. Select udp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

 

Persistence Mode

Source IP Address

  Timeout 1 hour

 

Scheduling Method

least connection

Advanced Properties

Port Following

tcp/10.0.3.4:443

Real Servers

Real Server Check Method

ICMP Ping

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Complete the other fields as required.

e) Click Add this Real Server then click OK to the pop-up message.

f) Repeat the steps above to add more Real Servers as needed, based on your environment.

6.1.1.4 Create a UAGLB TCP PCoIP Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the UAGLB TCP PCoIP Affinity Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image5.png

2. Type a valid Virtual Address.

3. Type 4172 as the Port.

4. Enter a recognizable Service Name, such as UAGLB TCP PCoIP Affinity.

5. Select tcp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Persistence Mode

Source IP Address

 

Timeout

1 hour

  Scheduling Method least connection

Real Servers

Real Server Check Method

TCP Connection Only

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Complete the other fields as required.

e) Click Add this Real Server then click OK to the pop-up message.

f) Repeat the steps above to add more Real Servers as needed, based on your environment.

6.1.1.5 Create a UAGLB UDP PCoIP Affinity Virtual Service

The following are the steps involved and the recommended settings to configure the UAGLB UDP PCoIP Affinity Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image7.png

2. Type a valid Virtual Address.

3. Type 4172 as the Port.

4. Enter a recognizable Service Name, such as APLB UDP PCoIP Affinity.

5. Select udp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

 

Persistence Mode

Source IP Address

  Timeout 1 Hour
Advanced Properties Port Following tcp/10.0.3.4:443

Real Servers

Real Server Check Method

ICMP Ping

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Complete the other fields as required.

e) Click Add this Real Server then click OK to the pop-up message.

f) Repeat the steps above to add more Real Servers as needed, based on your environment.

6.2 Method 2 - Multiple Port Number Groups

Multiple port group affinity does not rely on source IP address for affinity. Instead, the load balancer is configured to route the secondary Horizon protocols based on a group of unique port numbers assigned to each Unified Access Gateway appliance. The primary Horizon protocol on HTTPS port 443 is load balanced to allocate the session to a specific Unified Access Gateway appliance based on health and least loaded. The secondary connections are then routed to the correct Unified Access Gateway appliance based on the following Load Balancer configuration table.

Virtual IP Address Primary/Secondary Protocol Name Real Servers

10.1.160.31:443

Primary

TCP

UAGLB - HTTPS

10.1.160.183:443

10.1.160.184:443

10.1.160.31:10143

Secondary

TCP

UAG01 - BLAST-TCP

10.1.160.183:10143

10.1.160.31:10143

Secondary

UDP

UAG01 - BLAST-UDP

10.1.160.183:10143

10.1.160.31:10172

Secondary

TCP

UAG01 - PCOIP

10.1.160.183:10172

10.1.160.31:10172

Secondary

UDP

UAG01 - PCOIP-UDP

10.1.160.183:10172

10.1.160.31:10243

Secondary

TCP

UAG02 - BLAST-TCP

10.1.160.184:10243

10.1.160.31:10243

Secondary

UDP

UAG02 - BLAST-UDP

10.1.160.184:10243

10.1.160.31:10272

Secondary

TCP

UAG02 - PCOIP

10.1.160.184:10272

10.1.160.31:10272

Secondary

UDP

UAG02 - PCOIP-UDP

10.1.160.184:10272

The same port mapping scheme can be used for additional Unified Access Gateway appliances 03 > 99. For example, we use the following mapping convention in this document for Unified Access Gateway:

BLAST-TCP

10143 → UAG01 10143

10172 → UAG01 10172

10243 → UAG02 10243

10272 → UAG02 10272

The same convention is used for multiple Unified Access Gateways

10343 → UAG03 10343

10372 → UAG03 10372

The Unified Access Gateway Configuration for External URLs is shown below.

In our example, the FQDN http://uag.myco.com resolves to 10.1.160.31.

Unified Access Gateway Appliance Configuration Item Value

UAG01

tunnelExternalURL

https://uag.myco.com:443

UAG01

blastExternalURL

https://uag.myco.com:10143

UAG01

pcoipExternalURL

10.1.60.31:10172

UAG02

tunnelExternalURL

https://uag.myco.com:443

UAG02

blastExternalURL

https://uag.myco.com:10243

UAG02

pcoipExternalURL

10.1.60.31:10272

Advantages of Multiple Port Number Groups

Does not rely on source IP affinity

Does not require multiple public virtual IP addresses

Disadvantages of Multiple Port Number Groups

Uses non-standard port numbers from the Internet although the port numbers on the Unified Access Gateway appliances themselves are standard.

6.2.1 Create the VMware Unified Access Gateway Multiple Port Number Groups Virtual Services

The following sections describe the recommended settings for the VMware Unified Access Gateway Multiple Port Number Groups Virtual Services.

6.2.1.1 Create a UAGLB – HTTPS Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the UAGLB – HTTPS Multiple Ports Virtual Service:

In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.image8.png

1. Type a valid Virtual Address.

2. Type 443 as the Port.

3. Enter a recognizable Service Name, such as UAGLB – HTTPS Multiple Ports.

4. Click Add this Virtual Service.

5. Configure the settings as recommended in the following table:

Section Option Value Comment

Advanced Properties

Add a Port 80 Redirector VS

 

Click the Add HTTP Redirector button. This automatically creates a redirect on port 80.

Standard Options

Persistence Mode

SSL Session ID

 

 

Timeout

1 hour

 

 

Scheduling Method

least connection

 

Real Servers

Real Server Check Method

HTTPS Protocol

 

 

URL

/favicon.ico

 

6. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 443 as the Port number.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

g) Repeat the steps above to add more Real Servers as needed, based on your environment.

Create a UAGLB – HTTPS Multiple Ports HTTPS HTTP Redirect Virtual Service

Clicking the Add HTTP Redirector button automatically creates a port 80 redirect Virtual Service. This is optional, but the purpose of this Virtual Service is to redirect any clients who have connected using HTTP to the HTTPS Virtual Service.

6.2.1.2 Create a UAG01 TCP - Blast Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the UAG01 – TCP Blast Multiple Ports Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image9.png

2. Type a valid Virtual Address.

3. Type 10143 as the Port.

4. Enter a recognizable Service Name, such as UAG01 – TCP – Blast Multiple Ports.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Basic Properties

Service Type

Generic

Standard Options

Persistence Mode

SSL Session ID

 

Timeout

1 hour

 

Scheduling Method

least connection

Real Servers

Real Server Check Method

TCP Connection Only

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 10143 as the Port number.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

6.2.1.3 Create a UAG01 – UDP - Blast Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the UAG01 - UDP - Blast Multiple Ports Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image10.png

2. Type a valid Virtual Address.

3. Type 10143 as the Port.

4. Enter a recognizable Service Name, such as UAG01 – UDP Blast Multiple Ports.

5. Select udp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 10143 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

6.2.1.4 Create a UAG01 – TCP - PCoIP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the UAG01 – TCP - PCoIP Multiple Ports Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image12.png

2. Type a valid Virtual Address.

3. Type 10172 as the Port.

4. Enter a recognizable Service Name, such as UAG01 - TCP-PCoIP Multiple Ports.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Basic Properties

Service Type

Generic

Standard Options Persistence Mode SSL Session ID
  Timeout 1 hour
  Scheduling Method least connection

Real Servers

Real Server Check Method

TCP Connection Only

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 10172 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

6.2.1.5 Create a UAG01 – UDP - PCoIP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the UAG01-UDP-PCoIP Multiple Ports Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image13.png

2. Type a valid Virtual Address.

3. Type 10172 as the Port.

4. Enter a recognizable Service Name, such as UAG01 – UDP-PCoIP Multiple Port.

5. Select udp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 10172 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

6.2.1.6 Create a UAG02 - TCP - Blast Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the UAG02 - TCP - Blast Multiple Ports Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image14.png

2. Type a valid Virtual Address.

3. Type 10243 as the Port.

4. Enter a recognizable Service Name, such as UAG02 - TCP - Blast Multiple Port.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Basic Properties

Service Type

Generic

Standard Options

Persistence Mode

SSL Session ID

 

 

Timeout

 

1 hour

  Scheduling Method least connection

Real Servers

Real Server Check Method

TCP Connection Only

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 10243 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

6.2.1.7 Create a UAG02 – UDP - Blast Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – Blast Extreme-UDP Multiple Ports Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image15.png

2. Type a valid Virtual Address.

3. Type 10243 as the Port.

4. Enter a recognizable Service Name, such as UAG02 - UDP - Blast Multiple Port.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

HTTPS Protocol

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 10243 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

6.2.1.8 Create a UAG02 – TCP - PCoIP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the UAG02 - TCP - PCoIP Multiple Ports Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image16.png

2. Type a valid Virtual Address.

3. Type 10272 as the Port.

4. Enter a recognizable Service Name, such as UAG02 - TCP - PCoIP Multiple Port.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Basic Properties

Service Type

Generic

Standard Options

Persistence Mode

SSL Session IDn

  Timeout 1 hour
  Scheduling Method least connection

Real Servers

Real Server Check Method

TCP Connection Only

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 10272 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

6.2.1.9 Create a UAG02 - UDP - PCoIP Multiple Ports Virtual Service

The following are the steps involved and the recommended settings to configure the UAG02 - UDP - PCoIP Multiple Ports Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image17.png

2. Type a valid Virtual Address.

3. Type 10272 as the Port.

4. Enter a recognizable Service Name, such as UAG02 - UDP - PCoIP Multiple Ports.

5. Select udp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 10272 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

7 Method 3 - Multiple VIPs

This method is similar to the multiple port groups method except instead of dedicating a group of port numbers to each Unified Access Gateway appliance, it dedicates an individual VIP to each appliance in addition to the primary load balanced VIP. If you have two Unified Access Gateway appliances, then you would set up three VIPs. The primary Horizon protocol on HTTPS port 443 is load balanced to allocate the session to a specific Unified Access Gateway appliance based on health and least loaded. The secondary connections are then routed to the correct Unified Access Gateway appliance based on the following Load Balancer configuration table.

Unified Access Gateway Configurations for External URLs for this configuration are shown in the following table.HERE

Virtual IP Address Primary/Secondary Protocol Name Real Servers

10.1.160.32:443

Primary

TCP

UAGLB - HTTPS

10.1.160.186:443

10.1.160.187:443

10.1.160.33:443

Secondary

TCP

UAG01 - HTTPS BLAST

10.1.160.186:8443

10.1.160.33:443

Secondary

UDP

UAG01 - BLAST-UDP

10.1.160.186:8443

10.1.160.33:4172

Secondary

TCP

UAG01 - PCOIP

10.1.160.186:4172

10.1.160.33:4172

Secondary

UDP

UAG01 - PCOIP-UDP

10.1.160.186:4172

10.1.160.34:443

Secondary

TCP

UAG02 - BLAST

10.1.160.187:8443

10.1.160.34:443

Secondary

UDP

UAG02 - BLAST-UDP

10.1.160.187:8443

10.1.160.34:4172

Secondary

TCP

UAG02 - PCOIP

10.1.160.187:4172

10.1.160.34:4172

Secondary

UDP

UAG02 - PCOIP-UDP

10.1.160.187:4172

In our example, the FQDN http://ap1.myco.com resolves to 10.1.160.33 and https://ap2.myco.com:4172 resolves to 10.1.160.34

Unified Access Gateway Appliance Configuration Item Value

UAG01

tunnelExternalURL

https://uag1.myco.com:443

UAG01

blastExternalURL

https://uag1.myco.com:8443

UAG01

pcoipExternalURL

10.20.30.33:4172

UAG02

tunnelExternalURL

https://uag2.myco.com:443

UAG02

blastExternalURL

https://uag2.myco.com:8443

UAG02

pcoipExternalURL

10.20.30.34:4172

Advantages of multiple VIPs

    Do not rely on source IP affinity

    Uses standard port numbers

Disadvantages of multiple VIPs

Requires an additional public facing VIP for each Unified Access Gateway appliance in addition to the primary load balanced VIP.

7.1 Create the Multiple VIPs Virtual Services

The following sections describe the recommended settings for the VMware Unified Access Gateway Multiple VIPs Virtual Services.

7.1.1 Create an HTTPS-UAGLB Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the HTTPS-UAGLB Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image32.png

2. Type a valid Virtual Address.

3. Type 443 as the Port.

4. Enter a recognizable Service Name, such as UAG-HTTPS Multiple VIPs.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value Comment

Advanced Properties

Add a Port 80 Redirector VS

 

Click the Add HTTP Redirector button. This automatically creates a redirect on port 80.

Basic Properties

Service Type

Generic

 

Standard Options

Persistence Mode

SSL Session ID

 

 

Timeout

6 minutes

 

 

Scheduling Method

least connection

 

Real Servers

Real Server Check Method

HTTPS Protocol

 

 

URL

/favicon.ico

 

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 443 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

g) Repeat the steps above to add more Real Servers as needed, based on your environment.

Create a HTTPS - UAG Multiple Ports HTTPS HTTP Redirect Virtual Service

Clicking the Add HTTP Redirector button automatically creates a port 80 redirect Virtual Service. This is optional, but the purpose of this Virtual Service is to redirect any clients who have connected using HTTP to the HTTPS Virtual Service.

7.1.2 Create a UAG01 TCP Blast-UDP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the UAG01 - TCP Blast Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image19.png

2. Type a valid Virtual Address.

3. Type 8443 as the Port.

4. Enter a recognizable Service Name, such as UAG01 – TCP Blast Multiple VIP.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Basic Properties

Service Type

Generic

Standard Options Persistence Mode SSL Session ID
  Timeout 1 hour
  Scheduling Method least connection

Real Servers

Real Server Check Method

TCP Connection Only

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 8443 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

7.1.3 Create a UAG01 – UDP Blast Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the UAG01 - UDP Blast Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image20.png

2. Type a valid Virtual Address.

3. Type 8443 as the Port.

4. Enter a recognizable Service Name, such as UAG01 - UDP Blast Multiple VIPs.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 8443 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

7.1.4 Create a UAG01 - TCP - PCoIP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the UAG01 - TCP - PCoIP Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image21.png

2. Type a valid Virtual Address.

3. Type 4172 as the Port.

4. Enter a recognizable Service Name, such as UAG01 - TCP - PCoIP Multiple VIPs.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Basic Properties

Service Type

Generic

Standard Options Persistence Mode SSL Session ID
  Timeout 1 hour
  Scheduling Method least connection

Real Servers

Real Server Check Method

TCP Connection Only

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 4172 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

7.1.5 Create a UAG01 - UDP - PCoIP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the UAG01 - UDP - PCoIP Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image22.png

2. Type a valid Virtual Address.

3. Type 4172 as the Port.

4. Enter a recognizable Service Name, such as AG01 - UDP - PCoIP Multiple VIP.

5. Select udp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 4172 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

7.1.6 Create a UAG - TCP - Blast Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the UAG02 – TCP - Blast Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image23.png

2. Type a valid Virtual Address.

3. Type 8443 as the Port.

4. Enter a recognizable Service Name, such as UAG02 – TCP - Blast Multiple VIPs.

5. Select tcp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Basic Properties

Service Type

Generic

Standard Options Persistence Mode SSL Session ID
  Timeout 1 hour
  Scheduling Method least connection

Real Servers

Real Server Check Method

TCP Connection Only

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 8443 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

g) Repeat the steps above to add more Real Servers as needed, based on your environment.

7.1.7 Create a UAG02 – UDP - Blast Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the UAG02 - UDP - Blast Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image24.png

2. Type a valid Virtual Address.

3. Type 8443 as the Port.

4. Enter a recognizable Service Name, such as UAG02 – UDP – Blast Multiple VIP.

5. Select udp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 8443 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

7.1.8 Create a UAG02 – TCP - PCoIP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the UAG02 – TCP - PCoIP Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image26.png

2. Type a valid Virtual Address.

3. Type 4172 as the Port.

4. Enter a recognizable Service Name, such as UAG02 - TCP - PCoIP Multiple VIP.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value

Basic Properties

Service Type

Generic

Standard Options

Persistence Mode

SSL Session ID

  Timeout 1 hour  
  Scheduling Method least connection  

Real Servers

Real Server Check Method

TCP Connection Only

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 4172 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

7.1.9 Create a UAG02 – UDP- PCoIP Multiple VIPs Virtual Service

The following are the steps involved and the recommended settings to configure the AP02 – PCoIP-UDP Multiple VIPs Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image27.png

2. Type a valid Virtual Address.

3. Type 4172 as the Port.

4. Enter a recognizable Service Name, such as UAG02 – UDP - PCoIP Multiple VIP.

5. Select udp as the Protocol.

6. Click Add this Virtual Service.

7. Configure the settings as recommended in the following table:

Section Option Value

Standard Options

Force L4

Disabled

Real Servers

Real Server Check Method

ICMP Ping

8. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 4172 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

8 Connection Server

The Connection Server is a core component of VMware Horizon View. This role defines virtual desktop pools, applications and permissions. The initial Primary Horizon Protocol is load balanced between Connection Servers in the environment. The Secondary Horizon Protocols are connected by directly bypassing the load balancer.

8.1 Create the Connection Server Virtual Services

The following are the steps involved and the recommended settings to configure the VMware Connection Server Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image28.png

2. Type a valid Virtual Address.

3. Type 443 as the Port.

4. Enter a recognizable Service Name, such as VMware Connection Server.

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value Comment
Standard Options Persistence Mode Value  
  Timeout 1 hour  
  Cookie Name JSESSIONID  
  Scheduling Method least connection  
Advanced Properties Add a Port 80 Redirector VS   Click the Add HTTP Redirector button. this automatically creates a redirect on port 80.
Real Servers Real Server Check Method HTTPS Protocol  

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 443 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

g) Repeat the steps above to add more Real Servers as needed, based on your environment.

Create a HTTPS – Connection Server HTTPS HTTP Redirect Virtual Service

Clicking the Add HTTP Redirector button automatically creates a port 80 redirect Virtual Service. This is optional, but the purpose of this Virtual Service is to redirect any clients who have connected using HTTP to the HTTPS Virtual Service.

9 App Volume Manager

The App Volume Manager is a console for managing configuration, creation of AppStacks, and assignment of AppStacks and writable volumes.

9.1 Create App Volume Manager Virtual Services

The following sections describe the recommended settings for the VMware App Volume Manager Virtual Services.

The following are the steps involved and the recommended settings to configure the VMware App Volume Manager Virtual Service:

1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.

image29.png

2. Type a valid Virtual Address.

3. Type 443 as the Port.

4. Enter a recognizable Service Name, such as VMware App Volume Mgr

5. Click Add this Virtual Service.

6. Configure the settings as recommended in the following table:

Section Option Value Comment
Standard Options Persistence Mode Server Cookie  
  Timeout 1 hour  
  Cookie Name JSESSIONID  
  Scheduling Method least connection  
Advanced Properties Add a Port 80 redirector VS   Click the Add HTTP Redirector button. This automatically creates a redirect on port 80.
Real Servers Real Server Check Method HTTPS Protocol  

7. Add the Real Servers:

a) Expand the Real Servers section.

b) Click Add New.

c) Type the address of the relevant Real Server.

d) Type 443 as the Port.

e) Complete the other fields as required.

f) Click Add this Real Server then click OK to the pop-up message.

g) Repeat the steps above to add more Real Servers as needed, based on your environment.

Create a HTTPS – Connection Server HTTPS HTTP Redirect Virtual Service

Clicking the Add HTTP Redirector button automatically creates a port 80 redirect Virtual Service. This is optional, but the purpose of this Virtual Service is to redirect any clients who have connected using HTTP to the HTTPS Virtual Service.

Last Updated Date

This document was last updated on 06 October 2017.

Was this article helpful?

0 out of 0 found this helpful

Comments