VMware Horizon View 5.2
Contents
2 Introduction
VMware Horizon View (formerly VMware View) is a virtual desktop infrastructure solution that simplifies desktop management. It delivers personalized virtual desktops from a virtualized platform. This solution provides:
Reduction of complexity of PC management
Reduction of cost through virtualization
Increased PC uptime
Overall improved user experience
Simplified desktop security
The Horizon View server roles that require services from an Application Delivery Controller (ADC) for high availability are the Connection Server and the Security Server.
2.1 Document Purpose
The Virtual LoadMaster is VMware ready. This document is intended to provide guidance on how to configure Kemp LoadMaster products to provide high availability for a VMware Horizon View 5.2 environment. This document is not exclusively explicit to this version of VMware Horizon View nor does it claim explicit support for any or every other version of the application.
This documentation is created using a representative sample environment which is described later in the document. This document contains settings recommended by Kemp. This document does not to cover every possible deployment scenario; it may not address your unique setup, requirements, network layout or needs. In such an event that your infrastructure needs are not illustrated or reflected herein, the Kemp Engineering and Support Teams are available to provide guidance surrounding scenarios otherwise not explicitly defined.
2.2 Intended Audience
It is assumed that the reader is a server or network administrator who is familiar with networking, virtualization technologies, VMware, Virtual Desktop Infrastructure (VDI), DNS, Active Directory and general computer and network terminology. It is further assumed that you have set up the VMware Horizon View environment, DNS, Active Directory and have installed the Kemp LoadMaster. You should have reviewed the LoadMaster documentation and VMware Horizon View 5.2 documentation.
LoadMaster documentation is available at http://www.kemptechnologies.com/documentation
VMware Horizon View documentation is available at
http://pubs.vmware.com/view-52/index.jsp?topic=%2Fcom.vmware.ICbase%2FPDF%2Fic_pdf.html
3 Load Balancing VMware Horizon View
Descriptions of the VMware Horizon View server roles requiring high availability provided by an ADC and a descriptive VMware Horizon View diagram are described below.
3.1 Horizon View Connection Server
Horizon View Connection Server is the broker for client connections. It authenticates users to Active Directory and directs incoming user desktop requests to the correct endpoint. It also assigns packaged applications to desktops and pools and manages desktop sessions. In the deployment architecture defined herein, the LoadMaster does not handle the load balancing of PC over IP (PCoIP) traffic for connection servers.
3.2 Horizon View Security Server
Horizon View Security Server provides an extra layer of security for external Internet users who use a View Connection Server to access the internal network. Typically deployed in the DMZ, it proxies incoming connections to View Connection Servers on the trusted network. In the deployment architecture defined herein, LoadMaster does not handle the load balancing of PCoIP traffic for security servers.
To provide high availability and improved scalability, ADCs should be deployed to provide high availability and acceleration services for both security and connection servers.
3.3 Load Balancing VMware Horizon View Connection Servers
The steps and diagram below depict a Kemp LoadMaster deployment with VMware View Connection Servers:
1. The client establishes an SSL connection to the LoadMaster Virtual Service for the VMware View Connection Server pool.
2. LoadMaster performs SSL decryption and load balances the connection to the most appropriate Connection Server.
If desired, the LoadMaster can re-encrypt the connection before sending the traffic to the Connection Server.
3. Authentication, desktop entitlement and desktop selection all take place. Then, PCoIP connections are established directly to the selected View Desktop, bypassing the LoadMaster.
3.4 Load Balancing VMware Horizon View Security Servers
The steps and diagram below depict a Kemp LoadMaster deployment with VMware View Security Servers:
1. Client establishes SSL connection to the LoadMaster Virtual Service for the VMware View Security Server pool.
2. The LoadMaster performs SSL decryption and load balances the connection to the most appropriate Security Server. The LoadMaster re-encrypts the connection before sending the traffic to the Security Server.
3. Authentication, desktop entitlement and desktop selection take place. Then, PCoIP connections are established directly to the selected View Security Server, bypassing the Kemp LoadMaster.
4 Example Environment Setup
TestCompany has deployed VMware Horizon 5.2 in their environment to provide a VDI accessed both by internal and external clients. The deployment contains the following:
Two VMware Horizon View Connection Servers
Two VMware Horizon View Security Servers
Two Kemp LoadMaster HA Clusters
In the deployment architecture defined herein, the LoadMaster does not handle the load balancing of PCoIP traffic for Connection or Security servers. For this reason, the following should be noted:
Connectivity between external clients and the View Security servers is required
Connectivity between internal clients and the VMware infrastructure is required
The following scenarios are defined:
Access to the Horizon View environment using Connection Servers which are being load balanced and serviced by a Kemp LoadMaster ADC cluster
Access to Horizon View using Security servers which are being load balanced and serviced by a Kemp LoadMaster ADC cluster
5 Prerequisites
Minimally, you should have:
Implemented Active Directory, DNS and other core requirements for Horizon View
Installed VMware ESXi servers, vCenter server, View Connection and Security servers
Configured SSL certificates for authentication of View Connection and Security servers
Installed the LoadMaster(s) on the same network(s) as the servers to be load balanced
Established administrative access to the LoadMaster Web User Interface (WUI)
5.1 Allow HTTP Connections
To allow SSL-offloaded connections from the LoadMaster to the Connection Servers that are not re-encrypted, the Connection Servers must be configured to accept HTTP connections from intermediate devices. This is accomplished by modifying the locked.properties file on each Connection Server on which HTTP connections are desired. Steps on how to do this are outlined below. The servers will also continue to accept HTTPS connections.
1. Navigate to the locked.properties file in the SSLGateway configuration folder on the Connection Server, for example <install_directory>\VMware\VMware View\Server\sslgateway\conf\locked.properties
2. Add the serverProtocol property. Set it to http using lower case letters
3. The next two steps are optional:
a) If desired, change the HTTP listening port from 80 to a non-default port by setting the serverPortNonSSL to an alternate port number on which the LoadMaster will communicate with the Connection Server for HTTP connections.
b) If the Connection Server has multiple network interfaces and you would like to designate a single interface for HTTP connections, set the server Host to the IP address of the desired interface.
4. Save the locked.properties file.
5. Restart the View Connection Server service on the server
SSL offloading is not supported with smart card authentication.
5.2 Modify Secure Tunnel External URL
The following changes to the Secure Tunnel External URL parameters are required for the LoadMaster and the VMware Horizon View environment to interoperate correctly:
1. Log in to the View Manager Administrator tool.
2. Expand View Configuration and click Servers.
3. Select the Connection Servers tab.
4. Select each Connection server and click the Edit button after which the Edit View Connection Server Settings box will open.
5. Navigate to the General tab. In the HTTP(S) Secure Tunnel External URL text box, enter the LoadMaster Virtual Service IP address or DNS FQDN to be used for the Security Server pool followed by a colon and the appropriate port number.
6. Select the Use Secure Tunnel Connection to Desktop check box.
7. Click OK.
8. Next, select each Security Server and click the Edit button.
9. On the General tab in the HTTP(S) Secure Tunnel External URL text box, enter the LoadMaster Virtual Service IP address or DNS FQDN to be used for the Security Server pool followed by a colon and the appropriate port number.
10. Click OK.
Do not change the IP address configured in the PCoIP External URL field.
5.3 DNS
Access to the DNS system used in the network environment must be available to set up name resolution of your Horizon View namespaces to the Virtual Service IP addresse(s) that will be configured on the LoadMaster.
5.4 SSL Certificate Import on the LoadMaster
Follow the steps below to import the relevant View Connection and Security certificates on the Kemp LoadMaster:
1. In the main menu of the LoadMaster WUI, go to Certificates & Security > SSL Certificates.
2. Click Import Certificate.
3. Click Choose File in the Certificate File field.
4. Browse to and select the signed certificate file which is in use in the Horizon View infrastructure.
This must be a .pfx file containing private keys for the certificate used on the Horizon View servers.
5. If relevant, click Choose File in the Key File (optional) field to browse to and select the key file.
6. Enter the Pass Phrase.
7. Enter a recognizable name in the Certificate Identifier text box.
8. Click Save.
9. If required, repeat the steps above to add a Security certificate.
6 Template
Kemp has developed a template containing our recommended settings for this workload. You can install this template to help create Virtual Services (VSs) because it automatically populates the settings. You can use the template to easily create the required VSs with the recommended settings. For some workloads, additional manual steps may be required such as assigning a certificate or applying port following, these steps are covered in the document, if needed.
You can remove templates after use and this will not affect deployed services. If needed, you can make changes to any of the VS settings after using the template.
Download released templates from the following page: LoadMaster Templates.
For more information and steps on how to import and use templates, refer to the Virtual Services and Templates, Feature Description on the Kemp Documentation page.
7 Virtual Service Configuration
The sections below outline instructions on how to add Virtual Services for the View Connection and Security servers.
7.1 View Connection Servers
To add a Virtual Service for the View Connection Servers, follow the steps below:
1. In the main menu of the LoadMaster WUI, select Virtual Services and Add New.
2. Enter a valid IP address in the Virtual Address field.
3. Enter 443 as the Port.
4. Enter a recognizable Service Name, for example View Connection.
5. Click Add this Virtual Service.
6. Configure the settings as shown in the following table:
Section |
Option |
Value |
Comment |
---|---|---|---|
SSL Properties | SSL Acceleration | Enabled | |
Certificates | Select the relevant certificate. | Click > to assign the certificate. Click Set Certificates. | |
Standard Options |
Transparency | Disabled | |
Persistence Mode | Server Cookie | ||
|
Persistence Timeout | 6 Minutes | |
|
Cookie name | JSESSIONID | Click Set Cookie. |
Scheduling Method | least connection | ||
Real Servers |
URL | / | Click Set URL. |
HTTP Method | GET |
7. Click Add New.
8. Enter the relevant Real Server Address.
9. Enter 80 as the Port.
10. Click Add This Real Server.
11. Click OK.
12. Continue to add the remaining Real Servers by entering the Real Server Address and clicking Add This Real Server until all servers in the pool are added. When finished, click the Back button.
13. In the main menu of the LoadMaster WUI, click View/Modify Services.
14. Confirm that the newly created service is listed with a status of Up and that all of the added member servers are listed in black, non-bold font.
7.2 View Security Servers
To add the Virtual Service for the View Security Servers, follow the steps below:
1. In the main menu of the LoadMaster WUI, select Virtual Services and Add New.
2. Enter a valid IP address in the Virtual Address text box.
3. Enter 443 as the Port.
4. Enter a recognizable Service Name, for example View Security Pool.
5. Click Add this Virtual Service.
6. Configure the settings as shown in the following table:
Section |
Option |
Value |
Comment |
---|---|---|---|
SSL Properties | SSL Acceleration | Enabled | |
Reencrypt | Enabled | ||
Certificates | Select the relevant certificate. | Click > to assign the certificate. Click Set Certificates. | |
Standard Options | Persistence Mode | Server Cookie | |
|
Persistence Timeout | 6 Minutes | |
|
Cookie name | JSESSIONID | Click Set Cookie. |
Scheduling Method | least connection | ||
Real Servers |
URL | / | Click Set URL. |
HTTP Method | GET |
7. Click Add New.
8. Enter the relevant Real Server Address.
9. Click Add This Real Server.
10. Click OK.
11. Continue to add Real Servers until every server in the pool has been added. Then, click the Back button.
12. In the main menu of the LoadMaster WUI, select View/Modify Services.
13. Confirm that the newly created service is listed with a status of UP. Ensure that all member servers are listed in black, non-bold font.
References
The below links contain further information.
VMware Horizon View Documentation
http://www.vmware.com/support/pubs/view_pubs.html
Web User Interface, Configuration Guide
http://kemptechnologies.com/documentation.
Virtual Services and Templates, Feature Description
http://kemptechnologies.com/documentation.
Last Updated Date
This document was last updated on 03 March 2022.