VMware Horizon 7 and Horizon 8
Contents
1 Introduction
VMware Horizon is a virtual desktop infrastructure (VDI) solution that simplifies administration and delivery of personalized virtual desktops. It consists of several components and delivers a secure optimized virtual desktop infrastructure.
This deployment guide focuses on the load balancing requirements for the Horizon and Unified Access Gateway (UAG) use cases. It discusses the distinction between the primary and secondary Horizon protocols and describes the three methods for guaranteeing session affinity. The three methods ensure that all protocol traffic from a Horizon client session goes to the same Unified Access Gateway appliance. This article also covers health monitoring and SSL bridging for load balancers.
Unified Access Gateway (Access Point) is a Unified Gateway from VMware that comes in virtual appliance format and is designed to protect desktop and application resources to enable remote access from the internet. Unified Access Gateway is the default gateway for the following products:
- VMware Horizon
- VMware Horizon Air (DaaS)
- VMware Horizon Air Hybrid-Mode
- VMware Workspace One Access
- Airwatch Tunnel Gateway/Proxy
Connection Servers are the core component of VMware Horizon. This role defines virtual desktop pools, applications, and permissions.
App Volume Manager is a console for managing configuration, creation of AppStacks, and assignment of AppStacks and writable volumes.
Workspace One Access is a portal where users gain access to different types of applications including Software as a Service (SaaS) based, enterprise identity management to sync and extend Active Directory, and single sign on.
The Kemp LoadMaster is used to load balance the VMware Unified Access Gateway, Connection Servers, Workspace One Access, and App Volume Manager. The LoadMaster offers advanced Layer 4 and Layer 7 server load balancing, SSL Acceleration, and a multitude of other advanced Application Delivery Controller (ADC) features. The LoadMaster intelligently and efficiently distributes user traffic among the application servers so that users get the best experience possible.
This document provides guidance and recommended settings on how to load balance Horizon 7 or Horizon 8 with a Kemp LoadMaster. The Kemp Support Team is available to provide solutions for scenarios not explicitly defined.
The Kemp support site can be found at: https://support.kemptechnologies.com.
1.1 Document Purpose
This document provides the recommended LoadMaster settings used when load balancing the VMware Horizon use cases using the Unified Access Gateway. The Kemp Support Team is available to provide solutions for scenarios not explicitly defined. The Kemp support site can be found at: https://support.kemptechnologies.com.
1.2 Intended Audience
This document is intended to be read by anyone who is interested in configuring the LoadMaster to optimize VMware Horizon workload.
1.3 About this Document
This document was written with help from Mark Benson and Vish Kalsi of VMware. Some of the content in this document is based on the following VMware document: https://communities.vmware.com/docs/DOC-32792
In addition, you can find more information at https://www.vmware.com/support/pubs/access-point-pubs.html
2 Template
Kemp has developed a template containing our recommended settings for this workload. You can install this template to help create Virtual Services (VSs) because it automatically populates the settings. You can use the template to easily create the required VSs with the recommended settings. You can install this template to help create Virtual Services (VSs) because it automatically populates the settings. For some workloads, additional manual steps may be required such as assigning a certificate or applying port following, these steps are covered in this document.
You can remove templates after use and this will not affect deployed services. If needed, you can make changes to any of the VS settings after using the template.
Download released templates from the following page: LoadMaster Templates.
Depending on the configuration of Horizon 7 or Horizon 8 and UAG, the following templates are provided to address the different methods outlined in this guide:
- Horizon 7 and Horizon 8: This template includes Virtual Services that support VMware Horizon 7 or Horizon 8 Connection Servers, App Volume Manager, and Workspace One Access.
- UAG - Source IP Affinity: This template includes Virtual Services that support Unified Access Gateway using Method 1 (Source IP Affinity).
- Advantages of Source IP Affinity:
- Uses standard port numbers
- Does not require multiple virtual IP addresses
- Disadvantages of Source IP Affinity:
- Relies on source IP address affinity, which is not always possible
- Advantages of Source IP Affinity:
- UAG - Multi-Port Affinity: This template includes Virtual Services that support Unified Access Gateway using Method 2 (Multiple Port Affinity).
- Advantages of Multiple Port Number Groups:
- Does not rely on source IP affinity
- Does not require multiple public virtual IP addresses
- Disadvantages of Multiple Port Number Groups:
- Uses non-standard port numbers from the internet. Although the port numbers on the Unified Access Gateway appliances themselves are standard.
- Advantages of Multiple Port Number Groups:
- UAG - Multi-VIP Affinity: This template includes Virtual Services that support Unified Access Gateway using Method 3 (Multiple VIP Affinity).
- Advantages of Multiple VIPs:
- Does not rely on source IP affinity
- Uses standard port numbers
- Disadvantages of Multiple VIPs:
- Requires an additional public-facing VIP for each Unified Access Gateway appliance in addition to the primary load-balanced VIP
- Advantages of Multiple VIPs:
For more information and steps on how to import and use templates, refer to the Virtual Services and Templates, Feature Description on the Kemp Documentation page.
3 Architecture
Unified Access Gateway is typically deployed in a DMZ. For high availability and scalability requirements in a production deployment, several Unified Access Gateway appliances are usually set up behind a load balancer as shown in Figure 3-1. The LoadMaster is deployed in-line as a proxy for all services including PCoIP. Alternative deployment options could have the secondary Horizon protocols bypass the LoadMaster as it is only the initial session establishment (HTTPS) that can be load balanced.
4 Horizon Protocols
When a Horizon Client user connects to a Horizon environment, several different protocols are used. The first connection is always the primary XML-API protocol over HTTPS. Following successful authentication, one or more secondary protocols are also made.
4.1 Primary Horizon Protocol
The user enters a hostname at the Horizon Client and this starts the primary Horizon protocol. This is a control protocol for authentication, authorization and session management. It uses XML-structured messages over HTTPS (HTTP over SSL). This protocol is sometimes known as the Horizon XML-API control protocol. In a load-balanced environment as shown in the Architecture section, the load balancer routes this connection to one of the Unified Access Gateway appliances. The load balancer usually selects the appliance based first on availability, and then out of the available appliances that will route traffic based on the least number of current sessions. This has the effect of evenly distributing the traffic from different clients across the available set of Unified Access Gateway appliances.
4.2 Secondary Horizon Protocols
After the Horizon Client has established a secure communication to one of the Unified Access Gateway appliances, the user authenticates. If this authentication attempt is successful, then one or more secondary connections are made from the Horizon client. These secondary connections can include:
- HTTPS Tunnel used for encapsulating TCP protocols such as RDP, MMR/CDR and the client framework channel (TCP 443).
- Blast Extreme display protocol (TCP 443 or UDP 8443).
- PCoIP display protocol (TCP 4172 and UDP 4172).
These secondary Horizon protocols must be routed to the same Unified Access Gateway appliance to which the primary Horizon protocol is routed. This is so that Unified Access Gateway can authorize the secondary protocols based on the authenticated user session. An important security capability of Unified Access Gateway is that it will only forward traffic into the corporate datacenter if the traffic is on behalf of an authenticated user. If the secondary protocols were to be misrouted to a different Unified Access Gateway appliance to the primary protocol one, they would not be authorized and would therefore be dropped in the DMZ and the connection would fail. Misrouting the secondary protocols is a common problem if the Load Balancer is not configured correctly.
5 Configure the LoadMaster
The deployed VMware Unified Access Gateway environment determines which of the following setups is used.
5.1 Enable Subnet Originating Requests Globally
It is best practice to enable the Subnet Originating Requests option globally.
In a one-armed setup (where the Virtual Service and Real Servers are on the same network/subnet) Subnet Originating Requests is usually not needed. However, enabling Subnet Originating Requests should not affect the routing in a one-armed setup.
In a two-armed setup where the Virtual Service is on network/subnet A, for example, and the Real Servers are on network B, Subnet Originating Requests should be enabled on LoadMasters with firmware version 7.1-16 and above.
When Subnet Originating Requests is enabled, the Real Server sees traffic originating from 10.20.20.21 (LoadMaster eth1 address) and responds correctly in most scenarios.
With Subnet Originating Requests disabled, the Real Server sees traffic originating from 10.0.0.15 (LoadMaster Virtual Service address on eth0) and responds to eth0 which could cause asymmetric routing.
When Subnet Originating Requests is enabled globally, it is automatically enabled on all Virtual Services. If the Subnet Originating Requests option is disabled globally, you can choose whether to enable Subnet Originating Requests on a per-Virtual Service basis.
To enable Subnet Originating Requests globally, follow the steps below:
1. In the main menu of the LoadMaster User Interface (UI), go to System Configuration > Miscellaneous Options > Network Options.
2. Select the Subnet Originating Requests check box.
5.2 Enable Check Persist Globally
It is recommended that you change the Always Check Persist option to Yes - Accept Changes. Use the following steps:
1. Go to System Configuration > Miscellaneous Options > L7 Configuration.
2. Click the Always Check Persist drop-down arrow and select Yes - Accept Changes.
6 Unified Access Gateway Session Affinity Options
There are three main configuration options for session affinity. These are:
Source IP Affinity
Multiple Port Number Groups
Multiple VIPs
6.1 Method 1 - Source IP Affinity
Method 1 is recommended for all environments where source IP address affinity is possible. Where it is not possible, then either method 2 or method 3 should be used.
Method 1 is the simplest configuration for a load balancer because it uses standard port numbers and a single load balanced VIP. It relies on the load balancer to route secondary protocols to the same Unified Access Gateway appliance as was selected for the primary Horizon protocol. It does this based on repeat connections coming from the same Horizon client IP address. Unfortunately, this method does not work in all situations. For example, with certain Network Service Providers or NAT devices, the source IP address is not available for this affinity configuration. If source IP affinity cannot be used in your environment, then one of the other two methods should be used as they do not rely on source IP affinity.
Unified Access Gateway Configuration for External URLs for this configuration is shown in the following table.
In our example, the Fully Qualified Domain Name (FQDN) https://uag.myco.com resolves to 10.10.10.154.
| Unified Access Gateway Appliance | Configuration Item | Value |
|---|---|---|
|
UAG01 |
tunnelExternalURL |
https://uag.myco.com:443 |
|
UAG01 |
blastExternalURL |
https://uag.myco.com:443 |
|
UAG01 |
pcoipExternalURL |
10.10.10.154:4172 |
|
UAG02 |
tunnelExternalURL |
https://uag.myco.com:443 |
|
UAG02 |
blastExternalURL |
https://uag.myco.com:443 |
|
UAG02 |
pcoipExternalURL |
10.10.10.154:4172 |
The use of Blast port TCP/8443 can be leveraged but is not required.
Advantages of Source IP Affinity
Uses standard port numbers
Does not require multiple public virtual IP addresses
Disadvantages of Source IP AffinityRelies on source IP address affinity, which is not always possible.
6.2 Method 2 - Multiple Port Number Groups
Multiple port group affinity does not rely on source IP address for affinity. Instead, the load balancer is configured to route the secondary Horizon protocols based on a group of unique port numbers assigned to each Unified Access Gateway appliance. The primary Horizon protocol on HTTPS port 443 is load balanced to allocate the session to a specific Unified Access Gateway appliance based on health and least loaded. The secondary connections are then routed to the correct Unified Access Gateway appliance based on the following Load Balancer configuration table.
| Virtual IP Address |
Primary/ Secondary |
Protocol | Name | Real Servers |
|---|---|---|---|---|
|
10.10.10.154:443 |
Primary |
TCP |
UAGLB - HTTPS |
10.10.10.90:443 10.10.10.91:443 |
|
10.10.10.154:10143 |
Secondary |
TCP |
UAG01 - HTTPS |
10.10.10.90:443 |
|
10.10.10.154:10143 |
Secondary |
UDP |
UAG01 - BLAST-UDP |
10.10.10.90:8443 |
|
10.10.10.154:10172 |
Secondary |
TCP |
UAG01 - PCOIP |
10.10.10.90:4172 |
|
10.10.10.154:10172 |
Secondary |
UDP |
UAG01 - PCOIP-UDP |
10.10.10.90:4172 |
|
10.10.10.154:10243 |
Secondary |
TCP |
UAG02 - HTTPS |
10.10.10.91:443 |
|
10.10.10.154:10243 |
Secondary |
UDP |
UAG02 - BLAST-UDP |
10.10.10.91:8443 |
|
10.10.10.154:10272 |
Secondary |
TCP |
UAG02 - PCOIP |
10.10.10.91:4172 |
|
10.10.10.154:10272 |
Secondary |
UDP |
UAG02 - PCOIP-UDP |
10.10.10.91:4172 |
The same port mapping scheme can be used for additional Unified Access Gateway appliances 03 > 99. For example, we use the following mapping convention in this document for Unified Access Gateway.
The Unified Access Gateway Configuration for External URLs is shown below.
In our example, the FQDN http://uag.myco.com resolves to 10.10.10.154.
| Unified Access Gateway Appliance | Configuration Item | Value |
|---|---|---|
|
UAG01 |
tunnelExternalURL |
https://uag.myco.com:10143 |
|
UAG01 |
blastExternalURL |
https://uag.myco.com:10143 |
|
UAG01 |
pcoipExternalURL |
10.10.10.154:10172 |
|
UAG02 |
tunnelExternalURL |
https://uag.myco.com:10243 |
|
UAG02 |
blastExternalURL |
https://uag.myco.com:10243 |
|
UAG02 |
pcoipExternalURL |
10.10.10.154:10272 |
Advantages of Multiple Port Number Groups:
- Does not rely on source IP affinity
- Does not require multiple public virtual IP addresses
Disadvantages of Multiple Port Number Groups:
Uses non-standard port numbers from the Internet although the port numbers on the Unified Access Gateway appliances themselves are standard.
6.3 Method 3 - Multiple VIPs
This method is similar to the multiple port groups method except instead of dedicating a group of port numbers to each Unified Access Gateway appliance, it dedicates an individual VIP to each appliance in addition to the primary load balanced VIP. If you have two Unified Access Gateway appliances, then you would set up three VIPs. The primary Horizon protocol on HTTPS port 443 is load balanced to allocate the session to a specific Unified Access Gateway appliance based on health and least loaded. The secondary connections are then routed to the correct Unified Access Gateway appliance based on the following Load Balancer configuration table.
Unified Access Gateway Configurations for External URLs for this configuration are shown in the following table.
| Virtual IP Address | Primary/Secondary | Protocol | Name | Real Servers |
|---|---|---|---|---|
|
10.10.10.154:443 |
Primary |
TCP |
UAGLB - HTTPS |
10.10.10.90:443 10.10.10.91:443 |
|
10.10.10.156:443 |
Secondary |
TCP |
UAG01 - HTTPS BLAST |
10.10.10.90:443 |
|
10.10.10.156:8443 |
Secondary |
UDP |
UAG01 - BLAST-UDP |
10.10.10.90:8443 |
|
10.10.10.156:4172 |
Secondary |
TCP |
UAG01 - PCOIP |
10.10.10.90:4172 |
|
10.10.10.156:4172 |
Secondary |
UDP |
UAG01 - PCOIP-UDP |
10.10.10.90:4172 |
|
10.10.10.157:443 |
Secondary |
TCP |
UAG02 - BLAST |
10.10.10.91:443 |
|
10.10.10.157:8443 |
Secondary |
UDP |
UAG02 - BLAST-UDP |
10.10.10.91:8443 |
|
10.10.10.157:4172 |
Secondary |
TCP |
UAG02 - PCOIP |
10.10.10.91:4172 |
|
10.10.10.157:4172 |
Secondary |
UDP |
UAG02 - PCOIP-UDP |
10.10.10.91:4172 |
In our example, the FQDN http://uag1.myco.com resolves to 10.10.10.156 and https://uag2.myco.com resolves to 10.10.10.157.
| Unified Access Gateway Appliance | Configuration Item | Value |
|---|---|---|
|
UAG01 |
tunnelExternalURL |
https://uag1.myco.com:443 |
|
UAG01 |
blastExternalURL |
https://uag1.myco.com:8443 |
|
UAG01 |
pcoipExternalURL |
10.10.10.156:4172 |
|
UAG02 |
tunnelExternalURL |
https://uag2.myco.com:443 |
|
UAG02 |
blastExternalURL |
https://uag2.myco.com:8443 |
|
UAG02 |
pcoipExternalURL |
10.10.10.157:4172 |
Advantages of multiple VIPs:
- Do not rely on source IP affinity
- Uses standard port numbers
Disadvantages of multiple VIPs
Requires an additional public facing VIP for each Unified Access Gateway appliance in addition to the primary load balanced VIP.
7 Virtual Service - Connection Server
The Connection Server is a core component of VMware Horizon. This role defines virtual desktop pools, applications, and permissions. The initial Primary Horizon Protocol is load balanced between Connection Servers in the environment. The Secondary Horizon Protocols are connected by directly bypassing the load balancer.
This step-by-step setup of Virtual Services (VSs) leverages the Kemp application template for Horizon 7 and Horizon 8.
The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster Application Programming Interface (API) and automation tools.
SSL/TLS certificates should be added before creating this Virtual Service. For further information on certificates, refer to the SSL Accelerated Services Feature Description.
7.1 Create the Connection Server Virtual Services
The following are the steps involved and the recommended settings to configure the VMware Connection Server Virtual Service:
1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.
2. Type a valid Virtual Address.
3. Select the VMware Connection Server template in the Use Template drop-down list.
4. Click Add this Virtual Service.
5. In the main menu, go to Virtual Services > View/Modify Services.
6. Click Modify on the relevant Virtual Service on TCP port 443.
7. Expand the SSL Properties section.
8. Select the certificate to use from Available Certificates and click the arrow (>) to move it to Assigned Certificates.
9. Expand the Real Servers section.
10. Click Add New.
11. Type the Real Server Address.
12. Confirm that port 443 is entered.
13. Click Add This Real Server.
14. Repeat the steps above to add more Real Servers as needed.
7.1.1 Connection Server Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
| port | 443 |
| prot | tcp |
| VStype | http |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| Persist | src |
| PersistTimeout | 3600 |
| CheckType | https |
| Checkurl | /favicon.ico |
| CheckUseGet | 1 |
7.1.2 Connection Server Redirect Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
80 |
| prot | tcp |
| VStype | http |
| Forcel7 | 1 |
| Transparent | 0 |
| ErrorCode | 302 |
| ErrorUrl | https://%h%s |
| CheckType | None |
8 Virtual Service - Unified Access Gateway (UAG)
The UAG is a core component of VMware Horizon. This role provides access to virtual desktop pools and applications for external users. The initial Primary Horizon Protocol is load balanced between UAG servers in the environment. The Secondary Horizon Protocols are directed to correct UAG based on the configuration (method) used.
The templates to support different UAG methods include different protocols to support different customer environments. In most cases, one or more Virtual Services created by the template are not used. For instance, the following Virtual Services are optional if only the Blast protocol was used in the example provided in the Source IP Affinity UAG Configuration (Method 1) section of this guide.
Kemp recommends all Virtual Services get configured and the connections to these be monitored using the Real Time Statistics. If no connections are being recorded on these optional Virtual Services, they can be disabled or deleted to clean up the LoadMaster configuration.
8.1 Source IP Affinity UAG Configuration (Method 1)
The following is an example of a Unified Access Gateway configuration to support Source IP Affinity:
- The URL (Horizon-int.kempdemo.com) in this example points to the internal LoadMaster (10.10.10.103) publishing Connection Servers as configured in the Create the Connection Server Virtual Services section.
- The URL (Horizon.kempdemo.com) in this example points to the public IP address (10.10.10.154) of the external LoadMaster publishing the UAG servers.
- The IP address (10.10.10.154) in this example would be the public IP address of the external LoadMaster publishing the UAG Servers.
8.2 Source IP Affinity Virtual Services (Method 1)
This step-by-step setup of Virtual Services leverages the Kemp application template for UAG - Source IP Affinity.
The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster API and automation tools.
8.2.1 Create the UAG Source IP Affinity Virtual Service
The following are the steps involved and the recommended settings to configure the VMware UAG Source IP Affinity Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > Add New.
2. Type a valid Virtual Address.
3. Select the UAGLB - Source IP Affinity template in the Use Template drop-down list.
4. Click Add this Virtual Service.
8.2.1.1 Configure the UAG TCP HTTPS - Source IP Affinity Virtual Service
To configure this Virtual Service, follow the steps below:
1. In the main menu of the LoadMaster WUI, select View/Modify Services.
2. Click Modify on the UAGLB TCP HTTPS -Source IP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 443 is entered.
7. Click Add This Real Server.
8. Repeat these steps to add more Real Servers as needed.
8.2.1.1.1 UAG TCP HTTPS - Source IP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
443 |
| prot | tcp |
| VStype | http |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| Persist | src |
| PersistTimeout | 3600 |
| CheckType | https |
| Checkurl | /favicon.ico |
| CheckUseGet | 0 |
8.2.1.2 Configure the UAG TCP PCoIP - Source IP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, select View/Modify Services.
2. Click Modify on the UAGLB TCP PCoIP -Source IP Affinity Virtual Service.
3. Expand the Advanced Properties section.
4. In the Port Following drop-down list, select the Virtual Service with port 443.
5. Expand the Real Servers section.
6. Click Add New.
7. Type the Real Server Address.
8. Confirm that port 4172 is entered.
9. Click Add This Real Server.
10. Repeat these steps to add more Real Servers as needed.
8.2.1.2.1 UAG TCP PCoIP - Source IP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
4172 |
| prot | tcp |
| VStype | http |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| Persist | src |
| PersistTimeout | 3600 |
| FollowVSID | <Specify Virtual Service ID> |
| CheckType | tcp |
| Checkport | 4172 |
8.2.1.3 Configure the UAG UDP PCoIP - Source IP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAGLB UDP PCoIP -Source IP Affinity Virtual Service.
3. Expand the Advanced Properties section.
4. In the Port Following drop-down list, select the Virtual Service with port 443.
5. Expand the Real Servers section.
6. Click Add New.
7. Type the Real Server Address.
8. Confirm that port 4172 is entered.
9. Click Add This Real Server.
10. Repeat this step to add more Real Servers as needed.
8.2.1.3.1 UAG UDP PCoIP - Source IP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
4172 |
| prot | udp |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| Persist | src |
| PersistTimeout | 3600 |
| FollowVSID | <Specify Virtual Service ID> |
| CheckType | icmp |
8.2.1.4 Configure the UAG TCP Blast - Source IP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAGLB TCP Blast -Source IP Affinity Virtual Service.
3. Expand the Advanced Properties section.
4. In the Port Following drop-down list, select the Virtual Service with port 443.
5. Expand the Real Servers section.
6. Click Add New.
7. Type the Real Server Address.
8. Confirm that port 8443 is entered.
9. Click Add This Real Server.
10. Repeat these steps to add more Real Servers as needed.
8.2.1.4.1 UAG TCP Blast - Source IP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
8443 |
| prot | tcp |
| VStype | http |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| Persist | src |
| PersistTimeout | 3600 |
| FollowVSID | <Specify Virtual Service ID> |
| CheckType | tcp |
| Checkport | 8443 |
8.2.1.5 Configure the UAG UDP Blast - Source IP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAGLB UDP Blast - Source IP Affinity Virtual Service.
3. Expand the Advanced Properties section.
4. In the Port Following drop-down list, select the Virtual Service with port 443.
5. Expand the Real Servers section.
6. Click Add New.
7. Type the Real Server Address.
8. Confirm that port 8443 is entered.
9. Click Add This Real Server.
10. Repeat these steps to add more Real Servers as needed.
8.2.1.5.1 UAG UDP Blast - Source IP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
8443 |
| prot | udp |
| SubnetOriginating | 1 |
| ForceL7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| Persist | src |
| PersistTimeout | 3600 |
| FollowVSID | <Specify Virtual Service ID> |
| CheckType | icmp |
8.3 Multiple Port Affinity UAG Configuration (Method 2)
The following is an example of a Unified Access Gateway configuration to support Multiple Port Affinity. Each configuration is set with unique ports to direct clients to the correct UAG node.
- The URL (Horizon-int.kempdemo.com) in this example points to the internal LoadMaster (10.10.10.103) publishing Connection Servers as configured in the Create the Connection Server Virtual Services section.
- The URL (Horizon.kempdemo.com) in this example points to the public IP address (10.10.10.154) of the external LoadMaster publishing the UAG Servers.
- The IP address (10.10.10.154) in this example would be the public IP address of the external LoadMaster publishing the UAG Servers.
8.4 Multiple Port Affinity Virtual Services (Method 2)
This step-by-step setup of Virtual Services leverages the Kemp application template for UAG - Multiple Port Affinity.
This template deploys Virtual Services to support two UAGs. If the environment requires three or more UAGs, follow the steps in the Duplicate Virtual Service (Optional) section.
The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster API and automation tools.
8.4.1 Create the UAG Multiple Port Affinity Virtual Service
The following are the steps involved and the recommended settings to configure the VMware UAG Multi-Port Affinity Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > Add New.
2. Type a valid Virtual Address.
3. Select the UAGLB - Multi-Port Affinity template in the Use Template drop-down list.
4. Click Add this Virtual Service.
8.4.1.1 Configure the UAG TCP HTTPS - Multi-Port Affinity Virtual Service
To configure this Virtual Service, follow the steps below:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAGLB TCP HTTPS -Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 443 is entered.
7. Click Add This Real Server.
8. Repeat these steps to add more Real Servers as needed.
This Virtual Service will be the only one with multiple Real Servers.
8.4.1.1.1 UAG TCP HTTPS - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
443 |
| prot | tcp |
| VStype | http |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| CheckType | https |
| Checkurl | /favicon.ico |
| CheckUseGet | 0 |
8.4.1.2 Configure the UAG1 TCP Blast - Multi Port Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG1 TCP Blast -Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Update the Real Server Port to 443.
7. Click Add This Real Server.
UAG1 should be the only Real Server added to this Virtual Service.
8.4.1.2.1 UAG1 TCP Blast - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
10143 |
| prot | tcp |
| VStype | http |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| CheckType | tcp |
| Checkport | 443 |
8.4.1.3 Configure the UAG1 UDP Blast - Multi Port Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG1 UDP Blast - Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Update the Real Server Port to 8443.
7. Click Add This Real Server.
UAG1 should be the only Real Server added to this Virtual Service.
8.4.1.3.1 UAG1 UDP Blast - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
10143 |
| prot | udp |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| CheckType | icmp |
8.4.1.4 Configure the UAG1 TCP PCoIP - Multi Port Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG1 TCP PCoIP - Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 4172 is entered.
7. Click Add This Real Server.
UAG1 should be the only Real Server added to this Virtual Service.
8.4.1.4.1 UAG1 TCP PCoIP - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
10172 |
| prot | tcp |
| VStype | http |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| CheckType | tcp |
| Checkport | 4172 |
8.4.1.5 Configure the UAG1 UDP PCoIP - Multi-Port Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG1 UDP PCoIP -Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Update the Real Server Port to 4172.
7. Click Add This Real Server.
UAG1 should be the only Real Server added to this Virtual Service.
8.4.1.5.1 UAG1 UDP PCoIP - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
10172 |
| prot | udp |
| SubnetOriginating | 1 |
| Forcel7 | 1 |
| Transparent | 0 |
| Schedule | lc |
| CheckType | icmp |
8.4.1.6 Configure UAG2 TCP Blast - Multi-Port Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG2 TCP Blast -Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Update the Real Server Port to 443.
7. Click Add This Real Server.
UAG2 should be the only Real Server added to this Virtual Service.
8.4.1.6.1 UAG2 TCP Blast - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
10243 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
tcp |
|
Checkport |
443 |
8.4.1.7 Configure UAG2 UDP Blast - Multi-Port Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG2 UDP Blast - Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Update the Real Server Port to 8443.
7. Click Add This Real Server.
UAG2 should be the only Real Server added to this Virtual Service.
8.4.1.7.1 UAG2 UDP Blast - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
10243 |
|
prot |
udp |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
icmp |
8.4.1.8 Configure UAG2 TCP PCoIP - Multi-Port Affinity Virtual Service
.Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG2 TCP PCoIP - Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Update the Real Server Port to 4172.
7. Click Add This Real Server.
UAG2 should be the only Real Server added to this Virtual Service.
8.4.1.8.1 UAG2 TCP PCoIP - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
10272 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
tcp |
|
Checkport |
4172 |
8.4.1.9 Configure UAG2 UDP PCoIP - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAGLB UDP PCoIP - Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Update the Real Server Port to 4172.
7. Click Add This Real Server.
UAG2 should be the only Real Server added to this Virtual Service.
8.4.1.9.1 UAG2 UDP PCoIP - Multi-Port Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
10272 |
|
prot |
udp |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
icmp |
8.4.2 Example LoadMaster Configuration - Multiple Port Affinity
8.4.3 Duplicate Virtual Service (Optional)
To support additional UAG appliances, the Blast and PCoIP Virtual Services must be created for each. This section provides the necessary steps to add the UAG server to the configuration.
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG2 TCP Blast - Multi-Port Affinity Virtual Service.
3. Click Duplicate VIP.
4. Keep the same Virtual Address and change the port to 10343.
5. Click Duplicate VIP.
6. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
7. Click Modify on the UAG2 TCP Blast - Multi-Port Affinity [1] Virtual Service.
8. Modify the Service Name (for example, UAG3 TCP Blast - Multi-Port Affinity)
9. Expand the Real Servers section.
10. Click Delete to remove the Real Server listed.
11. Click OK on remove Real Server confirmation.
12. Click Add New.
13. Type the Real Server Address.
14. Confirm that port 443 is entered.
15. Click Add This Real Server.
UAG3 should be the only Real Server added to this Virtual Service.
16. Repeat the above steps for:
| Virtual Service to Duplicate | New Virtual Service Port | Real Server Port |
| UAG2 UDP Blast - Multi-Port Affinity | 10343 | 8443 |
| UAG2 TCP PCoIP - Multi-Port Affinity | 10372 | 1072 |
| UAG2 UDP PCoIP - Multi-Port Affinity | 10372 | 1072 |
The same port mapping scheme can be used for additional Unified Access Gateway appliances, 103xx - 199xx.
8.5 Multiple VIP Affinity UAG Configuration (Method 3)
The following is an example of a Unified Access Gateway configuration to support Multiple VIP Affinity. Each configuration is set with a unique IP address to direct clients to the correct UAG node.
- The URL (Horizon-int.kempdemo.com) in this example points to the internal LoadMaster (10.10.10.103) publishing Connection Servers as configured in Create the Connection Server Virtual Services.
- The URL (Horizon.kempdemo.com) in this example points to the IP address (10.10.10.154) of the external LoadMaster publishing the UAG Servers.
- The IP address (10.10.10.156) in this example would be the public IP address of the external LoadMaster publishing UAG1.
- The IP address (10.10.10.157) in this example would be the public IP address of the external LoadMaster publishing UAG2.
This method uses port TCP 443 for Blast. The Virtual Service can be updated to support TCP 8443 should the environment require that configuration.
8.6 Multiple VIP Affinity Virtual Services (Method 3)
This step-by-step setup of VSs leverages the Kemp application template for UAG - Multiple VIP Affinity.
Each template configuration can only support a single VIP. Because this method leverages multiple VIPs, two templates must be used.
The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster Application Programming Interface (API) and automation tools.
8.6.1 Create the UAG Multiple VIP Affinity HTTPS Virtual Service
The following are the steps involved and the recommended settings to configure the VMware UAG Multi-VIP Affinity Virtual Service:
1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.
2. Type a valid Virtual Address.
3. Select the UAGLB HTTPS Multi-VIP Affinity template from the Use Template drop-down list.
4. Click Add this Virtual Service.
8.6.1.1 Configure UAGLB TCP HTTPS - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAGLB TCP HTTPS -Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 443 is entered.
7. Click Add This Real Server.
8. Repeat this step to add more Real Servers as needed.
This Virtual Service will be the only one with multiple Real Servers.
8.6.1.1.1 UAGLB TCP HTTPS - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
443 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
https |
|
Checkurl |
/favicon.ico |
|
CheckUseGet |
0 |
| CheckPort | 443 |
8.6.2 Create the UAG1 Multiple VIP Affinity Blast and PCoIP Virtual Service
The following are the steps involved and the recommended settings to configure the VMware UAG Multi-VIP Affinity Virtual Service:
1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.
2. Type a valid Virtual Address.
3. Select the UAGLB PCoIP and Blast Multi-VIP Affinity template in the Use Template drop-down list.
4. Replace the Service Name with unique label to prevent duplicate Virtual Service names (for example, UAG1).
If you skip renaming the Virtual Service, the Virtual Service creation for the remaining UAG applications later in this guide will fail.
5. Click Add this Virtual Service.
8.6.2.1 Configure UAG1 TCP Blast - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG1 TCP Blast -Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 443 is entered.
7. Click Add This Real Server.
UAG1 should be the only Real Server added to this Virtual Service.
8.6.2.1.1 UAG1 TCP Blast - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
443 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
tcp |
|
Checkport |
443 |
8.6.2.2 Configure UAG1 UDP Blast - Multi-VIP Affinity
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the on UAG1 UDP Blast - Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 8443 is entered.
7. Click Add This Real Server.
UAG1 should be the only Real Server added to this Virtual Service.
8.6.2.2.1 UAG1 UDP Blast - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
8443 |
|
prot |
udp |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
icmp |
8.6.2.3 Configure UAG1 TCP PCoIP - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG1 TCP PCoIP - Multi-Port Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 4172 is entered.
7. Click Add This Real Server.
UAG1 should be the only Real Server added to this Virtual Service.
8.6.2.3.1 UAG1 TCP PCoIP - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
4172 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
tcp |
|
Checkport |
4172 |
8.6.2.4 Configure UAG1 UDP PCoIP - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG1 UDP PCoIP -Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 4172 is entered.
7. Click Add This Real Server.
UAG1 should be the only Real Server added to this Virtual Service.
8.6.2.4.1 UAG1 UDP PCoIP - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
4172 |
|
prot |
udp |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
icmp |
8.6.3 Create the UAG2 Multiple VIP Affinity Blast and PCoIP Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Type a valid Virtual Address.
3. Select the UAGLB PCoIP and Blast Multi-VIP Affinity template in the Use Template drop-down list.
4. Replace the Service Name with a unique label to prevent duplicate Virtual Service names (for example, UAG2).
5. Click Add this Virtual Service.
If the Virtual Service creation fails, it is possible that you skipped the step to rename the Virtual Service and therefore there is a name duplication error thrown.
8.6.3.1 Configure UAG2 TCP Blast - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG2 TCP Blast -Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 443 is entered.
7. Click Add This Real Server.
UAG2 should be the only Real Server added to this Virtual Service.
8.6.3.1.1 UAG2 TCP Blast - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
443 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
tcp |
|
Checkport |
443 |
8.6.3.2 Configure UAG2 UDP Blast - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG2 TCP Blast -Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 8443 is entered.
7. Click Add This Real Server.
UAG2 should be the only Real Server added to this Virtual Service.
8.6.3.2.1 UAG2 UDP Blast - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
8443 |
|
prot |
udp |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
icmp |
8.6.3.3 Configure UAG2 TCP PCoIP - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAG2 TCP PCoIP - Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Confirm that port 4172 is entered.
7. Click Add This Real Server.
UAG2 should be the only Real Server added to this Virtual Service.
8.6.3.3.1 UAG2 TCP PCoIP - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
4172 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
tcp |
|
Checkport |
4172 |
8.6.3.4 Configure UAG2 UDP PCoIP - Multi-VIP Affinity Virtual Service
Follow the steps below to configure this Virtual Service:
1. In the main menu of the LoadMaster WUI, go to Virtual Services > View/Modify Services.
2. Click Modify on the UAGLB UDP PCoIP - Multi-VIP Affinity Virtual Service.
3. Expand the Real Servers section.
4. Click Add New.
5. Type the Real Server Address.
6. Update the Real Server Port to 4172.
7. Click Add This Real Server.
UAG2 should be the only Real Server added to this Virtual Service.
8.6.3.4.1 UAG2 UDP PCoIP - Multi-VIP Affinity Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
4172 |
|
prot |
udp |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
CheckType |
icmp |
8.6.4 Example LoadMaster Configuration - Multiple VIP Affinity
Additional UAG appliances can be added to the configuration by using the Blast and PCoIP template. You must use a unique Virtual Service IPaddress and name.
9 App Volume Manager
The App Volume Manager is a console for managing configuration, creation of AppStacks, and assignment of AppStacks and writable volumes.
This step-by-step setup of VSs leverages the Kemp application template for Horizon 7 and Horizon 8.
The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster Application Programming Interface (API) and automation tools.
SSL/TLS certificates should be added before creating this VS. For further information on certificates, refer to the SSL Accelerated Services Feature Description.
9.1 Create the App Volume Manager Virtual Services
The following are the steps involved and the recommended settings to configure the VMware App Volume Manager Virtual Service:
1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.
2. Type a valid Virtual Address.
3. Select the VMware App Volume Manager template in the Use Template drop-down list.
4. Click Add this Virtual Service.
5. In the left-hand navigation select View/Modify Services.
6. Click Modify on the Virtual Service on TCP port 443.
7. Expand the SSL Properties section.
8. Select the certificate to use from Available Certificates and click the arrow (>) to move it to Assigned Certificates.
9. Expand the Real Servers section.
10. Click Add New.
11. Type the Real Server Address.
12. Confirm that port 443 is entered.
13. Click Add This Real Server.
14. Repeat this step to add more Real Servers as needed.
9.1.1 App Volume Manager Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
443 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
Persist |
src |
|
PersistTimeout |
3600 |
|
CheckType |
https |
|
Checkurl |
/ |
|
CheckUseGet |
1 |
9.1.2 App Volume Manager Redirect Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
80 |
| prot | tcp |
| VStype | http |
| Forcel7 | 1 |
| Transparent | 0 |
| ErrorCode | 302 |
| ErrorUrl | https://%h%s |
| CheckType | None |
10 Workspace One Access
The VMware Workspace One Access provides several functions in relation to the Horizon 7 and Horizon 8 implementation such as a portal where users gain access to different types of applications including SaaS-based, enterprise identity management to sync and extend Active Directory, and single sign on. There is also a self-service app store that enables users to search and select applications in a simple way.
This step-by-step setup of VSs leverages the Kemp application template for Horizon 7 and Horizon 8.
The table in each section outlines the settings configured by the application template. You can use this information to manually configure Virtual Services or use the Kemp LoadMaster Application Programming Interface (API) and automation tools.
SSL/TLS certificates should be added before creating this VS. For further information on certificates, refer to the SSL Accelerated Services Feature Description.
10.1 Create the Workspace One Access Virtual Services
The following are the steps involved and the recommended settings to configure the VMware Workspace One Access Virtual Service:
1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services > Add New.
2. Type a valid Virtual Address.
3. Select the Workspace One Access template from the Use Template drop-down list.
4. Click Add this Virtual Service.
5. In the left-hand navigation select View/Modify Services.
6. Click Modify on the Virtual Service on TCP port 443.
7. Expand the Real Servers section.
8. Click Add New.
9. Type the Real Server Address.
10. Confirm that port 443 is entered.
11. Click Add This Real Server.
12. Repeat this step to add more Real Servers as needed.
10.1.1 Workspace One Access Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
|
API Parameter |
API Value |
|---|---|
|
port |
443 |
|
prot |
tcp |
|
VStype |
http |
|
SubnetOriginating |
1 |
|
Forcel7 |
1 |
|
Transparent |
0 |
|
Schedule |
lc |
|
Persist |
src |
|
PersistTimeout |
3600 |
|
CheckType |
https |
|
Checkurl |
/ |
|
CheckUseGet |
1 |
10.1.2 Workspace One Access Redirect Virtual Service Recommended API Settings (optional)
This table outlines the API parameters and values set using the Kemp application template. You can use these settings with scripts and automation tools.
| API Parameter | API Value |
|---|---|
| port |
80 |
| prot | tcp |
| VStype | http |
| Forcel7 | 1 |
| Transparent | 0 |
| ErrorCode | 302 |
| ErrorUrl | https://%h%s |
| CheckType | None |
Last Updated Date
This document was last updated on 21 February 2022.