The following section shows you how to make use of VMware’s Unified Access Gateway (UAG) Appliance to give the enduser access into our virtual Desktop / Remote hosted Applications over an unsecure network like the Internet.
When we are creating this access we have multiple options.
- Using a VPN to ‘tunnel’ into the secure cooperate network environment and connect further to the Horizon View environment.
- Placing a Windows Server in the DMZ and installing/configuring the Horizon View Security Server and make it public accessible.
- Placing the virtual Unified Access Gateway in the DMZ and installing/configuring the Horizon View Security Server and make it public accessible.
What is the / my recommendation nowadays? Go with the Unified Access Gateway. Why?
- It is a general opinion within Security experts that a Windows, even if it’s hardened, offers more attack potentials than a hardened minimal linux.
- Using the Windows based security server creates a 1:1 relationship between the Security Server and the Connection Server, therefore it takes away some access flexibility.
- The UAG is getting more and more features to integrate other solutions like specific Airwatch functionality
- You can make use of the UDP based Blast Extreme Protocol Adaptive Transport protocol that gives you a better remote/user experience even if you are connecting over a lossy network
- It is much easier to operate than the first Access Point versions VMware has made GA a few years ago ;-)
One important aspect of the UAG is that you need to know about the packet-flow between the Horizon Client and the Desktop. You will be dependant on the networking and security guys. Make sure you are able to clearly articulate the requirements and what is going to happen. If you can tell the flow, the other people will be able to help you much better.
In the following article I am going to tell you how easy it is to set up a load balanced Horizon View environment. But remember: Just because something is easy to install it is not necessarily easy to design. There are multiple design affecting factors I am going to discuss in my #design guide. There are many Installation Guidelines out there, so I will keep it quick and simple and try to give you some hints what to do or not to do.
What do I want to achieve or show to you in this blog post?
- Creation Redundant Connection Server to access virtual Desktops
- A redundant Load Balancer in front of it (#NSX ftw)
- Internal Access only – I spent a lot of time with the Unified Access Gateway and show you in the second blog post about how to enable access over the Internet into your Horizon Homelab
The Connection Server is a core component within our Horizon View environment. It gives us the opportunity to create Desktop Pools out of Windows / Linux machines or Application Pools (based on Microsoft RDSH-Hosts) and entitle them to any Active Directory User in our environment. It offers us the following key functionality
- Brokering between Endpoints (that have the Horizon Client installed) and a virtual Desktop / Remote Desktop Session Host (Application)
- Authentication Handler (AD only or 2nd factor)
- View Administration via web-based (Flash :-/ ) user interface
- HTML5-Client to access the Desktops/Applications without the need of a client
- Connection to the vCenter Server to create new VMs / Desktops
*taken from the Horizon Reference Architecture
This section within my VDI series is not just relevant for VDI environments. In the following I will cover many things that are relevant for regular vSphere (cloud-a-like) environments.
The Management & Virtualization Layer plays quite an important role within a VDI environment. Within EUC solutions we typically should focus on the User and the User experience. But before we can deliver a performant, reliable and available working environment we need to make sure the layer on the bottom is rock solid as well.
What is the purpose of this layer?
- Hosting Instances of Virtual Desktops
- Hosting Instances of Remote Desktop Session Hosts (RDSH)
- Hosting Management components
- Components for brokering between Endpoints (Desktop User) and the Virtual Desktops Horizon View)
- Components for Integrating with Virtualization Management (Horizon View & vCenter Server)
- Delivering Applications into the Virtual Desktops (App Volumes)
- Monitoring of the Environment (e.g. Icinga)
- Operations Management (vRealize Operations Manager and Log Insight)
- Management of the Virtual Machines (aka Desktops / RDSH Hosts) and the Hypervisor (vCenter Server)
- Component for managing Security relevant components (NSX-Manager)
In my design guide I will write about general design decisions regarding the management & virtualization layer. In my implementation guide I will give you hints about the setup of the environment.
The goal of this post is to describe / discuss design implications, design decisions and characteristics for the following relevant Products within the core Layer in their most current release:
- vSphere Layer
- vCenter Server
- NSX Manager
- Horizon View Connection Server
Implementation Details can be found in the corresponding Implementation post I have created.
Before we can start with the implementation guide I want to give a brief description what key functionalities must exist.
The following components has been installed and configured:
- vSphere ESXi host (physical or nested)*
- vCenter Server (Appliance)*
- HA/DRS Cluster
- vSAN Cluster
- Active Directory Domain Controller (including DNS)*
- Microsoft Certificate Authority Role*
- NSX Manager*
- FTP Service (for backing up NSX Manager)
- CIFS-Share for UEM User Profile Archive and Config files
This will be the first post in my Horizon Guide implementation section. Since my focus is on Horizon I will not go through each of the steps that are involved in setting up the foundation. If you want to get a feeling of the purpose of my blog series: Check it out here.
In my design guide I will write a little bit about general design decisions regarding the management & virtualization topic. In my implementation guide I will quickly go through the setup I have chosen. As a side note I want to remember you to always use English Language and Keyboard Layout :-). Going into native US-Mode for all kind of setup will keep a lot of pain away from you.
Before being selected as an EUC champion I was already planning a bigger guide on how to design and implement a feature rich and enterprise ready VMware Horizon environment (Check out my opinion about the evolvement of VDI solutions over the years).
In 2017 VMware is putting more and more effort into transforming the enterprises into digital workspaces with their Workspace One solution / initiative. Within Workspace One VMware combines Horizon with Airwatch technology (for device management and application delivery).
Since my homelab has been a little bit underutilized over the last months I decided to built up an Horizon environment , including most of the Software pieces of Horizon Enterprise. Lucky me: VMware has just announced Horizon 7.2 which finally includes a new help desk tool to deliver faster 1/2nd level support to our (beloved) users.
My goal of this series is not just to have a simple implementation guide. I want to give a guideline about important things from an architectural point of view as well.
As every year Eric Siebert started the collection for votes regarding the best blogs within the virtualization field.
Caused by the great blogging-landscape I was quite surprised last year to have reached the Top 100. To be honest this was surely related to my engagement during Partner enablement and Trainings (where one or the other blog post of mine has been shown). Since I have been trapped in Projects for the last months I would be really surprised to reach this position again. Anyway I felt very honoured to be qualified again as a #vExpert and for the first time also as an #EUCchampion.
I tried to deliver content that is technically useful (from my hardly learned lessons) or gave you some insights in my thinking or conference experiences (VMworld videos). So if you took some fun or benefit out of my content I would really look forward to gain the one or another vote.
Here you can give your vote. Thanks Turbonomic (formerly VMturbo) and Eric Siebert to sponsor and execute this event once again.
I am listed with this blog this year: vLenzker (Fabian Lenz)
Introducing the Cloud Pod Architecture and Global entitlements within Horizon View was quite an important step. Suddenly the boundaries of having a Pool per Cluster was dealt with.
Since there is still a misunderstanding about the Cloud Pod Architecture and one feature Global Entitlement, please keep in mind:
A Global Entitlement does not create a Desktop Pool that spans multiple Clusters. It puts a logical layer for the Active Directory entitlement on top of existing independent Desktop pools.
There can be multiple use cases for that. Having multiple independent View environments in different locations or just having a Single vCenter with multiple Clusters. Since we are dealing with independent pools (and just putting a logical entitlement layer on top of it) all the templates and Desktop pool operations must be done local on each pool.
Once a year I am confronting myself with the question. Shall I go to this year’s VMworld? Following the discussion on Twitter and at Customer’s site a lot of people tend to say the good old words every culture of the mankind has been hearing:
“(#VMworld) is not the same any more…..When I was young, real knowledge and content was presented… . I was at #VMworld in the old days before it was cool….”
I think they are wrong and I will try to argument why this is my opinion.
During the beginning of the year I asked myself if they were right or not. What were the reason for those statements. After those technical (broken macbook) and non-technical (lack of dodgeball skills) disasters I was faced with during last years VMworld I needed to reevaluate for myself if my personal invest into going to VMworld is worth the money.
People knowing me better (and understanding what I am actually doing) know that I am very excited going to #VMworld. With the following post I try to give you some reasons why I love it & why VMworld is a great event and foundation to develop yourself a little further (it’s all about personal development, isn’t it?!)
If it’s your first time visiting VMware’s US event I think you will be able to extract some useful information to gain a maximum benefit out of it.
The release of vSAN 6.6 came with a tremendous ‘what’s new feature set’ brining VMware’s software-defined storage and hyper-converged solution to the next level. Many bloggers out there in the community did a great to job to explain the details of the following new features:
- Removal of the Multicast requirement
- Encryption using existing KMS solutions (KMIP 1.1 compatible)
- Stretched Cluster enhancements (changing of witness hosts and secondary level of failure protections within a site)
- Re-synchronization enhancements (including throttling)
- Web Client independant vSAN monitoring User Interface
- Performance enhancements
- Maintenance Mode enhancements including more information and prechecks
- New ESXCLI commands (that can be used with PowerCLI, e.g. to easily get smart data of the physical devies)
- and many more…
It’s been a month since NSX 6.3 has been released. It just came to my attention that an unknown behaviour of the NSX-Controller has been changed with that release.
We have 3 NSX-Controller while 2 of them should at least be available to remain complete functional. As we all hopefully now the NSX-Controller manages tables (VTEP, MAC, ARP) for Layer-2 VXLAN Operations (if we have selected hybrid or unicast as a replication mode).
The following tables tries to explain the impact of controller failures in case we are in Unicast or Hybrid-Mode in case of Layer-2 switching functionality:
|NSX Controller Available
||NSX-Controller Operations Mode
||New VMs or vMotioned VMs will have networking issues
||New VMs or vMotioned VMs will have networking issues