AskAresh

Intermittent Clipboard issues on VMware Horizon virtual desktop

Recently, we had an issue within our environment where-in end-users complained of intermittently one-way clipboard not working(Virtual Desktop to Endpoint will fail). The tricky part here was it would happen intermittently to anyone without any set pattern.

Environment Details:
VMware Horizon 7.11
VMware App Volumes 2.18.1
VMware Dynamic Environment Manager 9.10
VMware Horizon Client 5.x

Process of elimination

We were not using the Horizon Blast GPO for setting the clipboard.
The clipboard was setup using DEM Horizon Smart Policies – Enabled Both Directions
Upgrade the Horizon Client to the latest version to remove any Client related issues
We already had the anti-virus process exclusion of VMwareViewClipboard.exe
We disabled the Writable Volumes, and the clipboard issue will never occur.

Resolution

The above test made it evident that something within the Writable Volumes was causing the intermittent clipboard issue. The next thing that came to mind is adding path/process exclusion within the snapvol.cfg. One may ask how did you determine that path, but recently we have had many application issues that needed exclusion to make them work.

What I didn’t know was which path or process, until the task manager showed a clipboard process for Horizon called – VMwareViewClipboard.exe and its Path – C:\Program Files\Common Files\VMware\Remote Experience\x64. I read many communities post having mentioned this process. However, I wasn’t sure if adding the entire path exclusion made sense as I could see many Horizon process *.exe and wasn’t sure what additional repercussions it can have. I went ahead, adding the below process exclusion.

exclude_process_name=VMwareViewClipboard.exe

Process exclusion in writable volumes snapvol.cfg

Post adding the exclusion, all the end-users with intermittent clipboard issues were always able to do two side clipboard. In this blog, I am not outlining the steps on how to add the snapvol.cfg exclusion as my ex-colleague Daniel Bakshi outlines on a VMware blog post on how to do it step by step.

Update 2nd May 2020
We had a VMware GSS support case open on the same issue, and they came back with a suggestion to exclude this registry path instead of the process exclusions. Note we been told there is no impact with process or registry, but its a good practice to do registry/path exclusions instead of the process. This registry/subkeys are responsible for the Clipboard – DEM Horizon Smart Policies.

exclude_registry=\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware UEM

Process exclusion in writable volumes snapvol.cfg

I hope you will find this information useful if you encounter intermittent clipboard issues.

Thanks,
Aresh Sarkari

Tags: App Volumes, Dynamic Environment Manager, Horizon, VMware

Comments Leave a Comment
Categories App Volumes, Horizon

Black Screen on mobile devices during logon – VMware Horizon and VMware Workspace One

17 Dec

We had a strange issue in which end-users reported a black screen when they clicked on their Desktop tile in Workspace One portal on their mobile devices on Android and iOS. The moment they clicked on the endpoint the black screen would go away and it would give the logon banner and normal Windows 10 logon.

Usual Suspects

Our investigation led to Windows Logon Banner applied via the group policy causing the black screen. We were soon able to rule out by disabling the logon banner and the black screen persisted.
The black screen only appear on mobile devices. The Desktop/Laptops you didnt observe the issue.

EUC Stack

VMware Horizon 7.6
VMware App Volumes 2.14.2
VMware Identity Manager 3.3
VMware User Environment Manager 9.4
Windows 10 1803

Resolution

We managed to open the VMware GSS case and a lot of troubleshooting was carried out from re-running the VMware OSOT tool and changing the Power Configuration policy.

The final configuration that resolved the black screen issue:

Open the master image and run PowerShell with administrative rights and execute the following commands:

powercfg -change -monitor-timeout-ac 0
powercfg -change -monitor-timeout-dc 0

(Note – Here 0 means Never)

Power and Screen Settings – Windows 10

Make sure you restart the master template post implementing the commands . Take a snapshot and perform “Push-Image” operation in Horizon Administror console.

I hope you will find this information useful if you encounter the Black Screen issue. A big thanks to Manivannan Arul my teammate for his continoursly effort while troubleshooting with GSS.

Thanks,
Aresh Sarkari

Continue reading →

Tags: Horizon, VMware

Comments 1 Comment
Categories Horizon, Workspace ONE Access

VMware EUC – Horizon, UAG, VIDM and AppVolumes – NSX Load Balancing – Health Check Monitors

2 Feb

There is no single place to find a consolidated list of Load balancer health check monitors (aka Service Monitors in NSX) for the VMware EUC products:

I have been using VMware NSX load balancer across the board. The below details will provide an overview of what to enter for the health monitors. Note – If you are using something more meaningful for your environment leave feedback in the comments section. I will try to implement the same and update the blog later.

VMware Unified Access Gateway (UAG)

Create a new Service Monitor under NSX and call is UAG_https_monitor. Refer to the screenshot for more details.

Send String: GET /favicon.ico

VMware Identity Manager (VIDM)

Create a new Service Monitor under NSX and call is VIDM_https_monitor. Refer to the screenshot for more details.

Send String: GET /SAAS/auth/login
Response code: 200s

Horizon Connection Servers

Create a new Service Monitor under NSX and call is Horizon_https_monitor. Refer to the screenshot for more details.

Send String: GET /broker/xml/
Receive string: /styles/clientlaunch-default

VMware App Volumes

Create a new Service Monitor under NSX and call is AV_https_monitor. Refer to the screenshot for more details.

I hope you will find these monitors useful in monitoring the VMware EUC products.

Thanks,
Aresh Sarkari

Comments 3 Comments
Categories App Volumes, Horizon, NSX, Unified Access Gateway, Workspace ONE Access

Bye Bye VMware and Hello Dell EMC here I come!

16 Aug

On 9^th Aug 2018, I took the most difficult decisions of my life to leave my country India and one of the best companies in information technology VMware after working for 4.5 years. Our search for a better standard of living in a developed country and secured future for my kids ended up in Australia. We did evaluate Canada & Germany as well, but looking at all the factors, Australia was the place which we locked down to migrate and settle.

Back in early June, I started looking for an internal transfer within VMware. However, after talking to multiple bosses and divisions, nothing was materializing for an internal move. I had to make a hard choice to leave VMware and move ahead with my decision of moving countries. I began my job hunt during my notice period within VMware and 15 days later I came across a wonderful opportunity in Dell EMC @ Sydney, Australia. I am pleased that I got an opportunity in the parent and consortium of companies

Although I am going to miss working with a lot of colleagues @ VMware. But I am looking forward to working with new colleagues, projects and challenges in Dell EMC. It would be fun learning new things and solving problems from the real world and get an outside perspective. Will keep in touch on Twitter and LinkedIn

Thanks,
Aresh Sarkari

Comments 7 Comments
Categories Uncategorized

Update VMware vSAN Storage Controller Firmware and Driver – In three easy steps

9 Jul

We were having frequent hardware issues on our Dell PowerEdge R630 hyper converged servers and the Dell Support recommended in upgrading the Avago (LSI) Dell PERC H730 Mini Controller Driver and Firmware to the latest version.

Avago (LSI) Dell PERC H730 Mini	Existing Version	Dell Recommended
Firmware	25.5.2.0001	25.5.4.0006
Driver	6.910.18.00	7.703.18.00-1OEM

Note: The procedure of upgrade is applicable and tested on vSphere 6.5 U1 or vSAN 6.6 environments

We were running the support Driver/Firmware as all vSAN Health checks were green. However, there was a latest build available which included few additional fixes. Let me show you how easy it was to update the Storage Controller Drivers and Firmware using the VMware Update Manager and vSAN Configuration Assistant Upgrade Tool.

The Sequence that we need to execute is as follows:

Upgrade the Driver – LSI_mr3 VIB driver using the VMware Update Manager
After doing the above step you will start seeing the Controller Firmware and Avago Management Tool listed in the vSAN Configuration Assistant Update Tool

Step 1 – Sync Cluster to Perform Online Test

Add the my.vmware.com account in the vCenter to enable checking/sync with the online engine

Enter the Username and Password

Step 2 – Update Storage Controller Driver

The VMware Update Manager (VUM) will perform the Controller Driver Update in rolling reboot fashion one ESXi Host at a time

Select the Cluster and Choose the lsi_mr3: Avago Native MegaRAID SAS driver

Update Manager - LSI Controller Driver Package

Click on the Remediate Button
- Select VSAN Cluster under Baseline Groups and the VIB Driver LSI under Baselines
- Click Next

Select all the Host in the Cluster (E.g. If you want to perform a quick test you can select one-host). In our case we selected all the 21 hosts

Select the Package

Click on Ignore warning

Select Do Not Change Power State and leave the timings to defaults

Select the three options as below
- Disable DPM
- Disable HA admission control
- Migrate Powered-off VM

Click Finish
- Click on Pre-check Remediation and see the current configuration
- The upgrade will start in a rolling reboot (1-by-1)

Make sure to verify the versions of the driver is showing updated/passed in the VSAN health tests

Step 3 – Storage Controller Firmware

Once the Driver is installed the Controller Management Tools and Firmware for Avago get listed together in the vSAN Configuration Assistant Update tool.

Both the components get installed onto the ESXi host together:

Click on Download and that will turn the status in Ready to install
Click on the Update All and select the second option Rolling reboot (one host at a time)
Install the Firmware on all the ESXi Host within the cluster.

vSAN - Configuration Assistant Update Tool

Make sure to verify the versions of the firmware is showing updated/passed in the VSAN health tests

Check the Up-time of the ESXi host (Check every 2 hours and update the tracker)

This step will enable you to track the progress of the cluster as on how many host are done. In our scenario for the Driver (8 hr) and Controller (8 hr) combined together for a 21 host cluster it took close to 16 hours. Off course this number will vary depending upon the cluster usage.

Connect to the vCenter Linked mode

Connect-VIServer -Server rack-1-vc-5.domain.com -Protocol https -AllLinked

Check the Uptime of ESXi Host

Get-VMHost | Get-View | select Name, @{N="Uptime"; E={(Get-Date) - $_.Summary.Runtime.BootTime}}

I hope you will find these steps useful in upgrading the VSAN Controller/Driver firmware easily using the Update Manager + Configuration Assist Update Tool. Let me know, if you have additional questions in the comments section.

Thanks,
Aresh Sarkari

Comments 2 Comments
Categories vSAN

Poor man’s Samsung DEX HUB and VMware Horizon Advantage

22 Jun

I had been intrigued by the Samsung DeX mode post its launch but didn’t have the courage to buy the 125$ (Rs. 10,000/- INR) Samsung DeX Station. I was on a look-out for an alternate Hub which could do the DeX mode on my Galaxy S8+ for a lot less. After searching @ AliExpress I finally managed to find a hub called EASYA Thunderbolt 3 USB C to HDMI Adapter DeX Mode for Samsung Galaxy S8/S9 which had some good positive reviews and for 33$

The moment of truth was to plug-in the Galaxy S8+ and try the DeX mode. Attempt-1: Managed to plug the phone to the hub and HDMI monitor as the output. Next thing I noticed was the screen mirror got enabled and DeX Mode pop-up wouldn’t come or get detected.

Attempt-2: Additional to the above I plugged in the Power in the USB-C 3.1 PD Port and magically the pop-up appeared on the phone “Start DeX Mode”

If you don’t have the wireless mouse plugged in the entire Galaxy S8+ screen acts like a mouse trackpad which can come-in handy.

EASYA Thunderbolt 3 USB Type-C Hub To HDMI Adapter Dex Mode

Productivity with VMware Horizon:

The Horizon Client available on the Android Store has integration with DeX mode that enables you to use the Virtual Desktop in Full screen mode. I launch my Windows 10 Desktop and use it for an entire day. I was easily able to work on the following applications without any issues

Microsoft Outlook Client
Chrome and Firefox browser
Skype for Business (Audio/Chat Only) – Video was having issues
VMware Performance Tracker was showing the CPU and Network Bandwidth Usage graphs in real-time
There was no lag or any sign of slowness in any form
CPU Usage on the phone at an average of 4-6%

Known Observations:

The phone didn’t heat all day during its usage
The HUB was reasonably warm during the entire day usage
The limited DeX compatible Application works good in full-screen

More Picture on the Usage

DeX Mode and Horizon Client Launch

DeX Mode and Full Screen – Windows 10 + Dell 24 inch Monitor

Hardware Setup – Logitech M140 Bluetooth Keyboard + Mouse

More Documentation on Samsung DeX + VMware Horizon

Using Horizon Client with Samsung DeX
Enable the DeX Mode Auto Launch Feature

I hope you find this HUB review and DeX mode usage with Horizon useful and will be able to use it as a daily driver. Let me know if you would like to know more in the comments section

Thanks,
Aresh

Comments 1 Comment
Categories Horizon

vRealize Operations Manager – Monitor Management Packs for Availability and Notification

25 Apr

If you are using multiple vRealize Operations Manager (vROPS) – Management Packs like Horizon, VSAN, NSX and vCenter and want to monitor their availability of the adapter/POD in terms of whether they are “Collecting Data” and get notified via email when the collection of data stops due to unknown reasons. Then go ahead and read further.

If you don’t setup the monitoring one doesn’t get notified until someone logins to the vROPS Manager and see the adapter status physically.

Adapter Status:

Collection State/Status:

To achieve the above its a 3 steps process. You will have to create the following:

Custom Symptom Definition
Custom Alert Definition
Custom Notification

Symptom Definitions

We will create four custom Symptom Definition (SD) for Horizon Adapter, Horizon POD as it collects data, vCenter instances and VSAN Adapter. Following are the SD combined:

Horizon Adapter Instance
- Open the vROPS Manager and navigate to Alerts – Symptom Definitions
- Click on the +
- Under the Base Object Type Select – View Adapter Instance
- Under Metrics Select vRealize Operations Generated – Availability
- Enter a Symptom Definition Name – SD_Horizon_Adapter_Avail
- is – Critical
- metric – is less than
- Numeric Value – 1
- Under Advance
  - Wait Cycle – 3
  - Cancel Cycle – 3
  - Recommended – The wait/cancel cycle of 3 means that in case of any failure user will be notified after 15 minutes (3 cycles x default 5 minutes data collection interval)

vCenter Adapter – vCenter
- Open the vROPS Manager and navigate to Alerts – Symptom Definitions
- Click on the +
- Under the Base Object Type Select – vCenter Server
- Under Metrics Select vRealize Operations Generated – Availability
- Enter a Symptom Definition Name – SD_vCenter_Adapter_Avail
- is – Critical
- metric – is less than
- Numeric Value – 1
- Under Advance
  - Wait Cycle – 3
  - Cancel Cycle – 3
  - Recommended – The wait/cancel cycle of 3 means that in case of any failure user will be notified after 15 minutes (3 cycles x default 5 minutes data collection interval)

View POD
- Open the vROPS Manager and navigate to Alerts – Symptom Definitions
- Click on the +
- Under the Base Object Type Select – View POD
- Under Metrics Select vRealize Operations Generated – Availability
- Enter a Symptom Definition Name – SD_View_POD_Avail
- is – Critical
- metric – is less than
- Numeric Value – 1
- Under Advance
  - Wait Cycle – 3
  - Cancel Cycle – 3
  - Recommended – The wait/cancel cycle of 3 means that in case of any failure user will be notified after 15 minutes (3 cycles x default 5 minutes data collection interval)

VSAN Adapter Instance
- Open the vROPS Manager and navigate to Alerts – Symptom Definitions
- Click on the +
- Under the Base Object Type Select – VSAN Adapter Instance
- Under Metrics Select vRealize Operations Generated – Availability
- Enter a Symptom Definition Name – SD_VSAN_Adapter_Avail
- is – Critical
- metric – is less than
- Numeric Value – 1
- Under Advance
  - Wait Cycle – 3
  - Cancel Cycle – 3
  - Recommended – The wait/cancel cycle of 3 means that in case of any failure user will be notified after 15 minutes (3 cycles x default 5 minutes data collection interval)

Alert Definitions

We will create four custom Alert Definition (AD) for Horizon Adapter, Horizon POD as it collects data, vCenter instances and VSAN Adapter. Following are the AD combined:

Horizon Adapter Instance
- Open the vROPS Manager and navigate to Alerts – Alert Definitions
- Click on the +
- Enter a Name – AD_Horizon_Adapter
- Under the Base Object Type Select – View Adapter Instance
- Under the Alert Impact
  - Impact – Health
  - Criticality – Symptom Based
  - Alert Type and Subtype – Virtualization/Hypervisor: Availability
  - Wait Cycle – 1
  - Cancel Cycle – 1
- Under Add Symptom Definitions
  - Defined on – Self
  - Symptom Definition Type – Metric /Property
  - In the search box enter the previously created Symptom Definition – SD_Horizon_Adapter_Avail
- Under Add Recommendations – Search and Select “Check if the resources are available. If it isn’t restart it. If it is available check the network connectivity between the remote checks and the resource”

vCenter Adapter Instance
- Open the vROPS Manager and navigate to Alerts – Alert Definitions
- Click on the +
- Enter a Name – AD_vCenter_Adapter
- Under the Base Object Type Select – vCenter Server
- Under the Alert Impact
  - Impact – Health
  - Criticality – Symptom Based
  - Alert Type and Subtype – Virtualization/Hypervisor: Availability
  - Wait Cycle – 1
  - Cancel Cycle – 1
- Under Add Symptom Definitions
  - Defined on – Self
  - Symptom Definition Type – Metric /Property
  - In the search box enter the previously created Symptom Definition – SD_vCenter_Adapter_Avail
- Under Add Recommendations – Search and Select “Check if the resources are available. If it isn’t restart it. If it is available check the network connectivity between the remote checks and the resource”

View POD
- Open the vROPS Manager and navigate to Alerts – Alert Definitions
- Click on the +
- Enter a Name – AD_View_PODS
- Under the Base Object Type Select – View Pod
- Under the Alert Impact
  - Impact – Health
  - Criticality – Symptom Based
  - Alert Type and Subtype – Virtualization/Hypervisor: Availability
  - Wait Cycle – 1
  - Cancel Cycle – 1
- Under Add Symptom Definitions
  - Defined on – Self
  - Symptom Definition Type – Metric /Property
  - In the search box enter the previously created Symptom Definition – SD_View_PODS_Avail
- Under Add Recommendations – Search and Select “Check if the resources are available. If it isn’t restart it. If it is available check the network connectivity between the remote checks and the resource”

VSAN Adapter Instance
- Open the vROPS Manager and navigate to Alerts – Alert Definitions
- Click on the +
- Enter a Name – AD_VSAN_Adapter
- Under the Base Object Type Select – vSAN Adapter Instance
- Under the Alert Impact
  - Impact – Health
  - Criticality – Symptom Based
  - Alert Type and Subtype – Virtualization/Hypervisor: Availability
  - Wait Cycle – 1
  - Cancel Cycle – 1
- Under Add Symptom Definitions
  - Defined on – Self
  - Symptom Definition Type – Metric /Property
  - In the search box enter the previously created Symptom Definition – SD_VSAN_Adapter_Avail
- Under Add Recommendations – Search and Select “Check if the resources are available. If it isn’t restart it. If it is available check the network connectivity between the remote checks and the resource”

Notifications

We will create four Notification Rules for Horizon Adapter, Horizon POD as it collects data, vCenter instances and VSAN Adapter. Following are the Rules for Email Alerts combined:

Rule – Horizon Adapter Instance is down
- Open the vROPS Manager and navigate to Alerts – Notification Settings
- Click on the +
- Enter a Name – _Horizon_Adapter is down
- Under Method Select – Standard Email Plugin
- Instance – SMTP (previous configured)
- Enter Recipients – Email Address
- Notification Trigger – Alert Definition
- Add the previously created _AD_Horizon_Adapter

Rule – vCenter Adapter Instance is down
- Open the vROPS Manager and navigate to Alerts – Notification Settings
- Click on the +
- Enter a Name – _vCenter_Adapter is down
- Under Method Select – Standard Email Plugin
- Instance – SMTP (previous configured)
- Enter Recipients – Email Address
- Notification Trigger – Alert Definition
- Add the previously created _AD_vCenter_Adapter

Rule – View POD is down
- Open the vROPS Manager and navigate to Alerts – Notification Settings
- Click on the +
- Enter a Name – _View_POD is down
- Under Method Select – Standard Email Plugin
- Instance – SMTP (previous configured)
- Enter Recipients – Email Address
- Notification Trigger – Alert Definition
- Add the previously created _AD_View_POD

Rule – VSAN Adapter is down
- Open the vROPS Manager and navigate to Alerts – Notification Settings
- Click on the +
- Enter a Name – _VSAN_Adapter is down
- Under Method Select – Standard Email Plugin
- Instance – SMTP (previous configured)
- Enter Recipients – Email Address
- Notification Trigger – Alert Definition
- Add the previously created _AD_VSAN_Adapter

I hope you will find this post useful and will help you improvise on monitoring/alerting of your vROPS Management Packs. A big thanks to Gagik Manukyan in demonstrating the ability to configure this in our internal setup.

Thanks,
Aresh Sarkari

Comments 1 Comment
Categories Horizon, vROps

VMware Horizon TrueSSO – Configuration for High Availability and Redundancy

13 Apr

In this post I will demonstrate the configuration that are required to deploy the VMware Enrollment Servers for High availability and redundancy. This includes two Certificate Authority CA’s and Enrollment Servers

My colleague Tarique Chowdhury has an excellent post on the TrueSSO Lab Setup. However in that deployment it talks about a single Enrollment Server and Certificate Authority Server.

This post is not a replacement of the Setting Up TrueSSO guide on VMware Pubs. However the below mentioned two sections complement during the configurations for everything else follow the setup guide/blogs:

Certificate deployment – Enrollment Agent (Computer).

Deploying the Enrollment Agent (Computer) certificate onto this server, we are authorizing this ES to act as an Enrollment Agent and generate Certificates on behalf of users.

Both the Certificate Authority Server Enrollment Agent (Computer) certificate needs to be added. They are added one-by-one. The Personal –> Certificate store should look like below on the ES:

Configure TrueSSO on the Horizon Connection Servers:

Step1: Adding both the Enrollment Server (ES) – Adding the ES to the environment, we are able to query the ES about the domain and relevant True SSO info.

vdmutil --authAs username --authDomain askaresh --authPassword password --truesso --environment --add –enrollmentServer tsso1.askaresh.com,tsso2.askaresh.com

Step2 – List both the newly deployed Enrollment Server – We will get info about various components of the environment which will be useful for configuring True SSO.

vdmutil --authAs username –authDomain askaresh --authPassword password --truesso --environment --list --enrollmentServer tsso1.askaresh.com --domain askaresh.com

vdmutil --authAs username –authDomain askaresh --authPassword password --truesso --environment --list --enrollmentServer tsso2.askaresh.com --domain askaresh.com

Step3 – Adding the Connector for TrueSSO – A True SSO Connector is a configuration set where we specify details like ES(s), CA(s) and a Certificate Template to use for a certain Domain. When a Horizon CS gets a request to launch a desktop for an AD user, it will look up True SSO Connector for the domain the user belongs to and will use the components as specified to obtain a Certificate on behalf of the user.

vdmutil --authAs username --authDomain askaresh --authPassword password --truesso --create --connector --domain askaresh.com --template TrueSSO --primaryEnrollmentServer tsso1.askaresh.com –secondaryEnrollmentServer tsso2.askaresh.com --certificateServer MSSUBCA01-CA,MSSUBCA02-CA --mode enabled

Step4 – List the SAML Authenticator available in Horizon environment – A SAML Authenticator contains the trust and metadata exchange between Horizon View and vIDM. To use True SSO, we need to identify the correct SAML Authenticator and enable True SSO.

vdmutil --authAs username --authDomain askaresh --authPassword password --truesso --list --authenticator

Step5 – Enable TrueSSO for the SAML Authenticator

vdmutil --authAs username --authDomain askaresh --authPassword password --truesso --authenticator --edit --name VIDM-PROD --truessoMode ENABLED

Step6 – Check the status on the Horizon Administrator Dashboard

I hope you find these steps useful during the TrueSSO Availability and Redundancy configurations.

Thanks,
Aresh

Comments 9 Comments
Categories Horizon

NSX Load Balancing for VMware Unified Access Gateway – Part1

5 Mar

This blog post will be a two part series showing you step by step on how to load balance VMware Unified Access Gateway (UAG) using the VMware NSX. There are quite a few options such as F5, KEMP etc. available to do the load balancing of the UAG appliance but in this post we shall deep dive into NSX Load balancing. The objective in a production deployment is to load balance multiple UAG appliances deployed in the DMZ.

Load Balancing of multiple VMware UAG Appliances

There are plenty of guidance available on how to create the NSX Edge to do the load balancing. I am not going to cover those steps in this blog. Instead I will fast forward to the Load Balancing configurations required to do Unified Access Gateway.

Pre-Installation Checklist

This list should include everything that needs to be available BEFORE we start to install the UAG Load Balancer.

A pair of UAG Appliances should be deployed
The admin page of both the UAG appliances should be accessible
Create a X-Large NSX Edge and make sure its deployed using HA (Active/Passive)
Enable Syslog on the NSX Edge
Reserve the VIP IP address used by NSX

Step-by-Step guide (Part1 – We shall cover Global Configuration, Application Profiles and Service Monitoring)

1. Configure the Load Balancing – Global Configuration

Log into the Edge GW you need to configure and go to the Manage tab then the Load Balancer tab.
Click on Global Configuration
- Check the Enable Load Balancer checkbox
- Check the Enable Acceleration checkbox
- Check the Logging checkbox
- Change the Log Level dropdown to Warning
- Leave the rest as the default
- Click Ok

2. Configure the Load Balancer – Application Profiles

Overall we will be creating three Profiles – HTTPS, TCP and UDP as follows:
Click on the green plus sign to add the HTTPS profile
- Set the Name to XX_External-SSL_Offload
- Set the Type to HTTPS
- Set Enable SSL Passthrough
- Persistent to Source IP
- Expires in (seconds): 28800 (Preferably match it from Horizon Administrator – Global Configuration Settings)
- Everything else should be blank, grayed out, or None
- Click Ok
Click on the green plus sign to add the TCP profile
- Set the Name to XX_External-TCP
- Set the Type to TCP
- Persistent to Source IP
- Everything else should be blank, grayed out, or None
- Click Ok
Click on the green plus sign to add the UDP profile
- Set the Name to External-UDP
- Set the Type to UDP
- Persistent to Source IP
- Everything else should be blank, grayed out, or None
- Click Ok

3. Configure the Load Balancer – Service Monitoring

Overall we will be creating three Service Monitors – HTTPS, TCP and UDP as follows:
Click on the green plus sign to add the Access Point TCP Monitor. This one monitor will be used for all APs.
- Set the Name to default_tcp_monitor
- Set the Interval to 5
- Set the Timeout to 15
- Set the Max Retries to 3
- Set the Type to TCP
- Click Ok
- Click on the green plus sign to add the Access Point HTTP Monitor. This one monitor will be used for all APs.
  - Set the Name to default_http_monitor
  - Set the Interval to 5
  - Set the Timeout to 15
  - Set the Max Retries to 3
  - Set the Type to HTTP
  - Set the Method to GET
  - Click Ok
  - Click on the green plus sign to add the Access Point HTTPS Monitor. This one monitor will be used for all APs.
    - Set the Name to default_https_moinitor
    - Set the Interval to 5
    - Set the Timeout to 15
    - Set the Max Retries to 3
    - Set the Type to HTTPS
    - In the Expected field, type: HTTP/1.1 200 (note there is a space between the 1.1 and 200)
    - Set the Method to GET
    - In the URL field, type /favicon.ico
    - Click Ok

Remaining configuration around the “Pools” and “Virtual Servers” to be continued in the NSX Load Balancing for VMware Unified Access Gateway – Part2

I hope you find these steps useful and don’t have to invent the wheel when it comes to NSX LB for VMware UAG.

Thanks,
Aresh

Comments Leave a Comment
Categories NSX, Unified Access Gateway

NSX Load Balancing for VMware Unified Access Gateway – Part2

5 Mar

In this post we shall go over the remaining configuration on “Pools” and “Virtual Servers” of the NSX Load Balancing for VMware Unified Access Gateway.

4. Configure the Load Balancing – Pools

Overall we will be creating four Pools as follows:
Click on the green plus sign to add a new pool
- In the Name field, type: XXX-UAG-POOL-8443
- Leave the Description blank
- For Algorithm, pick IP-HASH
- Leave Algorithm Parameters blank
- For Monitors, pick default_tcp_monitor
Click on the green plus sign to add a new pool
- In the Name field, type: XXX-UAG-POOL-4172TCP
- Leave the Description blank
- For Algorithm, pick IP-HASH
- Leave Algorithm Parameters blank
- For Monitors, pick default_tcp_monitor
Click on the green plus sign to add a new pool
- In the Name field, type: XXX-UAG-POOL-4172UDP
- Leave the Description blank
- For Algorithm, pick IP-HASH
- Leave Algorithm Parameters blank
- For Monitors, pick default_tcp_monitor
Click on the green plus sign to add a new pool
- In the Name field, type: XXX-UAG-POOL-443
- Leave the Description blank
- For Algorithm, pick IP-HASH
- Leave Algorithm Parameters blank
- For Monitors, pick default_https_monitor

5. Configure the Load Balancer – Virtual Servers

Overall we will be creating six virtual servers as follows:
Click on the green plus sign to add a new Virtual Server
- Click on Enable Virtual Server
- Click on Enable Acceleration
- Set the Application Profile to XX-External-UDP
- In the Name field, type: XXX-UAG-8443UDP
- Leave the Description blank
- For IP Address, select IP address by click on the link
- For Protocol select UDP
- In Port/Port Range type 8443
- Set Default Pool select XXX-UAG-Pool-8443
- Everything else should be default
Click on the green plus sign to add a new Virtual Server
- Click on Enable Virtual Server
- Click on Enable Acceleration
- Set the Application Profile to XX-External-UDP
- In the Name field, type: XXX-UAG-4172UDP
- Leave the Description blank
- For IP Address, select IP address by click on the link
- For Protocol select UDP
- In Port/Port Range type 4172
- Set Default Pool select XXX-UAG-Pool-4172UDP
- Everything else should be default
Click on the green plus sign to add a new Virtual Server
- Click on Enable Virtual Server
- Click on Enable Acceleration
- Set the Application Profile to XX-External-TCP
- In the Name field, type: XXX-UAG-8443TCP
- Leave the Description blank
- For IP Address, select IP address by click on the link
- For Protocol select TCP
- In Port/Port Range type 8443
- Set Default Pool select XXX-UAG-Pool-8443
- Everything else should be default
Click on the green plus sign to add a new Virtual Server
- Click on Enable Virtual Server
- Click on Enable Acceleration
- Set the Application Profile to XX_external_ssl_offload
- In the Name field, type: XXX-UAG-443HTTPS
- Leave the Description blank
- For IP Address, select IP address by click on the link
- For Protocol select TCP
- In Port/Port Range type 443
- Set Default Pool select XXX-UAG-Pool-443
- Everything else should be default
Click on the green plus sign to add a new Virtual Server
- Click on Enable Virtual Server
- Click on Enable Acceleration
- Set the Application Profile to XX_external_tcp
- In the Name field, type: XXX-UAG-4172TCP
- Leave the Description blank
- For IP Address, select IP address by click on the link
- For Protocol select TCP
- In Port/Port Range type 4172
- Set Default Pool select XXX-UAG-Pool-4172TCP
- Everything else should be default

Previous configuration around the “Global Configuration”, “Application Profiles” and “Service Monitoring” the NSX Load Balancing for VMware Unified Access Gateway – Part1

We haven’t configured any “Application Rules”. I hope you find these steps useful and don’t have to invent the wheel when it comes to NSX LB for VMware UAG.

Thanks,
Aresh

Comments Leave a Comment
Categories NSX, Unified Access Gateway

← Older Entries

Newer Entries →

Search

AskAresh

Intermittent Clipboard issues on VMware Horizon virtual desktop

Black Screen on mobile devices during logon – VMware Horizon and VMware Workspace One

VMware EUC – Horizon, UAG, VIDM and AppVolumes – NSX Load Balancing – Health Check Monitors

Bye Bye VMware and Hello Dell EMC here I come!

Update VMware vSAN Storage Controller Firmware and Driver – In three easy steps

Make sure to verify the versions of the driver is showing updated/passed in the VSAN health tests

Step 3 – Storage Controller Firmware

Make sure to verify the versions of the firmware is showing updated/passed in the VSAN health tests

Check the Up-time of the ESXi host (Check every 2 hours and update the tracker)

Poor man’s Samsung DEX HUB and VMware Horizon Advantage

vRealize Operations Manager – Monitor Management Packs for Availability and Notification

VMware Horizon TrueSSO – Configuration for High Availability and Redundancy

Certificate deployment – Enrollment Agent (Computer).

Step5 – Enable TrueSSO for the SAML Authenticator

Step6 – Check the status on the Horizon Administrator Dashboard

NSX Load Balancing for VMware Unified Access Gateway – Part1

Pre-Installation Checklist

NSX Load Balancing for VMware Unified Access Gateway – Part2

Recent Posts

Follow me on Twitter

Categories

Archives