This blog post will be a two part series showing you step by step on how to load balance VMware Unified Access Gateway (UAG) using the VMware NSX. There are quite a few options such as F5, KEMP etc. available to do the load balancing of the UAG appliance but in this post we shall deep dive into NSX Load balancing. The objective in a production deployment is to load balance multiple UAG appliances deployed in the DMZ.

Load Balancing of multiple VMware UAG Appliances

There are plenty of guidance available on how to create the NSX Edge to do the load balancing. I am not going to cover those steps in this blog. Instead I will fast forward to the Load Balancing configurations required to do Unified Access Gateway.

Pre-Installation Checklist

This list should include everything that needs to be available BEFORE we start to install the UAG Load Balancer.

• A pair of UAG Appliances should be deployed
• The admin page of both the UAG appliances should be accessible
• Create a X-Large NSX Edge and make sure its deployed using HA (Active/Passive)
• Enable Syslog on the NSX Edge
• Reserve the VIP IP address used by NSX

Step-by-Step guide (Part1 – We shall cover Global Configuration, Application Profiles and Service Monitoring)

1. Configure the Load Balancing – Global Configuration

• Log into the Edge GW you need to configure and go to the Manage tab then the Load Balancer tab.
• Click on Global Configuration
• Check the Enable Load Balancer checkbox
• Check the Enable Acceleration checkbox
• Check the Logging checkbox
• Change the Log Level dropdown to Warning
• Leave the rest as the default
• Click Ok
  

• Overall we will be creating three Profiles – HTTPS, TCP and UDP as follows:
  
• Click on the green plus sign to add the HTTPS profile
• Set the Name to XX_External-SSL_Offload
• Set the Type to HTTPS
• Set Enable SSL Passthrough
• Persistent to Source IP
• Expires in (seconds): 28800 (Preferably match it from Horizon Administrator – Global Configuration Settings)
• Everything else should be blank, grayed out, or None
• Click Ok
  
• Click on the green plus sign to add the TCP profile
• Set the Name to XX_External-TCP
• Set the Type to TCP
• Persistent to Source IP
• Everything else should be blank, grayed out, or None
• Click Ok
  
• Click on the green plus sign to add the UDP profile
• Set the Name to External-UDP
• Set the Type to UDP
• Persistent to Source IP
• Everything else should be blank, grayed out, or None
• Click Ok
  

3. Configure the Load Balancer – Service Monitoring

• Overall we will be creating three Service Monitors – HTTPS, TCP and UDP as follows:
  
• Click on the green plus sign to add the Access Point TCP Monitor.  This one monitor will be used for all APs.
• Set the Name to default_tcp_monitor
• Set the Interval to 5
• Set the Timeout to 15
• Set the Max Retries to 3
• Set the Type to TCP
• Click Ok
  
• Click on the green plus sign to add the Access Point HTTP Monitor.  This one monitor will be used for all APs.
• Set the Name to default_http_monitor
• Set the Interval to 5
• Set the Timeout to 15
• Set the Max Retries to 3
• Set the Type to HTTP
• Set the Method to GET
• Click Ok
  
• Click on the green plus sign to add the Access Point HTTPS Monitor.  This one monitor will be used for all APs.
• Set the Name to default_https_moinitor
• Set the Interval to 5
• Set the Timeout to 15
• Set the Max Retries to 3
• Set the Type to HTTPS
• In the Expected field, type:  HTTP/1.1 200 (note there is a space between the 1.1 and 200)
• Set the Method to GET
• In the URL field, type /favicon.ico
• Click Ok
  

Remaining configuration around the “Pools” and “Virtual Servers” to be continued in the NSX Load Balancing for VMware Unified Access Gateway – Part2

I hope you find these steps useful and don’t have to invent the wheel when it comes to NSX LB for VMware UAG.

Thanks,
Aresh

In this post we shall go over the remaining configuration on “Pools” and “Virtual Servers” of the NSX Load Balancing for VMware Unified Access Gateway.

4. Configure the Load Balancing – Pools

• Overall we will be creating four Pools as follows:
  
• Click on the green plus sign to add a new pool
• In the Name field, type: XXX-UAG-POOL-8443
• Leave the Description blank
• For Algorithm, pick IP-HASH
• Leave Algorithm Parameters blank
• For Monitors, pick default_tcp_monitor
  
• Click on the green plus sign to add a new pool
• In the Name field, type: XXX-UAG-POOL-4172TCP
• Leave the Description blank
• For Algorithm, pick IP-HASH
• Leave Algorithm Parameters blank
• For Monitors, pick default_tcp_monitor
  
• Click on the green plus sign to add a new pool
• In the Name field, type: XXX-UAG-POOL-4172UDP
• Leave the Description blank
• For Algorithm, pick IP-HASH
• Leave Algorithm Parameters blank
• For Monitors, pick default_tcp_monitor
  
• Click on the green plus sign to add a new pool
• In the Name field, type: XXX-UAG-POOL-443
• Leave the Description blank
• For Algorithm, pick IP-HASH
• Leave Algorithm Parameters blank
• For Monitors, pick default_https_monitor
  

5. Configure the Load Balancer – Virtual Servers

• Overall we will be creating six virtual servers as follows:
  
• Click on the green plus sign to add a new Virtual Server
• Click on Enable Virtual Server
• Click on Enable Acceleration
• Set the Application Profile to XX-External-UDP
• In the Name field, type: XXX-UAG-8443UDP
• Leave the Description blank
• For IP Address, select IP address by click on the link
• For Protocol select UDP
• In Port/Port Range type 8443
• Set Default Pool select XXX-UAG-Pool-8443
• Everything else should be default
  
• Click on the green plus sign to add a new Virtual Server
• Click on Enable Virtual Server
• Click on Enable Acceleration
• Set the Application Profile to XX-External-UDP
  
• In the Name field, type: XXX-UAG-4172UDP
• Leave the Description blank
• For IP Address, select IP address by click on the link
• For Protocol select UDP
• In Port/Port Range type 4172
• Set Default Pool select XXX-UAG-Pool-4172UDP
  
• Everything else should be default
  
• Click on the green plus sign to add a new Virtual Server
• Click on Enable Virtual Server
• Click on Enable Acceleration
• Set the Application Profile to XX-External-TCP
  
• In the Name field, type: XXX-UAG-8443TCP
• Leave the Description blank
• For IP Address, select IP address by click on the link
• For Protocol select TCP
• In Port/Port Range type 8443
• Set Default Pool select XXX-UAG-Pool-8443
  
• Everything else should be default
  
• Click on the green plus sign to add a new Virtual Server
• Click on Enable Virtual Server
• Click on Enable Acceleration
• Set the Application Profile to XX_external_ssl_offload
  
• In the Name field, type: XXX-UAG-443HTTPS
• Leave the Description blank
• For IP Address, select IP address by click on the link
• For Protocol select TCP
• In Port/Port Range type 443
• Set Default Pool select XXX-UAG-Pool-443
  
• Everything else should be default
  
• Click on the green plus sign to add a new Virtual Server
• Click on Enable Virtual Server
• Click on Enable Acceleration
• Set the Application Profile to XX_external_tcp
  
• In the Name field, type: XXX-UAG-4172TCP
• Leave the Description blank
• For IP Address, select IP address by click on the link
• For Protocol select TCP
• In Port/Port Range type 4172
• Set Default Pool select XXX-UAG-Pool-4172TCP
  
• Everything else should be default
  

Previous configuration around the “Global Configuration”, “Application Profiles” and “Service Monitoring” the NSX Load Balancing for VMware Unified Access Gateway – Part1

We haven’t configured any “Application Rules”. I hope you find these steps useful and don’t have to invent the wheel when it comes to NSX LB for VMware UAG.

Thanks,
Aresh

This year at VMworld, myself and my colleague Simon Long had the opportunity to talk about a project we’ve been working on for the past few years. We’ve been re-redesigning and deploying VMware’s internal Horizon Desktop environments.

Session Summary

“How does VMware architect its own global VMware Horizon desktop environment?” “Has it encountered the same obstacles we are facing?” Over the past two years, VMware has been re-architecting and deploying its virtual desktop infrastructure with VMware Horizon, VMware App Volumes, and VMware User Environment Manager running on top of the full VMware software-defined data center stack (VMware vSphere, VMware vSAN, VMware NSX) and integrating with VMware vRealize Operations Manager and VMware vRealize Log Insight. In this session, the lead architects will reveal all.

Our session (ADV1255BU – The Secret Sauce Behind VMware’s Internal VMware Horizon Desktop) includes the following sections:

• Where we we? – Why did we need to kick off this project (from the beginning)
• What do we need? – Revisiting the business and technical requirements (from 3:05)
• How do we do this better? – How do we design this new infrastructure making sure we don’t hit the same issues again (from 5:13)
• Where we are today? – A look at what we architected and deployed  (from 9:12)
• What did we learn? – What challenges did we face along the way (from 30:45)
• Where do we go from here? – How can we improve upon what we have built (from 41:51)

I hope you enjoy it and find it useful. Please contact myself or Simon if you have any questions around our session.

Thanks,
Aresh

I thought I would share some pretty exciting news with you guys, I’ve recently received an award internally within VMware for a cool project that myself and my colleague Simon Long have been working on for the past 6-8 months. The project in question is called OneDesk. I’ll explain more about OneDesk shortly.

CIO Innovation Award

The award we won is called the VMware CIO Innovation award. Here is the description of the Innovation category:

Aresh Sarkari – VMware CIO 2017 Innovation Award

I wasn’t very lucky to receive the award in-person as the award arrived in India a couple of days late and by then Bask Iyer had to leave back for PA, CA.

OneDesk

The project myself and Simon Long have been working on is called OneDesk. For those of you who attended our VMworld session: The Secret Sauce Behind VMware’s Internal Horizon Desktop Deployments you’d have heard us talking about it during our session. For those of you who were unfortunate enough to miss it, I’ll explain all about it now.

What is OneDesk?

OneDesk is many things to many people. Here are some of its main functions:

EUC Dogfooding environment
OneDesk is an End User Computing (EUC) environment created from un-used production hardware where we deploy pre-release versions of our EUC software (Horizon, App Volumes and User Environment Manager). This allows us to test our products before we make them publicly available to our customers and providing feedback to the product teams of any issues that we encounter throughout or testing.

Pre-Production Horizon Environment
OneDesk also acts a Pre-Production environment for VMware’s internal Production Horizon desktop environments in the US, EMEA and India. The availability of our production Horizon deployments is extremely important to the business and often updating software can lead to service outages. By deploying the newly released EUC software into OneDesk as early as possible, we can use our experiences to make decisions on when we will upgrade the production environments.

Next-Generation EUC Environment
OneDesk also acts a ‘Next-Generation’ environment for our production Horizon desktop environments in the US, EMEA and India. The availability of our production Horizon deployments is extremely important to the business and often introducing new products or configuration changes can lead to service outages. We will be deploying all new products and configurations into OneDesk first, allowing us to iron out any creases and monitor stability before we consider deploying these changes into the production environments.

VMware on VMware
Last but not least, this is a VMware on VMware initiative. Where there is a business need, we look to utilize as many of VMware’s products as possible. By utilizing our own products early in the development cycle we are able to identify bugs and offer feedback to our product teams to help improve our customer’s experience once the products are released.

How is OneDesk different from the VMware production Horizon desktop environments?

The table below gives you an idea of how the services differ:

The table below gives you an idea of how the product version differs between OneDesk and Production: (Version may have changed since publication)

Here is a list of features that we’ve used OneDesk to test before we deploy the features into our production environments:

• Instant Clones
• Blast Extreme
• Unified Access Gateway
• Enrollment Server / True SSO
• Skype For Business Plugin
• Horizon Smart Policies (UEM)
• NSX Edge Load-Balancer
• NSX Distributed Firewall (Micro-Segmentation)
• Sparse Swap Files
• Client Cache

Product Improvement

Not only does deploying early releases of software allow us to test some really cool new features that we’ve been able to implement into Production, this also allows us to capture many bugs before we release the products to our customers. Hopefully, this means that you, our customers, have a must most stable product that you can rely on.

I’ve really enjoyed designing and deploying OneDesk and watching its value to VMware grow as we utilize it more and more. I’m looking forward to seeing where we can take OneDesk in the future. Watch this space.

Thanks,
Aresh Sarkari

The Desktop Pool Creation using PowerCLI and JSON file is by far the most powerful and advance way of creating desktop pools in Horizon 7.x in a automated way.

Before you begin with the script and JSON file make sure you have read this blog post “Automating VMware Horizon 7 with VMware PowerCLI 6.5” by Graeme Gordon it explains step by step how to prepare machine and execute the PowerCLI.

The following is the script (Save as desktoppool.ps1) you will need to execute this script for invoking the desktop pool creation using the advanced functions of the module – New-HVPool -spec ‘path to InstantClone.json file’

PowerCLI Script for Desktop Pool:

Now let’s take a look at the JSON file for Linked Clone Desktops as all the advanced parameters for the desktop pool creation are defined here. The effort of entering the parameters needs to be performed once usually 70% of parameters are standard across all the pools. During the new pool creation only 5-7 parameters needs to change and rest can remain as-is

Note – I have entered parameters based on my requirements feel free to modify the values. (Copy/paste the below into a JSON editor to make sure the editing is in correct format. Save the file as LinkedClone.json):

Linked Clone JSON – (All parameters should be configured through JSON)

The parameters are self explanatory they are the exact same shown in the Horizon Administrator UI during Desktop Pool Creation. If you need any additional information on the parameters refer to the VMware View API explorer for more details.

I hope you will find this script and method useful in Automating the Desktop Pool Creation in Horizon. If you have further questions leave a comment or DM on twitter.

Thanks,
Aresh Sarkari

If you have a VMware VSAN environment and you wanted to export a App Volumes – Writable Volumes from the vsanDatastore to another datastore, storage or for VMware GSS/R&D for further analysis go ahead and read further!

Background – The traditional way of exporting the Writable Volumes from the source vsanDatastore was to attach the *.vmdk to a dummy VM as a “Existing Hard Disk” and export the dummy VM using the “Export OVF Template” option from the vCenter. Repeat all the steps on target datastore where-in it needs to be imported. However, if you want an alternate and easy method than the dummy VM then follow the below steps.

Step by Step Instructions:

— SSH to any ESXi Host Resource Cluster where the WV is stored and browser to the cloudvolumes/writable directory location:

— Now search for the end-user (E.g twood) for which you want to export the Writable Volumes.

— Now lets open the *.vmdk file using “cat” command to retrieve the Object ID information. Make a note of the ObjectID

— In my scenario the Object ID was properly pre-created I didn’t have to use the objtool to find out the Object opened. However, in some cases you might have to run the following command

This screenshot below is an example of situations where in the Object ID is not properly pre-created. It will provide you with an output Object Opened at path:

— Now using WINSCP login to the same ESXi Host and go to the path:
Object ID – /vmfs/device/vsan/d17efe58-5610-4dd2-0d9e-ecf4bbea2830 (my scenario)
Or/else Object opened at path in the screenshot above.

Download the file “d17efe58-5610-4dd2-0d9e-ecf4bbea2830” which is Writable Volumes (*.vmdk) file and move the files to local or remote location that you are using the WINSCP tool.

— Rename the Object ID to a friendly name shown in the cloudvolumes/writable Directory Folder. I renamed it (DOMAIN!5C!twood.vmdk)

— You don’t need the *.vmdk.metedata file

— The Writable Volumes is now exported out of the VSAN environment you can attach the *.vmdk to a non App Volumes Agent machine to look at the contents inside the Writable Volumes. If you are going to send the vmdk to VMware GSS/R&D make sure to zip it before uploading

I hope you will find these steps useful and help you export a Writable Volume from your vsanDatastore. I haven’t been able to try AppStacks with this method its on my to-do list.

Thanks,
Aresh Sarkari

In your Virtual Desktop Infrastructure with the following configurations:

• Horizon 7.x – Floating Desktop Pool
• App Volumes 2.x – Writable Volumes UIA+Profile
• McAfee Agent 5.x and McAfee VSE 8.x in your Master Image

If you start noticing 100 % – CPU Usage for prolonged period of time and the Horizon Session getting disconnected from time to time after launch then you might need to include the following exclusion within your Writable Volumes (UIA+Profile) snapvol.cfg file:

My colleague Daniel Bakshi has written an extensive blogpost on how to modify the snapvol.cfg for individual or group of end-users please reference it to make the necessary changes – Using the VMware App Volumes snapvol.cfg File to Customize Writable Volumes

I hope you will find these exclusion useful and will help you resolve a similar issue a lot quicker. A big thanks to Art Rothstein in helping to troubleshoot and resolve the issue.

Thanks,
Aresh Sarkari