View Architecture Planning VMware Horizon 7 Version 7.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs.
View Architecture Planning You can find the most up-to-date technical documentation on the VMware Web site at: http://www.vmware.com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: docfeedback@vmware.com Copyright © 2009–2016 VMware, Inc. All rights reserved. Copyright and trademark information. VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com 2 VMware, Inc.
Contents View Architecture Planning 5 1 Introduction to View 7 Advantages of Using View 7 View Features 10 How the Components Fit Together 11 Integrating and Customizing View 15 2 Planning a Rich User Experience 21 Feature Support Matrix for Horizon Agent 21 Choosing a Display Protocol 23 Using Hosted Applications 27 Using View Persona Management to Retain User Data and Settings 28 Using USB Devices with Remote Desktops and Applications 29 Using the Real-Time Audio-Video Feature for Webcams and Microp
View Architecture Planning Advantages of Using Multiple vCenter Servers in a Pod 76 5 Planning for Security Features 79 Understanding Client Connections 79 Choosing a User Authentication Method 82 Restricting Remote Desktop Access 84 Using Group Policy Settings to Secure Remote Desktops and Applications 85 Using Smart Policies 86 Implementing Best Practices to Secure Client Systems 86 Assigning Administrator Roles 86 Preparing to Use a Security Server 87 Understanding View Communications Protocols 92 6
View Architecture Planning View Architecture Planning provides an introduction to VMware Horizon™ 7, including a description of its major features and deployment options and an overview of how the components are typically set up in a production environment.
View Architecture Planning 6 VMware, Inc.
1 Introduction to View With View, IT departments can run remote desktops and applications in the datacenter and deliver these desktops and applications to employees as a managed service. End users gain a familiar, personalized environment that they can access from any number of devices anywhere throughout the enterprise or from home. Administrators gain centralized control, efficiency, and security by having desktop data in the datacenter.
View Architecture Planning n Remote desktops and applications that are hosted in a data center experience little or no downtime. Virtual machines can reside on high-availability clusters of VMware servers. Virtual desktops can also connect to back-end physical systems and Microsoft Remote Desktop Services (RDS) hosts. Convenience The unified management console is built for scalability so that even the largest View deployments can be efficiently managed from a single management interface.
Chapter 1 Introduction to View Using VMware vSphere to host virtual desktops and RDS host servers provides the following benefits: n Administration tasks and management chores are reduced. Administrators can patch and upgrade applications and operating systems without touching a user's physical PC. n Integration with VMware Identity Manager means that IT managers can use the Web-based VMware Identity Manager administration interface to monitor user and group entitlements to remote desktops.
View Architecture Planning View Features Features included in View support usability, security, centralized control, and scalability. The following features provide a familiar experience for the end user: n On certain client devices, print from a virtual desktop to any local or networked printer that is defined on the client device. This virtual printer feature solves compatibility issues and does not require you to install additional print drivers in a virtual machine.
Chapter 1 Introduction to View n Use the Instant Clone feature, introduced in Horizon 7, to quickly create desktop images that share virtual disks and memory with a parent image. Instant Clones not only have the space efficiency of View Composer linked clones, they also eliminate the need to refresh, recompose, rebalance, thus further simplifying management of patches and updates to the operating system. Instant clones eliminate the desktop maintenance window altogether.
View Architecture Planning Figure 1‑2.
Chapter 1 Introduction to View View Connection Server This software service acts as a broker for client connections. View Connection Server authenticates users through Windows Active Directory and directs the request to the appropriate virtual machine, physical PC, or Microsoft RDS host.
View Architecture Planning n Details about the HTML Access Web client, which allows you to open a remote desktop inside a browser. No Horizon Client application is installed on the client system or device. See the Horizon Client documentation at https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html. n Various third-party thin clients and zero clients, available only through certified partners. n View Open Client, which supports the VMware partner certification program.
Chapter 1 Introduction to View View Composer You can install this software service on a vCenter Server instance that manages virtual machines or on a separate server. View Composer can then create a pool of linked clones from a specified parent virtual machine. This strategy reduces storage costs by up to 90 percent.
View Architecture Planning VMware Mirage and Horizon FLEX n End users can access VMware Identity Manager on the Web from inside a remote desktop for applications they need. n If you also use HTML Access, end users can open a remote desktop inside a browser, without having to install any client application on the client system or device. n IT managers can use the browser-based administration console of VMware Identity Manager to monitor user and group entitlements to remote desktops.
Chapter 1 Introduction to View Integrating with Popular Video Conferencing Software Flash URL Redirection Streaming Flash content directly from Adobe Media Server to client endpoints lowers the load on the datacenter ESXi host, removes the extra routing through the datacenter, and reduces the bandwidth required to simultaneously stream live video events to multiple client endpoints. The Flash URL redirection feature uses a JavaScript that is embedded inside a Web page by the Web page administrator.
View Architecture Planning Integrating View with Business Intelligence Software You can configure View Connection Server to record events to a Microsoft SQL Server or Oracle database. n End-user actions such as logging in and starting a desktop session. n Administrator actions such as adding entitlements and creating desktop pools. n Alerts that report system failures and errors. n Statistical sampling such as recording the maximum number of users over a 24-hour period.
Chapter 1 Introduction to View You can use LDIF files to perform a number of tasks. n Transfer configuration data between View Connection Server instances. n Define a large number of View objects, such as desktop pools, and add these to your View Connection Server instances without using View Administrator or View PowerCLI. n Back up a configuration so that you can restore the state of a View Connection Server instance. For more information, see the View Integration document.
View Architecture Planning 20 VMware, Inc.
2 Planning a Rich User Experience View provides the familiar, personalized desktop environment that end users expect. For example, on some client systems, end users can access USB and other devices connected to their local computer, send documents to any printer that their local computer can detect, authenticate with smart cards, and use multiple display monitors. View includes many features that you might want to make available to your end users.
View Architecture Planning Table 2‑1. Operating Systems for Linked-Clone and Full-Clone Remote Desktops (Continued) Guest Operating System Version Edition Service Pack Windows 8 64-bit and 32-bit Enterprise and Professional None Windows 7 64-bit and 32-bit Enterprise and Professional SP1 Windows Server 2012 R2 64-bit Datacenter Latest update Windows Server 2008 R2 64-bit Datacenter SP1 Table 2‑2.
Chapter 2 Planning a Rich User Experience Table 2‑4. Features Supported on Windows Operating Systems Where Horizon Agent Is Installed (Continued) Microsoft RDSHosted Desktops and Apps on Windows Server 2008/2012 R2 Windows 7 Desktop Windows 8.
View Architecture Planning n Advanced Encryption Standard (AES) 128-bit encryption is supported and is turned on by default. You can, however, change the encryption key cipher to AES-256. n Connections from all types of client devices. n Optimization controls for reducing bandwidth usage on the LAN and WAN. n 32-bit color is supported for virtual displays. n ClearType fonts are supported. n Audio redirection with dynamic audio quality adjustment for LAN and WAN.
Chapter 2 Planning a Rich User Experience 1080p-formatted video If the remote desktop has a dual virtual CPU, you can play 1080p formatted video, although the media player might need to be adjusted to a smaller window size. 3D rendering You can configure remote desktops to use software- or hardware-accelerated graphics. The software-accelerated graphics feature enables you to run DirectX 9 and OpenGL 2.1 applications without requiring a physical graphics processing unit (GPU).
View Architecture Planning n Multiple monitors are supported for some client types. On some clients, you can use up to 4 monitors with a resolution of up to 2560 x 1600 per display or up to 3 monitors with a resolution of 4K (3840 x 2160) for Windows 7 remote desktops with Aero disabled. Pivot display and autofit are also supported. When the 3D feature is enabled, up to 2 monitors are supported with a resolution of up to 1920 x 1200, or one monitor with a resolution of 4K (3840 x 2160).
Chapter 2 Planning a Rich User Experience Hardware Requirements for Client Systems For information about processor and memory requirements, see the "Using VMware Horizon Client" document for the specific type of desktop or mobile client device. Go to https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html. Microsoft RDP Remote Desktop Protocol is the same multichannel protocol many people already use to access their work computer from their home computer.
View Architecture Planning Deploying remote applications in this way might be preferable to deploying complete remote desktops under the following conditions: n If an application is set up with a multi-tiered architecture, where the components work better if they are located geographically near each other, using remote, hosted applications is a good solution.
Chapter 2 Planning a Rich User Experience As with Windows roaming profiles, you can configure folder redirection. You can redirect the following folders to a network share.
View Architecture Planning Using the Real-Time Audio-Video Feature for Webcams and Microphones With the Real-Time Audio-Video feature, you can use your local computer's webcam or microphone on your remote desktop. Real-Time Audio-Video is compatible with standard conferencing applications and browser-based video applications, and supports standard webcams, audio USB devices, and analog audio input.
Chapter 2 Planning a Rich User Experience Virtual Shared Graphics Acceleration (vSGA) Available with vSphere 5.1 and later, this feature allows multiple virtual machines to share the physical GPUs on ESXi hosts. You can use 3D applications for design, modeling, and multimedia. Soft 3D Software-accelerated graphics, available with vSphere 5.0 and later, allows you to run DirectX 9 and OpenGL 2.1 applications without requiring a physical GPU.
View Architecture Planning Using Single Sign-On for Logging In The single-sign-on (SSO) feature allows end users to supply Active Directory login credentials only once. If you do not use the single-sign-on feature, end users must log in twice. They are first prompted for Active Directory credentials to log in to View Connection Server and then are prompted log in to their remote desktop.
Chapter 2 Planning a Rich User Experience n Monitors can be placed side by side, stacked 2 by 2, or vertically stacked only if you are using 2 monitors and the total height is less than 4096 pixels. n To use the 3D rendering feature, you must use the Blast Extreme display protocol or the PCoIP display protocol. You can use up to 2 monitors, with a resolution of up to 1920 X 1200. For a resolution of 4K (3840 X 2160), only one monitor is supported. n With Horizon Client 3.
View Architecture Planning 34 VMware, Inc.
Managing Desktop and Application Pools from a Central Location 3 You can create pools that include one or hundreds or thousands of remote desktops. As a desktop source, you can use virtual machines, physical machines, and Windows Remote Desktop Services (RDS) hosts. Create one virtual machine as a base image, and View can generate a pool of remote desktops from that image. You can also create pools of applications that give users remote access to applications.
View Architecture Planning n For View Composer linked-clone virtual machines, you can specify whether to use a Microsoft Sysprep customization specification or QuickPrep from VMware. Sysprep generates a unique SID and GUID for each virtual machine in the pool. Instant clones require a different customization specification, called ClonePrep, from VMware. You can also specify how users are assigned desktops in a pool.
Chapter 3 Managing Desktop and Application Pools from a Central Location Reducing and Managing Storage Requirements Deploying desktops on virtual machines that are managed by vCenter Server provides all the storage efficiencies that were previously available only for virtualized servers. Using instant clones or View Composer linked clones as desktop machines increases the storage savings because all virtual machines in a pool share a virtual disk with a base image.
View Architecture Planning n You can deploy a desktop pool on a cluster that contains up to 32 ESXi hosts, with certain restrictions. Replica disks must be stored on VMFS5 or later datastores or NFS datastores. If you store replicas on a VMFS version earlier than VMFS5, a cluster can have at most eight hosts. OS disks and persistent disks can be stored on NFS or VMFS datastores. Compatible vSphere 5.5 Update 1 or Later Features With vSphere 5.
Chapter 3 Managing Desktop and Application Pools from a Central Location Using Virtual SAN for High-Performance Storage and Policy-Based Management VMware Virtual SAN is a software-defined storage tier, available with vSphere 5.5 Update 1 or a later release, that virtualizes the local physical storage disks available on a cluster of vSphere hosts.
View Architecture Planning For more information about Virtual SAN requirements, see "Working with Virtual SAN" in the vSphere 5.5 Update 1 Storage document. For vSphere 6 or later, see the Administering VMware Virtual SAN document. For guidance on sizing and designing the key components of View virtual desktop infrastructures for VMware Virtual SAN, see the white paper at http://www.vmware.com/files/pdf/products/vsan/VMW-TMD-Virt-SAN-Dsn-Szing-Guid-Horizon-View.pdf.
Chapter 3 Managing Desktop and Application Pools from a Central Location n All virtual disks that you provision on a virtual datastore must be an even multiple of 1 MB. Virtual Volumes is a vSphere 6.0 feature. For more information about the requirements, functionality, background, and setup requirements, see the topics about Virtual Volumes in the vSphere Storage document.
View Architecture Planning Local Datastores for Floating, Stateless Desktops Linked-clone desktops can be stored on local datastores, which are internal spare disks on ESXi hosts. Local storage offers advantages such as inexpensive hardware, fast virtual-machine provisioning, highperformance power operations, and simple management. However, using local storage limits the vSphere infrastructure configuration options that are available to you.
Chapter 3 Managing Desktop and Application Pools from a Central Location You can store instant clones on traditional, spinning media-backed datastores. These disks provide lower performance, but are less expensive and provide higher storage capacity, which makes them suited for storing the many instant clones in a large pool. Tiered storage configurations can be used to cost-effectively handle intensive I/O scenarios such as simultaneous running scheduled antivirus scans.
View Architecture Planning n Using Existing Processes or VMware Mirage for Application Provisioning on page 46 With View, you can continue to use the application provisioning techniques that your company currently uses, and you can use Mirage. Two additional considerations include managing server CPU usage and storage I/O and determining whether users are permitted to install applications.
Chapter 3 Managing Desktop and Application Pools from a Central Location Deploying Applications and System Updates with Instant Clones Because instant clone desktop pools share a base image, you can quickly deploy updates and patches by updating the parent virtual machine. The push image feature allows you to make changes to the parent virtual machine, take a snapshot of the new state, and push the new version of the image to all users and desktops on a rolling basis.
View Architecture Planning Deploying and Managing Applications Using App Volumes VMware App Volumes offers an alternative way to manage applications by virtualizing applications above the operating system. By using this strategy, applications, data files, settings, middleware, and configurations act as separate, layered containers. These containers are called application stacks (AppStacks) when in read-only mode or writable volumes when in read-write mode.
Chapter 3 Managing Desktop and Application Pools from a Central Location n Horizon Agent configuration After a GPO is applied, properties are stored in the local Windows registry of the specified component. You can use GPOs to set all the policies that are available from the View Administrator user interface (UI). You can also use GPOs to set policies that are not available from the UI.
View Architecture Planning 48 VMware, Inc.
Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments 4 A typical View architecture design uses a pod strategy that consists of components that support up to 10,000 remote desktops using a vSphere 5.1 or later infrastructure. Pod definitions can vary, based on hardware configuration, View and vSphere software versions used, and other environment-specific design factors.
View Architecture Planning Virtual Machine Requirements for Remote Desktops When you plan the specifications for remote desktops, the choices that you make regarding RAM, CPU, and disk space have a significant effect on your choices for server and storage hardware and expenditures.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments Estimating Memory Requirements for Virtual Machine Desktops RAM costs more for servers than it does for PCs. Because the cost of RAM is a high percentage of overall server hardware costs and total storage capacity needed, determining the correct memory allocation is crucial to planning your desktop deployment.
View Architecture Planning ESXi swap file This file, which has a .vswp extension, is created if you reserve less than 100 percent of a virtual machine's RAM. The size of the swap file is equal to the unreserved portion of guest RAM. For example, if 50 percent of guest RAM is reserved and guest RAM is 2GB, the ESXi swap file is 1GB. This file can be stored on the local data store on the ESXi host or cluster. ESXi suspend file This file, which has a .
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments Estimating CPU Requirements for Virtual Machine Desktops When estimating CPU, you must gather information about the average CPU utilization for various types of workers in your enterprise. CPU requirements vary by worker type.
View Architecture Planning n Use centralized file shares or a View Composer persistent disk or App Volumes for user-generated content and user-installed applications. n If you are using vSphere 5.1 or later, enable space reclamation for vCenter Server and for the linkedclone desktop pools. If virtual machine desktops use the space-efficient disk format available with vSphere 5.1 or later, stale or deleted data within a guest operating system is automatically reclaimed with a wipe and shrink process.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments n Note that in View 5.2 and later, the View Storage Accelerator feature is turned on by default, which allows ESXi 5.0 and later hosts to cache common virtual machine disk data. View Storage Accelerator can improve performance and reduce the need for extra storage I/O bandwidth to manage boot storms and anti-virus scanning I/O storms. This feature requires 1GB of RAM per ESXi host.
View Architecture Planning n Pools for Knowledge Workers and Power Users on page 57 Knowledge workers must be able to create complex documents and have them persist on the desktop. Power users must be able to install their own applications and have them persist. Depending on the nature and amount of personal data that must be retained, the desktop can be stateful or stateless.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments n Use the Persona Management feature so that users always have their preferred desktop appearance and application settings, as with Windows user profiles. If you do not have the desktops set to be refreshed or deleted at logoff, you can configure the persona to be removed at logoff.
View Architecture Planning Pools for Kiosk Users Kiosk users might include customers at airline check-in stations, students in classrooms or libraries, medical personnel at medical data entry workstations, or customers at self-service points. Accounts associated with client devices rather than users are entitled to use these desktop pools because users do not need to log in to use the client device or the remote desktop.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments Desktop Virtual Machine Configuration The example settings for items such as memory, number of virtual processors, and disk space are Viewspecific. The amount of system disk space required depends on the number of applications required in the base image. VMware has validated a setup that included 8GB of disk space.
View Architecture Planning For more information about RDS host configuration and tested workloads, see the VMware Horizon 6 Reference Architecture white paper at http://www.vmware.com/files/pdf/techpaper/VMware-Reference-Architecture-Horizon-6-View-MirageWorkspace.pdf. vCenter Server and View Composer Virtual Machine Configuration You can install vCenter Server and View Composer on the same virtual machine or on separate servers.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments Table 4‑5.
View Architecture Planning View Connection Server Cluster Design Considerations You can deploy multiple replicated View Connection Server instances in a group to support load balancing and high availability. Groups of replicated instances are designed to support clustering within a LANconnected single-datacenter environment.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments The number of connections per Access Point appliance is similar to those for security servers. For more information about Access Point appliances, see Deploying and Configuring Access Point.
View Architecture Planning For more information, see the chapter about creating desktop pools, in the Setting Up Desktop and Application Pools in View. Networking requirements depend on the type of server, the number of network adapters, and the way in which VMotion is configured. Determining Requirements for High Availability vSphere, through its efficiency and resource management, lets you achieve industry-leading levels of virtual machines per server.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments Table 4‑10. Virtual Machine Desktop Cluster Example Item Example Number of clusters 5 Number of desktops and pools per cluster 1 pool of 2,000 desktops (virtual machines) per cluster Nodes (ESXi hosts) Following are examples of various servers that could be used for each cluster: 12 Dell PowerEdge R720 (16 cores * 2 GHz; and 192GB RAM on each host) n 16 Dell PowerEdge R710 (12 cores * 2.
View Architecture Planning Shared Storage Example For a View 5.2 test environment, View Composer replica virtual machines were placed on high-readperformance solid-state drives (SSD), which support tens of thousands of I/Os per second (IOPS). Linked clones were placed on traditional, lower-performance spinning media-backed datastores, which are less expensive and provide higher storage capacity.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments This storage strategy is illustrated in the following figure. Figure 4‑1. Tiered Storage Example for a Large Desktop Pool Parent 2 Parent 4 Parent 1 Parent 3 Parent 5 PARENT SSD, shared across all clusters Replica 1 ES X ES X ES X ESX cluster, consisting of 192 Intel cores and 2.
View Architecture Planning You can also reduce operating system disk space by using View Composer persistent disks or a shared file server as the primary repository for the user profile and user documents. Because View Composer lets you separate user data from the operating system, you might find that only the persistent disk needs to be backed up or replicated, which further reduces storage requirements. For more information, see “Reducing Storage Requirements with View Composer,” on page 41.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments With the PCoIP or Blast Extreme display protocol, if you have an enterprise LAN with 100Mb or a 1Gb switched network, your end users can expect excellent performance under the following conditions: n Two monitors (1920 x 1080) n Heavy use of Microsoft Office applications n Heavy use of Flash-embedded Web browsing n Frequent use of multimedia with limited use of full screen mode n Frequent use of USB-based
View Architecture Planning Virtual VMotiondvswitch (1 uplink per host) Infra-dvswitch (2 uplink per host) Desktop-dvswitch (2 uplink per host) n One 1Gb vLAN for the management network n One 1Gb vLAN for the VMotion network n One 10Gb vLAN for the infrastructure network This switch was used by the ESXi hosts of infrastructure, parent, and desktop virtual machines. n Jumbo Frame (9000 MTU) n 1 Ephemeral Distributed Port Group n Private VLAN and 192.168.x.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments Capacity for an Hour-Long Logon Storm of 10,000 Users Note This example was used in a View 5.2 setup, which was carried out prior to the release of VMware Virtual SAN. For guidance on sizing and designing the key components of View virtual desktop infrastructures for VMware Virtual SAN, see the white paper at http://www.vmware.com/files/pdf/products/vsan/VMW-TMD-Virt-SAN-Dsn-Szing-Guid-Horizon-View.pdf.
View Architecture Planning Time Required for Rebalancing a Pool A desktop rebalance operation evenly redistributes linked-clone desktops among available logical drives. A rebalance operation saves storage space on overloaded drives and ensures that no drives are underused. You can also use a rebalance operation to migrate all virtual machines in a desktop pool to or from a Virtual SAN datastore.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments n 2Mbps per simultaneous user running 480p video, depending upon the configured frame rate limit and the video type. Note The estimate of 50 to 150Kbps per typical user is based on the assumption that all users are operating continuously and performing similar tasks over an 8- to 10- hour day. The 50Kbps bandwidth usage figure is from View Planner testing on a LAN with the Build-to-Lossless feature disabled.
View Architecture Planning Table 4‑11. Example of a LAN-Based View Building Block for 2,000 Virtual Machine Desktops (Continued) Item Example Database MS SQL Server or Oracle database server (can be run in the block itself) VLANs 3 (a 1Gbit Ethernet network for each: management network, storage network, and VMotion network) Each vCenter Server can support up to 10,000 virtual machines. This support enables you to have building blocks that contain more than 2,000 virtual machine desktops.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments Figure 4‑2. Pod Diagram for 10,000 Virtual Machine Desktops View building blocks switched networks Each switched network connects to each View Connection Server View Connection Servers load balancing network core Pod Example Using One vCenter Server In the previous section, the View pod consisted of multiple building blocks. Each building block supported 2,000 virtual machines with a single vCenter Server.
View Architecture Planning Cloud Pod Architecture Overview To use a group of replicated View Connection Server instances across a WAN, MAN (metropolitan area network), or other non-LAN, in scenarios where a View deployment needs to span datacenters, you must use the Cloud Pod Architecture feature. This feature uses standard View components to provide cross-datacenter administration, global and flexible user-to-desktop mapping, high-availability desktops, and disaster recovery capabilities.
Chapter 4 Architecture Design Elements and Planning Guidelines for Remote Desktop Deployments Pod designs with one vCenter Server instance Concurrency settings determine how many operations can be queued up for an entire View pod at one time. For example, if you set concurrent provisioning operations to 20 and you have only one vCenter Server instance in a pod, a desktop pool larger than 20 will cause provisioning operations to be serialized.
View Architecture Planning If your View design does not require user-triggered power and refit operations, a single vCenter Server instance can probably suit your needs. Without a high frequency of user-triggered power and refit operations, no long queue of operations can accumulate that might cause View Connection Server to timeout waiting for vCenter Server to complete the requested operations within the defined concurrency setting limits.
Planning for Security Features 5 View offers strong network security to protect sensitive corporate data. For added security, you can integrate View with certain third-party user-authentication solutions, use a security server, and implement the restricted entitlements feature. Important With Horizon 6 version 6.2 and later releases, View can perform cryptographic operations using FIPS (Federal Information Processing Standard) 140-2 compliant algorithms.
View Architecture Planning n Client Connections Using the PCoIP and Blast Secure Gateways on page 80 When clients connect to a remote desktop or application with the PCoIP or Blast Extreme display protocol from VMware, Horizon Client can make a second connection to the applicable Secure Gateway component on a View Connection Server instance, security server, or Access Point appliance.
Chapter 5 Planning for Security Features Tunneled Client Connections with Microsoft RDP When users connect to a remote desktop with the Microsoft RDP display protocol, Horizon Client can make a second HTTPS connection to the View Connection Server host. This connection is called the tunnel connection because it provides a tunnel for carrying RDP data. The tunnel connection offers the following advantages: n RDP data is tunneled through HTTPS and is encrypted using SSL.
View Architecture Planning Choosing a User Authentication Method View uses your existing Active Directory infrastructure for user authentication and management. For added security, you can integrate View with two-factor authentication solutions, such as RSA SecurID and RADIUS, and smart card authentication solutions.
Chapter 5 Planning for Security Features Administrators can use the vdmadmin command-line interface to configure domain filtering, which limits the domains that a View Connection Server instance searches and that it displays to users. See the View Administration document for more information. Policies, such as restricting permitted hours to log in and setting the expiration date for passwords, are also handled through existing Active Directory operational procedures.
View Architecture Planning Using the Log In as Current User Feature Available with Windows-Based Horizon Client With Horizon Client for Windows, when users select the Log in as current user check box, the credentials that they provided when logging in to the client system are used to authenticate to the View Connection Server instance and to the remote desktop. No further user authentication is required.
Chapter 5 Planning for Security Features n Assign the tag "External" to the View Connection Server instance that is paired with the security server and supports your external users. n Assign the "Internal" tag to the desktop pools that should be accessible only to internal users. n Assign the "External" tag to the desktop pools that should be accessible only to external users.
View Architecture Planning n Prevent users from providing credential information with Horizon Client command line options. n Prevent non-Horizon Client systems from using RDP to connect to remote desktops. You can set this policy so that connections must be Horizon Client-managed, which means that users must use View to connect to remote desktops. See the Setting Up Desktop and Application Pools in View for information on using remote desktop and Horizon Client group policy settings.
Chapter 5 Planning for Security Features Preparing to Use a Security Server A security server is a special instance of View Connection Server that runs a subset of View Connection Server functions. You can use a security server to provide an additional layer of security between the Internet and your internal network. Important With Horizon 6 version 6.2 and later releases, you can use Access Point appliances in place of security servers.
View Architecture Planning Figure 5‑2. Load-Balanced Security Servers in a DMZ client device external network DMZ load balancing View Security Servers View Connection Servers Microsoft Active Directory vCenter Management Server ESX hosts running Virtual Desktop virtual machines When users outside the corporate network connect to a security server, they must successfully authenticate before they can access remote desktops and applications.
Chapter 5 Planning for Security Features Figure 5‑3. Multiple Security Servers client device client device external network DMZ load balancing internal network View Security Servers load balancing View Connection Servers Microsoft Active Directory vCenter Management Server ESXi hosts running Virtual Desktop virtual machines You must implement a hardware or software load balancing solution if you install more than one security server.
View Architecture Planning Figure 5‑4.
Chapter 5 Planning for Security Features Table 5‑1. Front-End Firewall Rules (Continued) Default Port Source Protocol Destination Default Port Notes Horizon Client TCP Any UDP Any PCoIP Security server TCP 4172 UDP 4172 External client devices connect to a security server within the DMZ on TCP port 4172 and UDP port 4172 to communicate with a remote desktop or application over PCoIP.
View Architecture Planning Table 5‑2. Back-End Firewall Rules (Continued) Default Port Source Protocol Destination Default Port Notes Security server TCP Any UDP 55000 PCoIP Remote desktop or application TCP 4172 UDP 4172 Security servers connect to remote desktops and applications on TCP port 4172 and UDP port 4172 to exchange PCoIP traffic.
Chapter 5 Planning for Security Features Figure 5‑5. View Components and Protocols Without a Security Server client device RDP Client Horizon Client PCoIP RDP HTTP(S) View Secure GW Server & PCoIP Secure GW View Connection Server View Messaging View Broker & Admin Server View Administrator HTTP(S) SOAP vCenter Server View Manager LDAP JMS RDP PCoIP View Agent View desktop virtual machine Note This figure shows direct connections for clients using either PCoIP or RDP.
View Architecture Planning Figure 5‑6. View Components and Protocols with a Security Server client devices RDP Client Horizon Client HTTP(S) Blast HTTP(S) PCoIP View Security Server View Secure GW Server & PCoIP Secure GW Blast PCoIP RDP, Framework, MMR, CDR... AJP13 JMS View Secure GW Server & PCoIP Secure GW HTTP(S) View Broker & Admin Server View Messaging View Connection Server View Administrator SOAP vCenter Server View Manager LDAP JMS PCoIP RDP, Framework, MMR, CDR...
Chapter 5 Planning for Security Features Table 5‑3. Default Ports (Continued) Protocol Port HTTP TCP port 80 HTTPS TCP port 443 MMR/CDR For multimedia redirection and client drive redirection, TCP port 9427 RDP TCP port 3389 Note If the View Connection Server instance is configured for direct client connections, these protocols connect directly from the client to the remote desktop and are not tunneled through the View Secure GW Server component.
View Architecture Planning Blast Secure Gateway Security servers and Access Point appliances include a Blast Secure Gateway component. When the Blast Secure Gateway is enabled, after authentication, clients that use Blast Extreme or HTML Access can make another secure connection to a security server or Access Point appliance. This connection allows clients to access remote desktops and applications from the Internet.
Chapter 5 Planning for Security Features Intercomponent message validation uses DSA keys. The key size is 512 bits by default, except in FIPS mode, where the key size is 2048 bits. Note When the message security mode is set to Enhanced, SSL/TLS is used to secure JMS connections rather than using per-message encryption. In enhanced message security mode, validation applies to only one message type. For enhanced message mode, VMware recommends increasing the key size to 2048 bits.
View Architecture Planning Firewall Rules for Horizon Agent The Horizon Agent installation program opens certain TCP ports on the firewall. Ports are incoming unless otherwise noted. Table 5‑5. TCP Ports Opened During Agent Installation Protocol Ports RDP 3389 USB redirection 32111 (This port is also used for time zone synchronization.
Overview of Steps to Setting Up a View Environment 6 Complete these high-level tasks to install View and configure an initial deployment. Table 6‑1. View Installation and Setup Check List Step Task 1 Set up the required administrator users and groups in Active Directory. Instructions: View Installation and vSphere documentation. 2 If you have not yet done so, install and set up ESXi hosts and vCenter Server. Instructions: VMware vSphere documentation.
View Architecture Planning Table 6‑1. View Installation and Setup Check List (Continued) 100 Step Task 12 (Optional) Configure View Persona Management, which gives users access to personalized data and settings whenever they log in to a desktop. Instructions: Setting Up Desktop and Application Pools in View. 13 (Optional) For added security, integrate smart card authentication or a RADIUS two-factor authentication solution. Instructions: View Administration document. VMware, Inc.
Index Symbols .
View Architecture Planning Horizon Agent 98 View Connection Server 97 firewalls back-end 89 front-end 89 rules 90 Flash URL Redirection 15 floating-assignment desktop pools 35 front-end firewall configuring 89 rules 90 G gateway server 95 GPOs, security settings for remote desktops 85 GRID vGPU, NVIDIA 30 H HA cluster 60, 61, 63 hardware requirements, PCoIP 25 hardware-accelerated graphics 30 Horizon Agent 14, 46 Horizon Client 46 Horizon Client for Linux 13 Horizon Workspace 7 hosted applications 27 HTM
Index rebalancing a pool 70 recompose feature 44 recomposing a pool 70 refresh feature 44, 53 refreshing a pool 70 regulatory compliance 36 remote applications 27, 44 remote display protocols PCoIP 25 RDP 27 replicas 41 restricted entitlements 84 roaming profiles 28 RSA key size, changing 96 RSA SecurID authentication, configuring 83 S SBPM (storage-based policy management) 39, 40 scalability, planning for 49 SCOM 15 SCSI adapter types 59 security 36 security features, planning 79 security servers best pr
View Architecture Planning View Messaging 96 View node configuration 54 View Open Client 13 View pod 74 View Portal 14 View PowerCLI 15 View Secure Gateway Server 95 virtual profiles 10, 21 virtual machine configuration for vCenter 60 for remote desktops 50 for View Composer 60 for View Connection Server 61 virtual printing feature 10, 21, 31 virtual private networks 87 Virtual SAN 37, 39, 41 Virtual Volumes (VVols) 40, 41 VMotion 63 VMware Blast Extreme display protocol 23 vSAN 37, 39, 41 vSGA 3D renderin
