Installation and Setup Guide

Table 3‑10. PCoIP Client Session Variables (Continued)
Setting Description
Configure PCoIP
session encryption
algorithms
Controls the encryption algorithms advertised by the PCoIP endpoint during session
negotiation.
Checking one of the check boxes disables the associated encryption algorithm. You must
enable at least one algorithm.
This seing applies to both agent and client. The endpoints negotiate the actual session
encryption algorithm that is used. If FIPS140-2 approved mode is enabled, the Disable
AES-128-GCM encryption value will be overridden if both AES-128-GCM encryption and
AES-256-GCM encryption are disabled.
If the Configure SSL Connections seing is disabled or not congured, both the
Salsa20-256round12 and AES-128-GCM algorithms are available for negotiation by this
endpoint.
Supported encryption algorithms, in order of preference, are SALSA20/12-256, AES-
GCM-128, and AES-GCM-256. By default, all supported encryption algorithms are available
for negotiation by this endpoint.
Configure PCoIP
virtual channels
Species the virtual channels that can and cannot operate over PCoIP sessions. This seing
also determines whether to disable clipboard processing on the PCoIP host.
Virtual channels that are used in PCoIP sessions must appear on the virtual channel
authorization list. Virtual channels that appear in the unauthorized virtual channel list
cannot be used in PCoIP sessions.
You can specify a maximum of 15 virtual channels for use in PCoIP sessions.
Separate multiple channel names with the vertical bar (|) character. For example, the virtual
channel authorization string to allow the mksvchan and vdp_rdpvcbridge virtual channels
is mksvchan|vdp_rdpvcbridge.
If a channel name contains the vertical bar or backslash (\) character, insert a backslash
character before it. For example, type the channel name awk|ward\channel as
awk\|ward\\channel.
When the authorized virtual channel list is empty, all virtual channels are disallowed. When
the unauthorized virtual channel list is empty, all virtual channels are allowed.
The virtual channels seing applies to both agent and client. Virtual channels must be
enabled on both agent and client for virtual channels to be used.
The virtual channels seing provides a separate check box that allows you to disable remote
clipboard processing on the PCoIP host. This value applies to the agent only.
By default, all virtual channels are enabled, including clipboard processing.
Configure SSL cipher
list
Congures an SSL cipher list to restrict the use of cipher suites before establishing an
encrypted SSL connection. The list consists of one or more cipher suite strings separated by
colons. All cipher suite strings are case insensitive.
The default value is ECDHE-RSA-AES256-GCM-SHA384:AES256-SHA256:AES256-
SHA:ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:@STRENGTH.
If this seing is congured, the Enforce AES-256 or stronger ciphers for SSL connection
negotiation check box in the Configure SSL connections to satisfy Security
Tools seing is ignored.
This seing must be applied to both the PCoIP server and the PCoIP client.
Configure SSL
connections to
satisfy Security
Tools
Species how SSL session negotiation connections are established. To satisfy security tools,
such as port scanners, enable this seing and do the following:
1 Store the certicate for the Certicate Authority that signed any Server certicate to be
used with PCoIP in the Trusted Root certicate store.
2 Congure the agent to load certicates only from the Certicate Store. If the Personal
store for the Local Machine is used, leave the CA Certicate store name unchanged with
the value ROOT, unless a dierent store location was used in step 1.
If this seing is disabled or not congured, the AES-128 cipher suite is not available and the
endpoint uses Certication Authority certicates from the machine account's MY store and
Certication Authority certicates from the ROOT store.
Chapter 3 Configuring Horizon Client for End Users
VMware, Inc. 61