User manual

Third-party firewalls
Add rules to allow the following trac:
n
Servers (including security servers, Connection Server instances, and
replica servers): inbound trac to TCP port 8443.
n
Remote desktop virtual machines: inbound trac (from servers) to TCP
port 22443.
Display protocol for
Horizon
VMware Blast
When you use a Web browser to access a remote desktop, the VMware Blast
protocol is used rather than PCoIP or Microsoft RDP. VMware Blast uses
HTTPS (HTTP over SSL/TLS).
Preparing Connection Server and Security Servers for HTML Access
Administrators must perform specic tasks so that end users can connect to remote desktops using a Web
browser.
Before end users can connect to Connection Server or a security server and access a remote desktop, you
must install Connection Server with the HTML Access component and install security servers.
Following is a check list of the tasks you must perform in order to use HTML Access:
1 Install Connection Server with the HTML Access option on the server or servers that will compose a
Connection Server replicated group.
By default, the HTML Access component is already selected in the installer. For installation instructions,
see the View Installation documentation.
N To check whether the HTML Access component is installed, you can open the Uninstall a
Program applet in the Windows operating system and look for View HTML Access in the list.
2 If you use security servers, install Security Server.
For installation instructions, see the View Installation documentation.
I The version of Security Server must match the version of Connection Server.
3 Verify that each Connection Server instance or security server has a security certicate that can be fully
veried by using the host name that you enter in the browser.
For more information, see the View Installation documentation.
4 To use two-factor authentication, such as RSA SecurID or RADIUS authentication, verify that this
feature is enabled on Connection Server.
For more information, see the topics about two-factor authentication in the View Administration
documentation.
I If you enable the Hide domain list in client user interface seings and select two-factor
authentication (RSA SecureID or RADIUS) for the Connection Server instance, do not enforce Windows
user name matching. Enforcing Windows user name matching will prevent users from being able to
enter domain information in the user name text box and login will always fail. For more information,
see the topics about two-factor authentication in the View Administration document.
5 If you use third-party rewalls, congure rules to allow inbound trac to TCP port 8443 for all security
servers and Connection Server hosts in a replicated group, and congure a rule to allow inbound trac
(from View servers) to TCP port 22443 on remote desktops in the datacenter. For more information, see
“Firewall Rules for HTML Access,” on page 10.
Chapter 1 Setup and Installation
VMware, Inc. 9