6.0

2 When you run the VMware Horizon Client installation wizard on the client system, be sure to include
the USB Redirection component.
This component is included by default.
3 Verify that access to USB devices from a remote desktop is enabled in View Administrator.
In View Administrator, go to Policies > Global Policies and verify that USB access is set to Allow.
4 (Optional) Configure View Agent group policies to specify which types of devices are allowed to be
redirected.
See “Using Policies to Control USB Redirection,” on page 158.
5 (Optional) Configure similar settings on the client device.
You can also configure whether devices are automatically connected when Horizon Client connects to
the remote desktop or when the end user plugs in a USB device. The method of configuring USB
settings on the client device depends on the type of device. For example, for Windows client endpoints,
you can configure group policies, whereas for Mac OS X endpoints, you use a command-line command.
For instructions, see the "Using VMware Horizon Client" document for the specific type of client device.
6 Have end users connect to a remote desktop and plug their USB devices into the local client system.
If the driver for the USB device is not already installed in the remote desktop, the guest operating
system detects the USB device and searches for a suitable driver, just as it would on a physical
Windows computer.
Network Traffic and USB Redirection
USB redirection works independently of the display protocol (RDP or PCoIP) and USB traffic usually uses
TCP port 32111.
Network traffic between a client system and a remote desktop can travel various routes, depending on
whether the client system is inside the corporate network and how the administrator has chosen to set up
security.
1 If the client system is inside the corporate network, so that a direct connection can be made between the
client and desktop, USB traffic uses TCP port 32111.
2 If the client system is outside the corporate network, the client can connect through a View security
server.
A security server resides within a DMZ and acts as a proxy host for connections inside your trusted
network. This design provides an additional layer of security by shielding the View Connection Server
instance from the public-facing Internet and by forcing all unprotected session requests through the
security server.
A DMZ-based security server deployment requires a few ports to be opened on the firewall to allow
clients to connect with security servers inside the DMZ. You must also configure ports for
communication between security servers and the View Connection Server instances in the internal
network.
For information on specific ports, see "Firewall Rules for DMZ-Based Security Servers" in the View
Architecture Planning Guide.
Chapter 14 Using USB Devices with Remote Desktops
VMware, Inc. 155