6.0

3 If the client system is outside the corporate network, you can use View Administrator to enable the
HTTPS Secure Tunnel. The client then makes a further HTTPS connection to the View Connection
Server or security server host when users connect to a remote desktop. The connection is tunneled
using HTTPS port 443 to the security server, and then the onward connection for USB traffic from the
server to the remote desktop uses TCP port 32111. USB device performance is slightly degraded when
using this tunnel.
NOTE If you are using a zero client, USB traffic is redirected using a PCoIP virtual channel, rather than
through TCP 32111. Data is encapsulated and encrypted by the PCoIP Secure Gateway using TCP/UDP
port 4172. If you are using only zero clients, it is not necessary to open TCP port 32111.
Automatic Connections to USB Devices
On some client systems, administrators, end users, or both can configure automatic connections of USB
devices to a remote desktop. Automatic connections can be made either when the user plugs a USB device in
to the client system or when the client connects to the remote desktop.
Some devices, such as smart phones and tablets, require automatic connections because these devices are
restarted, and therefore disconnected, during an upgrade. If these devices are not set to automatically
reconnect to the remote desktop, during an upgrade, after the devices restart, they connect to the local client
system instead.
Configuration properties for automatic USB connections that administrators set on the client, or that end
users set by using a Horizon Client menu item, apply to all USB devices unless the devices are configured to
be excluded from USB redirection. For example, in some client versions, webcams and microphones are
excluded from USB redirection by default because these devices work better through the Real-Time Audio-
Video feature. In some cases, a USB device might not be excluded from redirection by default but might
require administrators to explicitly exclude the device from redirection. For example, the following types of
USB devices are not good candidates for USB redirection and must not be automatically connected to a
remote desktop:
n
USB Ethernet devices. If you redirect a USB Ethernet device, your client system might lose network
connectivity if that device is the only Ethernet device.
n
Touch screen devices. If you redirect a touch screen device, the remote desktop will receive touch input
but not keyboard input.
If you have set the remote desktop to autoconnect USB devices, you can configure a policy to exclude
specific devices such as touch screens and network devices. For more information, see “Configuring Filter
Policy Settings for USB Devices,” on page 161.
On Windows clients, as an alternative to using settings that automatically connect all but excluded devices,
you can edit a configuration file on the client that sets Horizon Client to reconnect only a specific device or
devices, such as smart phones and tablets, to the remote desktop. For instructions, see Using
VMware Horizon Client for Windows.
Disabling USB Redirection
Some highly security-sensitive applications require that USB redirection be disabled. You can disable USB
redirection for all desktop pools, for specific desktop pools, or for specific users in a desktop pool.
Use any of the following strategies, as appropriate for your situation:
n
In View Administrator, edit the USB access policy for a specific pool to either allow or deny access.
n
In View Administrator, after you set the policy at the desktop pool level, you can override the policy for
a specific virtual machine in the pool.
n
When installing View Agent, deselect the USB redirection component. VMware does not recommend
this strategy because it offers less flexibility than using policy settings.
Setting Up Desktop and Application Pools in View
156 VMware, Inc.