6.0

When users connect to remote desktops and applications, by default the client makes a second connection to
the View Connection Server or security server host. This connection is called the tunnel connection because
it provides a secure tunnel for carrying RDP and other data over HTTPS.
When users connect to remote desktops and applications with the PCoIP display protocol, the client can
make a further connection to the PCoIP Secure Gateway on the View Connection Server or security server
host. The PCoIP Secure Gateway ensures that only authenticated users can communicate with remote
desktops and applications over PCoIP.
You can also provide secure connections to external users who use HTML Access to connect to remote
desktops. The Blast Secure Gateway ensures that only authenticated users can communicate with remote
desktops. With HTML Access, Horizon Client software does not have to be installed on the users' endpoint
devices.
Depending on the type of client device being used, additional channels are established to carry other traffic
such as USB redirection data to the client device. These data channels route traffic through the secure tunnel
if it is enabled.
When the secure tunnel and secure gateways are disabled, desktop and application sessions are established
directly between the client device and the remote machine, bypassing the View Connection Server or
security server host. This type of connection is called a direct connection.
Desktop and application sessions that use direct connections remain connected even if View Connection
Server is no longer running.
Typically, to provide secure connections for external clients that connect to a security server or View
Connection Server host over a WAN, you enable the secure tunnel, the PCoIP Secure Gateway, and, if your
users connect using HTML Access, the Blast Secure Gateway. You can disable the secure tunnel and the
secure gateways to allow internal, LAN-connected clients to establish direct connections to remote desktops
and applications.
If you enable only the secure tunnel or only one secure gateway, a session might use a direct connection for
some traffic but send other traffic through the View Connection Server or security server host, depending on
the type of client being used.
SSL is required for all client connections to View Connection Server and security server hosts.
Configure the PCoIP Secure Gateway and Secure Tunnel Connections
You use View Administrator to configure the use of the secure tunnel and PCoIP Secure Gateway. These
components ensure that only authenticated users can communicate with remote desktops and applications.
Clients that use the PCoIP display protocol can use the PCoIP Secure Gateway. Clients that use the RDP
display protocol can use the secure tunnel.
For information about configuring the Blast Secure Gateway, see “Configure Secure HTML Access,” on
page 96.
IMPORTANT A typical network configuration that provides secure connections for external clients includes a
security server. To enable or disable the secure tunnel and PCoIP Secure Gateway on a security server, you
must edit the View Connection Server instance that is paired with the security server.
In a network configuration in which external clients connect directly to a View Connection Server host, you
enable or disable the secure tunnel and PCoIP Secure Gateway by editing that View Connection Server
instance in View Administrator.
Prerequisites
n
If you intend to enable the PCoIP Secure Gateway, verify that the View Connection Server instance and
paired security server are View 4.6 or later.
Chapter 7 Configuring View for the First Time
VMware, Inc. 95