Ensure that these gateway services are not also enabled on the Connection Server because this would cause a double-hop attempt of the protocol traffic, which is not supported and will result in failed connections. The Unified Access Gateway runs the following gateway services: the Blast Secure Gateway, the PCoIP Secure Gateway, and the HTTPS Secure Tunnel. The protocol session connection goes from the Horizon Client to the Unified Access Gateway and then to the Horizon Agent. The initial authentication phase of a connection is from the Horizon Client to a Unified Access Gateway appliance and then to a Connection Server.
If the connection is external, communication is typically through a VMware Unified Access Gateway (UAG) appliance. When load balancing Connection Servers, typically, only the initial XML-API connection (authentication, authorization, and session management) needs to be load balanced.īecause the secondary protocol connections go directly from the Horizon Client to the Horizon Agent, they are not load balanced. This is covered as a separate topic later in this post, in the section Internal HTML Client Access Connections.
In most typical deployments, the only gateway service used on a Connection Server is the Blast Secure Gateway, to handle VMware HTML Access (web-based client) traffic. This configuration is less common because the protocol session is then tunneled through the Connection Servers, making it part of the ongoing session. Secondary protocol connections route through the Connection Server only when a gateway or tunnel-the Blast Secure Gateway, the PCoIP Secure Gateway, or the HTTPS Secure Tunnel-is enabled on the Connection Server. The secondary, protocol session then normally connects directly from the Horizon Client to the Horizon Agent. With an internal connection, in the initial authentication phase, the connection is from the Horizon Client to the Connection Server. If you want to explore the components and architecture of Horizon, see the Component Design: Horizon Architecture section in the VMware Workspace ONE and VMware Horizon Reference Architecture. Following successful authentication, a connection using one or more secondary protocols is then made to the resource. The first phase of a connection is always the primary XML-API protocol over HTTPS, which provides authentication, authorization, and session management. Primary and Secondary Protocolsįirst, it is important to understand that when a Horizon Client connects to a Horizon environment, several different protocols are used, and a successful connection consists of two phases. If you want to go into more depth, we now offer the detailed and comprehensive Understand and Troubleshoot Horizon Connections guide. Note: Even though this blog was posted a while ago, it's still a very relevant and easy way to get the gist of Horizon connections. Although I use VMware Horizon, including its Horizon Connection Server, most, if not all, of what is described here is applicable to VMware Horizon Cloud as well. I thought it would be worthwhile explaining how this works for internal and external connections, with the aid of some diagrams. Some of these exchanges were to help determine the best architecture, some were to understand the traffic flow and network ports, and others were to help in troubleshooting. I’ve had a several conversations over the past few weeks about how a VMware Horizon Client connects to a resource.
0 kommentar(er)
