{"id":44651,"date":"2020-09-23T09:00:48","date_gmt":"2020-09-23T07:00:48","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=44651"},"modified":"2020-12-22T16:30:11","modified_gmt":"2020-12-22T15:30:11","slug":"vmware-horizon-7-deploy-unified-access-gateway","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/vmware-horizon-7-deploy-unified-access-gateway\/","title":{"rendered":"VMware Horizon 7: deploy Unified Access Gateway"},"content":{"rendered":"<p><img decoding=\"async\" class=\"aligncenter wp-image-46063 size-full\" title=\"horizon-7-unified-access-gateway-01\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-01.jpg\" alt=\"horizon-7-unified-access-gateway-01\" width=\"602\" height=\"202\" \/><\/p>\n<p><span id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__productname_109629C05AA84B9FA1238280CA1F785E\" class=\"ph productname\">Normally installed in a <strong>DMZ area<\/strong>, the Unified Access Gateway<\/span> (UAG) is an appliance used to ensure incoming traffic comes from a <strong>strongly authenticated remote user<\/strong>.<\/p>\n<p><span id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__productname_109629C05AA84B9FA1238280CA1F785E\" class=\"ph productname\">Unified Access Gateway<\/span> directs authentication requests to the appropriate server and only to desktop and application resources to which the <strong>user is actually entitled<\/strong>.<!--more--><\/p>\n<p>&nbsp;<\/p>\n<h2>Unified Access Gateway<\/h2>\n<p id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__p_86A9BD26056F4BB4B3777E69A5C60CA7\" class=\"p\"><span id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__productname_109629C05AA84B9FA1238280CA1F785E\" class=\"ph productname\">Unified Access Gateway<\/span> <strong>acts as a proxy host<\/strong> for connections inside your company's trusted network adding an extra layer of security.<\/p>\n<p id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__p_9EA3C3FE3DD04E9A8544D4B4F7B4380E\" class=\"p\"><span id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__productname_109629C05AA84B9FA1238280CA1F785E\" class=\"ph productname\">The appliance presents some\u00a0<\/span><strong>hardening settings<\/strong> since it is designed specifically for the DMZ:<\/p>\n<ul id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__ul_E71932554213423A9E5CB1F957860375\" class=\"ul\">\n<li id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__li_4CA49C7F3B43422B9AAAA1D7B3206118\" class=\"li\">Updated Linux Kernel and software patches<\/li>\n<li id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__li_1B96C71773324BB68B0FF10879DFBB78\" class=\"li\">Multiple NIC support for Internet and intranet traffic<\/li>\n<li id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__li_E2A418022C814E9BB2C6A9DD59C23714\" class=\"li\">Disabled SSH<\/li>\n<li id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__li_7C0328254A704403A1D758D813C45495\" class=\"li\">Disabled FTP, Telnet, Rlogin, or Rsh services<\/li>\n<li id=\"GUID-8996B593-6700-4493-8209-62A31C64836E__li_D26D9E6589C14E548EB978BEB61E539A\" class=\"li\">Disabled unwanted services<\/li>\n<\/ul>\n<p>Compared to VPN, the UAG appliance has some advantages:<\/p>\n<ul>\n<li>UAG is design for performance and security.<\/li>\n<li>Users can access their virtual desktops using the Horizon Client only without using different software to connect.<\/li>\n<li><span id=\"GUID-56BBCAD6-F0CE-4DD9-9750-16158E134C52__productname_109629C05AA84B9FA1238280CA1F785E\" class=\"ph productname\">UAG<\/span> applies access rules automatically requiring less administrative effort to maintain the required rules.<\/li>\n<\/ul>\n<ul id=\"GUID-56BBCAD6-F0CE-4DD9-9750-16158E134C52__ul_8C9A3E2004874EFD830054AC7716C0E7\" class=\"ul\"><\/ul>\n<h2>Deployment settings<\/h2>\n<p>The <span id=\"GUID-56BBCAD6-F0CE-4DD9-9750-16158E134C52__productname_109629C05AA84B9FA1238280CA1F785E\" class=\"ph productname\">Unified Access Gateway can be deployed with different configurations.\u00a0<\/span>You can specify one, two, or three <strong>NICS settings<\/strong>:<\/p>\n<ul>\n<li><strong>1 NIC<\/strong> - this is the simplest configuration where <strong>all network traffic<\/strong> is combined onto a <strong>single network<\/strong>.<\/li>\n<li><strong>2 NICs<\/strong> - one NIC for <strong>unauthenticated access<\/strong> and back-end <strong>authenticated traffic and management traffic<\/strong> are separated on the second NIC.<\/li>\n<li><strong>3 NICs<\/strong> - <strong>all traffic<\/strong> is separated in specific networks.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-46065\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-02.jpg\" alt=\"\" width=\"347\" height=\"443\" title=\"\"><\/p>\n<p>&nbsp;<\/p>\n<h2>Firewall ports to open<\/h2>\n<p>To <strong>avoid connection issues<\/strong> in your Horizon infrastructure, the appropriated ports must be open in your firewall. The following table lists ports to open.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46067\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-03-600x330.jpg\" alt=\"\" width=\"600\" height=\"330\" title=\"\"><\/p>\n<p>&nbsp;<\/p>\n<h2><span id=\"GUID-56BBCAD6-F0CE-4DD9-9750-16158E134C52__productname_109629C05AA84B9FA1238280CA1F785E\" class=\"ph productname\">Deploy the UAG appliance<\/span><\/h2>\n<p>After downloading the <a href=\"https:\/\/my.vmware.com\/web\/vmware\/downloads\/info\/slug\/desktop_end_user_computing\/vmware_unified_access_gateway\/3_10\" target=\"_blank\" rel=\"noopener noreferrer\">UAG software<\/a>\u00a0in <strong>OVA format<\/strong>, from vSphere Client right click the object where to install the appliance and select <strong>Deploy OVF Template<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-46069\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-04.jpg\" alt=\"\" width=\"419\" height=\"523\" title=\"\"><\/p>\n<p>Click <strong>Browse<\/strong> and select the .OVA file downloaded from VMware. Click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46071\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-05-600x496.jpg\" alt=\"\" width=\"600\" height=\"496\" title=\"\"><\/p>\n<p>Enter a <strong>Virtual machine name<\/strong> and select a location. Click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46073\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-06-600x495.jpg\" alt=\"\" width=\"600\" height=\"495\" title=\"\"><\/p>\n<p>Specify the compute resource and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46075\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-07-600x495.jpg\" alt=\"\" width=\"600\" height=\"495\" title=\"\"><\/p>\n<p>Click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46077\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-08-600x496.jpg\" alt=\"\" width=\"600\" height=\"496\" title=\"\"><\/p>\n<p>Select the <strong>Configuration<\/strong> required and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46079\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-09-600x495.jpg\" alt=\"\" width=\"600\" height=\"495\" title=\"\"><\/p>\n<p>Select the <strong>Storage<\/strong> to store the appliance and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46081\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-10-600x495.jpg\" alt=\"\" width=\"600\" height=\"495\" title=\"\"><\/p>\n<p>Specify the <strong>Destination Network<\/strong> and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46083\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-11-600x495.jpg\" alt=\"\" width=\"600\" height=\"495\" title=\"\"><\/p>\n<p>Enter the network parameters and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46085\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-12-600x495.jpg\" alt=\"\" width=\"600\" height=\"495\" title=\"\"><\/p>\n<p>Click <strong>Finish<\/strong> to proceed with UAG deployment.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46087\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-13-600x496.jpg\" alt=\"\" width=\"600\" height=\"496\" title=\"\"><\/p>\n<p>&nbsp;<\/p>\n<h2>Configure the <span id=\"GUID-56BBCAD6-F0CE-4DD9-9750-16158E134C52__productname_109629C05AA84B9FA1238280CA1F785E\" class=\"ph productname\">Unified Access Gateway appliance<\/span><\/h2>\n<p>Once the UAG has been deployed, open your preferred browser and enter the address <span style=\"color: #0000ff;\">https:\/\/&lt;IP_UAG&gt;:9443<\/span>. Enter the credentials and click <strong>Login<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-46089\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-14.jpg\" alt=\"\" width=\"450\" height=\"500\" title=\"\"><\/p>\n<p>Click <strong>Select<\/strong> in the <strong>Configure Manually<\/strong> side.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46091\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-15-600x286.jpg\" alt=\"\" width=\"600\" height=\"286\" title=\"\"><\/p>\n<p>Enable the <strong>Edge Service Setting<\/strong> switch under <strong>General Settings<\/strong> to configure the <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-8-2006-whats-new\/\">Horizon environment<\/a>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46093\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-16-600x251.jpg\" alt=\"\" width=\"600\" height=\"251\" title=\"\"><\/p>\n<p>Click the <strong>Horizon Settings<\/strong>' icon.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46095\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-17-600x385.jpg\" alt=\"\" width=\"600\" height=\"385\" title=\"\"><\/p>\n<p>Enter the <strong>Connection Server URL<\/strong> and the <strong>Connection Server URL Thumbprint<\/strong>. Enable the requested <strong>protocols such as PCOIP, Blast<\/strong> and specify the URL for the configured protocols used to connect <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-7-12-installing-connection-server-pt-1\/\">Horizon<\/a>\u00a0infrastructure from external. Click <strong>Save<\/strong> when done.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-46097\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-18.jpg\" alt=\"\" width=\"600\" height=\"943\" title=\"\"><\/p>\n<p>To find the correct Connection Server URL Thumbprint, right click in the browser the certificate used to connect the Connection Server. In the <strong>Details<\/strong> tab search for <strong>Thumbrint<\/strong> and copy the value. This <strong>value needs to be pasted<\/strong> to the appropriated field.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-46099\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-19.jpg\" alt=\"\" width=\"405\" height=\"510\" title=\"\"><\/p>\n<p>If the entered parameters are correct and the correct firewall ports open, you should see all items with a <strong>green circle<\/strong>. If the Horizon Destination Server is red, it means the UAG is <strong>unable to resolve the FQDN<\/strong> of the Connection Sever. As workaround, use the <strong>Connection Server IP Address<\/strong> instead of FQDN.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46101\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-20-600x441.jpg\" alt=\"\" width=\"600\" height=\"441\" title=\"\"><\/p>\n<p>In the Horizon Console, access the <strong>Servers<\/strong> area under <strong>Settings<\/strong> and go to <strong>Connection Servers<\/strong> tab. Select your Connection Server and click <strong>Edit<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46103\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-21-600x444.jpg\" alt=\"\" width=\"600\" height=\"444\" title=\"\"><\/p>\n<p>Disable the <strong>HTTP(s) Secure Tunnel<\/strong> and both <strong>PCoIP and Blast Secure Gateways<\/strong>. Click <strong>OK<\/strong>\u00a0to save the configuration.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46105\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-22-600x533.jpg\" alt=\"\" width=\"600\" height=\"533\" title=\"\"><\/p>\n<p>Now access the <strong>Gateways<\/strong> tab and click <strong>Register<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46107\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-23-600x549.jpg\" alt=\"\" width=\"600\" height=\"549\" title=\"\"><\/p>\n<p>Enter the <strong>name of the appliance<\/strong> specified in the Advanced Settings of the UAG and click <strong>OK<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46109\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-24-600x241.jpg\" alt=\"\" width=\"600\" height=\"241\" title=\"\"><\/p>\n<p>The appliance has been registered successfully.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46111\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-25-600x344.jpg\" alt=\"\" width=\"600\" height=\"344\" title=\"\"><\/p>\n<p>Under <strong>Monitor<\/strong>, select <strong>Dashboard<\/strong> and click <strong>View<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46113\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-26-600x477.jpg\" alt=\"\" width=\"600\" height=\"477\" title=\"\"><\/p>\n<p>In the <strong>Gateway<\/strong> tab you can find the configued UAG.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46115\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-27-600x410.jpg\" alt=\"\" width=\"600\" height=\"410\" title=\"\"><\/p>\n<p>Testing the connection to a VD, the <strong>Security Gateway<\/strong> used by Horizon is the configured UAG.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46117\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-29-600x262.jpg\" alt=\"\" width=\"600\" height=\"262\" title=\"\"><\/p>\n<p>&nbsp;<\/p>\n<h2>Export the UAG configuration<\/h2>\n<p>To export the configuration, in the UAG configuration UI you can find the <strong>Export Unified Access Gateway Settings<\/strong> option under <strong>Support Settings<\/strong>. You can export the configuration in <strong>JSON or INI format<\/strong> by clicking the appropriated options.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-46119\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-30-600x222.jpg\" alt=\"\" width=\"600\" height=\"222\" title=\"\"><\/p>\n<p>The settings are exported to your computer. Click <strong>OK<\/strong> to save.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-46121\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/09\/horizon-7-unified-access-gateway-31.jpg\" alt=\"\" width=\"434\" height=\"320\" title=\"\"><\/p>\n<p>The Unified Access Gateway configuration is now complete and the appliance is ready to manage the connection requests.<\/p>\n<p><img decoding=\"async\" title=\"signature\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/images\/firma.jpg\" alt=\"signature\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Normally installed in a DMZ area, the Unified Access Gateway (UAG) is an appliance used to ensure incoming traffic comes from a strongly authenticated remote user. Unified Access Gateway directs authentication requests to the appropriate server and only to desktop and application resources to which the user is actually entitled.<\/p>\n","protected":false},"author":3,"featured_media":46063,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"facebook_2879994398731222_17841400390232720":"","mastodon_115463926174894442_115463926174894442":"","linkedin_93tdZWzMZc_93tdZWzMZc":"","bluesky_did:plc:tkabz5kl2rukzdwtuongv3kz_did:plc:tkabz5kl2rukzdwtuongv3kz":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[903,1025],"tags":[1711,2250,2235,699],"class_list":["post-44651","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vmware-en","category-horizon-en","tag-horizon","tag-uag","tag-unified-access-gateway","tag-vmware-en","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/44651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=44651"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/44651\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/46063"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=44651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=44651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=44651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}