Configure NetScaler Gateway enabled PCoIP proxy for VMware Horizon View
Prerequisites
Version- NetScaler 12.0 or above
Universal License- PCoIP Proxy uses the Clientless Access feature of NetScaler Gateway, which means every NetScaler Gateway connection must be licensed for NetScaler Gateway Universal. On the NetScaler Gateway virtual server, ensureICA Onlyis cleared.
Horizon View infrastructure- A functional internal Horizon View infrastructure. Ensure you are able to connect to Horizon View Agents internally without NetScaler Gateway. Ensure that the Horizon ViewHTTP(S) Secure Tunnel和PCoIP Secure Gateway不是视图连接服务器上启用那t NetScaler will proxy connections to. Following versions of VMware Horizon view are supported.
- Connection Server: 7.0.1 and above
- Horizon Client: 4.2.0 and above (Windows and Mac)
Firewall Ports:
Ensure the following:
- UDP 4172 and TCP 443 must be open from Horizon View Clients to the NetScaler Gateway VIP.
- UDP 4172 must be open from the NetScaler SNIP to all internal Horizon View Agents.
- PCoIP Proxy is supported on NetScaler deployed behind NAT. Following are the important points to consider:
- Support is based on VPN virtual server FQDN parameter setting
- Supports only publicly accessible FQDN and not IP
- Supports only 443 and 4172 ports
- Must be a static NAT
Certificate– A valid certificate for the NetScaler Gateway virtual server.
Authentication– An LDAP authentication policy/server using advanced syntax.
Unified Gateway (optional)– If Unified Gateway, create the Unified Gateway before adding PCoIP functionality.
RfWebUI Portal Theme– For web browser access to Horizon View, the NetScaler Gateway virtual server must be configured with the RfWebUI theme.
Horizon View Client– The Horizon View Client must be installed on the client device, even if accessing Horizon published icons using the NetScaler RfWebUI portal.
To configure NetScaler Gateway to support PCoIP proxy for VMWare Horizon View:
Navigate toConfiguration > NetScaler Gateway Policies > PCoIP.
Create a virtual server profile and a PCoIP profile on thePCoIP Profiles and Connectionspage.
To create a virtual server profile, on theVServer Profilestab, clickAdd.
Enter a name for the virtual server profile.
Enter an Active Directory Domain Name that is used for single sign-on to View Connection Server, and then clickCreate.Note:Only a single Active Directory domain is supported per NetScaler Gateway virtual server. Also, the domain name specified here is displayed in the Horizon View Client.
ClickLogin.
To create a PCoIP profile, on theProfilestab, clickAdd.
Enter a name for the PCoIP profile.
Enter the connection URL for the internal VMware Horizon View Connection Server, and then clickCreate.
Navigate toConfiguration > NetScaler Gateway > Policies > Session.
On the right, select theSession Profilestab.
On theNetScaler Gateway Session Policies and Profilespage, create or edit a NetScaler Gateway session profile.
To create a NetScaler Gateway session profile, clickAdd, and provide a name.
To edit a NetScaler Gateway session profile, select the profile, and clickEdit.
On theClient Experiencetab, ensure that theClientless Accessvalue is set toOn.
On theSecuritytab, ensure that theDefault Authorization Actionvalue is set toALLOW.
On thePCoIPtab, select the required PCoIP profile, and then clickCreate. You can also create or edit PCoIP Profiles from this tab.
ClickCreateorOKto finish creating or editing the Session Profile.
If you have created a session profile, then you must also create a corresponding session policy.
Navigate toConfiguration > NetScaler Gateway > Policies > Session.
select theSession Policiestab and then clickAdd.
In the Create NetScaler Gateway Session Policy page, enter a name for the policy.
InProfile, select an existing profile or clickAdd和create a profile.
- Add an expression.
- ClickAdvanced Policy和then clickExpression Editor.
- InExpression, select the expression as per your requirement.
- ClickOK.
Bind the created PCoIP virtual server profile and session policy to a NetScaler Gateway virtual server.
Go toNetScaler Gateway > Virtual Servers.
On the right, eitherAdda new NetScaler Gateway virtual server, orEditan existing NetScaler Gateway virtual server.
If you are editing an existing NetScaler Gateway virtual server, in theBasic Settingssection, click the pencil icon.
For both adding and editing, in theBasic Settingssection, clickMore.
Use thePCoIP VServer Profilemenu to select the required PCoIP virtual server Profile.
Scroll down and ensure that ICA Only is cleared. Then clickOKto close theBasic Settings部分。
If you are creating a NetScaler Gateway virtual server, bind acertificate, and bind an LDAP authentication policy.
Scroll down to thePoliciessection and click the plus icon.
TheChoose Typepage defaults toSession和Request. ClickContinue.
In thePolicy Bindingsection, clickClick to select.
Select the required Session Policy that has the PCoIP Profile configured, and clickSelect.
In thePolicy Bindingpage, clickBind.
If you want to use a web browser to connect to VMware Horizon View, underAdvanced Settings, add thePortal Themes部分。如果你只使用Cl地平线视图ient to connect to NetScaler Gateway, then you don’t must perform this step.
Use thePortal Thememenu to selectRfWebUI和clickOK.
Horizon View published icons are added to the RfWebUI portal.
Note:VMware uses two or more protocols when using any protocol other than RDP. This can cause the requests to be load balanced across two different back-end servers. You can resolve this issue by setting up a single persistency group across all protocols ensuring all connections remain on the same Citrix virtual server.
Steps to enable USB redirection
USB devices connected to the client machine can be accessed from the virtual desktops and apps. Following are the steps to enable USB redirection:
- Log in to VMware Horizon Administrator Console.
- Navigate toInventory > View Configuration Servers.
- Select theConnection Serverstab.
- Select a listed Connection Server and ClickEdit.
- Under theGeneraltab, selectUse Secure Tunnel connection to machineoption underHTTP(S) Secure Tunnel. Provide NetScaler Gateway external URL in theExternal URLfield.
Update content switching expression for Unified Gateway
If your NetScaler Gateway virtual server is behind a Unified Gateway (Content Switching Virtual Server), then you must update the Content Switching Expression to include the PCoIP URL paths.
In the NetScaler GUI, navigate toConfiguration > Traffic Management > Content Switching > Policies.
Append the following expression under theExpressionarea, and then clickOK.
http.req.url.path.eq(“/broker/xml”) | http.req.url.path.contains(“/broker/resources”) | http.req.url.path.eq (" / pcoip-client”) | http.req.url.path.contains(“/ice-tunnel”) |
Use PCoIP gateway
To connect, you must have the Horizon View Client installed on the client device. Once installed, you can either use the Horizon View Client’s User Interface to connect to NetScaler Gateway, or you can use the NetScaler Gateway RfWebUI portal page to view the icons published from Horizon.
To view the active PCoIP connections, go toNetScaler Gateway > PCoIP.
On the right, switch to theConnectionstab. The active sessions are displayed with the following data: user name, Horizon View Client IP, and Horizon View Agent Destination IP.
To terminate a connection, right-click theConnectiontab, and clickKill Connection. Or clickKill All Connectionsto terminate all PCoIP connections.