Enabling PCoIP gateway function after 4.6 upgrade

[FrederikLeed]

My setup is as below

• External URL; mydesktoptest.xx.com (IP: 212.xx.xx.1)
  • Load Balancer (IP: 192.xx.xx.1)
    • SecurityServer1 (IP: 192.xx.xx.11)
      • ConnectionServer1 (IP: 172.xx.xx.1)

• External URL; mydesktop.xx.com (IP: 212.xx.xx.2)
  • Load Balancer (IP: 192.xx.xx.2)
    • SecurityServer2 (IP: 192.xx.xx.22)
      • ConnectionServer2 (IP: 172.xx.xx.2)

• Internal DNS; viewdesktop (RoundRobin DNS Alias)
  • ConnectionServer3 (IP: 172.xx.xx.3)
  • ConnectionServer4 (IP: 172.xx.xx.4)

• SecurityServer1
  • HTTP(S) Secure Tunnel
    • External URL: https://mydesktoptest.xx.com:443
  • PCoIP Secure Gateway
    • PCoIP External URL: 212.xx.xx.1:4172

• ConnectionServer1
  • Tags
    • Tags: BLANK
  • HTTP(S) Secure Tunnel
    • External URL: https://mydesktoptest.xx.com:443
    • Use Secure Tunnel Connection to desktop: YES
  • PCoIP Secure Gateway
    • PCoIP External URL: 212.xx.xx.1:4172
    • Use PCoIP Secure Gateway for PCoIP connections to desktop

I have no trouble connecting via PCoIP if i connect through mydesktoptest.xx.com if i'm on LAN. I have no trouble using the RDP protocol via mydesktoptest.xx.com from anywhere.

I'm not experiencing  the black timeout screen. I get this in the application log on the security server:

Log Name:      Application

Source:        VMware View

Date:          04-07-2011 11:41:11

Event ID:      102

Task Category: VMware View

Level:         Information

Keywords:      Classic

User:          SYSTEM

Computer:      SecurityServer1

Description:

(4F8761324B3BA72A1B1805B6495826FC) Problem starting channel 0 for Port2: Failed to allocate onbound connection to 172.xx.xx.145:32111: java.net.SocketTimeoutException: makeSocketConnection timed out com.vmware.vdi.ice.server.aj.d(SourceFile:857)

com.vmware.vdi.ob.tunnelservice.cb: Failed to allocate onbound connection to 172.xx.xx.145:32111: java.net.SocketTimeoutException: makeSocketConnection timed out

                             at com.vmware.vdi.ice.server.b.<init>(SourceFile:85)

                             at com.vmware.vdi.ice.server.aj.d(SourceFile:833)

                             at com.vmware.vdi.ice.server.aj.c(SourceFile:663)

                             at com.vmware.vdi.ob.tunnelservice.ab.run(SourceFile:830)

                             at java.lang.Thread.run(Thread.java:619)

Linked exception: java.net.SocketTimeoutException: makeSocketConnection timed out

java.net.SocketTimeoutException: makeSocketConnection timed out

                             at com.vmware.vdi.ob.tunnelservice.cj.a(SourceFile:182)

                             at com.vmware.vdi.ice.server.b.<init>(SourceFile:61)

                             at com.vmware.vdi.ice.server.aj.d(SourceFile:833)

                             at com.vmware.vdi.ice.server.aj.c(SourceFile:663)

                             at com.vmware.vdi.ob.tunnelservice.ab.run(SourceFile:830)

                             at java.lang.Thread.run(Thread.java:619)

Have i configured my end incorrectly or am i looking at spending hours with the LoadBalance / Network guys?

[admin]

Posting the pcoip logs might prove to be useful in determining the root cause.

[FrederikLeed]

[2011-Jul-04 12:55:13.852125]: header received

[2011-Jul-04 12:55:13.852125]: PCOIP-SG/1.0

[2011-Jul-04 12:55:13.852125]: XML

[2011-Jul-04 12:55:13.852125]: 135FE8EA619CA7C894843E6353068E34-0

[2011-Jul-04 12:55:13.852125]: 357

[2011-Jul-04 12:55:13.852125]: xml received 357 357

[2011-Jul-04 12:55:13.853101]: Received command: add-connection

[2011-Jul-04 12:55:13.853101]: Parameter: connection-id Value: 135FE8EA619CA7C894843E6353068E34/port1

[2011-Jul-04 12:55:13.853101]: Parameter: ctag Value: SCS1eLPMIPKNl5DcjXwIlsUEEZkY9ccZYKZraEzlQjo3lrdN6In+Chd7hkZdG04svDxiE2ZGLfHnj6dBlgtj1CbcnIU/J/Ko0LUGsM0m

[2011-Jul-04 12:55:13.853101]: Parameter: ip-address Value: 172.xx.xx.145

[2011-Jul-04 12:55:13.853101]: Parameter: tcp-port Value: 4172

[2011-Jul-04 12:55:13.856031]: Connected to PCoIP server

[2011-Jul-04 12:55:20.625562]: Error reading SSIG header from PCoIP server: An existing connection was forcibly closed by the remote host

[FrederikLeed]

I also have this from the LB log;

<?xml version="1.0"?><broker version="4.5"><get-desktop-connection><desktop-id>CN=XXXX,OU=XXXXX,DC=XXX,DC=XXXXXX,DC=XXX</desktop-id><environment-information><info name="LoggedOn_Username">xxxxx</info><info name="LoggedOn_Domainname">domain.local</info><info name="Type">Windows</info><info name="IP_Address">xxx.xxx.xxx.xxx</info><info name="MAC_Address">xx-xx-xx-xx-xx-xx</info><info name="Machine_Name">MYPC</info><info name="Machine_Domain">xx</info></environment-information><protocol><name>RDP</name></protocol></get-desktop-connection></broker>

[04/Jul/2011:10:41:13 +0200]     INFO     rules/mydesktop-response-data-get     rulelogmsginfo     vservers/MyDesktopTest - 443

HTTP/1.1 200 OK

Content-Length: 797

Content-Type: text/xml;charset=UTF-8

[04/Jul/2011:10:44:41 +0200]     INFO     rules/mydesktop-request-data-get     rulelogmsginfo     vservers/MyDesktopTest - 443

POST /broker/xml HTTP/1.1

Accept: text/*, application/octet-stream

content-type: text/xml; charset=UTF-8

Cookie: com.vmware.vdi.broker.location.id=xx-xx-xx-xx-xx-xx

Cookie: JSESSIONID=7FBDD2DEE6ECF6AF83D796B41658C3B6

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)

Host: mydesktoptest.xx.com

Content-Length: 64

Connection: Keep-Alive

Cache-Control: no-cache

<?xml version="1.0"?><broker version="4.5"><do-logout/></broker>

I am wondering why it says "Broker version="4.5"", the ViewAdmin interface says 4.6 to all of my security / connection servers.

[npeter]

Hi,

have a you enabled the option to use PCoIP Secure gateway in your connection broker?

Please have a look at this kb http://kb.vmware.com/kb/1034825

-noble

[DEVAXTATOR]

http://www.youtube.com/watch?v=hPsyhI6_s-I

use this link from vmwaretv.

[mittim12]

Also take a look at this document for setting up PCOIP for remote use.

http://communities.vmware.com/docs/DOC-14974

[FrederikLeed]

http://www.youtube.com/watch?v=hPsyhI6_s-I <-- How come he puts in 192.168.1.100 in the connection server as the external IP adress, and 192.168.10.100 ind the security server as the external IP adress?

Also, great links everyone, but i've been through them all and none really describe a setup where a load balancer is used, and none speak of External IP adresses and NAT'ing.

[heikkitoivanen]

FrederikLeed wrote:

• ConnectionServer1
  • Tags
    • Tags: BLANK
  • HTTP(S) Secure Tunnel
    • External URL: https://mydesktoptest.xx.com:443
    • Use Secure Tunnel Connection to desktop: YES
  • PCoIP Secure Gateway
    • PCoIP External URL: 212.xx.xx.1:4172
    • Use PCoIP Secure Gateway for PCoIP connections to desktop

I've recently spent hours and hours on this, and just got it working awhile ago, but as far as my understanding of the instructions&my own experiences go, if you are using a Security Server - setup , then you don't need to change the external URL nor the PCoIP external URL settings of the Connection Server. Just leave them as the real dns name of the connection server for the https external url, and the real ip address of the connection server for the PCoIP external URL.You do change them for the security server only, and they should be pointing to the nat'ed/virtual ip. And it would seem that you have done that correctly. But please change the connection server settings and have a go?

FrederikLeed wrote:

...

I'm not experiencing  the black timeout screen. I get this in the application log on the security server:

...

(4F8761324B3BA72A1B1805B6495826FC) Problem starting channel 0 for Port2: Failed to allocate onbound connection to 172.xx.xx.145:32111: java.net.SocketTimeoutException: makeSocketConnection timed out com.vmware.vdi.ice.server.aj.d(SourceFile:857)

com.vmware.vdi.ob.tunnelservice.cb: Failed to allocate onbound connection to 172.xx.xx.145:32111: java.net.SocketTimeoutException: makeSocketConnection timed out

...

This is the Security Server trying to talk to a virtual desktop/view agent in tcp-port 32111 which is used for USB redirection. You should have it checked that no firewall rules are blocking if you like to use it. Figure 5-6 'VMware View Components and Protocols with a Security Server' from the VMware View Architecture Planning Guide is quite helpful in what need to be open and into which direction; just follow the arrowheads closely.

[heikkitoivanen]

FrederikLeed wrote:

http://www.youtube.com/watch?v=hPsyhI6_s-I <-- How come he puts in 192.168.1.100 in the connection server as the external IP adress, and 192.168.10.100 ind the security server as the external IP adress?

Also, great links everyone, but i've been through them all and none really describe a setup where a load balancer is used, and none speak of External IP adresses and NAT'ing.

Every environment varies to some degree, but the simplest scenario I see involving a security server is like this:

people sitting inside the company in the same LAN, can just point their View Client towards the View Connection Server; In the View Administration, in the simplest scenarion, where the Connection Server just has a single NIC and a single IP, you would then enter this IP (for pcoip external url) and dns name ( for https external url) for the Connection Server (I can't remember if the installation will have to correct by default in single ip scenario).  And if you will also have a tunneling Security Server for people sitting outside the company (homeoffice/coming from wan/etc.) you must check the checkboxes to use tunneling and pcoip secure gateway.

For the Security Server you change the pcoip external URL to be the nat'ed virtual ip address and the https external url to be the dns-name that corresponds to the virtual ip provided by NAT. View Clients sitting outside the company are pointed to that outside name.

After that it should be just verififying that the nat/virtual ip passes traffic to the actual ip of the security server and all firewalls rules are correct from the view clients to the security server and from the security server to the virtual desktops.

[markbenson]

FrederikLeed wrote:

... but i've been through them all and none really describe a setup where a load balancer is used, and none speak of External IP adresses and NAT'ing.

This one does - http://communities.vmware.com/docs/DOC-14974

It even goes through a worked example in the video of two Connection Servers, two Security Servers and a load balancer with access from the Internet. It also covers precisely how to set things up through View Administrator.

Mark.

[FrederikLeed]

After waching some more video and reading some more, i've changed the settings to:

SecurityServer1 

• HTTP(S) Secure Tunnel 
  • External URL: https://mydesktoptest.xx.com:443
• PCoIP Secure Gateway 
  • PCoIP External URL: 212.xx.xx.1:4172

ConnectionServer1

• Tags 
  • Tags: BLANK
• HTTP(S) Secure Tunnel
  • External URL: https://connectionserver1.domain.local:443
  • Use Secure Tunnel Connection to desktop: YES
• PCoIP Secure Gateway
  • PCoIP External URL: 172.xx.xx.1:4172
  • Use PCoIP Secure Gateway for PCoIP connections to  desktop: YES

The weird thing is, when i am connected to my desktop from one pc ( PCoIP from local lan to connectionserver3/4) and then tries to connect via PCoIP from an external network from another pc, the connection actually goes so far as to disconnect the 1. session AND i am promtet for username and password when connecting again from my pc on LAN.

So some kind of connection is actually made, but then it quits.

Could this be becaus port 32111 is not open from the security server to my desktop or does this just disable USB traffic?

[DEVAXTATOR]

do a telnet test to the port if it works

ex: use putty

telnet ip of the security gateway:443 and 4172

and also if dosent work open also port 50002 the pcoip uses this protocol its not in the manual but for me it worked

4172 ud and tcp

50002 tcp and udp

[DEVAXTATOR]

if it goes black ex: it prompts username and password connects u see the bar of the vmware but the screen is black and disconnects use this workarround http://twitpic.com/3yuw2r u have to use this version of the vmware svga driver to connect to pcoip other drivers simply dont work

[heikkitoivanen]

tcp32111 is only needed for usb redirection; If you have it blocked, the you usb devices won't be available, but the desktop will work otherwise.

[markbenson]

Check the firewall config very carefully. (TCP in and UDP in both directions). This is step 3 http://communities.vmware.com/docs/DOC-14974

This was the problem in this post - http://communities.vmware.com/thread/318586 - it's possible you have the same problem. Look at the steps described in that post and see if this fixes your issue too.

The problem with a telnet type test for the ports is that this will only test TCP not UDP. Also, UDP is both directions.

Port 50002 was used in old View clients. View 4.6 uses 4172. 50002 can be used still as a source port and reply UDP to that source port, but destination ports are 4172 so it's unlikely you will need to do anything with 50002 at your firewall config.

If you still can't get this configured correctly, you may want to resort to Wireshark to look at the PCoIP interactions (as described in the referenced post above) to help you track this down.

Also check that your load balancer is not directing some or all of the PCoIP traffic from the client to the wrong Security Server. There is a section in the video on this specific point.

Let us know what it was once this is resolved.

Thanks.

Mark.

[FrederikLeed]

From internet:
telnet mydesktoptest.xx.com 4172 = OK!

From Securityserver1:
telnet 172.xx.xx.145 4172 = OK

How to test UDP ports?

I am thinking that UDP from Virtual Desktop to Security server is not enabled. Since i actually kind of connects to my desktop, but the connection is broken just as i would be presented with login screen.

I have a date with at network dude this week and i'll give you an update once it works.

[markbenson]

FrederikLeed wrote:

How to test UDP ports?

That's not possible, because you'd need to test not only inbound UDP, but outbound too. Test with a View Client and if you still get the black screen look at wireshark traces at the client and at the security server. This should help you to narrow down where PCoIP is getting blocked.

When you talk to your network person, please be very clear about the 6 PCoIP firewall rules needed (as detailed in step 3).

Mark.

[heikkitoivanen]

Not sure if you're familiar with Wireshark, and whether your environment permits installing it;

I had the priviledge of running this setup out-of-production, and could install it, I went and installed it on three hosts:

the view client host (my pc), the view security server and the virtual desktop.

Had it running simultaneously on all three hosts, and tried the view client on my pc to see what happens.

I created the following checklist for myself:

Run Wireshark on View Client (filter for 'tcp.port==443 || tcp.port==4172 || udp.port==4172'):

outgoing tcp443 (HTTPS) packets going to Security Server (nat'ed VIP address)? [yes/no] :

incoming tcp443 (HTTPS) packets from Security Server? [yes/no] :

outgoing tcp4172 (PCoIP) packets going to Security Server (nat'ed VIP address)? [yes/no] :

incoming tcp4172 (PCoIP) packets from Security Server? [yes/no] :

outgoing udp4172 (PCoIP) packets going to Security Server (nat'ed VIP address)? [yes/no] :

incoming udp4172 (PCoIP) packets from Security Server? [yes/no] :

Run Wireshark on View Security Server (filter for 'tcp.port==4172 || udp.port==4172'):

incoming tcp4172 (PCoIP) packets from View Client? [yes/no] :

outgoing tcp4172 (PCoIP) packets going to Virtual Desktop? [yes/no] :

incoming tcp4172 (PCoIP) packets from Virtual Desktop? [yes/no] :

outgoing udp4172 (PCoIP) packets going to Virtual Desktop? [yes/no] :

incoming udp4172 (PCoIP) packets from Virtual Desktop? [yes/no] :

outgoing udp4172 (PCoIP) packets going to View Client? [yes/no] :

Run Wireshark on View Desktop (filter for 'tcp.port==4172 || udp.port==4172'):

incoming tcp4172 (PCoIP) packets from Security Server? [yes/no] :

outgoing tcp4172 (PCoIP) packets to Security Server? [yes/no] :

incoming udp4172 (PCoIP) packets from Security Server? [yes/no] :

outgoing udp4172 (PCoIP) packets to Security Server? [yes/no] :

I carefully went through all my questions, and noticed that my network team had forgot to permit udp4172 between ss and virtual desktop, they permitted only tcp4172. After they fixed it, I was all good, and things worked.

Anyhow, going through a strict check-regime helped me pinpoint the issue. Maybe you can give it a try?

[DEVAXTATOR]

im sure of it if you can connect but the screen is black change to rdp protocol and try to connect if it works its the vmware svga driver. i had the same problem and i found an old post migrating to vmware view 4.5 because of the svga driver the link is in the previous post