two-factor authentication

[bjohn]

We have two security servers paired with two internal connection servers.

VDISEC1 paired with VDIBROKER1

VDISEC2 paired with VDIBROKER2

They are both load balanced internally and externally to point to view.mydomain.com. This has worked fine for us so far.

We would like to setup two-factor authentication for external users only. I don't see any way of setting it up without affecting internal users?

Thanks

[JHT_Seattle]

Spin up two more connection servers.  You can tag them ("Internal" and "External") to restrict your pools if necessary, or just have two separate LTMs configured for the service (one internal and one external) with two A records to keep internal users hitting the internal LTM.  That's what worked for us!

[bjohn]

Thanks, I suppose that's the only option I have.

I don't understand why I cant set any authentication options on the security server itself.

[JackMac4]

bjohn wrote:

Thanks, I suppose that's the only option I have.

I don't understand why I cant set any authentication options on the security server itself.

Because a security server isn't a connection server - it's simply a very scaled down DMZ option to get you to a connection server. View is a plugin architecture, meaning there are many modules that make up every component. For the Security Server we simply remove all the modules that aren't necessary, including authentication, because we don't want that exposed on the outside. Many people use their SS's as external facing machines. Depending on your architecture and sizing, you could always have one CS for internal use and one for external use, or possibly three rather than four. But ultimately, yes, you'll need another CS to do this.

[bjohn]

OK. Thanks for the explanation. We would need 2 more for reduancy.

Any issues with mixing 2008 R2 and 2012 connection servers?

[JackMac4]

bjohn wrote:

OK. Thanks for the explanation. We would need 2 more for reduancy.

Any issues with mixing 2008 R2 and 2012 connection servers?

Yes, that would certainly be the recommendation.

[bjohn]

Forgot to mention that I'm still on 5.1.3

Anyone out there use Azure for two-factor with VDI?

[markbenson]

Connection Server 5.1.x must be installed on Server 2008 R2. For Server 2012 you need a newer Horizon/View version.

Mark