WS1 installation in load balanced mode

[w1ldV1rtuD3sk]

Greetings everyone, i am trying to create a Proof Of Concept and i would like to achieve the following architecture : 3 load balanced servers with roles DS,API,AWCM in DMZ Example: --> ServerDS01.awlab.local --> ServerDS02.awlab.local --> ServerDS03.awlab.local Load Balanced VIP --> ServerDS.awlab.com 3 load balanced servers with the Admin Console role in the internal network. Example: --> ServerCN01.awlab.local --> ServerCN02.awlab.local --> ServerCN03.awlab.local Load Balanced VIP --> ServerCN.awlab.com All the above servers will be out of the domain. SQL database will be in the internal network with AlwaysON AG (Server in the AD Domain) Following the documentation of best practices (https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/1907/WS1_Installation.pdf) it is not clear which is the URL of the Admin console and which is the URL of the device services that has to be used during the installation of WS1. The documentation states that i have to use the internal FQDN of the server for the Admin console (CN) and the external FQDN for the Device Services (DS) URL So this means that the first time i will launch the installer on the first Admin Console server i will have to put his FQDN and not the load balancer FQDN? (ex. ServerCN01.awlab.local ) and for Devices services URL the FQDN of the first Device Services server ? (ServerDS01.awlab.local) or the load balanced FQDN of the DS ? I have checked other sites that advice to use the same URL on both Admin console and Device Services and then ' play'  with the CNAME of the device services in order to avoid AWCM problems... (https://digital-work.space/display/AIRWATCH/AirWatch+Install) From your experiences which URL has to be used in each installation ? Thank you in advance for your answer. Regards, Nicolas

[paulmdelv]

I have a similar setup of Workspace ONE that is installed at the moment, but we have 2 CS servers and 2 DS / API / AWCM servers behind load balancers. I wasn't there to set it up, but looking at the site URL's the console looks like UEM@company.com and DS looks like UEMds@company.com.
Hope this helps.

[chengtmskcc]

Nicolas,

I had a very similar setup at my previous position. What do you use to load balance your servers? F5? Citrix Netscaler? Windows?

If my memory serves me correctly, you should have an external DNS name like mobile.awlab.com. Then, traffic coming into this external domain will get routed to one of your servers behind ServerDS.awlab.com in DMZ. Then, traffic continues to flow from ServerDS.awlab.com in DMZ to any server behind ServerCN.awlab.com in internal.

I could be wrong as it's been a while, I think for the install you would use the individual hostname on each server instead of the load-balanced VIP.

[Mario_Giese]

Hi,

this is really missing in the documentation from my point of view.
We use the loadbalanced hostnames while installation because we want the communication between all the WSO Servers go via Loadbalancer in case that one server is down.
But I can't tell you if it is the recommended way.
BR Mario

[w1ldV1rtuD3sk]

I would like to thank all of you for your fast answers, I really appreciate it.
@Paul & Mario : It seems logical indeed to use the load balanced URLs in the server installation, but is not stated in the documentation. @Thomas : For the PoC will be F5, but before i will try the configuration in a small lab with Sophos UTM that i have already deployed. I totally agree for the traffic flow, but for the hostname of the installation do we have to use the FQDN of each individual server ? As Paul and Mario stated it is more logical to use the load balanced URL from the beginning right ?

[w1ldV1rtuD3sk]

I would like to give a feedback on this post, i have implemented the solution with the LB urls during installation and it worked smoothly. I have finally used Netscaler as a LB for my lab.

[BarisGulener]

Hi,

Is it possible for you to share the load balance settings you apply on Netscaler for Device Services Server?

Regards,

Baris