Re: Is a security server required for internet con... - VMware Technology Network VMTN

VMware Horizon Community

Do I have to deploy a VMware View Security Server to allow View clients to connect to View managed virtual desktops? Or can the Connection Server do everything? This is a small deployment and one server should be plenty to get the job done.

13 Replies

The connection server could do everything if you wanted to expose it to the outside world. The security server is just a secure method of relaying traffic from the internet to the LAN.

If you found this or any other post helpful please consider the use of the Helpful/Correct buttons to award points

Is there anything special that has to be done to get this to work? Do I need to do the setup for the connection server and the setup/configuration for the security server? I ask this because I am not able to connect from the internet. When I logon in with the View Client, after putting in my password and clicking LOGIN the login button and the cancel button grey out and I can do nothing else. If I look at the event messages on the connection server it says I have been disconnected from the security gateway.

Ok just for clarification are you referring to connections made outside of your LAN, such as a user from home connecting to a View Desktop over their internet connection or you referring to just using IE to connect from inside the LAN?

If you found this or any other post helpful please consider the use of the Helpful/Correct buttons to award points

Yes I want to allow connections from the internet (outside the LAN) using the View Client to a View Desktop. I want these connections to come directly to the connection server (View Manager). I do not want to have to install a second server for the security gateway. Can the connection server handle all the work required to have RDP tunnelled inside SSL connections?

Yes, it could handle it but you are going to have to expose all necassary ports through the firewall. Also depending on if you are using the direct configuration option to connect to virtual machines then you will have to allow 3389 of the VM's out over the firewall. Granted I have never done this as I see it as a security risk but it should be doable .

If you found this or any other post helpful please consider the use of the Helpful/Correct buttons to award points

Well that is my point also. I don't want to have to open anything but 443 on the firewall. So my question is can the connection server tunnel RDP through 443 so I don't have to open all the other ports on the firewall? Also, I do not want to use direct connection. I want 3389 tunnelled through 443. I know the security gateway will do this but like all the documentation says, the security gateway is just a subset of the connection server. So I figured the connection server could handle all the traffic through 443 just like the security gateway server could. Am I wrong?

I don't see why not. Do you have your external URL set correctly? Maybe you should capture the IP traffic while you are trying to connect to try and determine what is failing.

If you found this or any other post helpful please consider the use of the Helpful/Correct buttons to award points

Thanks for all your help. I will work on it further and see what I can get to work.

Sorry I couldn't be more helpful. Please respond back to the thread and let me know how it goes.

If you found this or any other post helpful please consider the use of the Helpful/Correct buttons to award points

Hello,

Is secuirty server required to track client side logins to their virtual desktops?

I wouldn't say that a Security Server is required for connectivity outside of the network but it would be the perferred method. If you want to simply track when clients login to their desktops you would setup an event database and that is where your connection brokers would store their information regarding events within the View environment.

If i use a m0n0wall VM like firewall/router, you think I nedd Security server ? In order to access mi infrastructure from internet which will be my https tunnel and PCoIP Secure Gateway IPs i have to put in ? In both cases the public IP of the firewall, right?

Thanks in advance...

I would always use a security server simply because I don't want to expose my connection broker.

Also if you don't mind create a new post if you have new questions. Much easier to work that when then from the older post in the forum.