Local Mode Access- manual checkout over WAN connection

[mobcdi]

I would like to configure local mode access to some desktops but want to use the manual checkout option (pg 254 of View 4.6 admin guide) I've distributed the base image which was published to the transfer server but when a user try's to complete the checkout process they get the error "A connection to the transfer server could not be established. Please check your network settings". They are able to see their entitled desktops and point it to the base image they received via other distribution channels (i.e. not directly from view servers)

My security server firewall is setup to allow JMS, JMSIR,AJP13, http, https and PCoIP ports back to the connection server but how do I configure the transfer server to fit in to the setup or is there alternatives to opening ports to the transfer server inside the corporate lan if I just want to use it for local mode access

[npeter]

Hi,

You need to enable these rules in firewall

Security server to Transfer Server port HTTP 80.

Security servers can use port 80 to download View desktop data to local mode desktops from the Transfer Server and to replicate data to the Transfer Server.

Security server to Transfer Server port HTTPS 443. If you configure View Connection Server to use SSL for local mode operations and desktop provisioning, security servers use port 443 for downloads and replication between local mode desktop

for more details refer page 61 of www.vmware.com/pdf/view-46-architecture-planning.pdf

-noble

[mobcdi]

Hi npeter,

Thanks for replying, I have a few follow up questions if you have a moment

So I could decide to use either 80 or 443 (if I choose to use SSL for local mode operations and desktop provisioning) not necessarily both?

Would my transfer server need to resolve to its FQDN and/or IP address for just the security server in the DMZ or would it be required for the local mode clients coming in over the internet to be able to do so to complete the download?

http://kb.vmware.com/kb/1027217 seems to say both the security server and the local mode clients need to be able to access the transfer server or is it possible to direct all traffic between view elements through the security server?

I suppose what I don't fully understand is the sequence of communications between a remote localmode client and the security server & transfer server

[npeter]

Hi Mob,

Yes you need to open one of them based on view configurations.

The following help topics from view admin will make things clear on which ports should be used when. These options are set under connection server-> Local mode

"1. Use secure tunnel connection for Local Mode operations:   
Local desktops use tunneled communications. Network traffic is routed through View Connection Server or a security server if one is configured.
If you do not use this setting, data transfers take place directly between local desktops and the corresponding remote desktops in the datacenter.
The default is not to use secure tunnel connections.

2. Use SSL for Local Mode operations:   
Communications and data transfers between client computers and the datacenter use SSL encryption. These operations include checking in and checking out desktops and replicating data from client computers to the datacenter, but do not include transfers of View Composer base images. They involve connections between client computers and View Transfer Server.
The default is not to use SSL.

3. Use SSL when provisioning desktops in Local Mode:
Transfers of View Composer base-image files from the Transfer Server repository to client computers use SSL encryption. These operations involve connections between client computers and View Transfer Server.

The default is not to use SSL."

In short,

If only option 1 is selected then 80 has to open between SS and TS

If any of the other options are also selceted, then port 443 needs to be open instead of 80.

I believe TS FQDN need not be resolvable from clients while in tunneled mode transfer.

This kb article lists all network port requirements for situations in view. http://kb.vmware.com/kb/1027217

-noble

[mobcdi]

Thanks noble I had forgotten about those settings on the connection server. I'm still abit unsure about the communications and I hope I can ask your help once again, if I enable setting 1 & 2 in local mode on my Connection Server (CS)as you outlined in your reply would the communication between the user checking out the desktop and the view environment look like Sequence 1 or Sequence 2?

Sequence 2, where there is still a need to talk directly to the transfer server

[npeter · Accepted solution]

Hi Mobcdi,

Option 1 (tunnel) description says "Network traffic is routed through  View Connection Server or a security server if one is configured."

Sequence -1 is looks more correct but with slight modification.

Form SS there should be a direct SSL connection to TS, because all local mode traffic is routed directly between SS and TS

Back end firewall rules on Page 61 of www.vmware.com/pdf/view-46-architecture-planning.pdf says

"If you configure View Connection Server to use SSL for local mode operations and desktop provisioning, security servers use port 443 for downloads and replication between local mode desktops and the Transfer Server."

-noble

[mobcdi]

Thanks noble,

I was hoping it would be end something like that, maybe 4.7 or 5 could have a ST security-transfer server role so it could be located in the DMZ and manually upload or sync the images that should be available outside the network kind of how "Update Manager Download Service" works with update manager.

Either way thanks for the help