RDP tunneling through VDI security server and then through VDI standard server

[Realworld]

Hi,

I have a problem with the setup as we would like it to be. If I take the instructions from the setup and administration manual for VDI, I don't get it to work. Here is a small schematic of my environment:

client -security server-standard server----client VM

Now what I seem to be getting from my logs, is that the security server wants to connect directly to the client VM. However, from security perspective we don't want this to happen (since the security server is directly attached to the internet)

Is there a way to let the security server tunnel it's RDP requests through the standard server?

[knudt]

Yes, this is possible. In VIew Manager, click on the Configuration button. Then for each VDM server, Edit the properties and ensure that the "Direct Connection to Desktop" is NOT selected.

[admin]

Hi Realworld,

as you will see onpage 32 of the View admin guide, this is the right way it works. The security server uses a direct RDP connection to the desktop. From a security perspective I think this is a good solution. The security server is only a gateway, which talks ssl/https (443) to the internet. on the internal site, it needs RDP to speak to the desktop and also open ports for JMS (the messaging protocol the brokers/agent use to communicat) and ARJ for the forwarded web traffic.

The user is redirected to his desktop, after he was authenticated against the Active Directory and optional to RSA SecurID and he has never contact with the original connection server.

On page 32 of the manual you can see what I mean.

Thanks,

Christoph

[Realworld]

Hi Christoph,

I must admit that I did see that image of protocol flows. However, if I look at the image on the page before that (the one with the Firewalls) then I get the impression that the Security server doesn't need a direct connection to the client using RDP. If there is any way that also the RDP traffic could be forwarded through the standard server (so not just the JMS and AJP13 traffic), I would become a very happy person :smileygrin:

Regards,

[TomHowarth]

Moved to the VMware View Manager Forum

If you found this or any other answer useful please consider the use of the Helpful or correct buttons to award points

Tom Howarth

VMware Communities User Moderator

Blog: www.planetvm.net