article Setting up PCoIP Remote Access with View 4.6 and Newer in Horizon Documents

Setting up PCoIP Remote Access with View 4.6 and Newer

markbenson — Fri, 25 Feb 2011 12:34:47 GMT

Starting at version 4.6, View has the ability to support PCoIP remote access through the View Security Server. See View 4.6 Announcement.

I posted an article back in December 2010 in the End User Computing CTO site about this forthcoming View release and described how it works. See Secure Remote Access with View and PCoIP.

Some people report that when they setup PCoIP remote access with View 4.6 and try a PCoIP connection from the View Client, they just get a black screen for a few seconds and then an error indicating that the session has ended. On the iPad View Client this problem shows as a message saying "your desktop is loading too slowly". In the vast majority of cases, this was caused because one of the 3 setup steps shown below was not done or not done properly. If you're getting these symptoms, then check very carefully that these 3 simple steps have been done correctly.

When View Connection Servers and Security Servers are running 4.6 or newer, you can enable this functionality by following these three steps:

1. Enable PCoIP Gateway functionality on each Connection Server. By default, PCoIP connections are direct from the View Client to the View virtual desktop as they were in View 4.0 and 4.5. If you have some Connection Servers for remote access and some for local access then just do this for the remote access ones. That way local access PCoIP can still be direct to the View virtual desktop. Using View Administrator, go to the Configuration Servers section. Select a Connection Server, select Edit and tick the box "Use PCoIP Secure Gateway for PCoIP connections to desktop". Then for all users of this Connection Server and any Security Servers attached, PCoIP will gateway through either the attached Security Servers or this Connection Server. The server used for the PCoIP gateway (usually the Security Servers) must be running View 4.6 or newer on Windows Server 2008 R2.

2. On every attached Security Server, set up the “External URL” and the new "PCoIP External URL". These URLs are used by the View Clients to connect to the particular View server. These names and addresses must be resolvable and usable by the clients. If remote connections are made directly to the Connection Server then the External URLs must also be setup on the Connection Server.

3. Update the firewall to allow PCoIP to pass through. This is:

PCoIP between View Client and Security Server

TCP destination port 4172 from Client to Security Server
UDP destination port 4172 from Client to Security Server
UDP source port 4172 from Security Server to Client (this is the reply UDP data)

PCoIP between Security Server and virtual desktop

TCP destination port 4172 from Security Server to virtual desktop
UDP destination port 4172 from Security Server to virtual desktop
UDP source port 4172 from virtual desktop to Security Server (this is the reply UDP data)

This is in addition to the firewall rules used in View 4.5.

For further details, refer to the View 4.6 Architecture and Planning Guide and the View Administrator Guide here View Documentation.

For a more detailed examination of this, take a look at this video. It goes into details on the deployment and architecture for PCoIP remote access with View 4.6 and goes through a worked example involving remote and local access, load balancing, the n+1 VIP model, the external URLs etc. and shows how it is all configured through View Administrator.

Mark Benson - VMware - View Architect - End User Computing CTO Office

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

legal1 — Fri, 25 Feb 2011 17:56:44 GMT

Does this impact WAN performance relative to the current version?

Presumably it will not consume as much bandwidth by avoiding the additional TCP encapsulation, but also wondering what the outlook is for further reducing the PCoIP bandwidth or having some ability to "tune" the connection for better performance in high latency/low bandwidth connections.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

markbenson — Fri, 25 Feb 2011 18:21:03 GMT

You're exactly right. Running PCoIP natively without encapsulation over a TCP protocol in this way is much more efficient and also improves the user experience. It also works from all View clients, even the Teradici Zero Clients.

It is always a good idea to tune PCoIP for your exact requirements to get even greater improvements.

You can, for example, reduce the PCoIP frame rate on the virtual desktop to improve WAN performance and reduce bandwidth requirements.

There are some good papers on this.

http://www.vmware.com/files/pdf/VMware-View-PCoIP-Network-Sizing-Guide-IG-EN.pdf

http://www.vmware.com/files/pdf/VMware-Teradici-PCoIP-Zero-Client-Remote-Access-Guide.pdf

http://www.teradici.com/pcoip/pcoip-technology/pcoip-faqs.php

Mark.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

mittim12 — Fri, 25 Feb 2011 19:16:57 GMT

There are some Group policy templates available on the connection brokers that will allow you to change PCOIP settings.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

bhallinan — Fri, 11 Mar 2011 22:35:49 GMT

Thank you for the hints and follow ups. These posts have been helpful.

When using the View Security Server url to connect to the View Connection Server, I am getting a black screen and a connection timeout only when the “Use PCoIP Secure Gateway for PCoIP connections to desktop” is set on the View Connection Server. If this flag is not set, the connection to the desktops works fine.

I have tested on an internal network where all machine firewall are configured correctly, as well as where all machine firewalls are turned off. The disconnect and timeout does not appear to be firewall related. Any suggestions?

I have thoroughly read and followed all the tips and hints at these locations:
http://www.vmware.com/support/pubs/view_pubs.html
http://communities.vmware.com/people/markbenson
http://paulslager.com/?p=1300
http://paulslager.com/?p=1326

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

markbenson — Sat, 12 Mar 2011 08:31:12 GMT

You'll get a black screen if any of these 3 steps haven't been done correctly.

Double check all your settings and in particular check that the External URL and PCoIP External URL are set correctly on your Security Server. These must contain names/addresses usable by the client to connect to the Security Server.

If it still doesn't work - go through the video for a complete worked example. You don't need to watch the whole thing, you can skip to about 18 mins in for the details of setting this up.

Use netasat -an to check that your Security Server is listening on UDP 4172 and TCP 4172.

Make sure PCoIP isn't being blocked anywhere. The logs and wireshark traces may help you.

If you still can't get it configured correctly, give us more details of your setup and someone will be able to help you further.

Mark.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

iamxCPx — Tue, 15 Mar 2011 22:03:33 GMT

Hi Mark,

First of all, thank you for providing this video.

I do have a question on setting up the security servers based on your video.

1. To split the security server to two (internal and external use), do they need to be installed as a replicate or stand alone security server?

2. Just watched the following youtube video on how to install the security server.

It's stated there that the Security Server host must be joined to the Active Directory domain.

On your example, the security server ip address is using a totally different subnet (192.168.1.xxx) than the local network (192.168.2.xxx). Is that mean they are not part of Active Directory? Is it because they are sitting on the DMZ?

Please advise.

Thank you so much.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

markbenson — Tue, 15 Mar 2011 22:16:23 GMT

Thanks for those comments.

No. View Security Servers don't need to be joined to an AD domain.

It's normal for Security Servers not to be joined to an AD domain to simplify the firewall rules in a DMZ.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

iamxCPx — Tue, 15 Mar 2011 22:40:55 GMT

Hi Mark,

Thanks for the prompt respond.

Btw, looks like you replied while I edited my comments. I wasn't fast enough. Oops.

Do you think you know the answer of my first question by any chance?

Thanks.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

markbenson — Wed, 16 Mar 2011 14:29:18 GMT

I'll try and respond less promptly in future

If you have one or more Connection Servers for internal and one or more for remote access, they can all be part of the same View cluster (i.e. 1 standard and the others replica). That way that can all be managed as one View environment.

Mark.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

acaceres2007 — Wed, 16 Mar 2011 19:20:34 GMT

Hi guys...

Thanks for all these helpful comments and posts.

I was wondering if I would still need a security server if I use a Cisco VPN to connect to my network. Will PCOIP work if I connect thorugh the VPN directly to my broker?

Thanks so much!

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

iamxCPx — Wed, 16 Mar 2011 21:21:35 GMT

Haha.

Thanks again.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

iamxCPx — Wed, 16 Mar 2011 21:28:22 GMT

@acaceres2007

You don't need a security server if you are using Cisco VPN.

That's what we have previously but then Cisco VPN users complaint that they were seeing blurryness on their screen a few to many so I thought maybe by bypassing the VPN and use the security server on the DMZ will solve that problem.

We'll see how it goes. Hopefully it'll be better.

Now the trick is how to put the Security Server VM on the DMZ.

I'm still working on it... :smileyplain:

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

acaceres2007 — Wed, 16 Mar 2011 21:31:36 GMT

Make sense... thanks!

Check this out!

http://paulslager.com/?p=1300

I found that blog on the internet!

regards,

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

bleibold — Tue, 03 May 2011 20:23:28 GMT

Anyone know why the video no longer loads?

Thanks,

Bob

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

markbenson — Thu, 05 May 2011 06:01:56 GMT

The YouTube video posted in a comment above is not my video. This was not correct anyway and has been withdrawn by the user.

The video you want is the one at the bottom of the article (on vimeo). That loads fine.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

bleibold — Thu, 05 May 2011 13:31:11 GMT

Thanks for the reply Mark. Actually, that video won't load for me either, but I am sure it has something to do with our proxy not allowing access to vimeo. I know we block youtube, so probably vimeo too. Anyway to download it so I can watch it offline?

Bob

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

markbenson — Thu, 05 May 2011 22:48:38 GMT

Yes, it does sond like your proxy. I'm sorry you can't watch it, but it sounds like it's a deliberate policy in your company to block access to videos. You'll need to access it in a place where you have full Internet access. In the mean time time, if you have any questions, then please feel free to raise a discussion thread in the main View communities section, and we'll hopefully answer any questions you have.

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

jmueller3 — Thu, 19 May 2011 22:36:30 GMT

I currently see a problem. If you are behind a proxy server, the PCoIP port (TCP/UDP 4172) blocked by default.
This is a Security Policy by many Companys.

In which version will be tunneled PCoIP completely in SSL.

TNX

Re: Setting up PCoIP Remote Access with View 4.6 and Newer

markbenson — Thu, 19 May 2011 23:37:45 GMT

We initially looked at various options around tunneling the PCoIP traffic through Security Server but we really didn’t want to interfere with the advanced performance characteristics of the protocol. The step improvement in having a UDP based remote display protocol would be somewhat eroded if we just tunnelled that over an HTTPS connection which uses TCP as its underlying transport protocol. HTTPS encapsulation is good for RDP, but PCoIP is already secured by AES-128 encryption over the wire and so double encryption is unnecessary. We also wanted to ensure we will support existing PCoIP based View clients, newer clients such as Wireless and 3G enabled iPad etc., and third party clients based on the Teradici zero client in a really easy and intuitive way. It was clear that customers want the same security, connectivity and ease of administration benefits from Security Server that they are used to for RDP and other TCP based protocols, but also want to maximize the user experience with PCoIP for the remote access case.

We recognise that sometimes, people will block 4172 and in these cases PCoIP will clearly not connect. For these cases it is still possible to drop back to RDP. Also View supports third party VPNs to connect so that's another option.

For the vast majority of cases, PCoIP is allowed through proxies and firewalls etc. and in this case the user gets the best possible compatibility and user experience.

Mark.