Gezmonder Tracker

Re: Youtube Performance Poll

Gezmonder — Mon, 05 Mar 2018 09:06:32 GMT

What I'm trying to get at, is what is expected with assumed perfect environmental conditions, fast networks etc, but default optimizations and policies in place.

Two screens enabled 1920 x 1200 on the pool (only one actually in use), with YouTube on Default View (showing comments and so on)

Windows 7 32-bit

No other applications open

Using Chrome - IE seems worse

ESXi hosts with very few other desktops running

10 GB datacenter LAN

Over the internet using UAG and a fast connection

Re: Youtube Performance Poll

Gezmonder — Fri, 02 Mar 2018 18:00:03 GMT

Oh yeh, I'm using the full Windows Horizon Client to keep things simple, no zero or thins

Youtube Performance Poll

Gezmonder — Fri, 02 Mar 2018 17:58:55 GMT

Hey guys,

Simple question here, if I have a basic Horizon setup, say v7.2, should I be expected to be able to view Youtube videos at 480p?

No GPUs or anything, nothing fancy, just 1 or 2 vCPU and 2 GB RAM. I'm testing this and where I wouldn't necessarily expect it to play 720p+ videos very well I would have thought 480p is a reasonable expectation.

I've tested with PCoIP and Blast, Blast is slightly better and it's kinder watchable but I'd give it a 7/10 as they break up a fair bit. Maybe just a general poll in response as to what should be expected for this sort of setup would be useful.

Cheers,

Re: UAG Blast - Failed to resolve proxying route for request

Gezmonder — Tue, 18 Jul 2017 08:19:38 GMT

Sorted this in the end, I logged it with VMWare support:

"Use Blast Secure Gateway for HTML Access to machine" on the Connection Server properties in the Admin console was set to enabled.

I guess that's for Security Server scenarios only.

Re: Access Point Authentication Order

Gezmonder — Mon, 17 Jul 2017 11:50:48 GMT

It's been a while since we set this up and have only been using the App where the steps are:

User types in User name

User generates a OTP on the mobile App

User enters OTP and selects OK

User Enters AD password

User is successfully logged in

This is all using the setting 'radius-auth' on it's own (I believe the RADIUS server caches the AD credentials) and it works fine.

We also have a bunch of tokens/user on the same solution that do not use the app, they use the SMS method explained previously. Will these co-exist? I don't see how from your explanation that UAG/RADIUS will know that in the user doesn't have a passcode yet and will fallback to the AD password in the first instance. We haven't been able to get the SMS method working yet, nothing seems to happen,

Re: UAG Blast - Failed to resolve proxying route for request

Gezmonder — Wed, 05 Jul 2017 14:59:13 GMT

So this is in C:\ProgramData\VMware\VDM\logs\debug<date><some other number>.txt ?

I can't find the word "origin" in there anywhere.

Also just noticed that the VMWare Horizon View Blast Secure Gateway service was set to manual and not started. Is that required? I started it anyway and it's not made any difference.

I've also just added portalHost=view-gateway.example.com to the locked.properties file but it hasn't helped either.

UAG Blast - Failed to resolve proxying route for request

Gezmonder — Fri, 30 Jun 2017 17:20:59 GMT

Hello,

We have had UAG running for a while and it works fine using the full client but there has been a recent requirement for HTML Blast access for external users which does not work fine.

It's been enabled for a while as far as I'm concerned but we never tested it. Authentication works fine and users can see and select their desktop pool, it then takes them to a screen saying "Failed to resolve proxying route for request".

I have downloaded to log bundle but it's not revelaing very much at all. The last entry in the esmanager.log file says "Accessing virtual/rdsh desktop using protocol BLAST with ipAddress x.x.x.x (the connection server). The BG log file really doesn't say anything of note.

HTML access works fine internally if not using the UAG and there are no drops of any traffic on the firewalls. I do have a load balancer in place but I am bypassing that for now and just pointing at a single connection server, it makes no difference though.

Horizon 7.01

UAG 2.9

Cheers.

Access Point Authentication Order

Gezmonder — Thu, 16 Mar 2017 17:16:52 GMT

Me again :smileylaugh:

So I've successfully done 2FA with Radius and Connection server authentication in the past. I'm doing another one now with a different Radius solution which unlike previous ones requires the AD authentication first with Radius second. This is because upon successfuly AD authentication an SMS is sent to the authenticating user's phone with the OTP which they can then enter on the next prompt.

This basically means that sp-auth needs to be followed by radius-auth., but this doesn't seem possible:

Can these be swapped around?

Re: Access Point Thumprint Issue

Gezmonder — Wed, 15 Mar 2017 13:08:39 GMT

In order to quickly get round this I thought I'd just try using the existing template I used last time to see how it was returned. When it was issued it came back with a SHA256RSA algorithm so I really don’t know where the original RSASSA-PSS came from!

Using this new certificate has resolved the issue, many thanks helping me to work through this.

Re: Access Point Thumprint Issue

Gezmonder — Tue, 14 Mar 2017 10:16:27 GMT

Thanks Mark, your method of looking closely at the cursor whilst arrowing through to locate the blank characters worked - The appliance itself is still not however. The Errors relating to the certificate thumbprints have now gone from the log, I still have SSL handshake errors though, scanning through the log I think it looks like this is the culprit, which is a new error:

Certificate does not conform to algorithm contraints

The Certificate is using a sha256 algorithm with a public key length of RSA 2048, but I notice a mismatch in the Signature algorithm between the SAN cert, Intermediate and Root from the internal CA. Could this be the problem? RSASSA-PSS looks like an old algorithm, possbily something not supported by the Access Point? It's been working fine for nearly six months for internal use on the Connection servers.

Re: Access Point Thumprint Issue

Gezmonder — Mon, 13 Mar 2017 16:27:28 GMT

Also, can we please have a separate forum section for Access Point?

Access Point Thumprint Issue

Gezmonder — Mon, 13 Mar 2017 16:26:17 GMT

Hello,

I've done a couple of Access Point 2.8 deployments now but am banging my head on a fundmental issue here.

I am deploying via the 2.8 Web GUI which is something I've used successfully in the past. I cannot get the Access Point in the DMZ to communicate with a Connection Server on the Back-end.

Ports are open and I to help troubleshooting I have deployed a Windows VM in the DMZ alongside it with the same access rules. So I can browse to the Connection servers from the DMZ Windows VM but if I go via the Access Point it doesn't proxy the connection, it just hangs and doesn't do anything at all.

Checking through the esmanager.log I can see lots of entries like this:

03/13 13:03:38,044[nioEventLoopGroup-7-1]ERROR view.ViewEdgeService [onFailure: 158][][] : unable to query Horizon Broker: javax.net.ssl.SSLHandshakeException: General SSLEngine problem

03/13 13:03:38,044[nioEventLoopGroup-7-1]ERROR utils.SyslogManager [onFailure: 159][][] : HORIZON_SERVICE:CONNECTION_BROKEN:unable to query Horizon Broker: javax.net.ssl.SSLHandshakeException: General SSLEngine problem

3/13 13:03:41,923[nioEventLoopGroup-7-1]ERROR utils.SyslogManager [checkServerTrusted: 197][][] : SSL:THUMB_PRINT_MISMATCH:Could not find a trusted cert thumbprint that matches any of the server certificates : CN=mydesktop.corp.local

03/13 13:03:41,923[nioEventLoopGroup-7-1]ERROR ssl.HttpsProxySslEngineFactory [checkServerTrusted: 194][][] : Could not find a trusted cert thumbprint that matches any of the server certificates : CN=CA-SUB01, DC=corp, DC=local

03/13 13:03:41,924[nioEventLoopGroup-7-1]ERROR view.ViewEdgeService [onFailure: 487][][] : javax.net.ssl.SSLHandshakeException: General SSLEngine problem

Now I'm absolutely 100% sure that I have copied and pasted the thumbprint from the connection servers vdm SAN certificate into the GUI using the sha1=00 f6 0h fd blah blah blah format I have double and triple checked it about fifty times now.

Is there a scenario where if also needs the root and intermediate adding in too? (I have tried this as well using comma separation).

Re: EUC Access Point IP Addressing

Gezmonder — Thu, 23 Feb 2017 21:01:34 GMT

It does work okay using the layout I described but I've dropped it down to a single NIC. My concern was that the documentation and templates keep harping on about single NICs being for PoCs which suggests that VMware won't support it in a production environment - If they do then that's fine.

Some members of the community are also arguing that using multiple NICs is less secure than using a Single NIC, I can see their point.

EUC Access Point IP Addressing

Gezmonder — Thu, 16 Feb 2017 14:03:13 GMT

Hello,

We have an Access Point 2.8 going into a small DMZ with a single flat 192 network publishing out Horizon 6.2. Using the two IP option seemed like a sensible approach and I have one IP with the rules open to reach the back end servers and another hosting a NAT from the internet facing firewall. However, the documentation states:

"With two network interfaces, external traffic is on one subnet, and internal and management traffic are on another subnet."

Now we obviously we only have one subnet and as a result I have not configured any additional routes during on the access point deployment.

Is a two IP configuration supported on a single subnet? I agree it has somewhat limited advantages but is slightly more secure than using a single IP.

Thanks.

Re: Using PowerShell to Deploy VMware Unified Access Gateway

Gezmonder — Mon, 23 Jan 2017 10:42:49 GMT

Thanks Mark, I was being cheeky. I knew this wasn't quite the right forum for it but I didn't want opinions I was hoping to get a proper answer from the product architect as above!

Re: Using PowerShell to Deploy VMware Unified Access Gateway

Gezmonder — Fri, 20 Jan 2017 09:08:04 GMT

Finding a list of supported/recommended 2FA solutions that work with Access Point is proving difficult. Given that they are very expensive does it work with Google Authenticator? I understand it doesn't work with VMware Verify, it that on the roadmap?

Re: View composer in different domain

Gezmonder — Tue, 13 Dec 2016 16:40:16 GMT

This proved useful, I just had the exact same scenario but in my case the ports were already open. It couldn't resolve the DNS name between the domains though so I added a hosts file entry to the Composer server to the vCenter and that resolved the problem.

Re: Time restricted access

Gezmonder — Wed, 26 Oct 2016 08:28:05 GMT

I thought about this, I know UEM pretty well but I want to restrict access to the desktop pools themselves but UEM is more aimed at restricting items and resources 'within' the desktop, by which point they would already be onboard.

Time restricted access

Gezmonder — Fri, 21 Oct 2016 14:44:12 GMT

Hi all,

Can anyone think of a way of restricting access on a time basis either to desktop pools or using some sort of from condition? So for example Pool A is only available between the hours or 1800-2300 or Pool A (or all pools) are only available between the same hours remotely.

I can't see a way of doing it myself other than to tag them to one Connection Server and schedule stop and start the services which is pretty lame.

Cheers!

Re: Desktop refreshes, nic not connected

Gezmonder — Tue, 12 Jul 2016 09:04:05 GMT

So we have switched from Ephemeral to Static port groups now and the NIC connection issue is now gone

Luckily for us, we didn't have the recompose issue.