Ports, Protocols, and URL Requirements for Horizon Cloud on Amazon WorkSpaces Core

Ensure that the required ports, protocols, and destination URLs for your Horizon Cloud on Amazon WorkSpaces Core deployment allow communication as necessary. Use the following tables to verify that your network configuration and firewalls will allow the communication traffic required for a successful deployment and for day-to-day operations.

The specific ports and protocols required for your deployment will in part depend on which features you select to use. If you do not plan to use a specific component or protocol, its required communication traffic is not necessary, and you can ignore the ports associated with that component.

Important: To allow the appropriate URLs and wildcard sub-domains, add them to an allow list for your firewall and network security group, and bypass SSL deep packet inspection in both the firewall and, if applicable, the proxy server. If the Horizon Edge Gateway is connected to the Horizon Agent through a proxy server, bypass SSL deep packet inspection in the proxy server for the URLs and wildcard sub-domains listed below. For situations where using URLs is not possible, see KB 6000374 — IP Addresses for Service Components.

Ports and Protocols Required by Horizon Edge

When you activate Horizon Infrastructure Monitoring, Horizon Edge is deployed and configured in the associated subscription. The following table lists the ports and protocols needed during the activation process — in which the appliance deploys and configures the manager VMs so the appliance can collect monitoring data — as well as the ports and protocols needed during steady-state operations.

Unified Access Gateway VM Ports and Protocols Requirements

In addition to the primary ports and protocols listed in the table above, the ports and protocols in the following table apply to the gateways configured for ongoing operations after deployment. For connections configured with Unified Access Gateway instances, traffic must be allowed to and from the Unified Access Gateway instances to the targets listed below.

Notes:

• For these service-deployed Unified Access Gateway instances, the UDP ports require both forward and reply UDP datagrams to be allowed. For example, Unified Access Gateway services use DNS to resolve hostnames. DNS requests are made on UDP port 53, so it is important that an external firewall does not block these requests or replies.
• The Unified Access Gateway is deployed on a multi-NIC configuration. The Source Network column details which network the traffic originates from.
• Bypass SSL deep packet inspection in the DMZ subnet for all URLs and wildcard subdomains listed below — in the firewall for traffic from the Unified Access Gateway to *.horizon.omnissa.com endpoints, and in any proxy server the Unified Access Gateway itself uses to reach cloud control plane endpoints.

App Volumes Ports and Protocols

To support App Volumes features for use with Horizon Cloud on Amazon WorkSpaces Core, you must configure port 445 for TCP protocol traffic to the tenant (desktops) subnet. Port 445 is the standard SMB port for accessing an SMB file share on Microsoft Windows. The AppStacks are stored in an SMB file share located in the same resource group as the pod manager VMs.

Note: If you use a self-managed Active Directory, on-premises or in the cloud, to manage identities and devices, you can add an FSx for Windows File Server file system to the Active Directory domain. See AWS documentation about using a self-managed Microsoft Active Directory.

VDI Ports and Protocols Requirements

The following table provides the ports and protocols required for the desktop (VDI or tenant) subnets configured in your environment.

Note: In addition to the ports listed below, ensure that the URLs and wildcard subdomains required for Horizon Edge are also reachable from your environment. For details, see Allow URLs for the Management Subnet and Check URL Access below.

End-User Connection Traffic Ports and Protocols Requirements

For detailed information about the various Horizon Clients your end users might use with your Horizon Edge Virtual Appliance, see the Horizon Client product documentation. Which ports must be opened depends on the choice you make for how your end users will connect.

Allow URLs for the Management Subnet and Check URL Access

To allow the appropriate URLs and wildcard sub-domains according to your site location and needs, perform the following tasks:

• Allow the URLs and wildcard sub-domains in the table below by adding them to an allow list for your firewall and network security group.
• Bypass SSL deep packet inspection in the firewall for the URLs and wildcard sub-domains listed below.
• If applicable, bypass SSL deep packet inspection in the proxy server. If the Horizon Edge Gateway is connected to the Horizon Agent through a proxy server, bypass SSL deep packet inspection in the proxy server for the URLs and wildcard sub-domains in the table below.

Important: The listed purposes are in the context of a Horizon Edge deployment.

Allow URL for Tenant (Desktop) Subnet

Use either a global VM Hub instance or a regional VM Hub instance.

• Bypass SSL deep packet inspection in the firewall for the URLs and wildcard sub-domains listed below.
• If applicable, bypass SSL deep packet inspection in the proxy server. If the Horizon Edge Gateway is connected to the Horizon Agent through a proxy server, bypass SSL deep packet inspection in the proxy server for the URLs and wildcard sub-domains listed below.

Global VM Hub DNS Hostname

If using a global VM Hub instance suits the needs of your site, allow the following URL:

Regional VM Hub DNS Hostnames

If using regional VM Hub instances suits the needs of your site, use the two corresponding URLs for the region in which your Horizon Edge Gateway is deployed. All regional VM Hub instances use port 443, protocol TCP, for agent-related operations such as certificate signing using VM Hub and renewal.

Note: Horizon Cloud has a localized active-active deployment in Japan to ensure infrastructure resiliency remains entirely within the region, adhering to local compliance policies. Traffic dynamically routes between the Horizon Cloud 1 instance (Japan East) and the Horizon Cloud 2 instance (Japan West) based on geographic affinity. If your organization enforces IP-based allowlisting, ensure your firewall rules include entries for both of the Horizon Cloud instances in Japan as listed in KB 6000374 — IP Addresses for Service Components.

Allow URLs for Proxy Enablement

If you plan to use a proxy server to control the traffic flow from your environment, open the required ports to allow the Horizon Edge Gateway to reach the proxy server.