Overview of Setting Up Omnissa Horizon 8 in FIPS Mode

To set up Horizon 8 in FIPS mode, you must first enable FIPS mode in the Windows environment. Then you install all the Horizon 8 components in FIPS mode.

The option to install Horizon 8 in FIPS mode is available only if FIPS mode is enabled in the Windows environment. For more information about enabling FIPS mode in Windows, see https://support.microsoft.com/en-us/kb/811833.

Note: Omnissa Horizon Console does not indicate whether Horizon 8 is running in FIPS mode, but there are three ways to know if a Connection Server is installed with FIPS compliant cryptography modules. To verify whether FIPS mode is enabled:

• The API response for /rest/config/v3/connection-servers contains a field fips_mode_enabled with possible values false or true.
• On a Connection Server, check the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Omnissa\Horizon\FipsMode. A value of 0 means it is not a FIPS installation, and 1 means it is a FIPS installation.
• Review CS debug logs for following line:
  [MessageFrameWork] KeyVault: Initiating in FIPS mode.

Note: Using FIPS for Horizon 8 on Amazon WorkSpaces Core requires a minimum combination of Horizon 2406 and Unified Access Gateway 2406.

To install Horizon 8 in FIPS mode, perform the following administrative tasks.

• When installing Omnissa Horizon Connection Server, select the FIPS mode option. See Install Horizon Connection Server with a New Configuration.

• When installing a replica server, select the FIPS mode option. See Install a Replicated Instance of Horizon Connection Server.

• Disable weak ciphers for Horizon Agent machines. See Deactivate Weak Ciphers in SSL/TLS.

• When installing Horizon Agent on a Windows machine, select the FIPS mode option. See the Horizon Agent installation topics in the Desktops and Applications in Horizon 8 document.

• When installing Horizon Agent on a Linux machine, include the parameter to enable FIPS support. See the Horizon Agent installation topics in the Desktops and Applications in Horizon 8 document.

• For Windows clients, enable FIPS mode in the client operating system and select the FIPS mode option when installing Omnissa Horizon Client for Windows. See the Horizon Client for Windows Guide document.

• For Linux clients, enable FIPS mode in the client operating system. See the Horizon Client for Linux Guide document.

• For Mac clients, enable FIPS mode in the client configuration file. See the Horizon Client for Mac Guide document.