Unified Access Gateway can be deployed using PowerShell scripts. You must configure basic parameters in the .INI file for the deployment.
[General] Section Parameters
The parameters in the [General] section are applicable to all hypervisors.
| INI Parameter | Description |
|---|---|
| adminMaxConcurrentSessions |
Allows you to configure limit on concurrent admin sessions.
The default value is 5.
The supported range is 1-50.
When this value is set to 1, no concurrent sessions are allowed.
If you want to create a new session when the number of concurrent sessions already reached the limit, the system will invalidate the least recently used session. |
| adminpasswordPolicyUnlockTime | Duration (in minutes) for which the Unified Access Gateway admin UI is locked out after the configured number of failed login attempts by the admin user.
After the lockout, the Unified Access Gateway admin UI is unlocked and the admin user can access the UI.
The default value is 5 minutes. |
| adminSessionIdleTimeoutMinutes | Duration (in minutes) for which the Unified Access Gateway admin UI session has been idle. After this timeout, the admin UI logs out automatically.
The default value is 10 minutes.
The maximum value is 1440 minutes.
If the parameter value is 0, the session does not expire even though in idle state. |
| ceipEnabled | If set to TRUE, sends Customer Experience Improvement Program ("CEIP") information to Omnissa. See Join or Leave the Customer Experience Improvement Program for details. |
| communityName | A valid communityName is case-sensitive and can include special characters. |
| CustomConfig (eth0CustomConfig, eth1CustomConfig, eth2CustomConfig) | The custom configuration values that must be added to the systemd.network files can be provided in the following format: SectionName^Parameter=Value
Currently supported configuration options are as follows. If more than one option is needed, they must be separated by semicolons:
.ini file. |
| deploymentoption | UAG can be created with either one, two or three network interface cards (NICs). Either specify onenic, twonic, or threenic. The default is onenic. This is for the standard 2 vCPU 4 GB RAM deployment. It is also possible to specify onenic-large, twonic-large, threenic-large, onenic-XL, twonic-XL, threenic-XL. The large options deploy UAG as 4 vCPU 8 GB RAM and the extra-large (XL) options deploy UAG as 8 vCPU and 32 GB RAM. |
| dsComplianceOS |
Default value is false.
When set to true, this Boolean flag sets the OS configuration to comply with the current Photon OS 4.0 DISA STIG Readiness Guide. The password complexity and other STIG requirements are automatically configured.
Note: This setting must be used with the FIPS version when DISA STIG OS compliance is required. |
| headersToBeLogged |
Enter a customized, comma-separated list of headers to be logged,
Example: X-Forwarded-Host,host,X-Forwarded-For,X-Forwarded-Proto
The default value for this field is set to X-Forwarded-For and includes the details for Username, Client build, and Client version. |
| osLoginUsername |
Enter a customized username of the high privilege user during Unified Access Gateway deployment.
Maximum length of the username is 32 characters and can be a combination of a-z, 0-9, underscore _ and, hyphen -.
When this user is configured, the root login is deactivated. |
| osMaxLoginLimit | Allows you to configure the limit on concurrent logins of Unified Access Gateway local console using high privileged non-root user.
The default value is 10.
Note: This configuration is effective only when non-root user (osLoginUsername) is configured for Unified Access Gateway local console login. There is no limit on the concurrent logins of root user. |
| passwordPolicyFailedLockout | Number of failed login attempts allowed for the root user to access the Unified Access Gateway console.
The default value is 3. |
| passwordPolicyMinClass | Minimum number of classes of character types that can be used to configure the root password complexity.
The classes of character types are as follows: uppercase, lowercase, digits, and others.
The default value is 1.
This parameter can be configured with the following values: 1, 2, 3, and 4.
If the parameter has the default value, then you can use characters from all the four classes. If the parameter value is 1, then you can use characters from any one of the classes. |
| passwordPolicyMinLen | Minimum length of the root user password.
The default value of this parameter is 6.
The maximum value of this parameter is 64. |
| passwordPolicyUnlockTime | Duration for which the Unified Access Gateway console is locked out after the configured number of failed login attempts by the root user.
After the lockout, the Unified Access Gateway console is unlocked and the root user can access the console.
The default value is 900 seconds. |
| rootPasswordExpirationDays | Password expiration policy for the root users.
The default password expiration time is 365 days.
To prevent password expiry, the expiration time can be set to 0. |
| rootSessionIdleTimeoutSeconds | Duration (in seconds) for which the Unified Access Gateway console session has been idle. After this timeout, the console logs out automatically.
Default value of this parameter when logging into Unified Access Gateway using SSH on Microsoft Azure is 180 seconds, and 300 seconds for other platforms.
For Serial console session, the default value is 900 seconds.
The maximum value of this parameter is 3600 seconds. |
| secureRandomSource | Allows you to configure the secure random bit generator source used by Java processes for cryptographic functions.
This option can be configured only at the time of deployment.
Supported values are: /dev/random and /dev/urandom. By default, /dev/random is used in the non-FIPS mode and /dev/urandom is used in the FIPS mode. |
| sshEnabled | When set to true, this parameter automatically enables SSH access on the deployed appliance.
When sent to false, SSH is not enabled.
Note: Omnissa does not generally recommend enabling SSH on Unified Access Gateway except in certain specific situations and where access can be restricted.
Enabling SSH access on Unified Access Gateway deployments for vSphere, Hyper-V, or Microsoft Azure is not generally required as console access with those platforms can be used.
In cases where SSH is enabled, TCP port 22 access must be restricted in firewalls or security groups to source IP addresses of individual administrators. |
| sshInterface |
Configure the network interface on which SSH login is enabled.
By default, SSH is enabled on all the interfaces.
The supported values are eth0, eth1, and eth2 based on the configuration. |
| sshLoginBannerText | Option to customize the banner text displayed when logging into Unified Access Gateway using SSH or the vSphere Client's Web Console.
This option can be configured only at the time of deployment. If you do not configure this parameter, the default text displayed is EUC Unified Access Gateway.
Only ASCII characters are supported in the customized text. For multi-line banner texts, \n must be used as the line separator. |
| sshPort |
Configure the port on which SSH is enabled.
The default value is 22. |
Parameters for vSphere or Hyper-V Deployment
Configure these additional parameters only when you are deploying Unified Access Gateway on vSphere or Hyper-V.
| INI Parameter | Description |
|---|---|
| defaultGateway |
Specifies the default gateway address for the UAG appliance. Used in the following cases:
10.108.168.xxx |
| ds | Datastore name which the appliance is deployed to.
Example: ds=Local Disk 1 |
| folder | Remember: This setting is applicable only for vSphere deployment.Specifies the folder where VM is created. Deploys the appliance in the named VMs and Templates folder. Folders in vCenter are shown under VMs and Templates. The folder specified must exist before deployment. |
| ip0 | The IPv4 address for NIC0. |
| ipmode0 | The IPMode for NIC1 (eth0), NIC2 (eth1), and NIC3 (eth2). Supported modes are |
| netBackendNetwork | The name of the UAG backend network. |
| netInternet | The name of the UAG primary network. |
| netManagementNetwork | The name of the UAG management interface network. |
| netmask0 | The IPv4 netmask for NIC0 (onenic, twonic, or threenic). |
| source |
Download the source file from the Customer Connect portal.
|
| target |
Remember: This setting is applicable only for vSphere deployment.
Specifies the vCenter Server information and target ESX host. Refer to the OVF Tool User's Guide for details of the syntax of target.
Note that target must reference a vCenter host or cluster. Deploying direct to a vSphere host is not supported. In this example, 192.168.0.21 is the IP address of the vCenter host and administrator@vsphere.local is the vCenter administrator user name.
Folder names, host names, and cluster names used in the target value are case sensitive.
If you are unsure of the value to use for target, you can omit folder names and so on and OVF Tool will then provide a list of possible values for the next level. This allows you to accurately build up the full target specification one level at a time.
Example:target=vi://administrator@vsphere.local@192.168.0.21/DC1/host/my folder/esx1.myco.int |
Was this page helpful?