To deploy Unified Access Gateway, deploy the OVF template using the vSphere Client or vSphere Web Client, power on the appliance, and configure settings.
Alternatively, you can configure these settings using PowerShell. For information about PowerShell parameters, see Run PowerShell script to deploy Unified Access Gateway.
Prerequisites
- Review the deployment options that are available in the wizard. See Unified Access Gateway System and Network Requirements.
- Review the sizing recommendations for the deployment. See Configuration Maximums and Unified Access Gateway Sizing Options.
- Determine the number of network interfaces and static IP addresses to configure for the Unified Access Gateway appliance. See Networking Configuration Requirements (Deployment Options).
- Download and install OVF Tool 4.4.3 or later from the Broadcom Developer Portal.
- Download the Unified Access Gateway OVA from the Customer Connect portal to your machine.
- To upgrade your older appliance to a new instance of Unified Access Gateway with zero downtime for users, see the Upgrade with Zero Downtime section.
Procedure
-
Use the native vSphere Client or the vSphere Web Client to log in to a vCenter Server instance.
For an IPv4 network, use the native vSphere Client or the vSphere Web Client. For an IPv6 network, use the vSphere Web Client.
-
Select a menu command for launching the Deploy OVF Template wizard.
Option Menu Command vSphere Client Select File > Deploy OVF Template. vSphere Web Client Select any inventory object that is a valid parent object of a virtual machine, such as a data center, folder, cluster, resource pool, or host, and from the Actions menu, select Deploy OVF Template. -
On the 1 Select an OVF template page, click URL and enter a URL to download and install the OVF template from the internet or click Local file to browse to the
.ovafile that you downloaded. Click NEXT.Review the product details, version, and size requirements.
-
Follow the prompts to complete the wizard.
OVF deployment
| Step | Description |
|---|---|
| 2. Select a name and folder | Select a name and target location. Enter a name for the Unified Access Gateway virtual appliance in the Virtual machine name field. The name must be unique within the inventory folder. Names are case-sensitive. Select a location for the virtual machine from the list. |
| 3. Select a compute resource (Host / Cluster) | Select the host or cluster on which you want to run the virtual appliance. Result: Compatibility and validation checks are done to verify if the compute resource can support the OVF. |
| 4. Review details | Verify the OVF deployment details. |
| 5. Configuration | Select a deployment configuration. For an IPv4 or IPV6 network, you can use one, two, or three network interfaces (NICs). Many DMZ implementations use separated networks to secure the different traffic types. Configure Unified Access Gateway according to the network design of the DMZ in which it is deployed. Along with the number of NICs, you can also choose Standard or Large deployment options for Unified Access Gateway. See Omnissa Configuration Maximums. Note: VM options for Standard and Large deployments: - Standard - 2 core and 4GB RAM - Large - 4 core and 16GB RAM - Extra Large - 8 core and 32GB RAM |
| 6. Select virtual disk format. | Select the virtual disk format. - For evaluation and testing environments, select the Thin Provision format. - For production environments, select one of the Thick Provision formats. Thick Provision Eager Zeroed is a type of thick virtual disk format that supports clustering features such as fault tolerance but takes much longer to create than other types of virtual disks. VM storage policy: Datastore default or any other configured storage policy. For more information, see Virtual Machine Storage Policies in the VMware vSphere Tech Docs. |
| 7 Select networks | If you are using a vSphere Web Client, the Select networks page allows you to map each NIC to a network and specify protocol settings. Map the networks used in the OVF template to networks in your inventory. 1. Select a deployment configuration - Single NIC or Two NIC or Three NIC, and so on. - If you are using only one NIC, all the rows are mapped to the same network. - If you are using more than one NIC, on the ManagementNetwork row, select the Destination Network, and then enter the IP addresses for the DNS Server, Default Gateway, and netmask for that network. - If you have a third NIC, select the third row and complete the settings. - If you are using only two NICs, for BackendNetwork row, select the same network that you used for ManagementNetwork. 2. Select the Internet row and click the down arrow to select the destination network. If you select IPv6 as the IP protocol, you must select the network that has IPv6 capabilities. 3. After you select the row, you can also enter IP addresses for the DNS server, gateway, and netmask in the lower portion of the window. Click NEXT. 4. Ignore the IP protocol drop-down menu if it is displayed, and do not make any selection here. The actual selection of IP protocol (IPv4/IPv6/both) depends on what IP mode is specified for IPMode for NIC 1 (eth0), NIC 2 (eth1), and NIC 3 (eth2) when customizing Networking Properties. DNS Server and default gateway settings are global and not associated with any specific NIC. |
8 Customize Template
| Property | Description |
|---|---|
| Networking Properties | The text boxes on the Properties page are specific to Unified Access Gateway and might not be required for other types of virtual appliances. Text in the wizard page explains each setting. If the text is truncated on the right side of the wizard, resize the window by dragging from the lower-right corner. For each of the NICs, for STATICV4, you must enter the IPv4 address for the NIC. For STATICV6, you must enter the IPv6 address for the NIC. If you leave the text boxes empty, the IP address allocation defaults to DHCPV4+DHCPV6. Important: The latest release of Unified Access Gateway does not accept netmask or prefix values and default gateway settings from the Network Protocol Profile (NPP). To configure Unified Access Gateway with static IP allocation, you must configure the netmask/prefix under network properties. These values do not be populated from NPP. Note: - The values are case-sensitive. - While deploying Unified Access Gateway using the vSphere Client HTML5 in vSphere 6.7 or earlier, only NIC1 (eth0) is available for configuration. Multiple NICs are available for configuration when using the vSphere client HTML5 in vSphere 7.0. |
| IPMode for NIC1 (eth0) | STATICV4/STATICV6/DHCPV4/DHCPV6/AUTOV6/STATICV4+STATICV6/STATICV4+DHCPV6/STATICV4+AUTOV6/DHCPV4+AUTOV6/DHCPV4+STATICV6/DHCPV4+DHCPV6/DHCPV4+AUTOV6 |
| Comma-separated list of forward rules in the form {tcp or udp}/listening-port-number/destination-ip-address:destination-port-nu. | For example, for IPv4, tcp/5262/10.110.92.129:9443, tcp/5263/10.20.30.50:7443 |
| NIC 1 (eth0) IPv4 address | Enter the IPv4 address for the NIC if you entered STATICV4 for the NIC mode. - Comma separated list of IPV4 custom routes for NIC (eth0) in the form ipv4-network-address/bits ipv4-gateway-address. For example, 20.2.0.0/16 10.2.0.1,20.9.0.0/16 10.2.0.2,10.2.0.1/32 Note: If ipv4-gateway-address is not specified, then the respective route that is added has a gateway of 0.0.0.0. |
| NIC 1 (eth0) IPv6 address | Enter the IPv6 address for the NIC if you entered STATICV6 for the NIC mode. |
| DNS server addresses | Enter space-separated IPv4 or IPv6 addresses of the domain name servers for the Unified Access Gateway appliance. Example of IPv4 entry is 192.0.2.1 192.0.2.2. Example of IPv6 entry is fc00:10:112:54::1 |
| DNS Search Domain | Enter space-separated DNS Search list. |
| NIC 1 (eth0) IPv4 Netmask | Enter the IPv4 netmask for the NIC. |
| NIC 1 (eth0) IPv6 Prefix | Enter the IPv6 prefix for the NIC. |
| NIC1 (eth0) Custom Configuration | Enter the custom configuration value for the NIC in the format, SectionName^Parameter=Value. An example of a custom configuration entry is DHCP^UseDNS=false. This value, when used, disables the usage of DNS IP addresses provided by the DHCP server. Using the same format, you can add multiple such systemd.network configuration entries separated by semi-colons. |
| IPv4 Default Gateway | Enter a IPv4 default gateway if Unified Access Gateway needs to communicate to an IP address that is not on a local segment of any NIC in Unified Access Gateway |
| IPv6 Default Gateway | Enter a IPv6 default gateway if Unified Access Gateway needs to communicate to an IP address that is not on a local segment of any NIC in Unified Access Gateway. |
| Unified Gateay Appliance name | Enter the host name of the appliance for identification. If you do not enter any name, the system automatically generates the name. |
| Join CEIP | Select Join the Customer Experience Improvement Program to join CEIP or deselect the option to leave CEIP. |
Password options
| Option | Description |
|---|---|
| OS Login Username | Enter the username to access the local console of Unified Access Gateway. When configured, a new sudo privileged user with given username is created and root login is disabled. Only a-z, 0-9, underscrore (_) and hyphen (-) are allowed and the maximum length is 32. Note: Leave this field blank to use root user. |
| Password for OS login | Enter the password for OS login. This password applies to either root or the custom user as configured in OS Login Username field. |
| Password Expiration in days for the OS user | Enter the Password expiration policy for the OS user. If set to zero password never expires. The default value is 365 days. |
| Password minimum length | Enter the minimum length of the password. The default value is 6. |
| Password policy for minimum character classes | Enter password policy for minimum number (1,2,3,4) of classes of character type (uppercase, lowercase, digit, others). |
| Password policy for maximum failed attempts | Enter the maximum failed attempts allowed. The default value is 3. |
| Password policy for unlock time in seconds on maximum failed attempts | Enter the time in seconds to unlock the password when you have reached maximum failed attempts. The default value is 900. |
| Session idle timeout for OS user in seconds | Enter the session idle timeout for OS user. The range is 30 -3600 seconds. Session expiry is disabled if this is set to zero (0). The default value is 300. |
| Maximum limit for concurrent sudo login sessions | Enter the maximum limit on cuncurrent login sessions for sudo user. If sudo user is not configured, this setting is ignored. The default value is 10 and minimum configurable is 1. There is no maximum limit. |
Admin user password (enables REST API access)
| Requirement | Description |
|---|---|
| Password and Confirm Password | Passwords must be at least 8 characters long, contain at least one uppercase and one lowercase letter, one digit, and one special character, which includes ! @ # $ % * ( ). WARNING: If you leave the password blank, an Admin UI User will not be created, and you will not be able to configure any settings on the appliance. You will have to redeploy the UAG appliance with a password to use the Admin UI. |
| Admin password minimum length | Enter the minimum length of the admin password. The default value is 8. |
| Admin password policy for maximum failed attempts | Enter the maximum failed attempts allowed. The default value is 3. |
| Admin password policy for unlock time in minutes on maximum failed attempts | Enter the time in minutes to unlock the admin password when you have reached maximum failed attempts. The default value is 5 minutes. |
| Admin session idle timeout in minutes | Enter the session idle timeout for the admin.The default value is 10 and the maximum is 1440 minutes. |
| Maximum concurrent sessions for admin console users | Enter the maximum limit on cuncurrent login sessions for the admin. The default value is 5 and maximum value is 50. When maximum session count exceeds for a user, least recently used session will be expired. |
Compliance
| Setting | Description |
|---|---|
| Enable DISA STIG compliance | Sets the OS configuration to comply with the current AlmaLinux 9 DISA STIG Readiness Guidelines. Select this check box to automatically configure password complexity and other STIG requirements. Note: This setting should be used with the FIPS version when DISA STIG OS compliance is required. |
System Properties
| Option | Description |
|---|---|
| Enable SSH | Option to enable SSH for accessing Unified Access Gateway virtual machine. |
| Allow SSH root login using password | Option to access Unified Access Gateway virtual machine by using an SSH root login and password. By default, the value of this option is true. |
| Allow SSH login using key pair | Option to access Unified Access Gateway virtual machine by using an SSH root login and public-private key pairs. By default, this value is false. The Unified Access Gateway Admin UI has a field, SSH Public Keys, where an administrator can upload public keys to allow the configured or the root user access to Unified Access Gateway when using the public-private key pair option. For this field to be available on the Admin UI, the value of this option and Enable SSH must be true at the time of deployment itself. If either of these options are not true, the SSH Public Keys field is not available on the Admin UI. SSH Public Keys field is an advanced system setting in the Admin UI. See System configuration. |
| Login Shell Banner Text | Option to customize the banner text displayed when logging into Unified Access Gateway using SSH or the vSphere Client's Web Console. This option can be configured only at the time of deployment. If you do not configure this option, the default text is displayed: EUC Unified Access Gateway. Only ASCII characters are supported in the customized text. For multi-line banner texts, \n must be used as the line seperator. Note: When Unified Access Gateway is deployed using the OVF template and the login banner text is configured, at the first launch of Unified Access Gateway, the vSphere Client's Web Console displays the default banner text and the customized banner text is ignored. On subsequent launches, the customized banner text is displayed. |
| SSH Interface | Configure the network interface on which SSH login is enabled. By default, SSH is enabled on all the interfaces. The supported values are eth0, eth1, and eth2 based on the configuration. |
| SSH Port | Configure the port on which SSH is enabled. The default value is 22. |
| Gateway specification | When deploying Unified Access Gateway on Horizon, you can run only those services that are required for Horizon. This allows you to keep only the required services on Horizon to be active and all other services are disabled. Enter the gateway name to install the service. The list of allowed values are Horizon_Gateway. By default, all services are installed. |
| Commands to Run During First boot | Enter semi-colon separated list of commands in plain-text or base64 encoded format to run during first boot up of Unified Access Gateway. Maximum size is 8kB. For more information, see Configurable Boot Time Commands for First Boot and Every Boot. |
| Commands to Run During Every Boot | Enter semi-colon separated list of commands in plain-text or base64 encoded format to run during every boot up of Unified Access Gateway. Maximum size is 8kB. For more information, see Configurable Boot Time Commands for First Boot and Every Boot. |
| SecureRandom Source | Allows you to configure the secure random bit generator source used by Java processes for cryptographic functions. This option can be configured only at the time of deployment. Supported values are: /dev/random and /dev/urandom. By default, /dev/random is used in the non-FIPS mode and /dev/urandom is used in the FIPS mode. |
- On the Ready to complete page, review the information and click FINISH.
A Deploy OVF Template task appears in the vCenter Server status area so that you can monitor deployment. You can also open a console on the virtual machine to view the console messages that are displayed during system start. A log of these messages is also available in the file /var/log/boot.msg.
-
Power on the virtual machine.
-
When the appliance is powered on, verify that end users can connect to the appliance by opening a browser and entering the following URL:
https://FQDN-of-UAG-appliance
In this URL, FQDN-of-UAG-appliance is the DNS-resolvable, fully qualified domain name of the Unified Access Gateway appliance.
If deployment was successful, you see the Web page provided by the server that Unified Access Gateway is pointing to. If deployment was not successful, you can delete the appliance virtual machine and deploy the appliance again. The most common error is not entering certificate thumbprints correctly.
Results
The Unified Access Gateway appliance is deployed and starts automatically.
What to do next
Log in to the Unified Access Gateway admin user interface (UI) and configure the desktop and application resources to allow remote access from the Internet through Unified Access Gateway and the authentication methods to use in the DMZ. The administration console URL is in the format https://<UAG-fqdn>:9443/admin/index.html.
Was this page helpful?