Configure Network Settings for Amazon WorkSpaces Core

For Horizon Cloud, your deployment requires subnet support in the Amazon WorkSpaces Core region, which requires the existence of a Virtual Private Cloud (VPC) in that region.

Create a VPC in an Amazon WorkSpaces Core region with applicable address space for the required subnets and NAT IPs.

Creating Management, Tentant, and DMZ Subnets

Create three non-overlapping subnet address ranges in classless inter-domain routing (CIDR) format in the VPC. The following subnet requirements are minimum. For larger environments, larger subnets might be necessary.

Procedure

1. Create the Management subnet - /26 minimum

   If deploying an Edge Gateway and using a NAT Gateway as the outbound connectivity type, configure a NAT Gateway. Also, ensure that the Management subnet does not conflict with the following IP ranges:

   • 169.254.0.0/16
   • 172.30.0.0/16
   • 172.31.0.0/16
   • 192.0.2.0/24

2. Create two Desktop (tenant) subnets in two different availability zones.

   For the primary desktop (tenant) subnet, create /27 minimum subnets, but size appropriately based on the number of desktops and RDS servers. You can add more subnets as required.

   Note: If you are using an internal load balancer, ensure that all VM subnets for your desktop VMs fall in the IP ranges described in RFC1918.

3. Create the DMZ subnet.

   Create /27 minimum subnets for the cluster of Unified Access Gateway.

   Note: Deploying a Unified Access Gateway requires three subnets. Each Unified Access Gateway VM has three NICs, one from each subnet. The external load balancer backend pool is attached to the DMZ subnet NICs. The internal load balancer backend pool is attached to the desktop subnet NICs. Verify that there are no network security groups (NSGs) or firewall rules blocking ingress to the DMZ network from the internet. The only NSGs that Omnissa deploys are ones attached to the NICs (not subnet) and by default allow ingress. Any firewall or NSG rules blocking incoming traffic from the internet to the DMZ NICs will cause issues when attempting to connect to the Unified Access Gateways through the external load balancer.

Specifying Agent Pairing and AWS IP Ranges for Amazon Workspaces Core in Settings

In Horizon Cloud, every VM connects securely to the Horizon Control Plane so that an agent running on a VM can send data in a more secure way. This process is referred to as agent pairing. For Amazon Workspaces Core, you can optionally specify an allowed NAT Gateway IP address range to use for this agent pairing by using a General Settings UI sequence. The IP range that you specify is used to validate and allow an external address to be used to connect one way traffic for internal VIP networks.

You can specify multiple NAT Gateway IP address ranges. Use of this setting is optional and allows for added security.

If you specify at least one NAT Gateway IP address range here, validation is performed and access is subsequently denied if a request is made that does not originate from within that IP range. If you do not supply a network range here, access is allowed from any of your NAT Gateway IP addresses.

Note: If you do not use AWS for your deployments, you can safely ignore the AWS IP Ranges section under General Settings in the Horizon Universal Console.

Procedure

1. From the Horizon Universal Console, click Settings and then click Manage on the General Settings tile.

2. Click Add in the Add a Network Range section and enter an allowed NAT Gateway IP address range.

3. You can also click Add in the AWS IP Ranges section to specify CIDR, single IP, and and IP ranges.