Create a UAG Deployment for a vSphere Edge

In Horizon Cloud, after you create a vSphere Edge you can configure the Unified Access Gateway (UAG) settings for that Edge. You cannot configure UAG settings when you create the Edge, only after the Edge has been created.

Enable SSH access to the Unified Access Gateway (UAG)

UAG log collection and diagnostic command execution for on-premises cloud providers, such as vSphere, Nutanix, and OpenStack, are performed by the module connecting to the UAG VM over SSH. SSH must be permitted from the Horizon Edge module to the UAG VM, so that Horizon Ops can collect UAG logs and run diagnostic commands for troubleshooting any issues found in UAG deployments.

• The SSH protocol must be enabled on the UAG appliance.
• Firewall/security-group rules must allow inbound SSH (TCP port 22) to the UAG VM's management interface from the Horizon Edge module's network.

Choosing a UAG Deployment Type - Basic or Advanced

There are two modes of UAG deployment available - Basic and Advanced. When using Advanced, you can configure your load balancer to use round robin instead of a source IP distribution method.

• Basic: Use for a load balancer that has been configured for session persistence/source IP affinity distribution mode. Traffic from the same client IP is routed through the same UAG instance. Use for a load balancer scenario with source-ip-affinity.

• Advanced: Use for a load balancer that has been configured in hash-based (round-robin) distribution mode. Traffic from the same client IP is routed to any healthy UAG instance in the cluster.

Note: Basic mode enables 2K session support per UAG. Advanced mode enables 4K session support per UAG. To use Advanced mode, ensure that the UAG is configured with a minimum of 4 vCPU and 16 GB RAM. Actual compute requirements may vary based on your specific use case and workload.

For either method, Omnissa does not deploy the load balancer for you. You must deploy your own load balancer.

Considerations for Using the UAG Advanced Deployment Type

• Ensure that all Horizon Clients connecting to the Edge for which the UAG Advanced Mode is being configured have been upgraded to Horizon HAI agent version 24.12 or above. See the Horizon Cloud Release Notes for related information about HAI agent version requirements.

• The UAG Basic and Advanced deployment types are available across all supported platforms, including Native Desktop, Mobile, and Web clients.

• If you aren’t already using a 3-NIC UAG, you must enter 3 networks with static IPs for those networks.

• All networks must be IP ranges that are equal in size.

• Basic mode supports 2K sessions per VM. Advanced mode supports 4K sessions per VM.

• If you are deploying the UAG as Blast Extreme, you can specify that either port 8443 or port 443 be used.

• Be sure that your VMs can communicate with one another on port 8445. Ensure that you have updated your firewall to allow VM-to-VM communication on port 8445.

• Update the load balancer policy to round robin after a successful Advanced mode UAG deployment.

• Recommendation: Provide the IP range with 10 consecutive IPs for the Management, DMZ, and Desktop networks when using the Advanced mode deployment.

Procedure

Perform the following steps to add the Unified Access Gateway (UAG) for the vSphere Edge.

1. Log in to Horizon Cloud and click Capacity in the left pane navigation.

2. Click the Horizon Edges tab on the resultant Capacity page.

3. In the table of existing Edges, locate the vSphere Edge.

4. In the Unified Access Gateway column for that vSphere Edge, locate the Not Configured link.

   Note: If the UAG has already been configured for this vSphere Edge, the status displays as either Configured or Ready and you are instead able to edit the existing UAG configuration.

5. Click Not Configured and respond to prompts on the resultant Configure Unified Access Gateway page as described below.

   Alternatively, if the UAG has not yet been configured, you can open the Edge details page by clicking on the Edge name. On the resultant page you can then click Add in the Unified Access Gateway area of the Edge details summary page.

6. On the Configure Unified Access Gateway Requirements page, confirm that you meet the stated requirements and click Next.

7. On the General Information page, provide the following information and then click Next.

   • UAG Name: Provide a name for this UAG deployment.
   • Description: Provide a description for this UAG deployment.
   • Unified Access Gateway VMs: Provide the number of VMs that you want for this UAG deployment.
   • Provider: Select the vSphere provider that will use this UAG deployment.
   • Deployment Type: Select Basic or Advanced. See details above for information about making your selection.
   • Number of Network Adapters: Select the number of NICs for each UAG VM. Note that all VMs will have this same number of NICs. This value determines the number of networks that you must provide information for in the following Networks section.
     
     • NIC 1: One network interface is appropriate for proof of concept or testing scenarios. When using a single NIC, all external, internal, and management traffic is provided on the same subnet.
     • NIC 2: With two network interfaces, external traffic is on one subnet while internal and management traffic are on another subnet.
     • NIC 3: Using three network interfaces is the most secure option. With a third NIC, external, internal, and management traffic each have their own subnet.
   • IP Mode: Select either Static v4 or DHCP v4. If Static V4 is selected, then Static IP Range, Netmask and Gateway options are shown later. They are not shown for DHCP V4 deployments.
     • Static v4: All VMs are deployed with static IP addresses. You must provide the IP range for the static IPs in the Networks section below.
     • DHCP v4: All the VMs will be deployed with DHCP IP addresses.
   • Load Balancer FQDN: Specify the fully qualified domain name (FQDN). This should match the SSL Certificate and DNS record which represent the external hostname mapped to the load balancer’s virtual IP (VIP). All client connections will be redirected to this FQDN to be distributed among backend UAG servers. Note: You must bring your own load balancer and configure it after UAG deployment (for example, configuring load balancer policies and configuring the load balancer's backend pool with DMZ network details) and before you can proceed further.
   • DNS: Specify the space-separated DNS server IP addresses for the UAG VMs to use to resolve all FQDNs (for example, 192.168.1.1 192.168.1.2).
   • DNS Search Domain: Specify the DNS search domain (for example, acme.com).
   • Default Gateway: Specify the default gateway IP-address for the UAG VM (for example, 192.168.1.253).
   • Blast Extreme TCP Port: Specify port information as described in onscreen help.
   • NTP Servers: Specify NTP server information as described in onscreen help.
   • Use Outbound proxy: Toggle on or off as described in onscreen help.

8. On the Resources page, provide the following information and then click Next.

   • Datacenter: Select the vSphere data center that you want to deploy the UAG VMs into.
   • Cluster: Select the cluster from the datacenter inventory list.
   • Resource Pool: Select the resource pool from the cluster inventory list.
   • Datastore: Select the datastore from the list shown.
   • VM Folder: Select the folder in which to store the VM.
   • Deployment size: Select a deployment size from the drop-down menu to specify the CPU and memory for the UAG VM(s). If you change this value after UAG deployment, each VM in the UAG deployment will be automatically redeployed one VM at a time.
   • Certificate Type: Select PEM or PFX.
   • Certificate: Browse to and then select the certificate from your local machine. Note that the certificate file should have the full certificate chain and the private key.
   • OVA Image link (optional): This option provides a local HTTPS link to the desired UAG OVA to deploy. Leave blank to deploy the latest UAG version from CDN.

9. On the Networks page, provide the following information for each network shown and then click Save.

   Note: Based on the number of network adapters selected, the number of networks shown will vary.

   • When the number of network adapters is 3, DMZ, Desktop and Management network options are shown.
   • When the number of network adapters is 2, DMZ and Desktop network options are shown.
   • When the number of network adapters is 1, only the DMZ network option is shown.

   Note: If the Static V4 deployment type was selected on the General Information page, then Static IP Range, Netmask and Gateway options are shown. They are not shown if DHCP V4 was selected.

   • Portgroup: Select the portgroup to be used for the network.
   • Static IP Range: Specify an IP range to be used for the respective interface of UAG VMs. The IP range format uses the from - to construct xxx.xxx.xxx.xxx - xxx.xxx.xxx.xxx (for example, 192.168.1.1-192.168.1.10 to provide 10 consecutive IPs).
   • Netmask: Specify the netmask value for the IP range provided above (for example, 255.255.255.0).
   • Gateway: Specify the gateway value for the IP range (for example, 10.202.143.253).
   • Route: Specify an optional, comma separated list of IPV4 custom routes for the NIC in the form of ipv4-network-address/bits ipv4-gateway-address (for example, 20.2.0.0/16 10.2.0.1,20.9.0.0/16 10.2.0.2,10.2.0.1/32).

When you click Save, a message appears stating that the UAG configuration is in progress. The Advanced deployment type configuration may take up to 15 minutes to complete.

What to do next

As stated above, after UAG deployment is complete you must configure your load balancer.

After you have configured your load balancer, you are ready to add an image. For example, see Add and Publish an Image for vSphere Provider.

For related information about editing the UAG settings of your Edge, see Update Unified Access Gateway Deployment Type and Load Balancer IP Address Impact.