Add and Deploy an Amazon Workspaces Core Edge

From the Horizon Universal Console, you can use the Add Horizon Edge UI to add and deploy a Horizon Edge into your Amazon WorkSpaces Core subscription.

The Horizon Edge is a thin-edge cloud infrastructure. For Amazon WorkSpaces Core deployments, an Amazon EC2 infrastructure is the provider.

Prerequisites

• Review and fulfill the requirements in the Requirements Checklist for Deploying an Amazon WorkSpaces Core Edge.

• Review and complete the preparatory items described in the linked pages within the page Amazon WorkSpaces Core Deployments.

• Determine the fully-qualified domain name (FQDN) that you will use for the deployed Horizon Edge Gateway appliance. The UI wizard asks you to input that FQDN.

• If the Horizon Connection Server involved in this Horizon Edge has a self-signed certificate, ensure you know the certificate fingerprint for the wizard's verification step.

• Review the Omnissa Community forum article Understanding Omnissa Horizon Edge Gateway: Purpose, Architecture & Best Practices.

Note that the outbound TLS connections from Horizon Edge Gateway to Horizon Cloud might fail if the default certificate rendered by Horizon Cloud is replaced with a custom certificate by using a proxy or any other means. Replacing the default certificate with a custom certificate is not supported.

Elastic Kubernetes Service (EKS) is supported when deploying the Horizon Cloud Edge.

Prerequisites for Configuring UAG Advanced Mode

• Ensure that all Horizon Clients connecting to the Edge (for which UAG Advanced mode is being configured) have been upgraded to Horizon HAI agent version 24.12 or above. See the Horizon Cloud Release Notes for related information about HAI agent version requirements.

• UAG Advanced Mode is available across all supported platforms, including Native Desktop, Mobile, and Web clients.

• When editing a deployed Horizon Edge, if there is a change in the deployment type from Basic to Advanced or Advanced to Basic, the load balancer IP address in the Unified Access Gateway section of the Edge deployment UI page might change. If a change in the load balancer IP does occur, you must update the DNS record with the new IP address.

  Note: If the Unified Access Gateway load balancer has a private front-end IP address allocated from a DMZ or VM subnet, the load balancer IP address will change if you select a different subnet while changing the deployment type to or from Basic and Advanced. For more information, see Update Unified Access Gateway Deployment Type and Load Balancer IP Address Impact.

Procedure

The Horizon Universal Console in Horizon Cloud makes the Add Horizon Edge UI page available from various entry points. Your starting point in the console for this step typically depends on whether your environment is greenfield or it has existing Horizon Edge deployments.

• No Horizon Edges yet - If there are no Horizon Edges deployed in the environment yet, you usually start the process by clicking Start Deployment. The console then displays the Add Horizon Edge UI stepper page. Alternatively, you can start by clicking Capacity > Add > Amazon WorkSpaces Core. The console then displays the Add Horizon Edge UI stepper page.

• At least one Horizon Edge - If there is at least one Horizon Edge for Amazon WorkSpaces Core that has already been created and deployed in your Horizon Cloud environment, click Capacity > Horizon Edges > Add > Horizon Cloud > Amazon WorkSpaces Core from the Horizon Universal Console to open the Add Horizon Edge stepper page.

1. Log in to the Horizon Universal Console. See Log in to Horizon Cloud.

2. Click Capacity > Horizon Edges in the left pane navigation.

3. From the Horizon Edges tab, click Add and from the drop-down menu, select Horizon Cloud > Amazon WorkSpaces Core.

4. Respond to all subsequent UI stepper pages as described below.

General Information

Enter the Horizon Edge name and description.

Primary Provider

1. In the Provider name section, enter the name for the Amazon WorkSpaces Core provider.

2. Select the required AWS region.

3. Enter the Assume Role ARN of the role you created in the prerequisite configuration.

4. Enter the external ID you provided during the creation of the Assume Role process in the previous section.

5. Click the Copy agent pairing spec button and copy the supplied agent pairing spec content to a file named Config.bin. Place the Config.bin file in the C:\AzureData folder on your source WorkSpaces Core VM or EC2 instance.

   To add images later, you must create and place this agent pairing spec file named Config.bin in the WorkSpaces Core VM or EC2 instance at C:\AzureData\Config.bin.

   Note: The C:\AzureData\Config.bin pairing spec file has a lifespan of 5 years.

6. Click Advanced to optionally add AWS resource tags.

   AWS resource tags are are currently only applied to pools.

   AWS resource tags are case-specific.

7. Click Next.

Site

If you have a site already created, you can use that in this step. If not, create a new site using the options provided in this step.

Connectivity

Specify the Horizon Edge Gateway connection mode to use for this network connection.

1. The available Network connection type is Internet.

2. For the Network connection mode, choose either Individual agent connection or Aggregated agent connection as described in onscreen help.

   • Individual agent connection - Agent communication connects directly to the internet.
   • Aggregated agent connection - Agent communication is consolidated through the Horizon Edge.

   Consider failover scenarios when determining which model to select.

3. Click Next.

Horizon Edge Gateway

1. The FQDN is auto-generated.

2. Select the VPC where you want to deploy the Horizon components, images, and desktop pools.

3. Select the subnet that will act as a management subnet.

App Volumes Application Storage

Enter the following App Volumes information and then click Next to continue. For related information, see Overview and Prerequisites For Using App Volumes Applications.

1. Specify the Domain name and DNS server IP address.
2. Enter the Service account user name and Service Account password.
3. For the Configure FSx file server sizing setting, select either Basic or Advanced as described in the onscreen help.
   If you want to increase the IOPS/throughput of the file server, select Advanced. For related information, see the Throughput and IOPS section of FSx for Windows File Server performance in Amazon FSx for Windows File Server product documentation.
   
4. For the File share security group setting, select either Use default security group or Configure custom security group as described in onscreen help.
5. If you selected Configure custom security group, choose the security group from the drop-down menu.
   When choosing a custom security group, be sure that it allows traffic from all CIDR ranges of the VPC where the Horizon Edge is deployed. To support connectivity, availability of the named security group is validated before you proceed further in defining the deployment.

Unified Access Gateway

Enter the following Unified Access Gateway information and then click Next to continue. For information about proxy options when specifying UAG outputs, see Port and Protocol Requirements for Horizon Cloud Deployment in Amazon WorkSpaces Core.

1. In the Deployment section, select the Deployment Type of Basic or Advanced as described in onscreen help. The deployment type setting specifies that load balancer distribution uses either source-ip-affinity or hash.

   • Basic - Use for a load balancer scenario with source-ip-affinity to support up to 2000 connections for each Horizon Edge if NAT gateway or firewall configured in front of an AWS load balancer.
     
   • Advanced - Use for a load balancer scenario with hash-based affinity to support up to 18000 connections for each Horizon Edge. Use of this option requires that you use a new management subnet with a subnet mask of /28. This UAG management subnet should be in the same VPC, or in a peered VPC, as the Edge management subnet. The new UAG management subnet must be provided with a /28 subnet mask selected from the list.

   For example, in scenarios where you deploy a NAT gateway or firewall in front of an AWS load balancer with Basic/source-ip-affinity UAG enabled, only 2000 connections are supported for each Horizon Edge. With Advanced/hash UAG deployment enabled, up to 18000 connections can be supported for each Horizon Edge.

   If you select Advanced, you can perform one or more of the following operations:

   • If you are deploying the UAG as Blast Extreme, you can specify that either port 8443 or port 443 be used.
   • The deployer service automatically enables 8445 inbound UDP port on the UAG management NSG.
   • You can specify an NTP server and Proxy information.

   When you click Save to configure the UAG Advanced mode, a message appears stating that UAG advanced mode configuration is in progress. The UAG Advanced mode configuration may take up to 15 minutes to complete.

   After the successful configuration of the UAG Advanced mode, the UAG Load balancer IP might change. If so, you might have to update the DNS record with the new IP Address.

   Note: If the Unified Access Gateway load balancer has a private front-end IP address allocated from a DMZ or VM subnet, the load balancer IP address will change if you select a different subnet while changing the deployment type to or from Basic and Advanced. For more information, see Update Unified Access Gateway Deployment Type and Load Balancer IP Address Impact.

2. In the Gateway Access section, select an Access Type from the following options:

   • Internal access over a corporate network - if you want to reach your VMs over the intranet (internal corporate network) only. A layer 4 load balancer will be deployed with a front end in the Desktop network.
   • External access over the internet - if you want to reach your VMs over the Internet. A layer 4 load balancer will be deployed with a public IP.
   • Internal and external access - allow both internal and external access.

   Note: For all three options, outbound Internet access to *.horizon.omnissa.com is required. When using Internal access over a corporate network, either user-defined routing or NAT Gateway can be applied to the Management subnet to allow outbound traffic. When the external access is configured externally with a DMZ network, external access to *.horizon.omnissa.com must be configured on the DMZ network.

   If you are using a supported Horizon Edge version, you can also deploy a UAG with a proxy that uses HTTPS instead of HTTP or deploy a UAG with a proxy without being required to provide trusted certificates. To enable these options, contact Omnissa Customer Connect.

3. In the Access Configuration section, toggle Automatic Public IP on or off. Turning it off allows you to specify an internal FQDN. Public IP address specification is not currently supported.

   For information about mapping your FQDN to an IP, see Configure Required DNS Records After Deploying Horizon Edge Gateway and Unified Access Gateway.

4. In the Gateway VMs section, provide the FQDN or FQDNs for the Unified Access Gateway deployment. The FQDN(s) must be reachable.

   When configuring internal and external access, if you want to use the same FQDN, enter the same FQDN in both the External FQDN and Internal FQDN fields.

   • For the Certificate Type, select PEM or PFX from the drop-down menu.
   • For the Certificate field, browse to select the certificate that allows clients to trust connections to the Unified Access Gateway in Amazon WorkSpaces Core. The certificate must only contain Server Authentication EKU and must not include Client Authentication EKU.
   • For the VM Model, select the appropriate model from the drop-down menu as described in onscreen help.
   • For the UAG VMs setting, enter the required number of gateway VMs.

5. In the Networking section, select the VM desktop, management and DMZ subnets.

6. Optional: In the Networking section, expand the Advanced option and enter proxy, cipher suites, and resource tag information as needed and as described in onscreen help.

7. Click Save.

Diagnose the Unified Access Gateway (UAG)

If using the API, you can use the following method to diagnose the UAG.

• endpoint: swagger UI

• Method: POST

• Headers:

  • Content-Type: application/json
  • Authorization: Bearer {your_token}

  A sample Request Body API call is shown below:

  { "diagnosticType": "<uag-diagnostic-type>", "gatewayId", "<uag-gateway-id>" }

Make sure to replace placeholders with the appropriate values.

Edit the Unified Access Gateway (UAG)

If using the API, the following fields are editable for the UAG deployment:

• Internal FQDN
• Certificate type
• Certificate update
• VM model
• UAG VMs
• Proxy details

Additional Information

You can select the Automatic Public IP toggle to switch the option on or off. The toggle is switched on by default. If a manual custom IP is selected, an external UAG will be deployed with a private front-end IP address on the DMZ network. You must then take care of the routing from this private IP address to the customer provided public one.

You can expand the Advanced node to perform the following operations:

• If you are deploying the Unified Access Gateway as Blast Extreme, you can specify that either port 8443 or port 443 be used.

• You can specify an NTP server and Proxy information, as shown and described in the onscreen help for those options.

• You can manage Amazon resource tags as needed, which includes viewing inherited tags, editing and deleting existing tags, and adding tags to be applied to the resource groupsspecific to this Unified Access Gateway. For related information, see Using Amazon Resource Tags.

What to do next

For information about monitoring your deployment, see Monitoring Your Environment.