Ports, Protocols, and URL Requirements for Horizon Cloud on Microsoft Azure

Ensure that the required ports, protocols, and destination URLs for your Horizon Cloud on Microsoft Azure deployment allow communication as necessary. Use the following tables to verify that your network configuration and firewalls will allow the communication traffic required for a successful deployment and for day-to-day operations.

The specific ports and protocols required for your deployment will in part depend on which features you select to use. If you do not plan to use a specific component or protocol, its required communication traffic is not necessary, and you can ignore the ports associated with that component. For example, if your end users will only use the Blast Extreme display protocol, then allowing the PCoIP ports is not a requirement.

Note: If your deployment uses a proxy server to control traffic flow, open the required ports to allow the Horizon Edge Gateway to reach the proxy server. When the format of your Microsoft Azure Edge is Edge Gateway (AKS), see Outbound network and FQDN rules for Azure Kubernetes Service (AKS) clusters. For situations where using URLs is not possible, see KB 6000374 — IP Addresses for Service Components.

Ports and Protocols Required by Horizon Edge

When you activate Horizon Infrastructure Monitoring, Horizon Edge is deployed and configured in the associated subscription. The following table lists the ports and protocols needed during the activation process — in which the appliance deploys and configures the manager VMs so the appliance can collect monitoring data — as well as the ports and protocols needed during steady-state operations.

To allow the URLs and wildcard sub-domains in the table below, add them to an allow list for your firewall and network security group, and bypass SSL deep packet inspection in both the firewall and, if applicable, the proxy server.

Unified Access Gateway VM Ports and Protocols Requirements

In addition to the primary ports and protocols listed in the table above, the ports and protocols in the following table apply to the gateways configured for ongoing operations after deployment. For connections configured with Unified Access Gateway instances, traffic must be allowed to and from the Unified Access Gateway instances to the targets listed below.

Considerations

• For these service-deployed Unified Access Gateway instances, the UDP ports require both forward and reply UDP datagrams to be allowed. For example, Unified Access Gateway services use DNS to resolve hostnames. DNS requests are made on UDP port 53, so it is important that an external firewall does not block these requests or replies.

• The Unified Access Gateway is deployed on a multi-NIC configuration. The Source Network column details which network the traffic originates from.

• Bypass SSL deep packet inspection in the DMZ subnet for all URLs and wildcard subdomains listed below — in the firewall for traffic from the Unified Access Gateway to *.horizon.omnissa.com endpoints, and in any proxy server the Unified Access Gateway itself uses to reach cloud control plane endpoints.

App Volumes Ports and Protocols

To support App Volumes features for use with Horizon Cloud on Microsoft Azure, you must configure port 445 for TCP protocol traffic to the tenant (desktops) subnet. Port 445 is the standard SMB port for accessing an SMB file share on Microsoft Windows. The AppStacks are stored in an SMB file share located in the same resource group as the pod manager VMs.

VDI Ports and Protocols Requirements

The following table provides the ports and protocols required for the desktop (VDI or tenant) subnets configured in your environment.

Note: In addition to the ports listed below, ensure that the URLs and wildcard subdomains required for Horizon Edge are also reachable from your environment. For details, see Ports and Protocols Required by Horizon Edge above.

You can allow a URL for the tenant (desktop) subnet at the global VM Hub level or at the regional VM Hub level. If using regional VM Hub instances suits the needs of your site, use the two corresponding URLs: Service Gateway and MQTT, for the region in which your Horizon Edge Gateway is deployed. The regional endpoint mapping is shown below the table.

Regional VM Hub DNS Hostname Reference

The following table maps Azure deployment regions to their corresponding Service Gateway and MQTT URLs. All entries use port 443, protocol TCP, for agent-related operations such as certificate signing using VM Hub and renewal.

Note: Horizon Cloud has a localized active-active deployment in Japan to ensure infrastructure resiliency remains entirely within the region, adhering to local compliance policies. Traffic dynamically routes between the Horizon Cloud 1 instance (Japan East) and the Horizon Cloud 2 instance (Japan West) based on geographic affinity. If your organization enforces IP-based allowlisting, ensure your firewall rules include entries for both of the Horizon Cloud instances in Japan as listed in KB 6000374 — IP Addresses for Service Components.

End-User Connection Traffic Ports and Protocols Requirements

For detailed information about the various Horizon Clients your end users might use with your Horizon Edge Virtual Appliance, see the Horizon Client product documentation. Which ports must be opened depends on the choice you make for how your end users will connect.