Add and Deploy an Amazon Workspaces Core Edge

From the Horizon Universal Console, you can use the Add Horizon Edge UI to add and deploy a Horizon Edge into your Amazon WorkSpaces Core subscription.

Introduction

The Horizon Edge is a thin-edge cloud infrastructure. For Amazon WorkSpaces Core deployments, an Amazon EC2 infrastructure is the provider.

The Horizon Universal Console makes the Add Horizon Edge UI stepper available from various entry points. Your starting point in the console typically depends on whether your environment is greenfield (new) or if it has existing deployments.

You begin the Add Horizon Edge process by using one of the following three methods.

• No Horizon Edges yet - start from the console’s Horizon Edge card

  If there are no Horizon Edges deployed in the environment yet, you usually start the process by clicking Start Deployment. The console then displays the Add Horizon Edge UI stepper page.

• No Horizon Edges - start from the console’s Capacity page

  If there are no Horizon Edges deployed in the environment yet, the Capacity page contains text and a Start menu. In this scenario, you can start by clicking Capacity > Add > Amazon WorkSpaces Core. The console then displays the Add Horizon Edge UI stepper page.

• At least one Horizon Edge - start from the console’s Capacity page

  If there is at least one Horizon Edge for Amazon WorkSpaces Core that has already been created and deployed in your Horizon Cloud environment, click Capacity > Horizon Edges > Add > Horizon Cloud > Amazon WorkSpaces Core from the Horizon Universal Console to open the Add Horizon Edge stepper page.

Prerequisites

• Review and fulfill the requirements in the Requirements Checklist for Deploying an Amazon WorkSpaces Core Edge.

• Review and complete the preparatory items described in the linked pages within the page Amazon WorkSpaces Core Deployments.

• Determine the fully-qualified domain name (FQDN) that you will use for the deployed Horizon Edge Gateway appliance. The UI wizard asks you to input that FQDN.

• If the Horizon Connection Server involved in this Horizon Edge has a self-signed certificate, ensure you know the certificate fingerprint for the wizard's verification step.

Note that the outbound TLS connections from Horizon Edge Gateway to Horizon Cloud might fail if the default certificate rendered by Horizon Cloud is replaced with a custom certificate by using a proxy or any other means. Replacing the default certificate with a custom certificate is not supported.

Elastic Kubernetes Service (EKS) is supported when deploying the Horizon Cloud Edge.

Prerequisites for Configuring UAG Advanced Mode

• Ensure that all Horizon Clients connecting to the Edge (for which UAG Advanced mode is being configured) have been upgraded to Horizon HAI agent version 24.12 or above. See the Horizon Cloud Release Notes for related information about HAI agent version requirements.

• UAG advanced mode is available only for desktop-native clients.

• When editing a deployed Horizon Edge, if there is a change in the deployment type from Basic to Advanced or Advanced to Basic, the load balancer IP address in the Unified Access Gateway section of the Edge deployment UI page might change. If a change in the load balancer IP does occur, you must update the DNS record with the new IP address.

  Note: If the Unified Access Gateway load balancer has a private front-end IP address allocated from a DMZ or VM subnet, the load balancer IP address will change if you select a different subnet while changing the deployment type to or from Basic and Advanced. For more information, see Update Unified Access Gateway Deployment Type and Load Balancer IP Address Impact.

Procedure

Enter required information as described on the following UI stepper pages.

General Information

Enter the desired Horizon Edge name and description.

Primary Provider

1. In the Provider name section, enter the name for the Amazon WorkSpaces Core provider.

2. Select the required AWS region.

3. Enter the Assume Role ARN of the role you created in the pre-requisite configuration.

4. Enter the external ID you provided during the creation of the Assume Role process in the previous section.

5. Click the Copy agent pairing spec button and copy the supplied agent pairing spec content to a file named Config.bin. Place the Config.bin file in the C:\AzureData folder on your source WorkSpaces Core VM or EC2 instance.

   To add images later, you must create and place this agent pairing spec file named Config.bin in the WorkSpaces Core VM or EC2 instance at C:\AzureData\Config.bin.

   Note: The C:\AzureData\Config.bin pairing spec file has a lifespan of 5 years.

6. Click Advanced to optionally add AWS resource tags.

   AWS resource tags are are currently only applied to pools.

   AWS resource tags are case-specific.

7. Click Next.

Site

If you have a site already created, you can use that in this step. If not, create a new site using the options provided in this step.

Connectivity

Connectivity defaults to Internet.

Domain Join Service Account for App Volumes

If applicable, enter your service account user name and password and then specify a DNS server name and IP address as described in the onscreen help.

The file server will be deployed to the basic configuration. If you want to increase the IOPS/throughput of the file server, see the Throughput and IOPS section of FSx for Windows File Server performance in Amazon FSx for Windows File Server product documentation.

Horizon Edge Gateway

1. The FQDN is auto-generated.

2. Select the VPC where you want to deploy the Horizon components, images, and desktop pools.

3. Select the subnet that will act as a management subnet.

Unified Access Gateway

In the Unified Access Gateway section, complete the following UI step options that are required for your deployment. Also, see Prerequisites for Configuring UAG Advanced Mode above if you intend to use the Advanced deployment type.

For information about proxy options when specifying UAG outputs, see Port and Protocol Requirements for Your Horizon Cloud Deployment in Amazon WorkSpaces Core.

1. In the Deployment section, select the Deployment Type of Basic or Advanced. The deployment type setting specifies that load balancer distribution uses either source-ip-affinity or hash.

   • Basic - Use for a load balancer scenario with source-ip-affinity to support up to 2000 connections for each Horizon Edge if NAT gateway or firewall configured in front of an AWS load balancer.
   • Advanced - Use for a load balancer scenario with hash-based affinity to support up to 18000 connections for each Horizon Edge. Use of this option requires that you use a new management subnet with a subnet mask of /28. This UAG management subnet should be in the same VPC, or in a peered VPC, as the Edge management subnet. The new UAG management subnet must be provided with a /28 subnet mask selected from the list.

   For example, in scenarios where you deploy a NAT gateway or firewall in front of an AWS load balancer with Basic/source-ip-affinity UAG enabled, only 2000 connections are supported for each Horizon Edge. With Advanced/hash UAG deployment enabled, up to 18000 connections can be supported for each Horizon Edge.

   When you click Save to configure the UAG Advanced mode, a message appears stating that UAG advanced mode configuration is in progress. The UAG Advanced mode configuration may take up to 15 minutes to complete.

   After the successful configuration of the UAG Advanced mode, the UAG Load balancer IP might change. If so, you might have to update the DNS record with the new IP Address.

   Note: If the Unified Access Gateway load balancer has a private front-end IP address allocated from a DMZ or VM subnet, the load balancer IP address will change if you select a different subnet while changing the deployment type to or from Basic and Advanced. For more information, see Update Unified Access Gateway Deployment Type and Load Balancer IP Address Impact.

   If you select Advanced, you can perform one or more of the following operations:

   • If you are deploying the UAG as Blast Extreme, you can specify that either port 8443 or port 443 be used.
   • For the Advanced option, the deployer service automatically enables 8445 inbound UDP port on the UAG management NSG.
   • You can specify an NTP server and Proxy information, as shown and described in the onscreen help for those options.

2. In the Gateway Access section, select an Access Type from the following options:

   • External access over the internet - if you want to reach your VMs through the Internet. A layer 4 load balancer will be deployed with a public IP.
   • Internal and external access - allow both internal and external access.

   Automatic Public IP is On by default. Turning it Off to use manual public IP specification is not currently supported.

3. You must map your FQDN to an IP. For FQDN to IP mapping, see Configure Required DNS Records After Deploying Horizon Edge Gateway and Unified Access Gateway.

4. In the Gateway VMs section, provide the FQDN or FQDNs for the Unified Access Gateway deployment. The FQDN(s) must be reachable.

   When configuring internal and external access, if you want to use the same FQDN, enter the same FQDN in both fields: External FQDN and Internal FQDN.

5. In the Gateway VMs section for the Certificate Type, select PEM or PFX from the drop-down menu.

6. In the Gateway VMs section for the Certificate Type field, specify the certificate that allows clients to trust connections to the Unified Access Gateway in Amazon WorkSpaces Core.

7. Select the desktop, management and DMZ subnets.

8. Select the needed options in the Advanced section.

9. Click Save.

Diagnose the Unified Access Gateway (UAG)

If using the API, you can use the following method to diagnose the UAG.

• endpoint: swagger UI

• Method: POST

• Headers:

  • Content-Type: application/json
  • Authorization: Bearer {your_token}

  A sample Request Body API call is shown below:

  { "diagnosticType": "", "gatewayId", "" }

Make sure to replace placeholders with the appropriate values.

Edit the Unified Access Gateway (UAG)

If using the API, the following fields are editable for the UAG deployment:

• Internal FQDN
• Certificate type
• Certificate update
• VM model
• UAG VMs
• Proxy details

Additional Information

You can select the Automatic Public IP toggle to switch the option on or off. The toggle is switched on by default. If a manual custom IP is selected, an external UAG will be deployed with a private front-end IP address on the DMZ network. You must then take care of the routing from this private IP address to the customer provided public one.

You can expand the Advanced node to perform the following operations:

• If you are deploying the Unified Access Gateway as Blast Extreme, you can specify that either port 8443 or port 443 be used.

• You can specify an NTP server and Proxy information, as shown and described in the onscreen help for those options.

• You can manage Amazon resource tags as needed, which includes viewing inherited tags, editing and deleting existing tags, and adding tags to be applied to the resource groupsspecific to this Unified Access Gateway. See Using Amazon Resource Tags for related information.

What to do next

For information about monitoring your deployment, see Monitoring Your Environment.