Configure Network Settings and Parent VM Setup for Horizon Cloud on OpenStack Edge Deployments

Configure the required network and load balancer settings for your Horizon Cloud on OpenStack Edge deployments.

Note: Horizon Cloud on OpenStack is currently available in Limited Availability (LA) mode only.

Edge and Load Balancer Network Requirements

The Edge VM requires one static IP from the identified Management network for the Edge VM along with a resolvable FQDN, (a record in the DNS infrastructure) to allow the desktop VMs to reach.

Only physical networks designated as external vLANs are currently supported. The required three physical networks and subnets are DMZ, Management, and Desktop.

• DMZ subnet - The DMZ network interface on this subnet for UAG(s) must be reachable by end users. This requires at least two consecutive static or reserved IPs, can scale up to ten for larger UAG clusters.

• Management subnet - This subnet can be used to deploy Edge VM, management interface for UAG in a multi-NIC model, alongside other infrastructure required for VDI.

• Desktop subnet - This subnet is for desktop VMs, which must connect to the Edge VM and Active Directory (Management).

• One static IP from the Management network for the Edge VM is required, with a resolvable FQDN ("A" record in DNS), allows desktop VMs to connect.

• DNS A record entry for the FQDN must resolve to the load balancer VIP for multi-UAG deployments.

• Ensure that all required URLs and ports are allowed and open in the network firewalls to support Horizon Cloud firewall as documented in Port and Protocol Requirements for Horizon Cloud on OpenStack Edge.

• The Omnissa Edge URL Checker tool, also referred to as the PreReqCheck Connectivity Validation toolkit, is available for URL reachability and port verification. It includes scripts to validate connectivity for the Edge, UAG, and desktop networks against required Horizon Cloud service URLs and ports. These scripts test both HTTP/HTTPS endpoints and non-HTTP (TCP/UDP) ports to ensure that all required connections are reachable.

• You can add a customer-managed local load balancer of choice to configure in front of the UAG instances. For information about adding a load balancer, see Load Balancing Unified Access Gateway for Horizon in Omnissa Tech Zone.

Network and Parent VM Settings to Support Network Port Security

Horizon Edges and Pools for OpenStack on Horizon Cloud require the Enable Port Security setting to be enabled on the network where they are deployed. Perform the following steps to ensure that the OpenStack port_security setting is enabled on applicable networks.

In addition to ensuring that all required URLs and ports are allowed through firewall, see Port and Protocol Requirements for Horizon Cloud on OpenStack Edge.

1. Log in to your Private Cloud Director application and navigate to Networks & Security.

2. Click Network, select the desired network from the list and then click Edit.

3. Select Enable Port Security and click Update Network on the Edit Network page.

UAG VM-related Network Requirements

To support the Unified Access Gateway (UAG), three networks are required in which the portGroup requires static or reserved IPs on the corresponding VLAN. The minimum requirement IP range with 2 consecutive IPs to deploy a pair of UAGs. Specific requirements are listed below:

• For the DMZ network, the portGroup on which the DMZ network interface of the UAG will be attached must be reachable from the network that the end users are connecting from. The Static IP Range minimum requirement is 2 consecutive IPs - for example, 10.202.155.30-10.202.155.39 - is required to support UAG cluster growth to 10.

• For the Management network, the portGroup on which the Management network interface of the UAG is attached is also the portGroup on which the Edge VM will be deployed. The Static IP range minimum requirement is 2 consecutive IPs - for example, 172.20.241.30-172.202.155.39 - is required to support UAG cluster growth to 10.

• For the Desktop network, the portGroup on which the Desktop network interface of the UAG is attached is the portGroup on which the desktop VMs are deployed on. The VMs must be able to reach the Edge VM and the Active Directory infrastructure. The Static IP range minimum requirement is 2 consecutive IPs - for example, 192.168.240.30-192.168.240.39 - is required to support UAG cluster growth to 10.

Note: You can use the Omnissa Edge URL Checker tool to verify the network requirements.

Additionally, a DNS entry must be created for the UAG FQDN that resolves itself to the load balancer VIP for scenarios in which a deployment contains multiple UAGs.

Parent VM Setup for OpenStack Edge

Before you start creating the parent VM, you must download the following additional software from third parties.

• Latest Omnissa HAI agent, which you can download from Omnissa Customer Connect.
  
• Latest stable VirtIO ISO, to be uploaded as and image to Private Cloud Director, as shown in the following steps.
  
• Latest stable cloudbase-init file to be copied to the Windows OS after installation is completed.
  

1. Create a Windows virtual machine (VM) in Platform9 from scratch or by cloning an existing VM.

2. Upload Windows 11 Installation ISO as an image. Run the following command to create an OpenStack Platform9 image resource from the Windows 11 ISO file. This image will be used later to create bootable volumes.

   openstack image create en-us_windows_11_business_editions_version_24h2_updated_sep_2025_x64 --os-interface admin --insecure --disk-format iso --container-format bare --file Windows ISO filepath
   

3. Upload VirtIO Drivers ISO as an Image. Create another image in OpenStack Platform9 from the VirtIO drivers ISO file for Windows.

   openstack image create virtio-win-0.1.285 --os-interface admin --insecure --disk-format iso --container-format bare --file Windows VirtIO drivers ISO filepath
   

4. Create the target volume for Windows installation to allow the VM to boot from this volume upon completion of installation. Create the volume where Windows will be installed.

   openstack volume create --size 40 --bootable WINXI-24H2-PRO
   

5. Create the source boot volume from Windows 11 ISO Image as a bootable volume for Windows 11 installation using the uploaded Windows 11 ISO image.

   openstack volume create --image en-us_windows_11_business_editions_version_24h2_updated_sep_2025_x64 --size 8 --bootable Windows11_24_H2_SEP_2025_Bootable
   

6. Create a volume from the VirtIO ISO image so that it can be attached as a virtual CD-ROM device in the VM.

   openstack volume create --image virtio-win-0.1.285 --size 1 VirtIO-Win-0-1-285
   

7. Set image properties on the target boot volume, not on the Windows installation source. Configure the boot volume with the necessary hardware and firmware settings to support Windows 11 installation.

   openstack volume set --image-property hw_boot_menu=true --image-property hw_firmware_type=uefi --image-property hw_machine_type=q35 --image-property hw_tpm_model=tpm-crb --image-property hw_tpm_version=2.0 --image-property hw_cdrom_bus=sata --image-property hw_disk_bus=scsi --image-property hw_scsi_model=virtio-scsi --image-property os_secure_boot=required --image-property os_type=windows WINXI-24H2-PRO
   

8. Identify the network and obtain the UUID of the network to be used for the Windows 11 VM.

   openstack network list
   

9. Obtain the UUID of all the 3 volumes created in Step 4, 5, and 6.

   openstack volume list
   

10. Create VM volumes by launching the virtual machine with the specific flavors, networks, and block device mappings by using the volumes that you created earlier.

    openstack server create --flavor m1.medium --network 4c0ce099-8930-4bfc-b587-4fb34e4dc568 --block-device source_type=volume,uuid=84b6636e-76fd-4661-91b7-50dd8f6a652f,destination_type=volume,device_type=disk,boot_index=0 --block-device source_type=volume,uuid=7ffadb59-11de-4489-a4e6-636ea5ce3d98,destination_type=volume,device_type=cdrom,boot_index=1 --block-device source_type=volume,uuid=6d12d90e-3cb1-4e81-851b-31dcff157010,destination_type=volume,device_type=cdrom,boot_index=-1 WINXI-24H2-PROe
    

Note: The block device (boot_index=0) is the 40 GB target boot volume for Windows installation created in Step 4 above.

11. Access the VM console used to set up your Windows OS. During the phase when User OOBE, instead of proceeding with Next, press <Shift + Ctrl + F3> (+Fn only for macOS), to enter into audit mode.

12. Install the VirtIO drivers and the Horizon Agent Installer (HAI) agent.

13. Install CloudBase-Init:

• Setup CloudBase-Init (Cloudbase-Init 1.1.6) and any other software necessary. Ensure that the Run Cloudbase-init service as Local System option is checked.

• Once installed, navigate to the install location at C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf.

• Open cloudbase-init.conf and replace the existing content inside the file with the following content:

  [DEFAULT]
  verbose=true
  debug=true
  log_dir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
  log_file=cloudbase-init.log
  default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
  mtu_use_dhcp_config=true
  ntp_use_dhcp_config=true
  local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\
  check_latest_version=false
  metadata_services=cloudbaseinit.metadata.services.httpservice.HttpService
  plugins=cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,cloudbaseinit.plugins.common.userdata.UserDataPlugin
  

14. Prepare a Guest Windows Operating System for Remote Desktop Deployment. You must perform certain tasks to prepare a guest Windows operating system for remote desktop deployment.

15. Prepare Windows Server Operating Systems for Desktop Use (multi-session only). To use a supported Windows Server virtual machine as a single-session virtual desktop (rather than as an RDS host), you must perform certain steps before you install Horizon Agent in the virtual machine. You must also configure Horizon Console to treat Windows servers as supported operating systems for Horizon 8 desktop use.

16. Install Desktop Experience on Windows Server (multi-session only). For published desktops and applications, and for virtual desktops that are deployed on single-user virtual machines that run Windows Server, scanner redirection requires that you install the Desktop Experience feature on the RDS hosts and the single-user virtual machines.

17. Run HorizonOSOT and select the analyze and optimize phases. See Overview of the Windows OS Optimization Tool for Horizon.

18. Run, HorizonOSOT, Generalize Phase, Leave Administrator password blank, select Auto Restart.

    Note: You may need an additional reboot at this time. For example, Sysprep may fail and display warning Reboot Pending. If this happens, reboot to enter audit mode, relaunch OSOT, and continue with the generalize phase.

Possible Issue and Workaround to Issue

If generalization fails to auto reboot, review your C:\Windows\System32\Sysprep\Panther\setup*.txt file. If the file contains the following content, proceed to the workaround steps.

```
BiUpdateEfiEntry failed c000000d
BiExportBcdObjects failed c000000d
BiExportStoreAlterationsToEfi failed c000000d
Failed to export alterations to firmware. Status: c000000d
```

Workaround steps

1. Click Start and enter run tpm.msc. Clear the tpm on the right-side panel, and when prompted to reboot, select ok.

2. Create a new user and add it to the Administrators group, as below:
   a) Launch Windows Explorer, right-click This PC, and then click Show More Options > Manage.
   b) Expand Local Users and Groups > Users, right-click New User and provide the username and passsword. Uncheck User must change password at next logon, select Password Never expires and click Create.
   c) Click Groups > Administrators > Add and enter the username from the above step, click Ok on the popup window, and then click Ok again.
   d) Set the password for the built-in Administrator user.
   

3. Launch OSOT and run the finalization phase.

4. Shut down the VM and detach the installation source and VirtIO driver volumes.

5. Take a VM snapshot.

6. Once the snapshot is created, review the block_device_mapping properties by selecting the snapshot, clicking Edit properties, and verifying that the Delete on termination key is set to True ("delete_on_termination": true).