Using a Local Web Server for a Omnissa Access Offline Upgrade

If you want to perform the offline upgrade to 23.09 using a local web server, prepare the web server to host the upgrade file, configure the existing 22.09.X Omnissa Access appliance to point to the web server, and perform the upgrade.

Prepare a Local Web Server for Offline Upgrade

Before you start the offline upgrade, set up the local web server by creating a directory structure that includes a subdirectory for the Omnissa Access virtual appliance.

Expect some downtime during upgrade and plan the timing of your upgrade accordingly.

Prerequisites

• Perform the general offline-upgrade prerequisites. See Prerequisites for a Omnissa Access Offline Upgrade.
• Download the Omnissa Access offline upgrade package to the Omnissa Access appliance. Download identity-manager-23.09.0.0-buildNumber-updaterepo.zip from the Omnissa Access product download page on the Omnissa Customer Connect page.
• If you use Web Server (IIS), configure the web server to allow special characters to be used in file names. You configure this in the Request Filtering section by selecting the Allow double escaping option.

Procedure

1. Create a directory on the web server at http://YourWebServer/VM/ and copy the downloaded zip file to it.

2. Verify that your web server includes mime types for .sig (text/plain) and .sha256 (text/plain).

   Without these mime types your web server fails to check for updates.

3. Unzip the file.

   The contents of the extracted ZIP file are served by http://YourWebServer/VM/.

   The extracted contents of the file contain the following subdirectories: /manifest and /package-pool.

4. Run the following updatelocal.hzn command to check that the URL has valid update contents.

   /usr/local/horizon/update/updatelocal.hzn checkurl http://YourWebServer/VM
   

Configure the Appliance and Perform Offline Upgrade

Configure the Omnissa Access appliance to point to the local web server to perform an offline upgrade. Then upgrade the appliance.

Prerequisites

Prepare a local web server for offline upgrade. See the preceding section.

• For Omnissa Access 23.09, the Mobile SSO CertProxy configuration page UI was redesigned. If you enabled the VA-Configuration > Mobile SSO > Android SSO cert proxy settings in your environment, during the upgrade, you are asked to update the following CertProxy settings.

  • Number of load balancers. Enter the number of load balancers that are between the CertProxy service and the Omnissa Access instance or enter 0 if a load balancer is not used.

  • Client IP load balancer header name (Remote IP source). This is the source used to obtain the CertProxy instance IP from the HTTP request. The value can be X-forwarded-For header orX-Real-Ip header. If the number of load balancers is 0, Remote IP source is automatically set to Request remote address.

  • The allowlist of CertProxy instance IP addresses to accept authentication requests from. The current IP addresses configuration is pre-populated. You can make changes or click Enter to keep the current configuration. To change the allowlist, enter IP addresses of CertProxy instances separated by a semicolon, either in CIDR format, subnet format delimited by a space, or as a single IP.

    Important: If the number of load balancers is 0 and the CertProxy destination is set to localhost, you must add the localhost IP to the list of IP addresses in the allowlist. This is usually 127.0.0.1.

Procedure

1. Log in to the Omnissa Access appliance as the root user.

2. Run the following command to configure an upgrade repository that uses a local web server.

   /usr/local/horizon/update/updatelocal.hzn seturl http://YourWebServer/VM/
   

   Note: To undo the configuration and restore the ability to perform an online upgrade, you can run the following command.

   /usr/local/horizon/update/updatelocal.hzn setdefault
   

3. Perform the upgrade.

4. Run the following updatemgr.hzn command.

   /usr/local/horizon/update/updatemgr.hzn updateinstaller
   

   1. If the CertProxy service is enabled, the following settings must be updated.

      1. Please provide number of load balancers between CertProxy and Access instance:

         Note: If you do not use a load balancer, enter 0 as the value. When you enter 0, the next CertProxy question does not display.

      2. Please provide client IP load balancer header name (x-forwarded-for/x-real-ip):

      3. Please provide list of CertProxy instance IP addresses, separated by a semicolon, either in CIDR format, subnet format delimited by a space, or as a single IP:

         Important: If the number of load balancers is 0 and the CertProxy destination is set to localhost, you must add the localhost IP to the list of IP addresses in the allowlist. This is usually 127.0.0.1.

   2. Run the following command to update the indices. When you upgrade the nodes in a cluster, in the first node that you upgrade, enter y to reindex the indices. When you upgrade the other nodes in the cluster, enter n. For a single node upgrade, the setting is y by default.

      /usr/local/horizon/update/updatemgr.hzn update
      

      Messages that occur during the upgrade are saved to the update.log file at /opt/<Vendor>/var/log/update.log.

   3. Run the updatemgr.hzn check command again to verify that a newer update does not exist.

      /usr/local/horizon/update/updatemgr.hzn check
      

   4. Restart the virtual appliance.

      reboot

   5. Check the version of the upgraded appliance.

      vamicli version --appliance
      

      The new version is displayed.

   6. After you upgrade all the nodes in your Omnissa Access deployment, use the diagnostics dashboard to monitor system information health.

      1. Log in to the Omnissa Access console.
      2. Select Monitor > Resiliency
      3. If your deployment consists of more than one Omnissa Access appliance, select the appliance you want to monitor.
      4. Check the status of the various services. Review each of the sections. Results

   The upgrade is complete.

   See Post-upgrade Configuration of Omnissa Access.