Month: January 2013

Knowledge

• Identify minimum hardware and software requirements for installation
• Identify required firewall rules
• Identify security server pairing password
• Navigate the View Connection Server installation wizard

Hardware Requirements

Processor Pentium IV 2.0GHz or higher.  Recommended 4 CPU

Networking One or more 10/100Mpbs NIC’s.   Recommended 1Gbps NIC

Memory 4GB RAM.  Recommended 10GB RAM for 50 or more desktops

Operating System – Software Requirements

Windows Server 2008 R2 64 Bit Standard or Enterprise

Windows Server 2003 R2 32 Bit Standard or Enterprise

Note, to use PCoIP Secure Gateway component, the OS must be Windows Server 2008 R2 64 Bit.

Virtualization – Software Requirements

The following version of vSphere are supported:

vSphere 4.0 Update 3 or higher

vSphere 4.1 Update 1 or higher

vSphere 5.0 or higher

Note, both ESX and ESXi hosts are supported.

Firewall Rules

The Security Server acts as a ‘secure gateway’ to the View Connection Server and as such should be placed in a DMZ (a logical zone between the internet and LAN).  As the Security Server is internet facing it will require the following Ports to be opened:

TCP 443 Inbound

PCoIP View Client to Security Server

TCP 4172 View Client to Security Server

UDP 4172 View Client to Security Server

UDP 4172 Security Server to View Client

PCoIP Security Server to Virtual Desktop

TCP 4172 Security Server to Virtual Desktop

UDP 4172 Security Server to Virtual Desktop

UDP 4172 Virtual Desktop to Security Server

Security Server Installation

As with previous posts, it’s a good idea to recap on what the Security Server does.  Essentially, the Security Server bypasses the need for a third party VPN device such as PPTP, L2TP IPSEC.

An SSL connection is made directly to the Security Server.  The link to a View Connection Server is a one to one relationship.  Therefore, if you have two View Connection Servers then you would need two Security Servers.

If you decide that two Security Servers are required then a third party load balancing device will need to be obtained as View doesn’t have this ability natively.

How does it work? Well two SSL tunnels are created, the first to the Security Server when the user authenticates, a secondary SSL tunnel is then created when the user accesses the View Desktop.

As mentioned previously, the Security Server should sit within a DMZ and therefore should not be part of your Active Directory domain.

Taking the above into account, I have created a VM called VMF-SS01 with the following specifications:

1 x vCPU

4 GB RAM

1 x vNIC

We use the same installer as the VMware View Connection Server which can be downloaded from here.  As at the time of this blog post, the most recent version is VMware-viewconnectionserver-x86_64-5.1.2-928164.exe

Launch the installer and click Next

Accept the EULA and click Next

Choose the installation location, in most setups I tend to leave this as the default.

Select View Security Server and click Next

Now we have to pair the Security Server with a View Connection Server.  This relies on DNS, with this in mind, you can choose to do a number of things:

1. Create a host entry for your View Connection Server
2. On the Security Server use a LAN DNS server and open up UDP and TCP Port 53 to the LAN

In my configuration, I’m going to opt for option 2. As it means the Security Server can resolve all my LAN servers, you probably wouldn’t do this in production!

This is where things start to get interesting, we need to enter a ‘pairing password’ on both the Security Server and View Connection Server.  You need to enter the password on the Connection Server first. Jump onto your View Connection Server and go to View Configuration > Servers > Connection Servers > More Commands > Specify Security Server Pairing Password

We now have to enter our one time password to enable authentication between the Security Server and View Connection Server.  A couple of things to note before we do this.

1. Windows Firewall doesn’t need to be turned on, even though it mentions it does.

2. The password is one time only to validate each server.

With this in mind, enter your passwords and hit OK.

Jump back onto the Security Server in my case VMF-SS01 and enter the same password and click Next

Next we need to enter in our external URL, I’m going to roll with view.vmfocus.com and we also need to enter our external IP Address.

Note, the external IP Address has to be static, using DNS with dynamic records such as no-ip.org do not work.

We will allow Security Server to configure the Windows Firewall automatically

We are cooking on gas now! Click Install

Voila all Finished

Now the strange thing is that even though we have installed the Security Server, the PCoIP Gateway is not enabled! This is covered in Objective 2.4.

Knowledge

• Identify minimum hardware and software requirements for installation
• Describe Composer database and connectivity
• Describe Composer service and dependencies
• Navigate View Composer installation wizard

Hardware Requirements

View Composer must be installed on the same server as vCenter which rules out the vCenter Server Appliance.

Operating System Requirements

vCenter 4.0 Update 3 or Higher Windows Server 2008 R2 Standard or Enterprise with no service pack or service pack one.

vCenter 4.1 Update 1 or Higher Windows Server 2008 R2 Standard or Enterprise with no service pack or service pack one.

vCenter 5.0 or Higher Windows Server 2008 R2 Standard or Enterprise with no service pack or service pack one.

Database

View Composer requires a SQL database or Oracle database.  For SQL this can be 2005 or 2008 and for Oracle both 10g or 11g can be used.   Both can be on the same instance as the vCenter database.  The database stores data related to:

• vCenter Server connections
• Active Directory connections
• Linked Clone desktops
• Replicas created by View Composer

Note, that each View Composer service must have it’s own database.

View Composer Installation

Before we install View Composer, it’s probably a good idea to recap what View Composer does.  It’s probably the main reason that makes View so viable, essentially it provides linked clone functionality.  You have a ‘parent VM disk’ which is read only, from this desktops are created using snapshots with very minor differences such as Computer Name and Active Directory GUID.

If we think about this, it gives us some unique advantages which are:

• Storage requirements decrease (not from an IOPS perspective)
• Quick desktop deployment as each linked clone only starts at 32MB in size difference from the parent rather than needing to copy the whole 10 or 20 GB VMDK.
• Easier patch management by updating your ‘golden image/template’ with new patches, then point the parent image at the new snapshot.

The VMware View Composer Server needs to be downloaded from here.  As at the time of this blog post the most recent version is VMware-viewcomposer-3.0.0-691993.exe

For this installation, I’m using SQL 2008 Express, I have created a database called ViewComposer and service.vmware has DBO rights.  If you are unsure on how to do this, I wrote a guide which can be found here under SQL Configuration.

Launch the View Composer installer on your vCenter Server and click Next

Accept the EULA and click Next

Choose the installation location, in most setups I tend to leave this as the default.

Now we need to enter the Data Source Name (DSN) details, click on ODBC DSN Setup

Select System DSN and then Add

Select SQL Server Native Client 10.0 and click Finish

Enter the Name, Description and the SQL Server you want to connect to and hit Next.

TOP TIP: If using SQL Express, go into services.msc and find SQL* and it will tell you the instance name.   In my case it’s VIM_SQLEXP

We are going to roll ‘With Integrated Windows Authentication’, so click Next

Select ‘Change the default database to:’ and choose your View Composer database.

Lastly click on Finish

Give the connection and test and hopefully you get success!

Back to the Database Information screen and enter in all the credentials.  I’m using my service.vmware account for connectivity to the View Composer database.  I strongly suggest you have a service account rather than using an administrator account.

View Composer uses SOAP and uses the Port 18443 for this.  As no SSL Certificates are installed on my vCenter Server, View Composer will create an SSL.  So all we have to do is click Next

Finally, we click Install and watch the magic happen.

All done, click Finish

Dang, we need to reboot vCenter.  In a production environment, this is key, so you may want to advise the client before hand, saving you having to wait around twiddling your thumbs!