Deploy Omnissa UAG on VMware vCenter - 夜莺博客

Deploy Omnissa UAG on VMware vCenter

原文:Deploy Omnissa UAG on VMware vCenter — theDXT (Daniel Keer)

Deploying the Omnissa UAG (Unified Access Gateway) on VMware vCenter can be a daunting task if you’ve never done it before.

In this post, I will show you step-by-step how to deploy the Omnissa Horizon UAG on VMware vCenter.

The Process

  • Download the UAG OVA from Omnissa.

Image 1

  • Right-click in VMware vCenter on the cluster or host you want to deploy the UAG to, and click on Deploy OVF Template.

Image 2

  • Select Local file, click Upload Files, select the UAG OVA you downloaded, then click Next.

Image 3

  • Give the VM a name that will be displayed in vCenter, select where you want the UAG VM deployed in your vCenter, and click Next.

Image 4

In my example, I will name it DXT-HO-UAG01 and select the location named Datacenter.

  • Select the cluster or host where you want to run the UAG VM, then click Next.

Image 5

In my example, I will select my G10 cluster.

  • Review the details and click Next.

You may get a certificate not trusted warning message. You can click ignore, or resolve this warning message by following the steps in my blog post, VMware vCenter OVA Certificate Trust.

Image 6
* Select the deployment configuration for your environment and click Next.

Image 7

The most common deployment option is Single NIC.

In my example, I will use a Single NIC deployment.

  • Select the location to store the UAG VM configuration and disk files, then click Next.

Image 8

In my example, I will select the storage as MSA-DS-Cluster.

  • Select the destination networks you want to use for the Internet, Management Network, and Backend Network, then click Next.

Even if you select a single or dual NIC configuration, you still need to choose each destination network.

In a two NIC deployment, the first NIC is for the internet, and the second NIC is for management and backend networks. In a three NIC deployment, the first NIC is for the internet, the second NIC is for the management network, and the third NIC is for the backend network.

Image 9

In my example, I selected a single NIC deployment and set the network to corp-LAN for the Internet, Management Network, and Backend Network.

  • Next, we need to configure the UAG settings.

Image 10

The UAG configuration consists of the following sections

Networking Properties

  • For IPMode for NIC 1 (eth0), select whether to use a static IP or DHCP. The default is DHCP.

Image 11

In my example, I will select STATICV4 as I want to use a static IPv4 address.

  • For Comma separated list of forward rules, enter any needed forward rules.

Image 12

Typically, this is left blank.

  • For NIC 1 (eth0) IPv4 address, enter the IPv4 address if you are using a static IP.

Image 13

In my example, I am using a static IP. I will enter 192.168.172.53.

  • For List of IPv4 custom routes for NIC 1 (eth0), enter any custom routes needed for NIC 1.

Image 14

This is typically left blank.

  • For NIC 1 (eth0) IPv6 address, enter the IPv6 address for NIC 1.

Image 15

In my example, I am only using IPv4. I will leave this blank.

  • For DNS server addresses, enter the addresses for your DNS servers.

If you have more than one, separate them with a space.

Image 16

In my example, I will enter 192.168.172.14 and 192.168.172.15.

  • For DNS Search Domain, enter the local domain you want to use.

Image 17

In my example, I will enter dxt.local.

  • For NIC 1 (eth0) IPv4 netmask, enter the IPv4 subnet mask.

Image 18

In my example, I am using a /24 network. I will enter the subnet mask of 255.255.255.0.

  • For NIC 1 (eth0) IPv6 netmask/prefix, enter the IPv6 netmask or prefix.

Image 19

In my example, I am only using IPv4. I will leave this blank.

  • For NIC 1 (eth0) Custom Configuration, enter any custom configurations as needed.

Image 20

Typically, this is left blank.

  • For IPv4 Default Gateway, enter the IPv4 default gateway.

Image 21

In my example, I will enter 192.168.172.1.

  • for IPv6 Default Gateway, enter the IPv6 default gateway.

Image 22

In my example, I am only using IPv4. I will leave this blank.

  • For Unified Gateway Appliance Name, enter the hostname you would like for the UAG.

Image 23

In my example, I will enter DXT-HO-UAG01.

Join CEIP

  • For Join the Omnissa Customer Experience Improvement Program, select whether you want to join the Omnissa CEIP. The default is yes.

Image 24

Password Options

  • For OS Login Username, enter the console username you would like the UAG to use.

Image 25

In my example, I will enter the username uag_os_admin.

  • For Password for OS login, enter the password you want to use for the OS login username you defined in the previous step.

You can only use the following special characters ! @ # $ % * ( ) _ + for more information about the password requirement, here is the Omnissa documentation.

Image 26

  • For Password Expiration (days), enter the number of days until the OS login password expires. The default is 365 days.

Image 27

In my example, I will leave it as the default of 365 days.

  • For Password minimum length, enter the minimum length you would like the OS password to be. The default is 6.

Image 28

In my example, I will use the default of 6 characters.

  • For Password policy for minimum character classes, enter how many character classes you would like to require. The default is 1. You can set this to 1, 2, 3, or 4. The classes are uppercase, lowercase, digit, and others.

Image 29

The default is saying that the password only requires 1 of the following character classes: uppercase, lowercase, digit, or other. The following passwords would work: password or PASSWORD or 123456789.

If you set it to 2, it means the password must contain 2 of the following character classes: uppercase, lowercase, digit, or other. The following passwords would work: Password or password! or PASSWORD1.

If you set it to 3, it means the password must contain 3 of the following character classes: uppercase, lowercase, digit, or other. The following passwords would work: password1! or PASSWORD1! or Password1.

If you set it to 4, it means the password will require all 4 character classes: uppercase, lowercase, digit, and other. The following passwords would work: Password1! or PASSword1!.

In my example, I will leave this as the default.

  • For Password policy for maximum failed attempts, specify how many incorrect login attempts until an account lock is triggered. The default is 3.

Image 30

In my example, I will leave it as the default.

  • For Password policy for unlock time in seconds on maximum failed attempts, set this to how long you want the account locked for. The default is 900 seconds, which is 15 minutes.

Image 31

In my example, I will leave it as the default.

  • For Session idle timeout for OS user (seconds), enter the number of seconds until an idle session is logged out. The default is 300 seconds, which is 5 minutes.

Image 32

In my example, I will leave it as the default.

  • For Maximum limit for concurrent sudo user logins, enter how many sudo sessions can be active at the same time. The default is 10.

Image 33

In my example, I will leave it as the default.

  • For Password for the admin user, which enables REST API access, this configures the password for the admin account that configures the UAG.

You can only use the following special characters ! @ # $ % * ^ & ( ) for more information about the password requirement, here is the Omnissa documentation.

Image 34

  • For Admin password minimum length, set the minimum password length. The default is 8.

Image 35

In my example, I will leave it as the default.

  • For Admin failed login attempts before lockout, set how many failed logins will trigger a lockout of the admin account. The default is 3.

Image 36

In my example, I will leave it as the default.

  • For Admin password policy for unlock time in minutes on maximum failed attempts, set this to how long until the admin account is unlocked. The default is 5 minutes.

Image 37

In my example, I will leave it as the default.

  • For Admin session idle timeout (minutes), set this to the number of minutes before an idle admin session is logged out. The default is 10 minutes.

Image 38

In my example, I will leave it as the default.

  • For Maximum concurrent sessions for admin console users, enter how many admin sessions can be active on the UAG UI. The default is 5.

Image 39

In my example, I will leave it as the default.

Compliance

  • For Enable DISA STIG compliance, select this if you are required to follow DISA (Defense Information Systems Agency) STIG (Security Technical Implementation Guide) compliance. The default is not selected.

Image 40

In my example, I will leave it not selected.

System Properties

  • For Enable SSH, select whether to enable SSH. The default is disabled.

Image 41

In my example, I will select Enable SSH to enable SSH access to the UAG.

  • For Allow SSH login using password, select whether to use SSH with a password. The default is to allow it.

Image 42

In my example, I will leave this as the default.

  • For Allow SSH login using key pair, select this option to enable SSH login with a key pair. The default is not to allow it.

Image 43

In my example, I will leave this as the default.

  • For Login Shell Banner Text, enter any text you would like as the login banner for SSH or web console logins. The default is blank.

Image 44

In my example, I will leave this blank.

  • For SSH Interface, select which interface you want to enable SSH on. If you leave the option blank, SSH will be enabled on all interfaces.

Image 45

In my example, I am deploying a single NIC configuration. I will leave the option blank.

  • For SSH Port, enter which port you want SSH to run on. If you leave it blank, SSH will be enabled on port 22.

Image 46

In my example, I will leave it blank to enable SSH on port 22.

  • For Enable Advanced Features, enter the advanced features you want to enable. The default is blank.

Image 47

I couldn’t find any documentation on which advanced features can be enabled with this option.

Typically, this is left blank.

  • For Gateway Specification, enter if you want the UAG to run only the required services for Horizon. The default is for the UAG to run all services.

Image 48

Typically, this is left blank.

  • For Commands to Run During First Boot, enter the commands you want the UAG to run during the first boot up.

Image 49

Typically, this is left blank.

  • For Commands to Run During Every Boot, enter the commands you want the UAG to run during each boot up.

Image 50

Typically, this is left blank.

  • For SecureRandom Source, select which source of random you would like to use. The default is /dev/random.

Image 51

In my example, I will leave this as the default.

  • Once you have completed configuring all the options, click Next.

Image 52

  • Review everything you’ve configured and click Finish.

Image 53

If you are following my example, the only changes we made are below. Everything else we left as the default.

IPMode for NIC 1 (eth0) = STATICV4NIC 1 (eth0) IPv4 address: = 192.168.172.53DNS server addresses = 192.168.172.14 192.168.172.15DNS Search Domain = dxt.localNIC 1 (eth0) IPv4 netmask = 255.255.255.0IPv4 Default Gateway = 192.168.172.1Unified Gateway Appliance Name = DXT-HO-UAG01OS Login Username = uag_os_adminEnable SSH = True

  • Wait while vCenter deploys the UAG.

Image 54

  • Once vCenter has completed deploying the UAG, locate the VM in vCenter and Power On the UAG.

Image 55

  • Once the UAG has booted up, you will see a screen that says EUC Unified Access Gateway, with options to Login or set the timezone.

Image 56

  • If we go to the IP address we entered for the UAG and use port 9443, we can access the UAG’s admin web UI.

In my example, I will go to https://192.168.172.53:9443.

Image 57

The username to log in will be admin, and the password will be the one you set for the admin user option during the OVA deployment customization.

That’s all it takes to deploy the Omnissa Unified Access Gateway appliance to VMware vCenter. If you want to read more about deploying the UAG to vCenter, here is the Omnissa documentation.