Hi,

In my company we are considering VSAN. But our datacenter architecture is particular and I would like to know how can I do the following

Context : our datacenters are like this :

- 1 main datacenter with 2 isolated rooms, LAN latency

- 1 secondary datacenter with 1 room, 5ms latency from the main datacenter

- 1 DR site used as witness site

We plan to deploy for instance 3 ESXi+VSAN in each room, so 9 servers.

We would like the following

- A policy for bronze VM, 0 copy

- A policy for silver VM , 1 copy on the main datacenter

- A policy for gold VM, 1 copy on the secondary datacenter

I'm considering to deploy a stretch cluster on the 3 rooms

So

- the prefered fault domain will be the main datacenter

- the secondary fault domain will be the secondary datacenter

Bronze VM should have PFTT = SFTT = 0

Silver VM should have PFTT = 0 and SFTT = 1

Gold VM should have PFTT = 1 and SFTT = 0
But is there a trick to ask VSAN to store the two copies of silver VM separated on each room of the primary datacenter ?Because SFTT = 1 allow to be sure the VM will survive to a one host failure. But if we loose one room of the main datacenter, the two copies of the silver VM could be in the same room and so unreachable.I think to setup 4 faults domains, but it appears that stretch cluster support only 3 : 2 mains and a witness site.Thank youBest regards

We are looking for confirmation on the cipher suites that can be configured on a UAG. We have TLS 1.0/1.1 disabled so we are only using TLS 1.2. According to Using PowerShell to Deploy VMware Unified Access Gateway and comparing to our UAG 3.0 these are the default cipher suites.

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

The connection server documentation (Default Global Policies for Security Protocols and Cipher Suites) states that the following ciphers are supported.

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA

Our security team is requiring that we disable all AES 128 ciphers and only use elliptical curve (ECDHE) which leaves us with the following.

UAG

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

Connection Server

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

We've also been told that GCM is preferred as it performs better than CBC. So in a perfect world we would only use TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 but it's not one of the listed protocols for the UAG. We've found that it can be configured on the UAG but it can't be the only cipher. So I could do the following on the UAG and Connection servers but I'm unsure if this actually works.

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

Our connection servers are restricted to only use TLS 1.2 and the following cipher suites.

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TL;DR

Will the TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 cipher suite work on a UAG?

Is it possible to only use TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on the UAG and connection server or are a minimum of two needed?

Why do the UAG and Connection Servers support different ciphers?

Just wanted to check if anyone has come across a GPO or setting to disable Turn off custom scaling and Sign off for users. This is a problem with non persistent desktops as it just logs off the user. Thanks

I followed the following guide to setup UEM to allow us to set a default Pinned Start menu Items and taskbar. It works great except on the 3rd logon Edge starts sneaking back into the taskbar. It has something to do with the import of the xml file more then once but I can't find a way to prevent Edge from sneaking back in.

Managing Windows 10 with VMware User Environment Manager

So I have applied the logoff script per this article

Powershell.exe Export-StartLayout -Path C:\Users\$env:USERNAME\AppData\Local\Microsoft\Windows\Shell\LayoutModification.XML

I then modified the Windows Common setting task bar config file to add in the synchronization of the xml file on logon/ logoff

Wanted to see if anyone else is using this and if they found a way to keep edge out of the taskbar. Thanks

#Sync Default Taskbar xml

[IncludeFiles]

<LocalAppData>\Microsoft\Windows\Shell\LayoutModification.XML

# Expanded settings for Windows Common Setting 'Taskbar settings':

[IncludeRegistryTrees]

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband

[IncludeIndividualRegistryValues]

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarSizeMove

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\EnableAutoTray

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2\Settings

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3\Settings

[IncludeFolderTrees]

<AppData>\Microsoft\Internet Explorer\Quick Launch

HI LUC.D,

could you please check the following script.  this is to get all hosts in vcenters which are not responding and then start vpxa service by direcly login to esxi boxes.

1:blue part will get info of esxi hosts which are not responding in all vcenters and disconnect from vcenters.

2:orange will connect to esxi host and restart vpxa agent .

3:can i pass info stored in $esxi_notres(hosts which are not responding) to function connect-esxi?

4:alsowhat is the key for hostd service in get-vmhostservice output.

$vc=@("tcclabc002vctt01.servers.chrysler.com","shccertvcs01.shdc.chrysler.com")

Connect-VIServer -Server $vc -user "administrator@vsphere.local" -password ""

$esxi_notres=get-vmhost|Where-Object{$_.connectionstate -eq "notresponding"}

$esxi_main=get-vmhost|Where-Object{$_.connectionstate -eq "maintenance"}

$esxi_notres.name

disconnect-viserver -server "*" -force -confirm:$false

$global:defaultviserver

function connect-esxi

{

[cmdletbinding()]

param(

[parameter(mandatory=$true)]

[string[]]$esxihost

)

connect-viserver -server $esxihost -username "root" -password ""

get-vmhost $esxihost|Get-VMHostService|where-object{$_.key -eq "vpxa"}|start-VMHostService

}

Thanks for your suport.

I am trying to convert 2nd vCenter to External PSC so I can setup cross vCenter NSX and I am getting this "certificate verify failed". I installed certificate on my computer so now it is showing secure connection when I login to browser however I am still not able to run this command in vcenter CLI.

Both environments are vSphere 6.5 U1

root@Test-VC [ ~ ]# cmsso-util reconfigure --repoint-psc psc-01.example.com --username Administrator --domain-name example.com --passwd "example"

Validating Provided Configuration ...

Falied to open connection https://psc01.example.com:443/websso/ Error: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)>

Please check the configuration and retry

Hi,

    this week we started upgrading our ESXi hosts from 6.5 to 6.5 update 1, using update manager.

For many years we made the ESXi hosts configuration backup using the vSphere CLI, by the vicfg-cfgbackup command, but after the 6.5 release we have same

errors that seems related to nonpresent Perl libraries.

So we started backupping ESXi configuration using the following PowerCLI command:

Get-VMHostFirmware -VMHost ESXi_host_IP_address -BackupConfiguration -DestinationPath output_directory

Now, after upgrading the first 4 host to ESXi 6.5 update 1, this backup no works anymore.

We obtain the following error:

PowerCLI C:\> Get-VMHostFirmware -VMHost srvesx013.xxxxxx -BackupConfiguration -DestinationPath C:\BCK

Get-VMHostFirmware : 23/08/2017 15:41:05        Get-VMHostFirmware              A general system error occurred: Internal error

At line:1 char:1

+ Get-VMHostFirmware -VMHost srvesx013.xxxxxx -BackupConfigura ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [Get-VMHostFirmware], SystemError

    + FullyQualifiedErrorId : Client20_SystemManagementServiceImpl_BackupVmHostFirmware_ViError,VMware.VimAutomation.V

   iCore.Cmdlets.Commands.Host.GetVMHostFirmware

While for an host that is still at 6.5 release, the command works well, as usual:

PowerCLI C:\> Get-VMHostFirmware -VMHost srvesx012.xxxxxxx -BackupConfiguration -DestinationPath C:\BCK

Host            Data

----            ----

srvesx012... C:\BCK\configBundle-srvesx012.xxxxxxx.tgz

Any hints?

For a small percentage of our virtual machines we have a requirement for two vNICs. I am trying to avoid creating a second blue print with two vNICs or putting two vNICs in our base blueprint. Our environment is vCAC 6.0.1.1 + vCO 5.5.1.1617127. My preference is for a vCAC/vCO solution. Yes, I do realize this can be done in PowerCLI -- I was just trying to keep the number of moving parts to a minimum.

Thanks.

Good afternoon,

I've noticed that there's a a pretty good delay with logins and the delay is with UEM. It seems to point to the roaming of the registry. Currently I'm roaming the following directories below. I'm working on pealing back the software directory, but the largest one is the Microsoft folder. Just out of curiosity, how are people handling that? Do people not leverage this that much, or focus strictly on the application data?

[IncludeRegistryTrees]

HKCU\Network

HKCU\Software

HKCU\System

HKCU\Printers

HKCU\Volatile Environment

HKCU\Control Panel

2017-09-20 12:41:22.895 [DEBUG] ImportRegistry::Import: Calling '"C:\Windows\REGEDIT.EXE" /S "C:\Users\mchabot\AppData\Local\Temp\FLX9BFB.tmp"' (RPAL: l=0 (D/E), r=0)

2017-09-20 12:41:30.000 [DEBUG] Read 2504 entries from profile archive (size: 424784542; compressed: 21477926)

Any advice would be fantastic.

Thanks!

Mike

I was attempting to evaluate Horizon View for use in a lab environment and was installing many of our most commonly used apps in a test environment.  In addition to the default Horizon modules I included USB, serial and scanner redirection for use in conjunction with Windows Embedded thin clients.  However when I loaded up a PCOIP session and launched Maple it would stop at the splash screen.  Testing different components installed by Horizon View revealed that the scanner redirection module conflicted with Maple 2017.  The environment is running vSphere 6.0 U3 and Horizon View 7.0.2.

Is there any precaution to make for this security warnings for VMware  product ?

Upgrade ?

Hello:

We are currently on Horizon 7 with Windows 10.  We have noticed that Internet Explorer can be painfully slow, especially on websites that are bloated with ads..  When flipping over to Chrome or Firefox, it's super quick and responsive, the difference isn't even close.  We are running Internet Explorer directly off of the image, meaning that it's installed in Windows 10 directly on the golden master image, nothing fancy there.  We are using AppVol for user's Writable Volumes though, but so far it doesn't seem to be causing this particular issue that I can tell.

When I do side by side tests of IE between a physical and VDI session, the VDI session seems slightly slower.  Our VMs have 8 GB of RAM, and the disposable disk is nowhere near capacity.  VMs have 70 MB of video memory when I checked.  Our storage is on a flash array.  As I mentioned all other apps run fine, the problem is only IE.

My question is, is there anything that we can do to speed up IE?  We have enabled the setting "Use software rendering instead of GPU rendering" in the browser which in our tests did not make any difference.  Are there any recommendations or optimizations for using IE with AppVol that we should look at, just to be safe?  I have looked around and so far nothing conclusive.  Even a "best practices" or optimization steps for using web browsers in VDI would be helpful if there is something.

Thank you for your help!

We have two hosts (6.5 U1) with a quad port NICs that are partitioned to 8 virtual NICS, so for example vmnic0 is the same physical port as vmnic4, vmnic1 is the same as vmnic5, etc. We have a DVS with a port group on our main VLAN (say 200) on vmnic0 and a standard switch also on VLAN 200 on vmnic4 (so same physical port to the switch) on both hosts. I've noticed the following scenario:

VM1 (standard switch) & VM2 (DVS) are on host 1, VM3 (standard switch) & VM4 (DVS) are on host 2

VM1 -> VM2 can't communicate (NOT OK)

VM1 -> VM3 can communicate (OK)

VM1 -> VM4 OK

VM2 -> VM1 NOT OK

VM2 -> VM3 OK

VM2 -> VM4 OK

VM3 -> VM1 OK

VM3 -> VM2 OK

VM3 -> VM4 NOT OK

...

So, VMs on the same host can't communicate between the DVS and standard switch even though they are on the same VLAN & underlying switching hardware. VMs can communicate between hosts no matter whether or not either is on DVS or standard switch. Is this expected behavior? It doesn't make sense to me

Ok, so occasionally my VM connections using Bridged connection stop working and I've been reading posts that show the issue to be related to multiple networks and VMNet0 picking the wrong network adapter.  The fix for this is to use the VMNetCfg to "force" the selection of the correct network adapter for VMNet0. 

From what I've been able to read since the VMNetCfg does not come with Workstation Player 12.5 I have to:

• uninstall current Player,
• download and install Pro 12.5
• copy WMNetCfg.exe from the install folder
• uninstall Pro 12.5
• reinstall Player.

Can anybody tell me if this is the only way or if there is a better way to get the WMNetCfg.

Thanks

David

Received an error when using the DELETE /api/auth/usergroups/{id} to remove an AD group. Granted, it states it is for 'local' group deletion. So, I attempted to pass in the parameter:

https://<vrops-server>/suite-api/api/auth/usergroups/<ad-group-id>?sourceId=<ad_auth_source_id>

and even tried to send in the json body

{

  "sourceId": "800b9f52-e218-4e8a-807d-baaf99e2de95"

}

which also yielded the same result (Canoot remove userGroup).

I thought I might use PUT /api/auth/usergroups

to modify the group by setting the auth source to null so it could then be deleted, but the documentation is very light, and sending either name or id does not allow group modification:

{

  "id": "<group-id>",

  "sourceId": null

}

returns:

{

"message": "Invalid request... #1 violations found.",

"validationFailures": [

"httpStatusCode": 400,

"apiErrorCode": 400

}

Updating the original call with 'name' returns:

{

"message": ""UserGroup" with identifier "CN=AD_Openstack,OU=Rialto,OU=Application Managed,OU=Groups,DC=amr,DC=corp,DC=intel,DC=com" already exists.",

"httpStatusCode": 422,

"apiErrorCode": 1508

}

So it seems I am at an impasse. Assistance would be appreciated.

By Mark Benson, Senior Architect and Senior Staff Engineer, End-User-Computing CTO Office, VMware

• Introduction
• What are the requirements for deploying UAG appliances using this script?
• How do I run the script?
• Configuration Settings
• Standard SSL, TLS and Cipher Settings
• Managing SSL Server Certificate Files

Introduction

Updated May 2017 for version 3.0

From version 2.9 the appliance is is now called Unified Access Gateway (UAG) instead of the old name of Access Point. It's the same, just a different name.

In September 2015, I posted A Technical Introduction to Access Point for Secure Remote Access article. Unified Access Gateway (UAG), formerly known as Access Point, is a VMware virtual appliance which is used with VMware Horizon (View) and Horizon Air (DaaS). In that article I mentioned the ability to perform a scripted deployment of an Access Point virtual appliance using VMware OVF Tool in order to perform a repeatable deployment where all settings can be applied in a way that allows UAG to be production ready on first boot. This procedure is described in the document Deploying and Configuring Access Point.

Whilst it is great to be able to specify all configuration settings in one go at deployment time, the downside of this is that the OVF Tool command line can become very long and complex. It is also easy to introduce errors on the command line as the command syntax for OVF Tool used in this way can be difficult to get right. Also, it is not possible to validate the settings with OVF Tool and it is therefore very easy to make configuration errors such as setting an admin REST API password that doesn't meet the required complexity rules.

Many Windows administrators managing a VMware Horizon environment need a much simpler way to deploy UAG in a secure, reliable and repeatable way and to have complete control over the settings. For these reasons, we have developed a sample PowerShell script that can be used to deploy Access Point and which overcomes the main difficulties of using OVF Tool directly on the command line. As this PowerShell script is delivered as a sample script, you can also adapt it as required for your specific needs although in most cases you won't need to modify it at all. The script calls the OVF Tool command but validates the settings and automatically constructs the correct command line syntax. The settings are taken from a simple .INI file. This script runs OVF Tool in a fully supported way for Access Point according the procedure in the document Deploying and Configuring Access Point . Note that no password values or private key values are stored within the .INI configuration files.

The PowerShell script sets all configuration settings for OVF Tool at deployment time. This includes setting up the CA issued SSL Server certificate and all other possible settings. After UAG has been deployed by this script, there is no need to make configuration changes after deployment. UAG will be ready for production use on first boot.

What are the requirements for deploying UAG appliances using this script?

1. For Access Point itself, a vSphere ESX host with a vCenter Server is needed. Decide on the vSphere datastore to be used and the Network name to be used. A vSphere Network Protocol Profile must be associated with every referenced network name. This Network Protocol Profile specifies network settings such as IPv4 subnet mask, gateway etc. The deployment of Access Point uses these values so make sure the values are correct.
2. The PowerShell script runs on a machine running Windows 8.1 (or newer) or Windows Server 2008 R2 (or newer). This can be the vCenter Server itself if it is running on Windows, or can be a separate Windows machine.
3. The Windows machine running the script must also have the VMware OVF Tool command installed. Install OVF Tool 4.2.0 or newer. You can download it from here OVF Tool Software and Documentation.

How do I run the script?

• Download a version of UAG virtual appliance image from VMware onto your Windows machine. This is an OVA file. e.g. euc-access-point-2.9.0.0-5178136_OVF10.ova. Refer to VMware Product Interoperability Matrixes to determine the version to download.
• Download the correct uagdeploy or apdeploy ZIP file attached below and extract the files into a folder on your Windows machine.
• On your Windows machine, open a PowerShell console and change directory to the location of your script.
• Create a .INI configuration file for your UAG virtual appliance. In this example, I am going deploy a new Access Point appliance called UAG1. I have created a .INI file called uag1.ini which contains all the configuration settings for UAG1. You can use the sample .INI files contained within the uagdeploy ZIP file to create your .INI file and then modify the settings to the values you want.
• Make sure script execution is unrestricted for the current user. You can do this by running the command:
  set-executionpolicy -scope currentuser unrestricted
• You only need to run this once and only if it is currently restricted.
  If you get a warning about running this script, you can unblock that warning by running the command:
  unblock-file -path .\uagdeploy.ps1
  or
  unblock-file -path .\apdeploy.ps1
• Run the command .\uagdeploy.ps1 -iniFile uag1.ini as shown in the screenshot below. If you don't specify the -iniFile option, the script will default to ap.ini. You will be prompted to set a root password for the appliance and an optional password for the admin REST API. You will also be prompted for the vCenter password. Deployment takes around a minute depending on your host and storage performance. If you are prompted to add the fingerprint for the target machine, enter yes.

• When the script completes, the UAG appliance is ready to use. No further configuration steps are required.

.INI File Contents

The uagdeploy ZIPfile attached at the bottom of this post contains four example .INI files. uag1-basic.ini is a minimal .INI file which just contains the minimum settings needed. uag2-advanced.ini is a more complex configuration file showing additional settings available. uag3-securid.ini is an example of a configuration including RSA SecurID authentication. uag4-radius.ini is an example of a configuration including RADIUS authentication. You should start with just a basic .INI file to ensure that this deployment method works in your environment. You can then add more advanced settings in your .INI file and repeat the deployment. If you have already deployed the named UAG appliance, then running the script again will power off the appliance, delete it, and will redeploy it with the current .INI settings. This is a useful capability to use when either upgrading the appliance to a newer version, or just to change any of the settings.

Basic .INI File Example

##############################################

[General]

name=UAG1

source=C:\APs\euc-unified-access-gateway-3.0.0.0-5562999_OVF10.ova

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/esx1.myco.int

ds=Local Disk 1

netInternet=VM Network

netManagementNetwork=VM Network

netBackendNetwork=VM Network

honorCipherOrder=true

[Horizon]

proxyDestinationUrl=https://192.168.0.209

##############################################

The following table describes each configuration setting. These must be arranged in the .INI file under the appropriate Group Name shown in the first column and as shown in the sample .INI files.

Configuring UAG as a Web Reverse Proxy for VMware Identified Manager

UAG (or Access Point) 2.6 and newer can be used as a Web Reverse Proxy in front of VMware Identity Manager version 2.6 (and newer). Make sure you use a 2.6 (or newer) version of UAG or Access Point e.g.

source=euc-unified-access-gateway-3.0.0.0-5562999_OVF10.ova

For exact up to date information on UAG and Access Point compatibility, refer to the VMware Product Interoperability Matrixes.

For this setup, remove the entire [Horizon] section from the .ini file and replace it with a new [WebReverseProxy] section. Use the values shown in the sample uag10-vidm.ini file in uagdeploy ZIP file below. Set the proxyDestinationUrl to the URL of the Identity Manager server. If that service does not use a trusted CA signed SSL server certificate then you will also need to add the proxyDestinationUrlThumbprints value. Leave all other values in [WebReverseProxy] exactly as shown in the sample uag10-vidm.ini.

The setup requires "split DNS" to be setup where the URL hostname for an external user resolved to the address of UAG, and the same URL hostname for an internal user resolves to the address of the Identity Manager server.

Configuration Settings

Standard SSL, TLS and Cipher Settings

UAG is deployed with the following settings:

• SSL 2.0 disabled
• SSL 3.0 disabled
• TLS 1.0 disabled
• TLS 1.2 enabled
• TLS 1.2 enabled

• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA

Managing SSL Server Certificate Files

Deploying a trusted certificate authority (CA) signed SSL server certificate on UAG gives users the assurance that they are connecting to a trusted environment. It also significantly reduces the security risk of a so called man-in-the-middle attack between the user and the service.

If you don't specify a certificate in the [SSLCert] section of the .ini file, UAG will generate a self-signed SSL server certificate. This will work, and can be useful for initial testing, but a self-signed certificate will not be trusted by Horizon  and other clients and therefore users will receive a warning when connecting via UAG.

For production environments, it is best to obtain an SSL server certificate from a trusted CA for use on each UAG appliance.

If you have the PEM format files for the SSL server certificate (including any intermediate CA certificates and root CA certificate) you can reference the files in the pemCerts and pemPrivKey values as described later in this section.

From UAG version 3.0, the deployment of the SSL server certificate became much simpler for customers who have their trusted CA certificate and private key in PKCS#12 (.p12 or .pfx) format. From UAG version 3.0, it is no longer necessary to convert the .p12 or .pfx file to PEM format using openssl commands as described below. Instead, you can now just reference the .p12 or .pfx file directly from within the .ini file. In the .INI file, add the following lines.

[SSLCert]

pfxCerts=mycaservercert.pfx

When the script is run, these certificates and private key will be automatically deployed to the new UAG appliance. The referenced pfxCerts file should contain the SSL server certificate with private key, and any intermediate certificates required. During deployment you enter the password associated with the .p12/.pfx file.

If there are multiple certificates with private key, then you can specify which one to use with the pfxCertAlias keyword.

If you have a certificate file with private key and certificate trust chain all in one PKCS#12 format file with either a .p12 or .pfx file extension, then with UAG 3.0 and newer you can use it use it directly without conversion as described above. For UAG and Access Point versions below 3.0 you must convert the PKCS#12 format file into the two PEM format files. PEM format is still supported for UAG 3.0 and newer and can still be needed if you have PEM format files. You can convert from PKCS#12 to the two PEM files with openssl (which you can download from Shining Light Productions - Win32 OpenSSL) by running the following example openssl commands which start with a PKCS#12 file called mycaservercert.pfx.

openssl pkcs12 -in mycaservercert.pfx -nokeys -out mycaservercert.pem

openssl pkcs12 -in mycaservercert.pfx -nodes -nocerts -out mycaservercertkey.pem

openssl rsa -in mycaservercertkey.pem -check -out mycaservercertkeyrsa.pem

Edit mycaservercert.pem and remove any unnecessary certificate entries. It should contain the one SSL server certificate followed by any necessary intermediate CA certificates and root CA certificate.

In the .INI file, add the following lines.

[SSLCert]

pemCerts=mycaservercert.pem

pemPrivKey=mycaservercertkeyrsa.pem

When the script is run, these certificates and private key will be automatically deployed to the new UAG appliance. The private key PEM file should be deleted from the Windows machine once UAG has been deployed.

If you find that the deployment of UAG works when you don't specify the PEM files (i.e. for UAG to use a self-signed SSL server certificate) but fails when you supply your own certificate as described above, then follow these steps. It could be caused by a missing intermediate or root certificate in your specified PEM file.

• Log into the console of UAG as user root and enter the root password you chose when you ran the uagdeploy.ps1 script.
• Using an editor such as vi, look at the log file /opt/vmware/gateway/logs/admin.log
• If you see entries saying "Unable to build the certification path" and "No issuer certificate for certificate in certification path found" it means that you having missing intermediate or root certificate entries in the PEM or .p12/.pfx file specified for.

• To correct this, you must make sure that any required intermediate certificates and/or root certificate are present in the PEM file and then re-run the uagdeploy.ps1 script.

Troubleshooting Deployment Problems

1. I get a security warning about running scripts downloaded from the Internet

Verify that the PowerShell script is the script you intend to run, and then from the PowerShell console, run the command:

unblock-file .\uagdeploy.ps1

2. I get an error saying "ovftool command not found".

Make sure you have installed the OVF Tool software on your Windows machine and that it is installed in the location expected by the script. OVF Tool Download.

3. I get an error saying "Invalid Network in property netmask0" or "Cannot initialize property 'netmask0'. Network 'VM Network' has no associated network protocol profile"

The message may state netmask0, netmask1 or netmask2, Check that a value has been set in the .INI file for each of the three networks (netInternet, netManagementNetwork and netBackendNetwork),Also check that a vSphere Network Protocol Profile has been associated with every referenced network name. This specifies network settings such as IPv4 subnet mask, gateway etc. so make sure the associated Network Protocol Profile has correct values for each of the settings.

4. I get a warning message about the operating system identifier being not supported (id: 85)

The full message is: The specified operating system identifier 'SUSE Linux Enterprise Server 12.0 64bit' (id:85) is not supported on the selected host. It will be mapped to the following OS identifier: 'Other Linux (64-bit)'.

This can be ignored. It is mapped to a supported operating system automatically.

5. How do I configure UAG for RSA SecurID authentication?

Add the following two lines to the [Horizon] section of your .ini file:

authMethods=securid-auth && sp-auth

matchWindowsUserName=true

Add a new section at the bottom of your .ini file containing:

[SecurIDAuth]

serverConfigFile=C:\temp\sdconf.rec

externalHostName=192.168.0.90

internalHostName=192.168.0.90

The IP addresses should both be set to the IP address of UAG. The sdconf.rec file is obtained from RSA Authentication Manager (RSA-AM) which should be fully configured according to RSA documentation.

Make sure you are using UAG 2.5 or newer and that the RSA-AM server is accessible on the network from UAG.

If there is a firewall between UAG and your RSA Authentication Manager server, make sure it isn't blocking the communication. This is normally UDP 5500 from UAG to RSA-AM and the reply traffic.

Rerun uagdeploy PowerShell command to redeploy your UAG configured for RSA SecurID. Refer to VMware UAG RSA SecurID Authentication Setup Video for a full step-by-step description of this setup. Also Refer to the RSA Ready Certification Document for VMware UAG.

Note that when RSA SecurID is configured in the .INI file, then after deployment when UAG first starts up, it performs a check against RSA-AM. If RSA-AM is not available, or if DNS cannot resolve the hostname of RSA-AM referenced in the sdconf.rec file, or if a firewall is blocking the UDP port for this communication, this startup will fail. When this initial handshake fails, the RSA SecurID component on UAG remains disabled. You can open up the sdconf.rec file with a text editor and although it is a binary file, you can see the RSA-AM hostname(s). If you suspect a communication failure, you can log in to the console of UAG as root and run nslookup with that hostname to verify that it can be resolved. Once you have resolved any environment issues, just rerun the PowerShell command to redeploy UAG.

If you need to redeploy UAG with the PowerShell command when it was previously configured for RSA SecurID, then you must first "clear node secret" on RSA-AM so that trust can be re-established.

6. How do I configure UAG for RADIUS authentication?

Add the following two lines to the [Horizon] section of your .ini file:

authMethods=radius-auth && sp-auth

matchWindowsUserName=true

Add a new section at the bottom of your .ini file containing:

[RADIUSAuth]

hostName=192.168.0.100

authType=PAP

authPort=1812

radiusDisplayHint=XXX Token

For more information on these and other settings, refer to the sample uag4-radius.ini file in the latest uagdeploy ZIP file below. Also refer to the [RADIUSAuth] descriptions in the table above.

Make sure you are using UAG 2.5 or newer and that the RADIUS server is accessible on the network from UAG.

If there is a firewall between UAG and your RADIUS server, make sure it isn't blocking the communication. This is normally UDP 1812 from UAG to to the RADIUS server and the reply traffic.

Rerun uagdeploy PowerShell command to redeploy your UAG configured for RADIUS.

Note that when RADIUS is configured in the .INI file, then after deployment when UAG first starts up, it performs a check against the configured RADIUS server. If the server is not available or if a firewall is blocking communication, this startup will fail.

7. How do I configure UAG for Client Device certificate authentication?

Add the following line to the [Horizon] section of your .ini file:

authMethods=certificate-auth && sp-auth

Add a new section at the bottom of your .ini file containing:

[CertificateAuth]

pemCerts=C:\Users\Administrator\Documents\SSL\CA Certs\north-ca-256.cer

The .cer file is the public certificate authority (CA) certificate that was used to issue required client device certificates.

A client device certificate must be installed in the user or computer certificate store on the system where the Windows Horizon Client is installed. This proves the identity of the client computer. Unless the client supplies a valid certificate issued by this CA, then UAG will reject the connection with an error as shown below.

Client devices that do supply a valid certificate will get the normal user authentication prompt.

This feature is typically used to ensure that only Windows domain joined client computers can connect to desktops and applications via UAG. The client device certificates can be managed automatically as part of a Windows client machine enrolment policy.

For the Cryptographic Service Provider (CSP) specified in the certificate issuing template, use the "Microsoft Enhanced RSA and AES Cryptographic Provider". This supports SHA256 certificates and TLS 1.2. SHA1 is generally now considered too weak for authentication purposes so you should use SHA256.

For Windows to be able to use the certificate for client authentication purposes, the user on the client computer must have read access to the certificate private key. It is not necessary or desirable to make the private key exportable.

8. I get an error saying "Locator does not refer to an object"

This means that the target= value (used by vSphere OVF Tool) is not correct for your vCenter environment. Refer to the table above for examples of the target format used to refer to a vCenter host or cluster. If you are not sure of the names to use, you can start with the top level object, e.g. by specifying:

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/

This will then show a list of possible names to use at the next level. You can then expand it, one level at a time based on this list.

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/Cluster1/

or

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/esxhost1

Note that folder names, host names and cluster names used in the target value are case sensitive.

9. I get an error saying "Transfer failed and Error: failed to send http data"

This will happen if your target entry references an ESXi hostname that cannot be resolved by your local computer.

This will also happen if you are using a version of vSphere OVF Tool that is not compatible with the version of vSphere and vCenter you are using. I have seen this error after upgrading vSphere to version 6.5 where I was using an older 4.1.0 version of OVF Tool which is not compatible. In this case, the solution was to upgrade to OVF Tool version 4.2.0 or newer - see OVF Tool Software and Documentation.

For any questions on UAG, post a message on the discussion section of the Horizon community forum.

Good morning

I'm using the vCenter 6.5, I need to create scheduled tasks, but I can not find the menu.

Tanks

Using vSphere 6.5, ESXi 6.5 connected to VMFS 5, VMFS 6, and NFS datastores. I have a user that i've given the Administrator role to directly to some datastores, and for some reason I can't upload anything to any of those datastores (ISOs, etc). Trying in the Fling says "r.fileTransferEndpoints is null" in the UI, and not showing any error or attempt in the log. Trying the same in the built in Flash client doesn't give an error at all but doesn't succeed, and using the built in HTML5 client I get an Unauthorized error. Here is the log entry for that from my VCSA when trying the built in HTML5 client: 70081905 103150 200334 com.vmware.vise.vim.http.transport.FileUploadRequestHandler HTTP connection to url: https://vcsa:443/folder/New%20Text%20Document.txt?dcPath=Datacenter&dsName=Test-Datastore failed with status code: 401 and response message: Unauthorized 

I do have full connectivity between the browser machine and VC, PSC, Appliance, and Hosts. Here is the interesting part: While this user has the Administrator role on this datastore directly and is having issues - my main admin user who is part of the vsphere.local\Administrators group, which has the Administrator role by default on all datastores, has no issues from the same browser machine. Also, the user is able to delete files, create folders, etc just no upload. If I take the user off and instead put their (or even the domain Users) group directly on the datastore, I can't see the datastore at all in the datastores view of the client. Alternatively, if I take the user out of their group and put them in the same group as my main user and log out and back in the web client the view doesn't change (I should be seeing every object in my inventory at this point) and I still can't upload files to any of the datastores they do have access.

Any ideas what could be the issue, or where I should look to dig further? I would think having Administrator role on the datastore would work fine, but obviously there's something else going on somewhere. Perhaps some kind of permissions caching?

This document is a detail page for the VMware vExpert Directory.

Expert Information

View all vExpert entries

Hello,

i´ve got some questions about esxi 6.0 (and 6.5) (all standalone hosts) regarding lag and mangementkernel

1) Today I wanted to create a static LAG between a cisco sg300-10 and a esxi 6.0 host with 4 nics, set the cisco to l2/3 algorithm and the vmware switch to route based on IP hash, shutdown esxi powered on the switch and restarted esxi, waited a few minutes, for esxi to come up again, but i could neither ping the esxi management IP nor one of the VMs.

The thing i can´t wrap my head around is: i´ve got the same thing running in the company I work for, works like a charm...

As i could´nt get it to work and the maintenance window at the customerside came to an end, I decided to just remove the LAG from the switches (esxi and cisco), set the 4 ports on the switch to 1Untagged and 100Tagged (Management-Network), works just fine.

2) Would it be better to create a LAG with LACP?

afaik every esxi after 5.1 supports lacp?

4) Would there be a better way to go about getting higher bandwith and at the same time redundancy?

I wanted to do it via static-LAG as it seemed to be the easiest way (and I´ve already got it work once....)

Fibre nor 10gbit are options.

From a colleague I´ve been told im a fool for even trying that, am I really such an Idiot for trying that?