VDI for me. Part 4

Picking up where we left off in VDI for me. Part 3, we are at a point in which the components of View can be installed and configured. As much as I’d like to walk you through each step, and offer explanations at each point, sticking to abbreviated steps is a better way to help you understand how the pieces of the puzzle fit together. Besides, others have great posts on installing and configuring the View Connection servers, not to mention the VMware documentation, which is quite good. The links at the end of the post will give you a good start. My focus will be to hit on the main areas to configure to get View up and running.

Here is the relationship between the Connection Servers, the clients, and the systems running the agents in my environment. The overall topology for my View environment can be found in VDI for me. Part 2.

For clients accessing View from the Internal LAN

For clients accessing View from offsite locations

Overview of steps
This is the order I used for deploying the View Components. To simplify, you may wish to skip steps 3 and 4 until you get everything working on the inside of your network.

Install Composer on your vCenter Server.
Build a VM and install View Connection Server intended for local LAN access only.
Build a VM and install View Connection Server intended to talk with Security Server.
Build a VM and install View Security Server in your DMZ.
Install View Agent on a VM.
Create a Pool for the VM, and entitle the pool to an user or group in AD.
Connect to the VM using the View Client.

Configuring your first Connection Server (For Internal Access)
From the point that your first connection manager is installed, you may begin the configuration.

Browse out to VMware View Administrator portal on your connection server (https://[yourconnectionserver]/admin) and enter the appropriate credentials.
Drill down into View Configuration > Product Licensing and Usage > Edit License to add your license information.
Register your vCenter Server by going to View Configuration > Servers > Add. Fill out all of the details, but do not click “Enable View Composer” quite yet. Click OK to exit.
Go back into Edit the vCenter server configuration, and click “Enable View Composer” and Click OK to exit.
In the area where the listing of View Connection servers are listed, select the only View Connection Server on the list, and click “Edit”. You will want to make sure both check boxes are unchecked, and use internal FQDN and IP addresses only.

Configuring your Second Connection Server (to be paired with Security Server)
During the installation of View on the second server, it will ask what type of Connection Server it will be. Choose “Replica” from the list, and type in the name of your first Connection Server.

Browse out to the View Administrator Portal, and you will now see a second connection server listed. Highlight it, and click on Edit.
Unlike the first connection server, this connection server needs to have both checkboxes checked.

Configuring your Security Server (to be paired with your second Connection Server)
Just a few easy steps will take care of your Security Server.

Browse out to the View Administrator portal, highlight the Connection Server you want to pair with the security server, and click More Commands > Specify Security Server Pairing Password.
Install the Connection Server install bits onto your new Security Server. Choose “Security Server” for the type of Connection Server it will be. It will then prompt you to enter the internal Connection Server to pair it to. This is the internal FQDN of the server Connection Server.
Enter the View pairing password established in step 1. This will make the Security Server show up in the View Administrator Portal.
Go back to the View Administrator portal, highlight the server that is listed under the Security Server, and click Edit. This is where you will enter in the FQDN desired. The PCoIP address should be the publicly registered IP address. In my case, it is the address bound to the external interface of my firewall, but your topology might dictate otherwise.

After it is all done, in the View Administrator portal, you should see one entry for a vCenter server, two entries for the View Connection servers, and one entry for a Security Server.

From this point, it is just a matter of installing the View Agent on the VMs (or physical workstation with a PCoIP host card) you’d like to expose, create a pool, entitle a user or group, and you should be ready to connect.

Tuning
After you add the VMware View adm templates to Active Directory, a number of tunable settings will be available to you. The good news in the tuning department is that while PCoIP is highly tunable, I don’t feel it has to be the first thing you need to address after the initial deployment. With View 5, it works quite well out of the box. I will defer to this post http://myvirtualcloud.net/?p=2061 on some common, View specific GPO settings you might want to adjust, especially in a WAN environment. The two settings that will probably make the biggest impact are the “Maximum Frame Rate” settings, and the “Build to Lossless” toggle. I applied these and a few others in order to accommodate our Development Team working on another continent deal with their 280+ms latency.

The tools available to monitor, test, and debug PCoIP are improving almost by the day, and will be an interesting area to watch. Take a look at the links for the PCoIP Log Viewer and the PCoIP Configuration utilities at the end of this post.

Tips and Observations
When running View, there is a noticeable increase on the dependence of vCenter, and the databases that support it and View Composer. This is especially the case in smaller environments where the server running vCenter might be housing the vCenter database, and the database for View Composer. Chris Wahl’s recent post Protecting the vCenter Database with SQL Log Shipping addresses this, and provides a good way to protect the vCenter databases through log shipping. If you are a Dell EqualLogic user, it may be helpful to move your SQL DB and Log volumes off to guest attached volumes, and use their ASM/ME application to easily make snaps and replicas of the database. Regardless of the adjustments that you choose to make, factor this in to your design criteria, especially if the desktops served up by View become critical to your business.

If your connection to a View VM terminates prematurely, don’t worry. It seems to be a common occurrence during initial deployment that can happen for a number of reasons. There are a lot of KB articles on how to diagnose them. One that I ran across that wasn’t documented very much was that the VM may not have enough memory assigned to the video RAM. The result can be that it works fine using RDP, but disconnects when using PCoIP. I’ve had some VMs mysteriously reduce themselves back down to a default number that won’t support large or multiple screen resolutions. Take a quick look the settings of your VM. Once those initial issues have been resolved, I’ve found everything to work as expected.

In my mad rush to build out the second View environment at our CoLo, everything worked perfectly, except when it came to the View client validating the secured connection. All indicators pointed to SSL, and perhaps how the exported SSL certificate was applied to the VM running the Security Server. I checked, and rechecked everything, burning up a fair amount of time. It turned out it was a silly mistake (aren’t they all?). In C:\Program Files\VMware\VMware View\Server\sslgateway\conf there needs to be a file called locked.properties. This contains information on the exported certificate. Well, when I created the locked.properties file, Windows was nice enough to append the .txt to it (e.g. locked.properties.txt). The default settings in Windows left that extension hidden, so it didn’t show. By the way, I’ve always hated that default setting for hiding file extensions. It is controlled via GPO at my primary site, but didn’t have that set at the CoLo site.

Next up, I’ll be wrapping up this series with the final impressions of the project. What worked well, what didn’t. Perceptions from the users, and from those writing the checks. Stay tuned.

Helpful Links
VMware View Documentation Portal. A lot of good information here.
http://www.vmware.com/support/pubs/view_pubs.html

A couple of nice YouTube videos showing a step by step installation of View Composer
http://www.youtube.com/watch?v=JSFnkLW1ve4&feature=youtube_gdata_player
http://www.youtube.com/watch?v=SDc21h0uTkA&feature=youtube_gdata_player

How to apply View specific settings for systems via GPO (written for 4.5, but also applies to 5.0)
http://blog.vhowto.info/2010/11/25/vmware-view-4-5-active-directory-group-policies/

PCoIP disconnect codes
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2012101

PCoIP Log Viewer
http://mindfluxinc.net/?p=195

PCoIP Configuration utility (beta)
http://mindfluxinc.net/?p=338

More PCoIP tuning suggestions
http://mindfluxinc.net/?p=338