Secure Remote Access with VMware Unified Access Gateway

Deploying Unified Access Gateway With PowerShell

The PowerShell deployment method for Unified Access Gateway allows for the mastering of all settings into a single INI file, including the Unified Access Gateway appliance settings and the edge services. This means the Unified Access Gateway appliance is fully configured with certificates and edge services on first boot. This aids with repeat installations and upgrades, and expedites large deployments.

To deploy Unified Access Gateway with PowerShell, use the script and sample setting files provided in the community article, “Using PowerShell to Deploy VMware Unified Access Gateway.”

Download

First, get the latest files:

• Download and install the latest OVF tools from my.vmware.com.
• Download the latest Unified Access Gateway OVA file from my.vmware.com.

Configure

Next, configure the PowerShell script for your environment.

1. From “Using PowerShell to Deploy VMware Unified Access Gateway,” download the uagdeploy-310-v3.zip or later file and extract the contents.

2. Make a copy and edit one of the sample INI files (such as uag2-advanced.ini).

3. Enter your information as required for the General and SSLCertsections.

Leave all other lines as they are. In the following example, spaces and comment lines have been removed to conserve space.

[General]

name=uag1

source=C:\euc-unified-access-gateway-3.1.1.0-6797878_OVF10.ova

target=vi://administrator@vsphere.local:PASSWORD@192.168.1.12/Datacenter1/host/Cluster1/

ds=vsanDatastore

netInternet=DMZ

netManagementNetwork=DMZ

netBackendNetwork=DMZ

deploymentOption=onenic

ip0=192.168.1.36

dns=192.168.2.10 192.168.2.11

[SSLCert]

pfxCerts=sslcerts.pfx

4. Copy, paste and complete edge service sections from the sample INIfiles as required.

5. As an example, to add secure external access to Horizon 7 resources, retain or copy in the [Horizon] section of the uag2-advanced.ini file and paste it into your INI file at the end. Change the following to the relevant values for your environment.

[Horizon]

proxyDestinationUrl=https://view.domain.com

tunnelExternalUrl=https://horizon.domain.com:443

blastExternalUrl=https://horizon.domain.com:443

pcoipExternalUrl=88.100.100.100:4172

In the previous example:

• view.domain.com is the internal address of the Horizon Connection Server (or the internal load balancer address if you have more than one Connection Server).
• horizon.domain.com is the external address used for Horizon connections.
• 88.100.100.100 is the external IP address for horizon.domain.com

Deploy

Now you are ready to deploy the Unified Access Gateway appliance.

1. Open a PowerShell prompt and change to the directory where the scripts and your INI file are located.
   • Be sure to use the uagdeploy.ps1, uagdeploy.psm1 and uagdeployhv.ps1 supplied with the uagdeploy-310-v3.zip file or later.
2. Make sure that script execution is unrestricted for the current user. You can do this by running the command:
   • set-executionpolicy -scope currentuser unrestricted
   • You only need to run this once, and only if it is currently restricted.
3. If you get a warning about running this script, you can unblock that warning by running the command:
   • unblock-file -path .\uagdeploy.ps1
4. Run .\uagdeploy.psl .\<filename>.ini and follow the prompts, entering the passwords.
   • You can optionally specify the admin and root passwords as parameters which will prevent you being prompted for them.
5. After the process is complete, wait a few minutes for the Unified Access Gateway appliance to boot completely.

You can monitor this process in the vSphere Client to see when the assigned IP address is reported on the summary page for the VM. If you have all the settings in the INI file completed correctly, and your certificates are in order, you will have a fully operational Unified Access Gateway that will proxy connections to your Horizon Connection Servers.

Log in to the Unified Access Gateway administrator console to check the configuration and service statuses and to add or change the configuration. If you change any settings, such as adding a new edge service, remember to export the settings and update your INI file to reflect your changes.