This is the 8th part of my VCAP7-DTM Design exam series. In part 7 I covered the creation of a physical design for Horizon desktop and pools. Now we take a look at section 7 of the blueprint, the creation of an application architecture design for Horizon 7:
Section 7 – Incorporate Application Services into a Horizon Physical Design
Objective 7.1: Design Application Integration and/or Delivery System(s) using Horizon Application Tools
Objective 7.2: Design Active Directory to Facilitate Application Assignment Objective 7.3: Design and Size RDS Application Pools and Farms
Objective 7.4: Create Application Architecture Design
Objective 7.5: Design Application Integration and/or Delivery System(s) using Horizon Workspace One
The purpose of implementing VMware Horizon 7 is to deliver virtualized applications and/or desktop for end users. You have different methods of application delivery and the delivery depends on many factors. The delivery method can have major impacts on the user experience.
End users want the “fat client experience” – they want speed and performance and ease of use. IT has to define and find a balance between user experience and security and these opposing goals of IT and end users could be a challenge.
Today, people don’t want to wait for anything. They want to use, consume, be independent and have all the permissions they need to download and/or install applications – they just want to do their job. In this case, for example, a self-service portal with workflows could provide the necessary flexibility and security. But what about application performance and delivery?
One of the biggest challenges during a VDI project are legacy applications and IT still has to manage them in 2018. And sometimes, the customer is making the money with legacy applications. If the performance suffers or these applications don’t work anymore, neither does the business.
Application Delivery
With Horizon 7 you have different options for app delivery:
Manually installed applications in the master image or in the virtual desktop
Delivery using ThinApp, App Volumes or RDSH (RDS application pool)
Each method has advantages, disadvantages and a different way of management. In most of the cases you will find a mix of these application delivery methods, but it depends on your use cases which ones you are going to choose.
I expect you know the features and technology of ThinApp and App Volumes and therefore I don’t explain them further. Just think about flexibility and management. I assume you don’t want to end up with 10 different master images which you have to maintain separately and modify once or twice a week. In general, Office applications and Adobe Reader are installed in the base image and the other applications can be delivered by App Volumes. If you need a “secure browser” (sandboxed browser) environment, then ThinApp is the right solution for this. Maybe you have the same application but with different versions? Then, it depends on the use case and requirement – your options are the manual installation, the delivery with App Volumes and ThinApp. Make yourself familiar with all those methods and also study the multi-site reference guide of each product.
Note: Sometimes it’s hard to know all features of a specific product, but reading and understanding the release notes can save your life sometimes. Example: ThinApp 5.2.3 only supports Firefox version 50.1 and nothing else. Maybe you can install and deploy Firefox 52.9 which is working, but is not officially supported by VMware. And then, when you want to upgrade to 60.1, suddenly the compilation with ThinApp is not working anymore even it was with 52.9, which was also not supported.
If you have read and understood this requirement before, you or your customer wouldn’t have a problem now.
Just think about if you provide secure browsing with Firefox delivered by ThinApp and you have a high security environment. When a new Firefox version gets published which is more secure and is supported by Mozilla, you cannot deliver this browser anymore. What are you doing now? Do you have enough time to find, design and test another solution?
ThinApp, App Volumes and RDSH have unique characteristics that allow them to increase the user experience and decrease resource utilization. Evaluate each solution and use the appropriate one for your design.
PS: If you are using XenApp/XenDesktop you could also consider App Volumes
This is all I have to say about application delivery without going too deep. Make your homework and know what you need! Next time we take a look at section 8 which is about session management and client devices.
This is the sixth part of my VCAP7-DTM Design exam series. In part 5 I covered the creation of a physical design for horizon storage. This time we take a look at section 5 of the blueprint, the creation of a physical network design for Horizon:
Section 5 – Create a Physical Design for Horizon Networking
Objective 5.1 – Plan and Design Network Requirements for Horizon solutions (including Mirage and Workspace One)
Objective 5.2 – Design Network and Security Components Based on Capacity and Availability Requirements
Objective 5.3 – Evaluate GPO and Display Protocol Tuning Options Based on Bandwidth and Connection Limits
Networking is also a very important and exciting when creating a Horizon architecture and a lot of questions are coming up when I think about Horizon and network access and devices:
How does the ISP infrastructure look like?
Do we have redundant internet uplinks?
Bandwidth in the data center?
Firewalls?
Remote connections?
How is the connection between Horizon client and agent?
ESXi host network interfaces?
Do we have mobile workers using WLAN?
I once had a customer who had a really nice and modern data center infrastructure, but their firewalls didn’t provide enough throughput. Make your homework and know how the routing and switching looks like and check every component’s limit.
Beside our VDI traffic, what about management, vMotion and vSAN traffic? Do we have enough network interfaces and bandwidth? If you think about management traffic, then 1Gbit interfaces are normally sufficient. But vMotion and vSAN traffic should have redundant 10Gbit connections and be on different subnets/VLANs.
Overview of the Network Architecture
In most network architectures two firewalls exist to create the DMZ.
The Unified Access Gateway (UAG) appliances are placed in the DMZ. UAG can perform authentication or pass a connection to the Connection Server for AD authentication.
Notauthenticated sessions are dropped at the Unified Access Gateway appliance and only authenticated sessions are allowed to connect to the internal resources.
UAG appliances in the DMZ communicate with the Connection Server instances inside the corporate firewalls and ensure that only the desired remote apps and desktop sessions can enter the corporate data center on behalf of this strongly authenticated user.
Inside the corporate firewall you install and configure at least two Connection Server instances. Their configuration data is stored in an embedded LDAP directory (AD LDS) and is replicated among all members of the group.
The used session bandwidth between the Horizon client and agent depends highly on the session configuration. For display traffic, many elements can affect network bandwidth, such as the used protocol, monitor resolution, frames per second, graphically intense applications or videos, image and video quality settings.
Because the effects of each configuration can vary widely, it’s recommended to monitor the session bandwidth consumption as part of a pilot. Try to figure out the bandwidth requirements for each use case.
Display Protocol
I would say that Blast Extreme is the way to go, because it has been optimized for mobile devices and can intelligently switch between UDP and TCP (Adaptive Transport). PCoIP has been developed by Teradici, but Blast is VMware’s own creation and that’s why I think that Blast will be “the future” and that RDP still can be used as fallback for some special scenarios.
Display Protocol Tuning Options
I will not cover this topic and explain you how you can configure the maximum bandwidth for PCoIP via GPO. There are several options to decrease and increase the used session bandwidth:
Nowadays, every client device is connected with 1Gbps. LAN connections and the user experience are most of the time perfect. How is it with WAN connections where you will have latencies that could be between 50 and 200ms? Do you apply Quality of Services (Qos) policies to prioritize Horizon traffic?
WAN optimization is one of the keywords when talking about WAN connections and is valuable for TCP-based protocols which require many handshakes between client and server, such as RDP.
PCoIP is UDP-based and this was the reason why everyone in the past said, that you should prefer this protocol for connections with higher latencies and then no WAN optimization or acceleration would be needed.
Then inside the corporate network you would use RDP because your network is stable or did you leave this choice to the user?
With Blast Extreme, Adaptive Transport will automatically detect higher latencies and automatically switches between TCP and UDP if needed. Higher latencies could also occur with mobile devices working of WiFi networks.
In my opinion there are almost no reasons anymore to use anything else than Blast because it’s also more network efficient than PCoIP.
Conclusion
Use separate networks for vSphere management, VM connectivity, vMotion and vSAN traffic. Make sure you have redundancy across different physical adapters (NIC, PCI slot) and devices (switches, router, firewall). Consider the use of a vSphere Distributed Switch (vDS) to reduce management overhead and provide a richer feature set. Maybe NSX could be interesting for micro segmentation.
Load balancing is a very important component of a Horizon architecture. The primary purpose of load balancing is to optimize performance by evenly distributing client sessions across all available Connection Server instances. The same is valid for UAG appliances, Identity Manager or App Volumes Manager. NSX comes with a virtual load balancer, but F5 and NetScaler are also fine.
Depending on your customer’s requirements and needs, the network design is another key part to remove single point of failures.
In part 7 we will figure out how we have to design Horizon desktops and pools.
This is the fifth part of my VCAP7-DTM Design exam series. In part 4 I covered the creation of a physical design for vSphere and Horizon components. This time we take a look at section 4 of the blueprint, the creation of a physical design for horizon storage:
Section 4 – Create a Physical Design for Horizon Storage
Objective 4.1 – Create and Optimize a Physical Design for Horizon Infrastructure Storage
Objective 4.2 – Create and Optimize a Physical Design for View Pool Storage
Objective 4.3 – Create and Optimize a Physical Storage Design for Applications
Objective 4.4 – Create and Optimize a Tiered Physical Horizon Storage Design
Objective 4.5 – Integrate Virtual SAN into a Horizon Design
This article is not a comparison between HCI and traditional storage architecture and if you build hosts by yourself or buy Dell EMC’s VxRail or any other vSAN ReadyNode.
Since it is VMware’s strategy to push vSAN and get away from traditional storage, I only cover vSAN. For my VCDX design I will also move away from traditional storage and use vSAN – it’s also my customer’s strategy. The price for flash storage is decreasing constantly and makes a hybrid vSAN architecture less attractive – at least for our use cases.
In general the storage design of a Horizon implementation is very critical. You have to think about capacity, growth capacity, data/object placement, disaster recovery, kind of SSD disks and so on. But in my opinion, HCI or vSAN makes your life a lot easier and simplifies the storage deployment.
If you fail to correctly size the storage and I/O capacity, your customer’s user experience will suffer or the deployment of new desktops is not possible anymore. So, storage performance and sizing is vital for the satisfactory of your customers and their users!
All-Flash or Hybrid Architecture
The first thing you have to figure out and define is the vSAN platform you are going to deploy – All-Flash or hybrid architecture. A All-Flash vSAN configuration aims at delivering very high IOPS with low latencies. Also in a All-Flash configuration you use two different grades of (flash) disks: lower capacity and higher endurance device for the capacity tier and more cost-effective and higher capacity disks for the capacity tier
There is no read cache available in a All-Flash configuration as all data is directly read from the capacity tier. Because you aim for extremely high IOPS, make sure you provide a dedicated 10Gb network for the vSAN traffic.
You can enable the deduplication and compression setting (not available when using a hybrid vSAN) in the vSAN cluster to reduce redundant copies of blocks within the same disk group to one copy and to compress the blocks after they have been deduplicated.
Erasure Coding (RAID 5/6 is only available with All-Flash) provides the same level of redundancy as mirroring, but with a reduced capacity requirement. In general, erasure coding means breaking data into multiple pieces and spread them across multiple devices, while adding parity data in the event data gets corrupted or lost. This is a good and short video about this feature:
When using vSAN without further adjustments, your virtual desktops and infrastructure servers are using the default vSAN storage policy. For infrastructure servers this might be okay, but for our desktops we need to create a new policies. Cormac Hogan has very good material about Horizon and vSAN Storage Policies:
The Number of Failures to Tolerate defines the number of host, disk or network failures a storage object can tolerate. This number of Failures to Tolerate (FTT) has the greatest impact on your capacity in a vSAN cluster. Based on your configured availability requirements for a VM, the settings in the policy can lead to a higher consumption on the vSAN datastore (more copies of your data). For “n” failures tolerated, n+1 copies of the object are created and 2n+1 hosts are required.
Consider to configure FTT = 0 for the OS disk for linked-clone floating pools or if you use full-clone non-persistent desktops. If vSAN should experience a failure, only non-persistent data will be lost.
I hope this information was helpful even we didn’t go to deep. If you need to know more about vSAN, then you’ll find tons of documents and other blogs about this technology.
In part 6 I’ll try to give you more information about the design for a Horizon network.
This is the fourth part of my VCAP7-DTM Design exam series. In part 3 I covered the creation of a logical design for Horizon 7. This time we take a look at section 3 of the blueprint, the creation of a physical design:
Section 3 – Create a Physical Design for vSphere and Horizon Components Objective 3.1 – Create a Horizon Pod and Block Architecture Design Objective 3.2 – Extend Horizon Architecture Design to Support Additional Horizon Suite Components Objective 3.3 – Design vSphere Infrastructure to Support a Horizon Implementation Objective 3.4 – Add Required Services to Support a Given vSphere Design
Physical diagrams contain more details than the logical architecture and could can brand names or models of storage arrays, network switches and so on. In the physical design we will describe individual parameters or settings for each component.
VMware Horizon Block and Pod Design
A VMware Horizon solution includes one or more Horizon instances, where a Horizon instance is a pod that includes one or more building blocks.
A building block consists of physical servers, a vSphere infrastructure, Horizon 7 servers, shared storage, and virtual machine desktops for end users. A building block is a logical construct and should not be sized for more than 2’000 Horizon desktops. Customers usually include up to five building blocks in a Horizon 7 pod, although in theory you can use more blocks than that, as long as the pod does not go above 10’000 sessions and 7 Horizon Connection Server instances.
The Cloud Pod Architecture (CPA) feature allows you to link multiple Horizon pods together (using the View Inter-Pod API (VAPI) protocol) to provide cross-data center administration and to perform local or global user-to-desktop mappings (entitlements). In a traditional Horizon implementation you manage each pod independently.
There are two different kind of building blocks, the management block (only one) and the resource block (up to 5 in a Horizon pod)
VMware recommends about 2’000 sessions or desktops in a Horizon resource block which includes at least one Horizon Connection Server (CS). In addition to the CS other components like ESXi hosts, vSphere clusters, desktop and application pools and storage form a VMware Horizon resource block.
One Horizon pod can contain up to 10’000 sessions or desktops and 7 Connection Server instances. For environments exceeding the 10’000 users, you have to leverage the Cloud Pod Architecture feature with the usage of load balancers.
In the image above each Horizon 7 resource block has its own vCenter Server. Since View 5.2 and later customers have the ability to use a single vCenter Server instance to manage a 10’000 desktop environment. Although using one vCenter Server for 10’000 desktops is possible and supported, doing so is not recommended because this design creates a single point of failure. The loss of that single vCenter Server prevents any desktop power management, provisioning and other operations.
The Horizon 7 management block consists of the VMs that are supporting the block and pod infrastructure:
vCenter Server instances, Horizon infrastructure servers, Connection Servers, database servers, Composer, UAG, Active Directory, DNS, DHCP, Certification Authorities etc.
Horizon Component Design
To be able to deliver the Horizon 7 services, we first need to design and build the required infrastructure components.
VMware Identity Manager (vIDM) provides the optional WorkspaceONE portal which provides access to different types of applications (Horizon desktop & apps, SaaS-based web apps, ThinApp packaged applications and even Citrix-based application an desktops). Even vIDM is available from on-premises installation, VMware recommends a SaaS-based implementation.
Following VMware’s recommendations, you will need at least three vCenter Server instances:
– 1 vCenter Server for every 2’000 desktops – 1 vCenter Server for the Horizon management block – 1 vCenter Server for the vCenter Server Management cluster (with all vCenter Servers including networking and security instances)
Each Horizon Connection Server provisioned with the minimum supported system specifications should be able to manage the connectivity for up to 2’000 users. If you are using Blast Secure Gateway connections to desktops using HTML access, the Connection Server only can have a maximum of 800 connections. A minimum of two Connection Servers is recommended for failover and redundancy reasons. VMware supports a maximum of seven active Connection Servers per replication group because of Java Message Services (JMS) performance limitations.
Connection servers are active only if they are enabled in Horizon Administrator to accept connections. A disabled connection server communicates with other connection servers in the group and replicates the LDAP directory.
This means that, if you have deployed the maximum of 7 Connection Servers, five have to be enabled and two disabled.
Although View Composer can be installed on the same server as the Windows vCenter Server, for larger environments VMware recommends that you install View Composer on a standalone server. Each Composer server requires a unique Composer database. However, multiple Composer databases can be placed on a single SQL instance. A View Composer server is always paired with a vCenter Server for each Horizon block. If possible, VMware recommends using the Instant Clone technology which doesn’t need additional infrastructure servers.
The Unified Access Gateway (UAG) is the new way to allow remote connections and has the same features like the old View Security Server. The UAG appliance (VM based on Linux) is normally installed in the DMZ and enables secure access from outside the corporate network to the internally hosted desktop and application servers. Unlike a Security Server, the UAG appliance doesn’t need to be paired with a specific Connection Server. VMware recommends the usage of a UAG than Security Server.
This is it. 🙂 The next article focuses on section 4 where the design for Horizon storage is the topic.
This is the third part of my VCAP7-DTM Design exam series. In part 2 I covered the creation of a conceptual design for Horizon 7. This time we take a look at section 2 of the blueprint, the creation of a logical design.
As you already know, the conceptual design or architecture is the one you begin with and is driven by the most essential requirements (the ones you gathered during the assessment). Typically you do not mention any specific solution or product in the conceptual design. To provide more details you will create a logical design of the Horizon solution.
There are different ways to create a conceptual design (e.g. page 71 in the VDI Design Guide) but the example of a logical design for Horizon 7 is very easy to find in the internet. Here is an example from the VMware Horizon 7 Enterprise Edition Multi-Site Reference Architecture:
The logical architecture should provide a high-level overview of the proposed architecture for the customer’s Horizon environment and helps all involved people in the early phases of planning, designing and deploying the solution.
As you can see, it now contains components like connection servers, Identity Managers, Composer Servers, database servers etc. The logical diagram shows you more details than before but the more specific (technical) details for each component will be described in the physical design which is part of section 3 of the exam blueprint. Example: Amount of App Volumes Managers Permissions of UEM shares Applied GPOs Load balancing solution
As you may know from the first article, I successfully passed my VCP7-DTM exam and now I’m studying for the VCAP7-DTM Design certification.
Before we take a closer look at the different objectives or requirements, there is one important information about the VCIX7-DTM track. Since no VCAP7-DTM Deploy exam is available and it’s not clear yet when this exam will be published, you only need the VCAP7-DTM Design certification to earn the VCIX7-DTM status. I have got this information from VMware certification.
Section 1 – Create a Horizon Conceptual Design
Let’s have a look at the different objectives from section 1 and see what they mean for me using my learning resources.
Objective 1.1 – Gather and analyze requirements Objective 1.2 – Gather and analyze application requirements Objective 1.3 – Differentiate requirements, risks, constraints and assumptions Objective 1.4 – Evaluate existing business practices against established use cases
The gathering of requirements (functional and nonfunctional) is an essential part of the whole design and deploy process.
A functional requirement describes what the solution must do or accomplish. Example: Limit access to a specific user group
A nonfunctional requirement describes the characteristics of a solution. Example: Horizon service uptime of 99.99%
To have a good and valid design you also have to define goals, requirements, risks, constraints and assumptions.
Normally, defining goals is one of the easier parts when it comes to a design. When you interview the different key stakeholders and use the right questions, you already have the business objectives or goals. The goals are the business drivers and it’s important for you as architect to understand all the objectives to fulfill the customer’s needs.
What are the company’s business needs? Do they want to increase user mobility? Lower the operational costs with a faster deployment method? Is remote access needed?
If your design process is based on the VMware Delivery Excellence Methodology, then you know that the assessment phase focuses on the scope of the project and the data-gathering for the design. You need to understand the customer’s requirements and for that you need to interview different key stakeholders to create a design which meets all the needs. After you have gathered all the requirements, you must document them and write down the constraints, assumptions and risks.
With all the information about the current state, the business requirements and the application requirements, you are able to create an enterprise infrastructure design based on a three-step model. The conceptual design is the first one to begin with:
Michael Rebmann is currently working as a Lead Solution Architect for VMware by Broadcom in Switzerland and focuses on some of the largest and most strategic customers. Michael engages with the community as a co-leader of the Swiss German VMUG and became a VMware vExpert PRO in 2022. Opinions are his own.
VMware CMTY Podcast #607 – VMware Cloud Foundation
VMware CMTY Podcast #546 – VMware Carbon Black Cloud Workload
