How does uag work

This was problematic on a few fronts 1 documentation and 2 supportability. We should start with the UAG itself because things can get really confusing quickly. You should slice up the UAG itself into two buckets 1 the servers and 2 the load balancer. In System Configuration , focus on a few key areas, such as cipher suites, TLS versions, and configuring your SysLog server to make troubleshooting easy.

This is huge early on and can be a major difference maker. There is a file on the UAG called favicon. If ALL services are up and green, the favicon. If even ONE service is down, the service is down. The key with all of this is you MUST replace the internet interface certificate with an internal certificate so your load balancer can properly evaluate the health monitor. One last thing, avoid putting in an Alias at all costs so it will actually apply the certificate.

HAProxy is considered to be widely one of the top open source load balancer technologies that exists out there. A few of the characteristics that make it so powerful are:. Basically the way this works is:. The UAG relies on a bit of haproxy code to send edge services to different backend ports based on their SSL SNI, which we will cover more in detail in the load balancer section of this blog post. A bit of editorialization after learning about how HAProxy works to note.

They are using deprecated code that will be out of support by end of You will also notice this is the code that sends it to the Edge Services Manager ESManager in the event that nothing matches. Most people think its turned on, but that is not always the case. Below, you will find a screenshot of where this is on a Netscaler. It goes without saying, to be very clear and sure. If you are seeing things like s, then its likely your SNI is not enabled.

Another key item around load balancers is the SSL Security of them. A great thing about the UAG is it embeds certain headers for security, thus simplifying your life.

I will be adding sections for each of the 3 services as I go along. The SEG is a crucial one and its vital that you get that right from the start. We start at the GUI which has a few key items that you need to do. One item to be aware of, your connection will not go green if your Exchange URL has any issues. Something you want to be careful of. UAG 3. Exchange redirection is an optional configuration that some clients may not account for.

Once this is done, you should be all green and its party time! The SEG is powered by Docker and with that in mind, you will have to do a few things especially if you are leveraging ENSv2 as you should be.

This was a really smart move by VMware. They give you a file where you can set any changes you want to make to configurations for the application. You have a few you may need to make that you can see below. The 2nd one is optional based on need and behaviors you see. One other item you will need to address for the EWS Proxy is enabling unsupported auth methods.

On a side note, VMware maybe make your config keys less ridiculous. You lost me by the 3rd dot:. The logback. Most of the services on the SEG will not have their log levels increased by using the UAG log level areas, so I strongly suggest looking at them. A few items that you can increase are:. An issue that you will commonly run into is after editing a log the SEG service will go down because of a syntactical error. The good news is by default there is a logback. A very common thing that I have seen people do is forget to close to config file and restart SEG services.

When you do this, it creates some artifacts and breaks the config file. The last file that I want to mention, which is very helpful is the seg-jvm-args. This file will let you customize the Java-specific components of your SEG implementation. Mainly it focuses on security components and how you can leverage them.

It provides the following hardening settings from an appliance perspective:. It helps to bolster security from the standpoint that it inspects access requests to the internal EUC environment and makes sure the user is what VMware calls strongly authenticated.

The UAG directs authentication requests to the appropriate server and discards the requests that are not valid. Horizon access is comprised of primary and secondary protocols for accessing the Horizon environment. Look for a post showing this method coming soon.

For the walk through below, we will look at the OVA deployment of the appliance. This is the screen you want to pay attention to as here is where you will configure your network address settings for your network configurations which may be more than one adapter depending on what you chose as well as passwords. After deploying the UAG 3. Connect to the web interface of the UAG appliance on port You will be prompted on how you want to configure the settings for the UAG appliance.

Here I am choosing to configure these manually. If you have exported the settings from another UAG appliance, you can import the settings into another UAG using the import settings option. Toggle the switch.

Can you explain further? Your email address will not be published. They wont appear until they exist, and are passing traffic. Post a Reply. Submit a Comment Cancel reply Your email address will not be published.