统一访问网关UAG部署和安全最佳实践

1、统一访问网关UAG部署和安全最佳实践Agenda2DeploymentUpgradeSecurity and ComplianceDMZ Edge Authentication for Horizon4Content Gateway standalone installers EOA 2019VMware Tunnel and Secure Email Gateway standalone installers are nextSecurity Server deprecated withHorizon 2006 in 2020Writing on the Wall: Use Unified

2、Access Gateway for EverythingThe Security Gateway for Workspace ONE and HorizonWallWritingDMZServer NetworksArchitectural ComparisonSecurity Server vs. Unified Access GatewayWith Security ServerWith Unified Access GatewayHorizon Connection Server 1Horizon Connection Server 2Unified Access Gateway 1U

3、nified AccessGateway 2External UsersInternal UsersHorizon Connection Server 3Horizon Connection Server 4External UsersInternalUsersHorizon Connection Server 1Horizon Connection Server 2Tunnel and Gateways DisabledTunnel and Gateways EnabledTunnel and Gateways DisabledExternal Load BalancerInternal L

4、oad BalancerExternal Load BalancerInternal Load BalancerDMZServer NetworksSecurity Server 1Security Server 24DeploymentPreparation5Deployment MethodsvSphere OVFTemplate / Deployment UtilityPowerShell6Appliance initializationTypos, Mishaps and deploying Unified Access Gateway without vCenterUnified A

5、ccess Gateway deployment must be targeting vCenter, target ESXi is not supportedNetworking configuration issues result in failure of appliance initializationCommon issuesDuplicated IP detectedDHCP server issuesIncorrect IPs and netmask defined during the deploymentother network issuesThe vami.log co

6、ntain all initialization logs78Deployment and configuration is done in one processSettings mastered in an INI fileDeployment settingsNetworkingStorageAppliance SizingSystemConfiguration settingsCertificatesEdge ServicesAuthentication MethodsVM is automatically powered ONSupported in all platformsPow

7、erShell MethodRecommended for those looking to automate deployment and upgradeEdit INI settings fileRun PowerShell scriptDeployand Configure9How Unified Access Gateway PowerShell Script WorksAbstraction layer to provide similes experience across all platformsOVF ToolAWS Tools for PowerShellAzure Pow

8、erShellHyper-V PowerShellINI FileINI FileINI FileINI FileUnified Access Gateway PowerShell scriptuagdeploy.ps1uagdeployec2.ps1uagdeployaz.ps1uagdeployhv.ps110Generalname=UAG2 uagName=site1-uag2 deploymentOption=twonicAzuresubscriptionID=12345678-1234-1234-1234 resourceGroupName=uagrglocation=us sout

9、hstorageAccountName=uagstore imageURI=/vhds/euc- unified-access-gateway-x.y.z.0-nnnnnnn_OVF10.vhd diskStorageContainer=uagdisksvmSize=Standard_A2_v2# Network settingsvirtualNetworkName=vnet1 subnetName0=subnet1 publicIPAddressName0=UAG12PublicIPAddress networkSecurityGroupName0=UAGInternetSG11Azure

10、INI SampleGeneral name=UAG2 uagName=site1-uag2deploymentOption=onenicAmazonEC2credentialProfileName=awsProfile# type, region and image instanceType=c4.large region=us-east-2 amiId=ami-1334b87b#Network settingssubnetId0=subnet-5c933425 securityGroupId0=sg-00877c3367 publicIPId0=eipalloc-027afa45f1Ama

11、zon Web Service INI SampleGeneral name=UAG2 uagName=site1-uag2source=C:UAGsuag_OVF10.ova target=vi:/1/DC1/host/ deploymentOption=onenic#Storage settingsds=Local Disk 1 diskMode=thin#Network settings netInternet=VM NetworknetManagementNetwork=VM NetworknetBackendNetwork=VM NetworkdefaultGateway=ip0=0

12、netmask0=dns=0vSphere INI SampleSpecific INI Sections for Hypervisor, Network and Storage ConfigurationUnified Access Gateway OVA image must be imported into AWS and Azure for deploymentName vs uagName INI SettingsVM name vs Hostname (random or explicitly set)NameuagNameuagNameuagNameRandom name wil

13、l be generated whenuagName is NOT defined (uag-xxxxx-xxxx-xxxx)12Helps to easily identify the appliance when integrated with other solutions, such as VMware Log Insight for Syslog, Horizon console for monitoring, and othersINI Settings for PowerShell deploymentGeneral uagName=AirwatchTunnelGateway o

14、rganizationGroupCode= apiServerUrl= apiServerUsername= airwatchServerHostname=AirWatchContentGateway cgConfigId=apiServerUrl= apiServerUsername= airwatchServerHostname=AirwatchSecureEmailGateway memConfigurationId= apiServerUsername= apiServerUrl= airwatchServerHostname=UEM Edge Services Settings (s

15、ample)Horizon proxyDestinationUrl= tunnelExternalUrl= blastExternalUrl= pcoipExternalUrl=WebReverseProxy# proxyDestinationUrl= instanceId=proxyDestinationUrlThumbprints= proxyPattern=proxyHostPattern=13Horizon and Web Reverse Proxy Edge Services Settings (sample)Edge Services, Certificates and Authe

16、ntication Methods SectionsStandard across all platformsUse the following INI sections for UEM Services to be ready on first boot:AirwatchTunnelGatewayAirWatchContentGatewayAirwatchSecureEmailGatewayThe script performs a request call against the API URL for validationUsing only AirWatch INI section w

17、ont achieve ready onfirst boot when multiple UEM services are configuredINI Sections for UEM Services Required to Achieve Ready on First BootBest Practice when configuring multiple UEM Services14INI Sample Dual NIC Appliance and Four Edge ServicesReady on first boot15Deploying Three UAG Instances Si

18、multaneouslyDemo16DMZ or Cloud TenantsInternal ResourcesHorizon Desktops and AppsWeb Applications REST API Servers WikisIntranetFile Repository SharePoint ContentHorizon Connection Servers Re-run the uagdeploy PowerShell script for each INI file to add new appliancesRapid Scale UpEmail ServerEdge Se

19、rvicesHorizonWeb Reverse Proxy & Identity BridgingSecure Email GatewayContentGatewayVMwareTunnel17Ensure Load Balance are configured to perform health check favicon.ico:MUST be HTTPS GET on /favicon.icoDONT use /broker/xml or other URLs/ports for HorizonFor Secure Email Gateway use cases, ensure:Add

20、 the IPs from each new appliance to the SEG Cluster configuration on UEM Console prior to the deploymentIn multi-nic deployment internal/management nic will be used by SEG Cluster18Load Balancing Considerations when Scaling UpMaintain end-users working without compromising productivity19UpgradeWhen

21、Quiesce mode is enabled:Appliance is shown as not availableHealth check through favicon.ico returns 503 to load balancerLoad balancer sends traffic to the next available applianceCurrent sessions wont be dropUpdate Quiesce mode using UAG REST APIPUT https:/:9443/rest/v1/config/systemINI Settings for

22、 PowerShell deploymentGeneralquiesceMode= TRUE | FALSEQuiesce Mode Prevent New Sessions Been CreatedBlue/Green Deployment20DMZ or Cloud TenantsHorizon Desktops and AppsEdit the INI file to change the name, IP (when using static IP) and source reference from the 3.10 image file name to the 2009 versi

23、onRun the uagdeploy PowerShell command for each UAG .INI file to deploy new appliancesAdd new appliances to the Load Balancer VIPAll initial settings from the 3.10 version are automatically applied to the 2009 version as the settings come from the INI fileBlue/Green Deployment1. Deploy New Appliance

24、sBbased on the Updated INI FileInternal ResourcesEmail ServerFile Repository SharePoint ContentWeb Applications REST API Servers WikisIntranetHorizon Connection Servers 21Horizon Desktops and AppsPut old appliances in “Quiesce Mode”, the load balancer will route new connections to the new UAG applia

25、ncesUsers with active session remain working with no impactNew sessions will be routed to the new appliances (2009)2. Enable Quiesce Mode on the Old Appliances (3.10)Internal ResourcesEmail ServerFile Repository SharePoint ContentWeb Applications REST API Servers WikisIntranetHorizon Connection Serv

26、ers DMZ or Cloud TenantsQuiesce Mode ONQuiesce Mode ON22DMZ or Cloud TenantsInternal Resources Horizon Desktops and AppsWeb Applications REST API Servers WikisIntranetFile Repository SharePoint ContentHorizon Connection ServersMonitor old appliances using Edge Services Statistic API to identify the

27、ones with active sessionsWhen all existing sessions have “drained” from the old ones they can be destroyed3. Destroy Old Appliances with no Active SessionsEmail ServerQuiesce Mode ONQuiesce Mode ONGET Statistics API call (0)GET Statistics API call (0)Admin or automated process23DMZ or Cloud TenantsH

28、orizon Desktops and AppsPowerShell | Quiesce mode | Statistics API | AutomationUpgrade Completed with Zero DowntimeInternal ResourcesEmail ServerFile Repository SharePoint ContentWeb Applications REST API Servers WikisIntranetHorizon Connection Servers 24Security and Compliance25TLS UpdatesIncreasin

29、g security over TLS Communication26TLS 1.3release adds TLS 1.3 support to the following edge services:Horizon and Web Reverse Proxy on TCP 443Secure Email GatewayEnabled by default during deployment, unless disabled on the INI settings during PowerShell deploymenttls13Enabled = TRUE | FALSETLS 1.1TL

30、S 1.1 disabled by default on UAG 3.9+Horizon and Web Reverse Proxy on TCP 443The Horizon Blast Secure Gateway component on TCP port8443 no longer use TLS 1.1It supports TLS 1.2 onlyFinal security score (A+)Compliant with PCI DSS RequirementsFinance Industry (Payment Card Industry Data Security Stand

31、ard)PCI DSS 3.2.1 - Requirements 2.3 and 4.1Compliant with HIPAAHealthcare Industry (Health Insurance Portability and Accountability Act of 1996)Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Ind

32、ividualsCompliant with NIST(National Institute of Standards and Technology)NIST Special Publication 800-52 Revision 1 - Section 327Securing the UAG HTTP over TLS CommunicationUAG 3.10 Rating ImmuniWeb (/ssl/)Certificate Authentication Support for UAG FIPS VersionFor Horizon use casesOverviewAdded Ce

33、rtificate as authentication method to UAG FIPS version, supporting smart card and device certificateHorizon environment requires FIPS enabled and Unified Access Gateway FIPSUnified Access Gateway 3.10 minimum requiredBenefitsSupport federal customers to stay in complianceRemove Security Server depen

34、dency for Horizon 7 and above28Certificate Authentication Support for UAG FIPS VersionConfiguration on Unified Access Gateway administration consoleUpload of X.509 Certificate under authentication methods enable Certificate Auth Methods options on Horizon edge service settings29Beefing Up Security for Horizon Remote Access with Unified Access Gatewa