Deploying a vIDM clustered environment using NSX-T Loadbalancer


 

Documenting steps taken to install a vIDM ( Workspace One ) in my lab so that it would benefit others too

 

Step-1 : Certificate Creation in Locker

Create a certificate inside vRSLCM Locker. This would be your vIDM certificate


Enter all information which is needed to create a certificate in the locker


You must enter the load balancer name of in the CN field


Under IP and Hostname section , enter all hostnames which belongs to vIDM cluster including Load Balancer






Once certificate is created , click on the three dots next to the certificate and then download it




A .pem file will be downloaded


Edit the .pem file with the notepad


The first section would be server certificate followed by root certificate. In my case root certificate is from vRSLCM's locker.


The last section would be the private key.


Copy the root certificate and create a separate cert called root.cer and then create a seperate file with server certificate and the key and call itas server certificate with key.



 

Step:2 Importing certificates into NSX-T


Login into NSX-T and then click on system to import the certificate files saved before

  • root certificate

  • server certificate with key



root certificate should be imported as CA cert and then server certificate as certificate





 

Step:3 Create Service Monitors


You set up health check monitoring.Servers that fail to respond to the health checks within a specified time period are excluded from future connection handling.


In a Web browser, log in to NSX-T Manager for the Management domain by using the user interface.


On the main navigation bar, click Networking.

In the navigation pane, click Load balancing and click the Monitors tab.

From the Select monitor type drop-down menu, select Active.


From the Add active monitor drop-down menu, select HTTPS and configure the settings.



​Setting

Value

Name

didmmonitor

Protocol

HTTPS

Monitoring Port

443

Monitoring Interval

3

Timeout Period

10

Description

Monitor for Distributed vIDM or WS1

Falls Count

3

Rise Count

3


In the HTTP request section, click Configure

The HTTP request and response configuration dialog box opens.

On the HTTP request configuration tab, configure the settings



Setting

Value

HTTP Method

Get

HTTP request URL

/SAAS/API/1.0/REST/system/health/heartbeat

HTTP request version

1.1


On the HTTP response configuration tab, configure the settings, and click Apply



Setting

Value

HTTP response code

200

HTTP response body

ok


In the SSL configuration section, click Configure.



Setting

Value

Server SSL

Enabled

Client certificate

Select the server certificate with key

Server SSL Profile

default-balanced-server-ssl-profile


On the Monitors page, click Save








 

Step:4 Creating Server Pool


The server pool determines the load balancing algorithm and combines resources from the pool members.


You add the three Workspace ONE Access cluster nodes as members of the server pool.



Name

IP Address

10.xx.xx.1

10.xx.xx.2

10.xx.xx.3

In a Web browser, log in to NSX-T Manager for the Management domain by using the user interface


On the main navigation bar, click Networking.


In the navigation pane, click Load balancing, click the Server pools tab, and click Add server pool.The Add new server pool wizard opens.


On the General properties page, configure the settings




Setting

Value

Name

didmserverpool

Description

Server Pool for vIDM or WS1

Algorithm

Least Connection

Translation Mode

Automap


Click Select Members



On the Configure server pool members page, click Add member, configure the settings, click Save, and click Apply



Setting

Value for didmone

Value for didmtwo

Value for didmthree

Name

didmone

didmtwo

didmthree

IP

192.xx.xx.1

192.xx.xx.2

192.xx.xx.3

Port

443

443

443

Weight

1

1

1

State

Enabled

Enabled

Enabled

Backup Member

Disabled

Disabled

Disabled

Maximum concurrent connections

-

-

-


Click Set Monitors, on the Select health monitors page, select didmmonitor, and click Apply..


On Server Pool page, click Apply








 

Step:5 Create Application Profiles


You create an application profile and associate it with a virtual server to define the behavior of a particular type of network traffic. The virtual server then processes traffic according to the values specified in the profile.


In a Web browser, log in to NSX-T Manager for the Management domain by using the user interface.


Create the application profiles for Workspace ONE Access or vIDM cluster


On the main navigation bar, click Networking.


In the navigation pane, click Load balancing and click the Profiles tab.


From the Select profile type drop-down menu, select Application.


From the Add application profile drop-down menu, select HTTP Profile, configure the settings, and click Save.



Setting

Value for Application Profile

Value for Application Profile Redirect

Name

didmhttpappprofile

didmhttpappprofileredirect

Type

HTTP

HTTP

Idle Timeout

3600

3600

Descriotion

vIDM & WS1 App Profile

vIDM & WS1 App Profile Redirect

X-Forwarded-For

Insert

none

Request Header Size

1024

1024

Response Header Size

4096

4096

Redirection

None

HTTP to HTTPS Redirect

Response Timeout

60

60

NTLM Authentication

Disabled

Disabled





Create a persistence profile for the cross-region Workspace ONE Access cluster.

On the Load balancing page, click the Profiles tab.

From the Select profile type drop-down menu, select Persistence.

From the Add persistence profile drop-down menu, select Cookie, configure the settings,

and click Save.



Setting

Value

Name

didmcookiepersistenceprofile

Description

Cookie Persistence Profile

Share Persistence

Disabled

Cookie Mode

Rewrite

Cookie Name

JSESSIONID

Cookie Garbling

Enabled

Cookie Fallback

Enabled





 

Step:6 Creating Virtual Servers


You create two L7 HTTP virtual servers for the cross-region Workspace ONE Access cluster. These virtual servers are associated with the configured application profile and server pool and distribute client connections among the server pool members.


In a Web browser, log in to NSX-T Manager for the Management domain by using the user interface.


On the main navigation bar, click Networking.

In the navigation pane, click Load balancing and click the Virtual servers tab.

From the Add virtual server drop-down menu, select L7 HTTP and configure the settings



Setting

Value

Name

didmvirtualserver

IP Address

IP of the VIP

Ports

443

Load Balancer

select appropriate lb in your environment

Server Pool

select the server pool created in previous step

Description

Virtual Server Pool for vIDM or WS1

Application Profile

Select Application Profile created previously

Persistence

Cookie

Cookie

Select the persistence profile created previously






In the SSL Configuration section, click Configure

The Edit SSL configuration dialog box opens.

Click the Client SSL tab and configure the settings