Deploying a vIDM clustered environment using NSX-T Loadbalancer
Updated: Mar 9
Documenting steps taken to install a vIDM ( Workspace One ) in my lab so that it would benefit others too
Step-1 : Certificate Creation in Locker
Create a certificate inside vRSLCM Locker. This would be your vIDM certificate
Enter all information which is needed to create a certificate in the locker
You must enter the load balancer name of in the CN field
Under IP and Hostname section , enter all hostnames which belongs to vIDM cluster including Load Balancer
Once certificate is created , click on the three dots next to the certificate and then download it
A .pem file will be downloaded
Edit the .pem file with the notepad
The first section would be server certificate followed by root certificate. In my case root certificate is from vRSLCM's locker.
The last section would be the private key.
Copy the root certificate and create a separate cert called root.cer and then create a seperate file with server certificate and the key and call itas server certificate with key.
Step:2 Importing certificates into NSX-T
Login into NSX-T and then click on system to import the certificate files saved before
root certificate
server certificate with key
root certificate should be imported as CA cert and then server certificate as certificate
Step:3 Create Service Monitors
You set up health check monitoring.Servers that fail to respond to the health checks within a specified time period are excluded from future connection handling.
In a Web browser, log in to NSX-T Manager for the Management domain by using the user interface.
On the main navigation bar, click Networking.
In the navigation pane, click Load balancing and click the Monitors tab.
From the Select monitor type drop-down menu, select Active.
From the Add active monitor drop-down menu, select HTTPS and configure the settings.
Setting | Value |
Name | didmmonitor |
Protocol | HTTPS |
Monitoring Port | 443 |
Monitoring Interval | 3 |
Timeout Period | 10 |
Description | Monitor for Distributed vIDM or WS1 |
Falls Count | 3 |
Rise Count | 3 |
In the HTTP request section, click Configure
The HTTP request and response configuration dialog box opens.
On the HTTP request configuration tab, configure the settings
Setting | Value |
HTTP Method | Get |
HTTP request URL | /SAAS/API/1.0/REST/system/health/heartbeat |
HTTP request version | 1.1 |
On the HTTP response configuration tab, configure the settings, and click Apply
Setting | Value |
HTTP response code | 200 |
HTTP response body | ok |
In the SSL configuration section, click Configure.
Setting | Value |
Server SSL | Enabled |
Client certificate | Select the server certificate with key |
Server SSL Profile | default-balanced-server-ssl-profile |
On the Monitors page, click Save
Step:4 Creating Server Pool
The server pool determines the load balancing algorithm and combines resources from the pool members.
You add the three Workspace ONE Access cluster nodes as members of the server pool.
Name | IP Address |
10.xx.xx.1 | |
10.xx.xx.2 | |
10.xx.xx.3 |
In a Web browser, log in to NSX-T Manager for the Management domain by using the user interface
On the main navigation bar, click Networking.
In the navigation pane, click Load balancing, click the Server pools tab, and click Add server pool.The Add new server pool wizard opens.
On the General properties page, configure the settings
Setting | Value |
Name | didmserverpool |
Description | Server Pool for vIDM or WS1 |
Algorithm | Least Connection |
Translation Mode | Automap |
Click Select Members
On the Configure server pool members page, click Add member, configure the settings, click Save, and click Apply
Setting | Value for didmone | Value for didmtwo | Value for didmthree |
Name | didmone | didmtwo | didmthree |
IP | 192.xx.xx.1 | 192.xx.xx.2 | 192.xx.xx.3 |
Port | 443 | 443 | 443 |
Weight | 1 | 1 | 1 |
State | Enabled | Enabled | Enabled |
Backup Member | Disabled | Disabled | Disabled |
Maximum concurrent connections | - | - | - |
Click Set Monitors, on the Select health monitors page, select didmmonitor, and click Apply..
On Server Pool page, click Apply
Step:5 Create Application Profiles
You create an application profile and associate it with a virtual server to define the behavior of a particular type of network traffic. The virtual server then processes traffic according to the values specified in the profile.
In a Web browser, log in to NSX-T Manager for the Management domain by using the user interface.
Create the application profiles for Workspace ONE Access or vIDM cluster
On the main navigation bar, click Networking.
In the navigation pane, click Load balancing and click the Profiles tab.
From the Select profile type drop-down menu, select Application.
From the Add application profile drop-down menu, select HTTP Profile, configure the settings, and click Save.