VMware Horizon Unified Access Gateway Load Balancing – NetScaler 12

Navigation

Use this procedure to load balance VMware Unified Access Gateway (formerly known as Access Point).

• Overview
  • UAG vs Security Servers
  • Protocols/Ports
• Load Balancing Monitors
• Load Balancing Servers
• Load Balancing Services
  • Overview
  • Configuration Summary
  • TCP 443
  • Other Ports
• Load Balancing Virtual Servers
• Persistency Group
• Horizon 7 Origin Check
• CLI Commands
• Horizon Configuration

Overview

To simplify this post, this post is focused on Unified Access Gateway, which is the replacement for Horizon Security Servers.

For load balancing of other Horizon components:

• Internal Horizon Connection Servers – This is standard load balancing on SSL_BRIDGE protocol, port 443, and Source IP persistence. See the CLI commands for a sample configuration.
• Horizon Security Servers – Detailed configuration for Horizon Security Servers have been removed from this version of the post. But the CLI commands for Security Server load balancing are preserved at the bottom of this post.

UAG appliances vs Horizon Security Servers

There are two VMware-provided remote access solutions for Horizon View:

• Unified Access Gateway (formerly known as Access Point)
• Security Servers

Unified Access Gateway appliances are preferred over Horizon Security Servers for the following reasons:

• No need to pair with internal Connection Servers, which simplifies the configuration.
• Linux appliance instead of Windows server.
• Authentication can be offloaded to the Unified Access Gateway. This includes: Smart Cards, RSA, and RADIUS.
• Blast Extreme Adaptive Transport (BEAT) in Horizon 7.1 and newer only works with Unified Access Gateway 2.9 and newer. Security Server and older Access Points don’t work.

Here is a typical Unified Access Gateway architecture:

• Two Internal Connection Servers – these need to be load balanced on an internal VIP on TCP 443. Internal users connect to the internal VIP.
  • Instructions for load balancing the internal Connection Servers are not detailed in this post. Instead, see the CLI Commands.
• Two DMZ Unified Access Gateway (Access Point) appliances – these need to be load balanced on a DMZ VIP on several ports. External users connect to the DMZ VIP.
  • Unified Access Gateway appliances connect to the internal Load Balancing VIP for the internal Connection Servers using HTTPS protocol
  • Unified Access Gateway appliances connect directly to Horizon Agents using Blast or PCoIP protocol.
    

Protocols/Ports

Horizon 7 introduces a new Blast Extreme protocol. VMware Technical White Paper Blast Extreme Display Protocol in Horizon 7.

For VMware Unified Access Gateway (UAG), Blast Extreme only needs TCP 443, and UDP 443. If you use VMware Unified Access Gateway with Blast Extreme exclusively, then the number of ports to UAG is minimal, and load balancing configuration is simplified. Here are typical load balancing port requirements for Unified Access Gateway with Blast Extreme only:

• TCP 443
• UDP 443

Note: UDP is disabled by default, but it can be enabled using a Blast GPO setting.

To support Blast Extreme, PCoIP, and HTML Blast connectivity, the following ports must be load balanced to the UAGs:

• TCP 443
• UDP 443
• TCP 4172
• UDP 4172
• TCP 8443
• UDP 8443

The initial connection to UAG is always TCP 443 (HTTPS). If a user is load balanced on port 443 to a particular UAG, then the connection on UDP 4172 must go the same UAG. Normally load balancing persistence only applies to a single port number, so whatever UAG was selected for port 443, won’t be considered for the 4172 connection. But in NetScaler, you can configure a Persistency Group to use a single persistency across multiple load balancing Virtual Servers with different port numbers. In F5, you configure Match Across.

Also see Load Balancing across VMware Unified Access Gateway Appliances by Mark Benson at VMware Communities.

This topic primarily focuses on NetScaler GUI configuration. Alternatively, you can skip directly to the CLI commands.

Load Balancing Monitors

Users connect to Unified Access Gateway appliances on multiple ports: TCP 443, UDP 443, TCP 8443, UDP 8443, TCP 4172, and UDP 4172. Create Load Balancing Monitors for each port number. Since UDP can’t be easily monitored, use TCP monitors as substitutes for UDP. That means you only need three monitors:

• TCP 443 – HTTPS
• TCP 4172
• TCP 8443

SSL (443) Monitor

1. On the left, expand Traffic Management, expand Load Balancing, and click Monitors.
   
2. On the right, click Add.
   
3. Name it Horizon-SSL or similar.
4. Change the Type drop-down to HTTP-ECV.
   
5. On the Standard Parameters tab, in the Destination Port field, enter 443.
   
6. Scroll down the Standard Parameters tab, and check the box next to Secure.
   
7. Scroll back up, and switch to the Special Parameters tab.
   
8. In the Send String section, enter GET /broker/xml
9. In the Receive String section, enter clientlaunch-default
10. Scroll down, and click Create.
    

PCoIP (4172) Monitor

1. On the right, click Add.
   
2. Name it Horizon-PCoIP or similar.
3. Change the Type drop-down to TCP.
   
4. On the Standard Parameters tab, in the Destination Port field, enter 4172.
   
5. Scroll down, and click Create.
   

Blast (8443) Monitor

1. On the right, click Add.
   
2. Name it Horizon-Blast or similar.
3. Change the Type drop-down to TCP.
   
4. On the Standard Parameters tab, in the Destination Port field, enter 8443.
   
5. Scroll down, and click Create.
   

Load Balancing Servers

Create Load Balancing Server Objects for the DMZ Unified Access Gateway appliances.

1. On the left, expand Traffic Management, expand Load Balancing, and click Servers.
   
2. On the right, click Add.
   
3. Enter a descriptive server name, usually it matches the actual appliance name.
4. Enter the IP address of a Unified Access Gateway appliance.
5. Enter comments to describe the server. Click Create.
   
6. Continue adding Unified Access Gateway appliances.
   

Load Balancing Services

Overview

Since there are six protocol/ports to UAG, there will be six service groups – one for each protocol/port:

• TCP 443 – SSL_BRIDGE
• UDP 443
• UDP 4172
• TCP 4172
• TCP 8443 – SSL_BRIDGE
• UDP 8443

Users will initially connect to TCP port 443, and then must be redirected to one of the other ports on the same UAG appliance that was initially used for the TCP 443 connection. If TCP 443 is up, but UDP 4172 is down on the same appliance, then you probably TCP 443 to go down too. To facilitate this, bind all three port number monitors to the TCP 443 service. If any of the bound monitors goes down, then TCP 443 is also taken down.

• Only the TCP 443 service group needs to monitor all port numbers.
• Other port number service groups only need to monitor that specific port number. For example, the TCP 8443 Service Group should monitor port TCP 8443.
• Since UDP is difficult to monitor, the UDP Service Groups will monitor the equivalent TCP port. For example, the UDP 4172 Service Group will monitor TCP 4172. This isn’t the best option, but it’s better than ping.

TCP 443 Load Balancing Service Group

1. On the left, expand Traffic Management, expand Load Balancing, and click Service Groups.
   
2. On the right, click Add.
   
3. Give the Service Group a descriptive name (e.g. svcgrp-UAG-SSL).
4. Change the Protocol to SSL_BRIDGE, and click OK to close the Basic Settings section.
   
5. On the left, click where it says No Service Group Member.
   
   1. Change the selection to Existing Server, and select the Unified Access Gateway appliances you created earlier.
      
      
   2. In the Port field, enter 443, and click Create.
      
6. Click OK to close the Service Group Members section.
   
7. On the right, in the Advanced Settings column, click Monitors.
   
8. On the left, in the Monitors section, click where it says No Service Group to Monitor Binding.
   
   1. Click where it says Click to select.
      
   2. Click the radio button next to the Horizon-SSL monitor, and click Select.
      
   3. Click Bind.
      
9. The TCP 443 Service Group should monitor all port numbers. To bind more monitors, on the left, click where it says 1 Service Group to Monitor Binding.
   
   1. Click Add Binding.
      
   2. Click where it says Click to select.
      
   3. Click the radio button next to the Horizon-PCoIP monitor, and click Select.
      
   4. Then click Bind.
      
   5. Repeat these steps to bind the Horizon-Blast monitor. If any of these monitors goes down, then the UAG is taken offline.
   6. Click Close.
      
10. To verify the monitors, on the left, in the Service Group Members section, click the line that says # Service Group Members.
    
    1. Right-click one of the members, and click Monitor Details.
       
    2. The Last Response should indicate Success. If you bound multiple monitors to the Service, then the member will only be UP if all monitors succeed.
       
    3. Click Close when done.
11. Then click Done to finish creating the Service Group.
    

Other Ports Load Balancing Services

Here are general instructions for the other Horizon UAG load balancing service groups.

1. On the left, go to Traffic Management > Load Balancing > Service Groups.
   
2. On the right, click Add.
   
3. Name it svcgrp-Horizon-UDP443 or similar.
4. Change the Protocol to UDP. Click OK.
   
5. Click where it says No Service Group Member.
   
   1. Change the selection to Server Based, and then click Click to select.
      
   2. Select your multiple Unified Access Gateway appliances, and click Select.
      
   3. Enter 443 as the Port. Click Create.
      
6. Click OK to close the Service Group Members section.
   
7. On the right, in the Advanced Settings column, add the Monitors section.
   
   1. On the left, in the Monitors section, click where it says No Service Group to Monitor Binding.
      
   2. Click where it says Click to select.
      
   3. Select the Horizon-SSL monitor, click Select, and then click Bind.
      
8. Click Done to finish creating the Service Group for UDP 443.
9. Add another Service Group for PCoIP on TCP 4172.
   1. Name = svcgrp-Horizon-PCoIPTCP or similar.
   2. Protocol = TCP
      
   3. Members = multiple Unified Access Gateway appliances.
   4. Port = 4172.
      
   5. Monitors = Horizon-PCoIP. You can add the other monitors if desired.
      
10. Add another Service Group for PCoIP on UDP 4172.
    1. Name = svcgrp-Horizon-PCoIPUDP or similar.
    2. Protocol = UDP
       
    3. Members = multiple Unified Access Gateway appliances
    4. Port = 4172.
       
    5. Monitors = Horizon-PCoIP. You can add the other monitors if desired.
       
11. Add another Service Group for SSL_BRIDGE 8443.
    1. Name = svcgrp-Horizon-TCP8443 or similar.
    2. Protocol = SSL_BRIDGE
       
    3. Members = multiple Unified Access Gateway appliances
    4. Port = 8443.
       
    5. Monitors = Horizon-Blast. You can add the other monitors if desired.
       
12. Add another Service Group for UDP 8443 (Blast Extreme in Horizon 7).
    1. Name = svcgrp-Horizon-UDP8443 or similar.
    2. Protocol = UDP
       
    3. Members = multiple Unified Access Gateway appliances
    4. Port = 8443.
       
    5. Monitors = Horizon-Blast. You can add the other monitors if desired.
       
13. The six service groups should look something like this:
    

Load Balancing Virtual Servers

Unified Access Gateway appliances listen on multiple ports so you will need separate load balancers for each port number. Here is a summary of their Virtual Servers, all listening on the same Virtual IP address:

• Virtual Server on SSL_BRIDGE 443 – bind the SSL_BRIDGE 443 service group.
• Virtual Server on UDP 443 (Horizon 7) – bind the UDP 443 service group.
• Virtual Server on UDP 4172 – bind the PCoIP UDP service group.
• Virtual Server on TCP 4172 – bind the PCoIP TCP service group.
• Virtual Server on SSL_BRIDGE 8443 – bind the SSL_BRIDGE 8443 service group.
• Virtual Server on UDP 8443 (Horizon 7) – bind the UDP 8443 service group.

Do the following to create the Virtual Servers:

1. On the left, under Traffic Management > Load Balancing, click Virtual Servers.
   
2. On the right, click Add.
   
3. In the Basic Settings section:
   1. Name it lbvip-Horizon-SSL or similar.
   2. Change the Protocol to SSL_BRIDGE.
   3. Specify a new VIP. This one VIP will be used for all of the Virtual Servers.
   4. Enter 443 as the Port.
4. Click OK to close the Basic Settings section.
   
5. On the left, in the Services and Service Groups section, click where it says No Load Balancing Virtual Server ServiceGroup Binding.
   
   1. Click where it says Click to select.
      
   2. Click the radio button next to the Horizon-SSL Service Group, and click Select.
      
   3. Click Bind.
      
6. Click Continue to close the Services and Service Groups section.
   
7. Then click Done to finish creating the Load Balancing Virtual Server. Persistency will be configured later.
   
8. Create another Load Balancing Virtual Server for UDP 443. You can right-click the existing Load Balancing Virtual Server, and click Add to copy some settings.
   
   1. Same VIP as the TCP 443 Load Balancer.
   2. Protocol = UDP, Port = 443
      
   3. Service Group Binding = the UDP 443 Service Group
      
      
9. Create another Load Balancing Virtual Server for PCoIP UDP 4172:
   1. Same VIP as the 443 Load Balancer.
   2. Protocol = UDP, Port = 4172
      
   3. Service Group Binding = the PCoIP UDP Service Group.
      
      
10. Create another Load Balancing Virtual Server for PCoIP TCP 4172:
    1. Same VIP as the 443 Load Balancer.
    2. Protocol = TCP, Port = 4172
       
    3. Service Group Binding = the PCoIP TCP Service Group
       
       
11. Create another Load Balancing Virtual Server for SSL_BRIDGE 8443:
    1. Same VIP as the 443 Load Balancer.
    2. Protocol = SSL_BRIDGE, Port = 8443
       
    3. Service Group Binding = the TCP 8443 SSL_BRIDGE Service Group
       
       
12. Ceate another Load Balancing Virtual Server for UDP 8443:
    1. Same VIP as the 443 Load Balancer.
    2. Protocol = UDP, Port = 8443
       
    3. Service Group Binding = the UDP 8443 Service Group
       
       
13. This gives you six Virtual Servers on the same VIP, but different protocols and port numbers.
    

Persistency Group

Users will first connect to SSL_BRIDGE 443, and be load balanced. Subsequent connections to the other port numbers must go to the same load balanced appliance. Create a Persistency Group to facilitate this.

1. On the left, under Traffic Management, expand Load Balancing, and click Persistency Groups.
   
2. On the right, click Add.
   
3. Give the Persistency Group a name (e.g. Horizon).
4. Change the Persistence drop-down to SOURCEIP.
   
5. Enter a Time-out that is equal to, or greater than the timeout in Horizon View Administrator, which defaults to 10 hours (600 minutes).
6. In the Virtual Server Name section, click Add.
   
7. Move all six Unified Access Gateway Load Balancing Virtual Servers to the right. Click Create.
   

Horizon 7 Origin Check

Origin Check might prevent you from connecting to load balanced Connection Servers and/or Unified Access Gateways. You can disable Origin Check as detailed at VMware 2144768 Accessing the Horizon View Administrator page displays a blank error window in Horizon 7.

Load Balancing CLI Commands

Internal Connection Server Load Balancing

add server VCS01 10.2.2.19
add server VCS02 10.2.2.20
add serviceGroup svcgrp-VCS-SSL SSL_BRIDGE
add lb vserver lbvip-Horizon-SSL SSL_BRIDGE 10.2.5.203 443 -persistenceType SOURCEIP -timeout 600
bind lb vserver lbvip-Horizon-SSL svcgrp-VCS-SSL
add lb monitor Horizon-SSL HTTP-ECV -send "GET /broker/xml" -recv clientlaunch-default -LRTM DISABLED -destPort 443 -secure YES
bind serviceGroup svcgrp-VCS-SSL VCS01 443
bind serviceGroup svcgrp-VCS-SSL VCS02 443
bind serviceGroup svcgrp-VCS-SSL -monitorName Horizon-SSL

Unified Access Gateway load balancing with Blast Extreme only (no PCoIP)

add server UAG01 10.2.2.187
add server UAG02 10.2.2.24
add lb monitor Horizon-SSL HTTP-ECV -send "GET /broker/xml" -recv clientlaunch-default -secure YES
add serviceGroup svcgrp-Horizon-SSL SSL_BRIDGE
add serviceGroup svcgrp-Horizon-UDP443 UDP
bind serviceGroup svcgrp-Horizon-SSL UAG01 443
bind serviceGroup svcgrp-Horizon-SSL UAG02 443
bind serviceGroup svcgrp-Horizon-SSL -monitorName Horizon-SSL
bind serviceGroup svcgrp-Horizon-UDP443 UAG01 443
bind serviceGroup svcgrp-Horizon-UDP443 UAG02 443
bind serviceGroup svcgrp-Horizon-UDP443 -monitorName Horizon-SSL
add lb vserver lbvip-Horizon-SSL SSL_BRIDGE 10.2.2.204 443
add lb vserver lbvip-Horizon-UDP443 UDP 10.2.2.204 443
bind lb vserver lbvip-Horizon-SSL svcgrp-Horizon-SSL
bind lb vserver lbvip-Horizon-UDP443 svcgrp-Horizon-UDP443
bind lb group Horizon lbvip-Horizon-SSL
bind lb group Horizon lbvip-Horizon-UDP443
set lb group Horizon -persistenceType SOURCEIP -timeout 600

Unified Access Gateway load balancing with Blast and PCoIP

add server UAG01 10.2.2.187
add server UAG02 10.2.2.188
add serviceGroup svcgrp-UAG-SSL SSL_BRIDGE
add serviceGroup svcgrp-UAG-UDP443 UDP
add serviceGroup svcgrp-UAG-PCoIPTCP TCP
add serviceGroup svcgrp-UAG-PCoIPUDP UDP
add serviceGroup svcgrp-UAG-TCP8443 SSL_BRIDGE
add serviceGroup svcgrp-UAG-UDP8443 UDP
add lb vserver lbvip-Horizon-SSL SSL_BRIDGE 10.2.5.204 443
add lb vserver lbvip-Horizon-UDP443 UDP 10.2.5.204 443
add lb vserver lbvip-Horizon-PCoIPUDP UDP 10.2.5.204 4172
add lb vserver lbvip-Horizon-PCoIPTCP TCP 10.2.5.204 4172
add lb vserver lbvip-Horizon-8443SSL SSL_BRIDGE 10.2.5.204 8443
add lb vserver lbvip-Horizon-8443UDP UDP 10.2.5.204 8443
bind lb vserver lbvip-Horizon-SSL svcgrp-UAG-SSL
bind lb vserver lbvip-Horizon-UDP443 svcgrp-UAG-UDP443
bind lb vserver lbvip-Horizon-PCoIPTCP svcgrp-UAG-PCoIPTCP
bind lb vserver lbvip-Horizon-PCoIPUDP svcgrp-UAG-PCoIPUDP
bind lb vserver lbvip-Horizon-8443SSL svcgrp-UAG-TCP8443
bind lb vserver lbvip-Horizon-8443UDP svcgrp-UAG-UDP8443
add lb group Horizon -persistenceType SOURCEIP -timeout 600
bind lb group Horizon lbvip-Horizon-SSL
bind lb group Horizon lbvip-Horizon-UDP443
bind lb group Horizon lbvip-Horizon-PCoIPUDP
bind lb group Horizon lbvip-Horizon-PCoIPTCP
bind lb group Horizon lbvip-Horizon-8443SSL
bind lb group Horizon lbvip-Horizon-8443UDP
set lb group Horizon -persistenceType SOURCEIP -timeout 600
add lb monitor Horizon-SSL HTTP-ECV -send "GET /broker/xml" -recv clientlaunch-default -LRTM DISABLED -destPort 443 -secure YES
add lb monitor Horizon-PCoIP TCP -LRTM DISABLED -destPort 4172 -secure YES
add lb monitor Horizon-Blast TCP -LRTM DISABLED -destPort 8443 -secure YES
bind serviceGroup svcgrp-UAG-SSL UAG01 443
bind serviceGroup svcgrp-UAG-SSL UAG02 443
bind serviceGroup svcgrp-UAG-SSL -monitorName Horizon-SSL
bind serviceGroup svcgrp-UAG-SSL -monitorName Horizon-PCoIP
bind serviceGroup svcgrp-UAG-SSL -monitorName Horizon-Blast
bind serviceGroup svcgrp-UAG-UDP443 UAG01 443
bind serviceGroup svcgrp-UAG-UDP443 UAG02 443
bind serviceGroup svcgrp-UAG-UDP443 -monitorName Horizon-SSL
bind serviceGroup svcgrp-UAG-PCoIPTCP UAG01 4172
bind serviceGroup svcgrp-UAG-PCoIPTCP UAG02 4172
bind serviceGroup svcgrp-UAG-PCoIPTCP -monitorName Horizon-PCoIP
bind serviceGroup svcgrp-UAG-PCoIPUDP UAG01 4172
bind serviceGroup svcgrp-UAG-PCoIPUDP UAG02 4172
bind serviceGroup svcgrp-UAG-PCoIPUDP -monitorName Horizon-PCoIP
bind serviceGroup svcgrp-UAG-TCP8443 UAG01 8443
bind serviceGroup svcgrp-UAG-TCP8443 UAG02 8443
bind serviceGroup svcgrp-UAG-TCP8443 -monitorName Horizon-Blast
bind serviceGroup svcgrp-UAG-UDP8443 UAG01 8443
bind serviceGroup svcgrp-UAG-UDP8443 UAG02 8443
bind serviceGroup svcgrp-UAG-UDP8443 -monitorName Horizon-Blast

Horizon Security Server load balancing

add server VSS01 10.2.2.187
add server VSS02 10.2.2.24
add lb monitor Horizon-PCoIP TCP -destPort 4172
add lb monitor Horizon-Blast TCP -destPort 8443
add lb monitor Horizon-SSL HTTP-ECV -send "GET /broker/xml" -recv clientlaunch-default -secure YES
add lb monitor Horizon-SSL-VCS01 HTTP-ECV -send "GET /broker/xml" -recv clientlaunch-default -destIP 10.2.2.19 -destPort 443 -secure YES
add lb monitor Horizon-SSL-VCS02 HTTP-ECV -send "GET /broker/xml" -recv clientlaunch-default -destIP 10.2.2.20 -destPort 443 -secure YES
add service svc-VSS01-SSL VSS01 SSL_BRIDGE 443
add service svc-VSS02-SSL VSS02 SSL_BRIDGE 443
bind service svc-VSS02-SSL -monitorName Horizon-SSL-VCS02
bind service svc-VSS02-SSL -monitorName Horizon-SSL
bind service svc-VSS02-SSL -monitorName Horizon-Blast
bind service svc-VSS02-SSL -monitorName Horizon-PCoIP
bind service svc-VSS01-SSL -monitorName Horizon-SSL-VCS01
bind service svc-VSS01-SSL -monitorName Horizon-Blast
bind service svc-VSS01-SSL -monitorName Horizon-PCoIP
bind service svc-VSS01-SSL -monitorName Horizon-SSL
add serviceGroup svcgrp-Horizon-UDP443 UDP
add serviceGroup svcgrp-Horizon-PCoIPTCP TCP
add serviceGroup svcgrp-Horizon-PCoIPUDP UDP
add serviceGroup svcgrp-Horizon-TCP8443 SSL_BRIDGE
add serviceGroup svcgrp-Horizon-UDP8443 UDP
bind serviceGroup svcgrp-Horizon-UDP443 VSS01 443
bind serviceGroup svcgrp-Horizon-UDP443 VSS02 443
bind serviceGroup svcgrp-Horizon-UDP443 -monitorName Horizon-SSL
bind serviceGroup svcgrp-Horizon-PCoIPTCP VSS01 4172
bind serviceGroup svcgrp-Horizon-PCoIPTCP VSS02 4172
bind serviceGroup svcgrp-Horizon-PCoIPTCP -monitorName Horizon-PCoIP
bind serviceGroup svcgrp-Horizon-PCoIPUDP VSS01 4172
bind serviceGroup svcgrp-Horizon-PCoIPUDP VSS02 4172
bind serviceGroup svcgrp-Horizon-PCoIPUDP -monitorName Horizon-PCoIP
bind serviceGroup svcgrp-Horizon-TCP8443 VSS01 8443
bind serviceGroup svcgrp-Horizon-TCP8443 VSS02 8443
bind serviceGroup svcgrp-Horizon-TCP8443 -monitorName Horizon-Blast
bind serviceGroup svcgrp-Horizon-UDP8443 VSS01 8443
bind serviceGroup svcgrp-Horizon-UDP8443 VSS02 8443
bind serviceGroup svcgrp-Horizon-UDP8443 -monitorName Horizon-Blast
add lb vserver lbvip-Horizon-SSL SSL_BRIDGE 10.2.2.204 443
add lb vserver lbvip-Horizon-UDP443 UDP 10.2.2.204 443
add lb vserver lbvip-Horizon-PCoIPUDP UDP 10.2.2.204 4172
add lb vserver lbvip-Horizon-PCoIPTCP TCP 10.2.2.204 1472
add lb vserver lbvip-Horizon-8443TCP SSL_BRIDGE 10.2.2.204 8443
add lb vserver lbvip-Horizon-8443UDP UDP 10.2.2.204 8443
bind lb vserver lbvip-Horizon-SSL svc-VSS01-SSL
bind lb vserver lbvip-Horizon-SSL svc-VSS02-SSL
bind lb vserver lbvip-Horizon-UDP443 svcgrp-Horizon-UDP443
bind lb vserver lbvip-Horizon-PCoIPTCP svcgrp-Horizon-PCoIPTCP
bind lb vserver lbvip-Horizon-PCoIPUDP svcgrp-Horizon-PCoIPUDP
bind lb vserver lbvip-Horizon-8443TCP svcgrp-Horizon-TCP8443
bind lb vserver lbvip-Horizon-8443UDP svcgrp-Horizon-UDP8443
bind lb group Horizon lbvip-Horizon-SSL
bind lb group Horizon lbvip-Horizon-UDP443
bind lb group Horizon lbvip-Horizon-PCoIPUDP
bind lb group Horizon lbvip-Horizon-PCoIPTCP
bind lb group Horizon lbvip-Horizon-8443TCP
bind lb group Horizon lbvip-Horizon-8443UDP
set lb group Horizon -persistenceType SOURCEIP -timeout 600