VMware Branch Office Desktop VALIDATED DESIGN GUIDE

Transcription

1 ware Branch Office Desktop VALIDATED DESIGN GUIDE

2 ware Branch Office Desktop Table of Contents.... About the Validated Design Guide Introduction... 4 Audience Business Case What is a Branch Office Desktop?... 5 Design Overview User Profiles Design Components... 8 Key Components of the Architecture Validation Configuration Lab Equipment List Solution Components Resource Pool Configuration WAN Services LAN Services Network Configuration vcns Edge, App, and Data Protection Deployment vshield App Firewall Rules vcns Data Protection Compliance Configuration Secure Connectivity Between Branch Site and Headquarters Site Antivirus Configuration ware Mirage Configuration Storage Configuration CIFS Configuration ThinApp, Persona, and Corporate Data Backup and Disaster Recovery Security Single Sign-On (Optional Component) Monitoring Summary VALIDATED DESIGN GUIDE / 2

3 ware Branch Office Desktop About the Validated Design Guide A ware Validated Design Guide provides an overview of a solution architecture and implementation. The validated designs and solutions have been created through architectural design development and lab testing. The guide is intended to provide guidance for the introduction of proof of concepts, emerging new technology and architectures, as well as the enhancement of customer use cases. Validated Design Guides: Incorporate generally available products into the design Employ repeatable processes for the deployment, operation, and management of components within the solution Validated designs are tested for a specific use case or architectural practice of a limited scale and duration. These guides ensure the viability of theoretical designs or concepts in real-world practices. Validated Design Guides provide an overview of the solution design and implementation that include the following elements: Use cases catered to by the design Products validated as part of design testing Software used for each component of the design Configurations used to support the design test cases A list of design limitations and issues discovered during testing Introduction This Validated Design Guide provides an overview of the ware Branch Office Desktop solution. The architecture uses products from ware and its ecosystem of partners to build a comprehensive solution that satisfies the specific requirements of various use cases in enterprises such as security, compliance, and printing. This document provides an overview of the various use cases, logical solution architecture, and results of the tested configuration. The solution is not exclusive to the products tested within the architecture. Consult your ware representative on how to modify the architecture with your preferred vendors. The key benefits of the Branch Office Desktop are local performance, streamlined remote image management, and enhanced data security and compliance. Audience This document is intended to assist solution architects, sales engineers, field consultants, advanced services specialists, and customers who configure and deploy a Branch Office Desktop solution. VALIDATED DESIGN GUIDE / 3

4 ware Branch Office Desktop Business Case Today there are over 11 million branch offices worldwide with 80% of employees accessing their desktops remotely. And when it comes to managing IT in branch offices, it s not uncommon for organizations to look at centralization. Why? Because it simply isn t efficient to maintain local IT staff and resources in each location, especially when the work tasks being supported in each location are near-identical. Not only is the inefficiency of replicated and distributed IT management an unnecessary resource drain, it can expose the organization to greater risks of lost productivity and revenues by creating many more points of vulnerability. Against this backdrop, desktop virtualization is a compelling technology option, because it provides a quick and straightforward mechanism for centralizing existing distributed end-user capabilities. The recognized security, high availability and cost streamlining characteristics of desktop virtualization seem ideally suited to the branch-office requirement unfortunately one major hurdle has consistently stood in the way: the WAN. Not only is bandwidth expensive and in some cases a constraint on application performance, but the single point of failure it presents a genuine risk for organizations that need constant uptime. Where desktop virtualization has been deployed for branch office workers, it s not uncommon to see critical application servers still located in the branch, while the virtual desktops sit in a corporate datacenter. This compounds the impact of network latency on application performance and can make life more difficult for branch employees trying to get their work done. Of course, not all branches were created equal and not all users have the same application requirements in terms of function and performance. Many branches have an abundance of bandwidth, but others clearly do not. In other words, any solution to the branch-office worker requirement needs to be able address a variety of requirements. To holistically address these different needs, ware has recently tested and validated a new Branch Office Desktop solution that delivers the efficiencies and cost savings of centralization, but doesn t assume that every desktop image must be centralized. It combines hosted virtual desktops, with image management for physical and virtual endpoints located in the branch. By supporting a spectrum requirements through an adaptable solution that combines both approaches, we ensure our Branch-Office Desktop can be right-sized to the specific needs of individual branch locations and workers. For organizations with ample bandwidth the solution leverages hosted virtual desktops with ware View and View Composer to help enhance security, ensure high availability and streamline management. For those branches where bandwidth is constrained, but security and mobility remain critical, the solution incorporates the use of storage and compute appliances to ensure LAN-like performance can be maintained. VALIDATED DESIGN GUIDE / 4

5 ware Branch Office Desktop What is a Branch Office Desktop? Regional and branch offices need access to corporate assets but often lack local administrative resources to maintain and manage these assets in a timely manner. The Branch Office Desktop solution delivers consistent and scalable desktops as a managed service for remote and branch office workers across the WAN to maximize uptime, streamline desktop management, and drive down operational costs. By implementing the Branch Office Desktop solution, you can benefit from: Enhanced local user experience Ease of management Security Design Overview The design we have validated in the solution s lab identifies the hybrid approach combining the best of both worlds in ware View and ware Mirage technologies. The ware Branch Office Desktop is seamlessly assembled to offer user flexibility, enforce branch office policy, enable single image management, and deliver optimum experience. By integrating the ware vcenter Operations Management Suite (vcops) and View Adapter collection at the branch, the solution offers the business better visibility and more flexibility for managing branches. The core design includes the following elements: Application performance management and end-user monitoring tools to ensure the best possible user experience vcops for View (V4V) provides a single pane of management for our virtual desktop infrastructure ware View and ware Mirage to support both physical and virtual image management, and persistent and stateless desktops Antivirus protection with vsphere Endpoint for virtual desktops, traditional AV in guest OS for physical desktops and recovery from virus infections for physical desktops to the last known good image with ware Mirage Full DK level backup practices on virtual profiles/persona server, SQL database, and all infrastructure virtual machines to ensure fast recovery when needed The design can leverage ware Rapid Desktop Appliances. VALIDATED DESIGN GUIDE / 5

6 ware Branch Office Desktop User Profiles In a typical organization multiple user profiles exist, each with unique requirements. This solution architecture caters to the following user profiles within the Branch Office Desktop use case. These can be fulfilled using a mixed type of deployment including Mirage-managed persistent virtual desktops, Mirage-managed physical desktops, and stateless virtual desktops. User Profile Characteristics Office-Based Information Worker Content / Media Worker / Software Developer Home Office Worker Traveling Worker VIP Workers with a broader skill set that require assimilation and manipulation of information or input from multiple sources. Examples include higher-level, backoffice functions, such as finance, IT, and mid-level management. Users will require a relatively broad application portfolio and need some level of control over how they access applications and data, but not full administrative control. They are unlikely to be mobile, but might work from more than one fixed location. They will require multi-channel communication and collaboration capabilities for working with peers. Workers with a high level of expertise in an area of creativity or science that require detailed manipulation of content. These are the traditional power users. Examples include engineers, graphic designers, and some developers. They typically require a narrow, but specialized portfolio of applications. They are unlikely to be mobile and normally work from a single, fixed location. They also need some level of control over how they access applications and data, but not full administrative control, and may be ring-fenced from other corporate functions. They require high levels of computation capability and graphical display and may also require specialist peripheral devices. Workers with a broader skill set that require assimilation and manipulation of information or input from multiple sources. These workers traditionally work from home and may also need to roam within a defined area or set of areas such as a campus or office. Examples include remote workers, teachers, doctors, and higherlevel managers. Workers who spend at least 50 percent of their time in a non-office / non-campus location. They typically perform a single function which is often customer facing. Examples include sales and service representatives. They typically require access to only a narrow portfolio of applications and only create information content in a highly structured manner. They do not require control over how they access applications or data, but need access from almost any location within geographic boundaries. They tend to use laptops. Business executives that typically require access to only a small number of applications, but expect control over how they access these applications and corporate data. They need to be mobile and tend to use tablets and laptops. VALIDATED DESIGN GUIDE / 6

7 ware Branch Office Desktop The business profiles featured above can be translated into two distinct user workload profiles as listed below: User Profile Characteristics Task Worker Knowledge Worker Application Profile Microsoft Office, Adobe, Internet Explorer (IE), Firefox, Chrome, Outlook, corporate apps Antivirus Network Profile LAN (remote office LAN) Security Profile Audit capability, antivirus and data loss protection Application Profile Microsoft Office, Adobe, IE, Firefox, Chrome, Outlook, SaaS apps, Windows apps, multimedia players (Flash, etc.), antivirus, WebEx Network Profile LAN (remote office LAN) Security Profile Audit capability and GPO settings for UX policy, antivirus and data loss protection Other Multi-monitor; print to nearest printer VALIDATED DESIGN GUIDE / 7

8 ware Branch Office Desktop Design Components The design uses a single-tier branch profile consisting of a fully integrated, one-box solution; all necessary branch office network functions such as LAN or WAN exist in a single tier or device. A single-tier branch design allows customers to take advantage of ware Rapid Desktop Program certified appliances. The ware Rapid Desktop View Appliance is a fully certified, converged, and scalable solution. Each certified and validated appliance delivers predictable units of performance and user experience. Datacenter - Basic Backup vcops vcenter ware Mirage ESX Host - Main Datacenter View Appliance + ware Distributed Branch Office WAN Branch ESX Host - Branch View Appliance VSS AD Load Balancer Appliance SQL DB App Servers RADIUS VCS vshield Manager vcenter Global Domain Catalog Controller Mail Server Endpoint Security i.e AV ware Mirage Branch Reflector(s) ware Mirage Single Image Update & App Layering Print Server VDI Desktop with ware Mirage Agent Physical Desktop with ware Mirage Agent Figure 1: ware Branch Office Desktop Architecture VA L I D A T E D D E S I G N G U I D E / 8

9 ware Branch Office Desktop Key Components of the Architecture Though the architecture is vendor agnostic, below is a list of components that are part of the architecture. Core Components Component Description ware vsphere and vcenter ware View ware Mirage ware vcloud Networking and Security (vcns) App, Edge, Data Security (formerly vshield App, Edge, Data Security) ware vcops Persona Management and user-installed apps Backup and restore The solution is built on top of vsphere, the industry-leading virtualization platform. There are many benefits to using the vsphere platform and more information on this platform can be found at www. vmware.com/products/vsphere. The central component of the solution architecture, ware View is the industry-leading virtual desktop infrastructure (VDI) product. More information on ware View can be found at ware Mirage can distribute a single image to a group of PCs anywhere on the network, quickly and easily. These images are seamlessly merged into a Windows endpoint. With just a few clicks in the Mirage Management Console, IT can initiate a Base Layer enforce operation that brings any desktop back into full compliance without impacting user profiles or user data. User-installed applications can be maintained or removed, if the IT administrator wishes, during this operation as well. ware vcloud Networking and Security is the leading software-defined networking and security solution that enhances operational efficiency, unlocks agility, and enables extensibility to rapidly respond to business needs. It provides a broad range of services in a single solution, including virtual firewall, VPN, load balancing, and VXLAN extended networks. One of the biggest challenges faced by IT is on-demand management of the entire environment and the need to proactively identify and plan the infrastructure. ware vcops for View provides the management infrastructure required for the environment. More information on ware vcops can be found at Many use cases defined in the solution have a requirement to persist user information across sessions. The biggest cost savings, however, both in terms of CAPEX and OPEX, can be achieved by using stateless desktops. To effectively achieve this, ware View has a feature called Persona Management to maintain user data and profile persistence across stateless sessions. In addition to profile persistence, some use cases require support for user-installed apps. This can be achieved by using some of our partner products. Backup and restore capabilities are added as a core component in this design to protect data at each branch site. This design incorporates two types of backup: image-level protection and guest-level protection. Image-level protection enables backup clients to make a copy of all the virtual disks and configuration files associated with the particular virtual desktop in the event of hardware failure, corruption, or accidental deletion of a virtual desktop. VALIDATED DESIGN GUIDE / 9

10 ware Branch Office Desktop Validation Configuration In some user scenarios, ware Mirage can be deployed at the branch on its own for simple, single-imagemanagement deployment. In our solution lab validation, we deployed the hybrid approach: ware View centralized management and ware Mirage image management. In the branch location, one or more clients can be designated dynamically as a reflector to serve peers. In the main datacenter, a simple deployment of ware Mirage Server cluster with file portal is deployed. At the Mirage Server level, we enable the branch reflectors for each site. To deploy Mirage-managed clients, both physical and virtual, a 2MB Mirage Client is then installed. This use case allows easy fail over from physical to virtual with the exact same desktop experience. For storage implementation, SAN, NAS, or local storage is supported. In our lab validation, we assume 15GB per user and enable compression on the selected Mirage storage volume (for savings up to 25 percent). On the network side, Mirage consumes an average of 15Kbits/sec per user, which equals roughly 50MB per user per day. Workloads will vary by use case and bandwidth will be dynamically adjusted depending on user activities to ensure the best user experience. ware View provides central management and real-time secure access. You can create persistent desktops or stateless desktops for various workloads in any branch functions. All View event databases, security events, user business application transaction QoS data, and backup events can be fully integrated into the vcops with View Adapter (V4V). In this design, the Branch Office Desktop includes some ware ISV partner solutions including load balancing, backup, replication, WAN acceleration, and security and data loss protection (DLP) products. The exhaustive list of vendors is designed to remain neutral for functional validation purposes only. VALIDATED DESIGN GUIDE / 10

11 ware Branch Office Desktop Lab Equipment List Headquarters Site Product Function / Description / Version Servers Storage Networking 2U server with 2 Intel Xeon E GHz processors, 128GB RAM Nimblestorage CS220 8TB Array iscsi storage array, Raw Disk Capacity: 8TB, Raw Flash Cache 160GB, 24GB RAM, 4 1GbE network ports Unmanaged layer 3 10 / 100 / 1, port switch Branch Site Product Function / Description / Version Servers Storage Networking 4U server with 2 Intel Xeon E7-8837, 128GB RAM Nimblestorage CS220 8TB Array iscsi storage array, Raw Disk Capacity: 8TB, Raw Flash Cache 160GB, 24GB RAM, 4 1GbE network ports Unmanaged layer 3 10 / 100 / 1, port switch VALIDATED DESIGN GUIDE / 11

12 ware Branch Office Desktop Solution Components Headquarters Site Product Function / Description / Version vsphere vsphere with vcenter 5.0 ware Mirage 3.6 vcloud Networking and Security Suite 5.1 Branch Site Product Function / Description / Version vsphere vsphere with vcenter 5.0 ware View with Persona Management 5.1 ware View Composer 3.0 ware Mirage 3.6 vcloud Networking and Security Suite 5.1 vcops vcops for View 1.0 ware Zimbra 8.0 Antivirus Trend Micro Deep Security 8.0 Backup and restore CommVault Simpana 9 Application transaction monitoring / user perspectives Aternity 5.6 Optional Components Product Function / Description / Version Load balancer Single sign-on F5 BigIP Indigo Identityware InSession VALIDATED DESIGN GUIDE / 12

13 ware Branch Office Desktop Resource Pool Configuration A resource pool allows us to allocate a section of CPU and memory resources dedicated for a particular type of workload. This allows granularity in ensuring each workload can be properly managed. To handle the multiple desktop workloads, in each branch we created resource pools for each of the following components: ware View managed stateless desktop pool ware Mirage managed persistent desktop pool Infrastructure, monitoring, and View vapps Figure 2: Resource Pool Configuration VALIDATED DESIGN GUIDE / 13

14 ware Branch Office Desktop WAN Services In a branch office deployment there is often some scope for optimization services of the wide area network. Consideration should be given to application services such as network de-duplication, compression, latency optimization, and caching techniques when deploying in production. These services can deliver multiple benefits and should be strongly considered. ware has several technology partners that can be leveraged to provide WAN application services and more information on these solutions can be found here. partners.html LAN Services Due diligence, for both corporate headquarters and branch networks, must be performed as part of the Branch Office Desktop design to realize the best possible performance for the overall solution. A good design will consider quality and class-of-service policies that optimize delivery of real-time protocols such as PCoIP, along with general best practices for bandwidth optimization, congestion algorithms, and latency/jitter tuning. Further information can be found in the ware View 5 with PCoIP Network Optimization guide. VALIDATED DESIGN GUIDE / 14

15 ware Branch Office Desktop Network Configuration The network design for this solution has been implemented using industry-standard best practices and ware best practices. For all broadcast domains, VLANs have been implemented to segregate vsphere management and virtual machine traffic where appropriate, and all ESX host port uplinks are configured as 802.1q trunks. In the virtual infrastructure, vsphere Distributed Switch technology has been leveraged in headquarters and branch hosts and then secured using ware vcloud Networking and Security. Where possible, jumbo frames were implemented in the virtual switches along with XNET3 network adapters in Windows guests for both infrastructure and desktop virtual machines. Further information can be found in the ware Performance Best Practices guide. Configuration of virtual distributed switches (vds) for the branch site is illustrated in the diagram below. ESXi Host Uplink Port 1 Uplink Port 2 Uplink Port 3 Uplink Port 4 Management 1 VLAN Management 2 VLAN Fault Tolerance Logging VLAN vds Mirage Managed Persistent Pool VLAN Stateless Pool VLAN vmotion VLAN Figure 3: vds Configuration for the Branch Site VALIDATED DESIGN GUIDE / 15

16 ware Branch Office Desktop vcns Edge, App, and Data Protection Deployment The figure below illustrates how the vcns App Security Zones were set up for communication between the management components and the desktop pools. Branch ware vshield App ware vshield App Mirage Managed Persistent Pool Stateless Desktop Pool ware vshield App Management Infrastructure Figure 4: vcns App Provides Access Policy among Different Functional Groups VALIDATED DESIGN GUIDE / 16

17 ware Branch Office Desktop vshield App Firewall Rules For each of the desktop pools, we have blocked all traffic between the two pools. We have also defined the allowable traffic between the desktop pools and the management infrastructure with vapps. By only allowing the required traffic for defined applications in the desktop pools, we are able to protect the infrastructure virtual machines from any unauthorized communication. Figure 5: Dashboard of vcns App Firewall Rules VALIDATED DESIGN GUIDE / 17

18 ware Branch Office Desktop vcns Data Protection Compliance Configuration Deploying vcns with Data Security enables IT to scan for sensitive data across the entire virtual infrastructure and desktops. It includes predefined templates for country- and industry-specific regulars to quickly identify and report sensitive data violations. It is deployed at the branch as its own virtual machine as part of the vcns suite. Since the data discovery functions are offloaded to this virtual machine, compliance can be maintained without sacrificing performance at the branch. Figure 6: Dashboard Illustrating Enabled Compliance Profiles at the Branch Site VALIDATED DESIGN GUIDE / 18

19 ware Branch Office Desktop Secure Connectivity Between Branch Site and Headquarters Site In the Branch Office Desktop solution, we use vcns Edge (formally vshield Edge) secure IPSec site-to-site VPNs to connect the headquarters and branch network sites. In a typical production deployment, the networks at the headquarters and branch sites are usually not contiguous and a VPN allows both sites to communicate as though they were locally attached. This gives us two main benefits: simplified networking design and secure communications over the WAN. More information can be found in the ware technical brief Securing Hybrid Clouds with ware vshield Edge VPNs. Figure 7: Site-to-Site VPN Configuration Figure 8: Site-to-Site VPN Configuration Network Menu VALIDATED DESIGN GUIDE / 19

20 ware Branch Office Desktop Figure 9: Site-to-Site VPN Configuration Add IPSec-VPN Tunnel Figure 10: Site-to-Site VPN Configuration Configure Services Settings VALIDATED DESIGN GUIDE / 20

21 ware Branch Office Desktop Antivirus Configuration ware vshield Endpoint (now included with vsphere) provides industry-standard APIs to optimize antivirus and anti-malware security for virtual environments via integration with ware partners. ware vshield Endpoint allows security technology partners to offer more efficient antivirus and anti-malware protection for virtual hosts, including ware View desktops. You can offload antivirus and anti-malware functions from individual virtual machines to a centralized secure virtual appliance. For physical desktops, we deployed a traditional antivirus server and antivirus clients to each of the desktop OS images. For the virtual desktops, ware vshield Endpoint offloads virtual desktop antivirus and antimalware scanning operations to a dedicated secure virtual appliance delivered by ware partners. Offloading scanning operations improves desktop consolidation ratios and performance by eliminating antivirus storms, while streamlining antivirus and anti-malware deployment and monitoring and satisfying compliance and audit requirements through detailed logging of antivirus and anti-malware activities. ware Mirage Configuration ware Mirage Server was deployed at the headquarters site. A branch reflector was then installed and configured at the branch site. A resource pool was created to contain all of the Mirage-managed persistent desktops at the branch. Figure 11: ware Mirage Dashboard Listing All Mirage-Enabled Clients VALIDATED DESIGN GUIDE / 21

22 ware Branch Office Desktop Figure 12: ware Mirage Dashboard Showing the Branch Reflector Status A Centralized Virtual Desktop (CVD) represents the desktop image and can be efficiently stored and managed, modularly restored, or re-deployed to any physical or virtual system client. For our validation we had both types of clients, physical and virtual, that were managed by the Mirage Server above. Figure 13: ware Mirage Dashboard Showing an Image Sync Up in Progress for Each Clients VALIDATED DESIGN GUIDE / 22

23 ware Branch Office Desktop Physical Device Failover to a with Mirage What happens when a physical device fails? In a typical branch office, the user experiences data loss -- from minimal to catastrophic depending on how frequently they may have synced their files with their current data backup solution. In our validation, physical devices at the branch are managed with Mirage. This means that their user data has been continously synced to the Mirage Server so in the event of hardware failure, their data is safely stored and can be restored. While the user waits for new hardware to arrive, Mirage allows the ability to restore the user data to a virtual desktop. The virtual machine will have the Mirage Agent which will start restoring the user data and files therefore allowing the user minimal downtown. Here are the steps an IT Administrator can take to restore the user s data and files to a virtual desktop. A new virtual desktop must be provisioned but not have the View Agent or ware Tools installed. The virtual desktop should have the Mirage Agent installed and be able to communicate with the Mirage Server at the headquarters site. Go into the Mirage Server Management Console, and go into the Prending Devices area where new unassigned devices ( including the new virtual desktop ) are listed. From here right click on the computer name of the new virtual desktop that was provisioned for the data recovery and select Disaster Recovery. VALIDATED DESIGN GUIDE / 23

24 ware Branch Office Desktop The wizard for disaster recovery appears and select on the option Replace the User Machine. Select the correct stored Image (CVD) for the user that you want restored to the new virtual desktop. VALIDATED DESIGN GUIDE / 24

25 ware Branch Office Desktop In this menu we select the new naming convention for the image and put in the domain credentials for the desired target domain for the virtual desktop. Then you will click next and finish. Logging onto the virtual desktop will show the Mirage Agent and the status of the users files and data being copied from the Mirage Server onto the virtual desktop. Once this has completed, reboot the virtual desktop and log back in and proceed with installing ware Tools and ware View Agent. Now the virtual desktop will be ready for the user to use and access all of their files. VALIDATED DESIGN GUIDE / 25

26 ware Branch Office Desktop Storage Configuration In the Branch Office Desktop design, storage is an important element to ensure optimal user experience and provide backup and restore capabilities in case a branch site were to go down. CIFS Configuration ThinApp, Persona, and Corporate Data ware ThinApp packages are stored on commodity CIFS storage for simple distribution to Windows endpoints in the Branch Office Desktop design. As part of the design, the ThinApp repository was replicated to headquarters from the branch site using Active Directory Distributed File System services. For persona and corporate files, the same methodology was implemented and a one-way replication was established. This methodology is primarily for data retention; however it is also leveraged in the event of a branch-hosted user connecting back to headquarters, where the data can be made available. Backup and Disaster Recovery Between headquarters and the branch site, users that have a stateless virtual desktop have their files and data replicated back to headquarters storage. Folder redirection is accomplished using Microsoft AD Group Policy Objects (GPOs). The GPO maps the end user s My Documents folder to a DFS global name space. Microsoft DFS replication is used here. For Mirage clients, user data (along with their entire image) is replicated back to the Mirage Server at headquarters. In case of virtual machine or physical device failure, the Mirage client can be set to sync back that device s image (including all files and applications) to any new Mirage-enabled physical or virtual desktop. At each branch site, the management virtual machines are backed up at regular intervals to a local backup appliance and also to the headquarters. This helps to restore the site quickly in case of a failover. Security Single Sign-On (Optional Component) Single sign-on (SSO) software and tap-and-go cards provide access control for multiple related, but independent, software systems. Using an SSO product in the architecture enhances user experience since the user logs into the environment only once to access all applications provisioned for them. SSO software can be used in conjunction with a tap-and-go card which further enhances user experience. For the Branch Office Desktop, a typical deployment of SSO software would include deploying the SSO server to the headquarters infrastructure. By centralizing the SSO server, all credentials for a particular site can be defined and managed by IT personnel at headquarters. At the branch office, an additional SSO replica / child server can be deployed (if supported by the vendor product) to speed up the authentication process locally. VALIDATED DESIGN GUIDE / 26

27 ware Branch Office Desktop Monitoring ware vcenter Operations Manager (vcops) for View extends the trusted analytical capabilities of the vcenter Operations Manager product family to the View desktop environment. vcops for View focuses on the virtual desktop end-user experience, providing monitoring and management of performance metrics critical to superior View user performance. vcops for View monitors the View desktop, as well as all of the supporting elements of the virtual infrastructure, from a View-specific customized console. Figure 14: vcops for View Dashboard Showing VDI Health vcops and the vcops for View adapter are deployed and configured at each branch site providing a single dashboard for monitoring the entire infrastructure for the branch. By adding third-party Quality of Service monitoring software, additional feedback such as application response times can be checked to ensure that the local user experience remains high. Third-party software that provides additional metrics can be integrated with vcops thereby enriching the single dashboard experience for IT. VALIDATED DESIGN GUIDE / 27

28 ware Branch Office Desktop Summary The main objectives for this validation were: Enhanced local experience Bringing VDI workload directly to the local branch Ease of management Any level of IT professional can have role-based access to manage the branch office environment via the View Administration console or vcops management console Security Fully deployed with complete vcloud Networking and Security (vcns) from Edge, App, to Endpoint along with third-party ISV s antivirus products. In addition, the lab also deploys Microsoft RADIUS for View RADIUS authentication with 2FA authentication such as USB etoken access into the physical and virtual desktops The Branch Office Desktop solution lab validation tested the main objectives by extending coverage of ware View and Mirage, and combining and exploring interactions between ISV products as well as Network Systems in a customer-representative environment. ware, Inc Hillview Avenue Palo Alto CA USA Tel Fax Copyright 2012 ware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. ware products are covered by one or more patents listed at ware is a registered trademark or trademark of ware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. Item No: W-DG-BRANCHOFF-USLET WEB