Cisco VXC PCoIP Configuration

Transcription

1 As a user or administrator you can interact with your Cisco VXC clients through the embedded HTTPS web interface (the Administrative Web Interface) and On Screen Display (OSD). Users can connect or disconnect a session, view diagnostics, and configure user parameters. Administrators can view and change configuration settings and user permissions, upload data to the PCoIP device, view session diagnostics information, and view product information. To minimize the total learning curve and maximize the accessibility, the web interface and OSD are organized as similarly as possible and are structured in a task-oriented fashion. Device Configuration, page 1 VPN for Cisco VXC 2111, page 63 Device Configuration The Configuration option on the Administrative Web Interface and OSD lets you configure various aspects for the device. This section describes the full set of configuration options. The OSD configuration options are a subset of the options available in the Administrative Web Interface. To make changes to the configuration settings you need an administrative password. You do not need a password to view the Diagnostic and Information menus. Configuration Using the Initial Setup Web Page The Initial Setup web page contains the configuration parameters that you can set before using the client. The page simplifies the out-of-box experience and reduces the time for new users to establish a session between a PCoIP zero client and remote virtual machine. More complex environments require further configuration. 1

2 Configuration Using the Initial Setup Web Page Cisco does not recommend that you use this page to configure the Cisco VXC client. To configure Session parameters, see Session Configuration, on page 16. To configure network options see Network Settings Configuration, on page 4. To configure audio parameters, see Audio s Configuration. To set up a connection with a VMware View Connection Server, see VMware View Connection Configuration, on page 18. If configured in the firmware defaults, the Initial Setup page appears the first time you log in. After you click Apply, the Home page appears for subsequent sessions unless the firmware parameters are reset. After you update the settings on this page, click Apply. Figure 1: Initial Setup Web Page The following table lists the audio parameters. For more information, see Audio s Configuration. 2

3 Configuration Using the Initial Setup Web Page Table 1: Audio s Enable HD Audio Comments Enables audio support on the client The following table lists the network parameters. For more information, see Network Settings Configuration, on page 4. Table 2: Network s Enable DHCP IP Address Subnet Mask Gateway Primary DNS Server Secondary DNS Server Comments Enables DHCP rather than manual configuration The device IP address The device subnet mask The device gateway IP address The device primary DNS IP address The device secondary DNS IP address The following table lists the client session parameters. For more information, see Session Configuration, on page 16. Table 3: Session s (Client) Identify Host by Host IP Address Host MAC Address Comments Specifies the host identify method. Specifies the host IP address Specifies the host MAC address. You can set the Host MAC Address value to to ignore this field when a session starts. 3

4 Network Settings Configuration Network Settings Configuration You can configure the client network settings from the Network page. After you update the parameters on this page, click Apply to save your changes. Figure 2: Network Configuration Web Page Figure 3: OSD: Network Configuration 4

5 Network Settings Configuration Table 4: Network Settings s Enable DHCP IP Address Subnet Mask Gateway When enabled: The device contacts a DHCP server to be assigned an IP address, subnet mask, gateway IP address, and DNS servers. The firmware requests a domain name (option 15), host name (option 12), and client FQDN (option 81). When disabled: You must set these parameters manually. The device IP address. If DHCP is disabled, you must set this field to a valid IP address. If DHCP is enabled, you cannot edit this field. The device subnet mask. If DHCP is disabled, you must set this field to a valid subnet mask. If DHCP is enabled, you cannot edit this field. Caution It is possible to configure an illegal IP address/subnet mask combination (for example, invalid mask) that leaves the device unreachable. Take care when setting the subnet mask. The device gateway IP address. If DHCP is disabled, this field is required. If DHCP is enabled, you cannot edit this field. 5

6 Network Settings Configuration Primary DNS Server Secondary DNS Server Domain Name FQDN The device primary DNS IP address. This field is optional. If the DNS server IP address is configured when using a Connection Manager, the Connection Manager address may be set as an FQDN instead of an IP address. The device secondary DNS IP address. This field is optional. If the DNS server IP address is configured when using a Connection Manager, the Connection Manager address may be set as an FQDN instead of an IP address. The domain named used (for example, domain.local). This field is optional. This field specifies the client domain. The Fully Qualified Domain Name for the client. The default is pcoip-portal-<mac> where <MAC> is the client MAC address. If used, the domain name is appended (for example, pcoip-portal-<mac>.domain.local). This field is read-only on this page. To use the FQDN feature, the DNS server with DHCP option 81 must be available and properly configured. 6

7 Network Settings Configuration Ethernet Mode Maximum MTU Size Enable 802.1X Security Lets you configure the Ethernet mode of the client as: Auto 10 Mbps Full-Duplex 100 Mbps Full-Duplex When you choose 10 Mbps Full Duplex or 100 Mbps Full-Duplex and then click Apply, this warning message appears: Warning: When Auto-Negotiation is disabled on the PCoIP device, it must also be disabled on the switch. Additionally, the PCoIP device and switch must be configured to use the same speed and duplex parameters. Different parameters may result in a loss of network connectivity. Are you sure you want to continue? Click OK to change the parameter. Always set the Ethernet Mode to Auto and use only 10 Mbps full-duplex or 100 Mbps full-duplex when the other network equipment (for example, switch) is also configured to operate at 10 Mbps full-duplex or 100 Mbps full-duplex. An improperly set Ethernet Mode may result in the network operating at half-duplex (which is not supported by the PCoIP protocol). The session will be severely degraded and eventually dropped. Lets you configure the Maximum Transfer Unit packet size. A smaller MTU may be needed for situations such as VPN tunneling because PCoIP packets cannot be fragmented. Set the Maximum MTU Size to a value smaller than the network path MTU for the end-to-end connection between the virtual machine and client. The Maximum MTU Size range is 600 to 1500 bytes for all firmware versions. The default MTU is 1300 for sessions with the remote virtual machine. Enable this field for each of your hosts and zero clients if your network uses 802.1x security to ensure that only authorized devices access the network. If enabled, configure the Authentication, Identity, and Client Certificate fields. 7

8 Access Settings Authentication Identity Client Certificate Enable 802.1X Legacy Support This field is set to TLS (Transport Layer Security) and is grayed-out. TLS is currently the only authentication protocol supported. Enter the identity string used to identify your device to the network. Click Choose to select the client certificate you want to use for your 802.1x devices. The list of certificates that appears includes the certificates uploaded from the Certificate Upload page that contain a private key. The certificate you choose from the Network page is linked to the read-only Client Certificate field on the Certificate Upload page. PCoIP only supports one 802.1x client certificate. Ensure your security details are all contained within the one file. The 802.1x certificate must contain a private key. When enabled, allows greater 802.1x compatability for older switches on the network. Access Settings The Access page lets you prevent the device from being managed by the Cisco VXC Manager, PCoIP Management Console, or any other PCoIP device management tool, and lets you disable administrative access to the Administrative Web Interface. It also provides an option to force an administrative password change the next time the Administrative Web Interface or OSD is accessed. 8

9 Access Settings At least one of the device's management configuration interfaces must remain enabled at all times. If the device has its OSD Configuration menu hidden (see PCoIP Management Console documentation), you will receive an error message if you select to disable both the Management Console Interface and the Administrative Web Interface from this page. In this situation, only one of these interfaces can be disabled. Figure 4: Access Configuration Web Page Figure 5: OSD: Access Configuration 9

10 Configure IPv6 Settings Table 5: Access Settings s Disable Management Console Interface Disable Administrative Web Interface Force password change on next login When selected, the device cannot be accessed or managed by the Cisco VXC Manager, the PCoIP Management Console, or any other PCoIP device management tool. When selected, the device cannot be accessed or managed using the Administrative Web Interface. When selected, the administrative password must be changed the next time either the Administrative Web Interface or OSD is accessed. The new password may be blank. Configure IPv6 Settings The IPv6 page lets you enable IPv6 for PCoIP devices connected to your IPv6 network. 10

11 Configure IPv6 Settings IPv6 is not currently supported by VMware View. Figure 6: Administrative Web Interface IPv6 Settings page Figure 7: OSD IPv6 Settings page 11

12 Configure IPv6 Settings When you make a change to one of the settings on this page, you must reboot your device for the change to take effect. Table 6: IPv6 Settings parameters Enable IPv6 Link Local Address Gateway Enable DHCPv6 DHCPv6 Addresses Enable this field to enable IPv6 for your PCoIP devices. This field is automatically populated. Enter the gateway address. Enable this field to set up Dynamic Host Configuration Protocol version 6 (DHCPv6) for your device. When DHCPv6 is enabled and the device is rebooted, the server automatically populates these fields with addresses for the device. 12

13 Configure IPv6 Settings Primary DNS Secondary DNS Domain Name FQDN Enable SLAAC SLAAC Addresses Enable Manual Address Manual Address The device's primary DNS IP address. If DHCPv6 is enabled, this field is automatically populated by the DHCPv6 server. The device's secondary DNS IP address. If DHCPv6 is enabled, this field is automatically populated by the DHCPv6 server. The domain name used (for example, 'domain.local') for the host or client. If DHCPv6 is enabled, this field is automatically populated by the DHCPv6 server. The fully qualified domain name for the client. If DHCPv6 is enabled, this field is automatically populated by the DHCPv6 server. Enable this field to set up stateless address auto-configuration (SLAAC) for your devices. When SLAAC is enabled and the device is rebooted, these fields are automatically populated. Enable this field to set up a manual (static) address for the device. Enter the IP address for the device. 13

14 Custom Information Configuration Custom Information Configuration The Label page allows you to add custom information for the client. Figure 8: Label Configuration Web Page Figure 9: OSD: Label Configuration 14

15 Discovery Mechanism Configuration Table 7: Label parameters PCoIP Device Name Lets you give the client a logical name. The default is pcoip-portal-<mac> where <MAC> is the device MAC address. This field is the name the client registers with the DNS server if DHCP is enabled and the system is configured to support registering the host name with the DNS server. It is important to ensure that the PCoIP Device Name is unique for each endpoint in the network and follows these naming conventions: The first and last character must be a letter (A-Z or a-z) or a digit (0-9) The remaining characters must be letters, digits, or hyphens The length must be 63 characters or less PCoIP Device Generic Tag A description or other information (such as the location of the endpoint) for the device. The firmware does not use this field. It is provided for administrator use only. Generic tag information about the device. The firmware does not use this field. It is provided for administrator use only. Discovery Mechanism Configuration This screen does not apply to the Cisco VXC client. SNMP Agent configuration The Cisco VXC includes an SNMP agent that supports reporting of management information to an SNMP manager. The SNMP page lets you enable or disable the Cisco VXC SNMP agent. The Cisco VXC uses public as the SNMP community string. 15

16 Session Configuration For more information on using the PCoIP SNMP Agent, see the SNMP user guide on the Teradici support site. Figure 10: SNMP Configuration Web Page Table 8: SNMP s Enable SNMP When enabled, the client enables the PCoIP SNMP agent to respond to SNMP requests. Disabling the SNMP agent prevents it from responding to SNMP requests and ensures that the PCoIP SNMP MIB cannot be accessed. Session Configuration The Session page lets you configure how the client device connects to or accepts connections from peer devices. The Advanced configuration options available from the Session page depend on the option you select in the Session Connection Type field: Direct to Host* Direct to Host + SLP Host Discovery* View Connection Server View Connection Server + Auto-Logon View Connection Server + Kiosk View Connection Server + Imprivata OneSign Connection Management Interface* 16

17 Session Configuration PCoIP Connection Manager* *Not supported with Cisco VXC. 17

18 VMware View Connection Configuration VMware View Connection Configuration The Session page lets you configure your client for use with a VMware View Connection server. When you select View Connection Server as the Session Connection Type, specific configuration options appear. Figure 11: Administrative Web Interface VMware View Session Configuration Page Figure 12: OSD VMware View Session Configuration Page 18

19 VMware View Connection Configuration Figure 13: OSD VMware View session Configuration Page (Advanced Options) Table 9: VMware View Page s DNS Name or IP Address Enter the VMware View Connection server's DNS name or IP address. 19

20 VMware View Connection Configuration Desktop Name to Select Port Certificate Check Mode Enter the pool/desktop name used by a zero client when starting a session. This setting is optional. By default this field is blank, and port 443 is used to communicate with the VMware View Connection server. If your network is set up to use a non-standard port for secure connections, enter the port number. Select how the client behaves if it cannot verify a secure connection to the server: Never connect to untrusted servers: Configure the client to reject the connection if a trusted, valid certificate is not installed. (This is the most secure option.) Warn before connecting to untrusted servers: Configure the client to display a warning if an unsigned or expired certificate is encountered, or if the certificate is not self-signed and the zero client trust store is empty. (This option is selected by default.) Do not verify server identity certificates: Configure the client to allow all connections. (This option is not secure.) Certificate Check Mode Lockout Trusted View Connection Servers Auto Connect Enable to prevent users from changing the VCS Certificate Check Mode settings from the OSD. Click the Show button to display VMware View Connection servers for which the client has received a valid certificate. Click the Clear button to clear this cache. Specify if the client should always connect at startup to the VMware View Connection server in the DNS Name or IP Address field. When Auto Connect is enabled, the client automatically connects to the selected VMware View Connection server whenever the client powers up or when a session with the virtual desktop is terminated. The user sees the user credentials login dialog box on the OSD instead of the Connect dialog box. After enabling Auto Connect, the client must be power-cycled for the change to take effect. 20

21 VMware View Connection Configuration Connection Server Cache Mode This field determines whether a View Connection Server is dynamically added to the Server drop-down menu on the OSD Connect page when a user types in a valid server address, or whether it appears in a read-only list for the user to select. Last servers used: Select this option if you want a list of cached servers that a user has typed in to appear in the Server drop-down menu on the OSD Connect page. Read-only: Select this option if you want users to select a View Connection Server from a read-only list. Enable Self-Help Link Auto Launch If Only One Desktop Login Username Caching Use OSD Logo for Login Banner Prefer GSC-IS See "Enabling the Self-Help Link" for details. When enabled, after user credentials are entered, users are automatically connected to their virtual desktop. This feature only applies to users who are entitled to a single desktop. It does not apply to users entitled to multiple virtual desktops. When enabled, the username text box automatically populates with the last username entered. On the OSD, this field is called "Remember Username." When enabled, the PCoIP zero client OSD logo appears during login in place of the VMware View banner. You can upload a custom OSD logo via the Administrative Web Interface. When selected, the GSC-IS interface is used if a smart card supports more than one interface such as CAC (GSC-IS) and PIV endpoint. If a smart card supports only one interface, such as either CAC or PIV endpoint, then only the CAC or PIV endpoint interface is used regardless of the Prefer GSC-IS setting. This only affects smart card access performed outside of PCoIP sessions. Prefer GSC-IS is selected by default. 21

22 VMware View Connection Configuration Enable Peer Loss Overlay Enable Preparing Desktop Overlay Enable Session Disconnect Hotkey Session Negotiation Cipher When enabled, the Network Connection Lost overlay appears on the display(s) when a loss of network connectivity is detected. It also appears in the case of a virtual desktop such as VMware View. Normal hypervisor scheduling delays can falsely trigger this message. This option is disabled by default. This option is only available for a zero client. Desktop applications that require the peer loss notification should re-enable the feature through the OSD or Administrative Web Interface. When enabled, the "Preparing Desktop" overlay appears on the display(s) when you log in. This option is disabled by default. This overlay provides assurance that login is proceeding if the desktop takes more than a few seconds to appear. When enabled, users can press the Ctrl+Alt+F12 hotkey sequence to pop up the "Zero Client Control Panel" overlay, which lets them disconnect the current session on the workstation or power off the workstation. Configure the Transport Layer Security (TLS) cipher the client will use to negotiate the TLS session between the PCoIP client and the virtual machine: TLS 1.0 with RSA keys and AES-256 or AES-128 encryption is the only supported option. The Cisco VXC 2111/2211 does not currently support AES-256 encryption. 22

23 VMware View Connection Configuration Enabled Session Ciphers Enable or disable an encryption mode for the client. By default, both encryption modes are enabled: AES-128-GCM: An encryption method implemented in the TERA1x100 processor that allows best performance between hardware endpoints. Salsa Round12: A lighter encryption method implemented in firmware that may offer improved performance when connecting to VMware View 4 or later when there is more than about 7 Mbps available on the network. For more information, see documentation for using PCoIP zero clients with VMware View on the Teradici support site. The enabled encryption mode must match between the virtual machine and client for a session to be established. If both modes are enabled, the firmware selects SALSA Round12 for the PCoIP session (VMware View 4.5 and later). The Enabled Session Ciphers setting specifies the UDP packet encryption type used during the session. This setting has no effect on whether the client identifies the connection as trusted. The zero client identifies a View Connection Server (VCS) connection as trusted if a certificate is passed between the client and the VCS. 23

24 VMware View Connection Configuration Disconnect Message Filter This field lets you control what type of messages appear when a session is disconnected. There are three categories: Information: User or administrator initiated actions affecting the session. You have been disconnected because you logged in from another location or your virtual machine was shut down or restarted. You have been disconnected because an administrator disconnected you. You have been disconnected because you logged in from another location. You have been disconnected because you disconnected from your workstation. Warning: System-initiated, but expected actions affecting the session. This occurs when a session is closed remotely (the global timeout value is reached). Error: Unexpected system-initiated actions causing session to fail. The following are Error messages: You have been disconnected. Unable to connect (0x1001). Please contact your IT administrator. Unable to connect (0x1002). Please contact your IT administrator. Session closed remotely. Session closed remotely (unknown cause). configuration error (0x100). Please contact your configuration error (0x201). Please contact your 24

25 VMware View Connection Configuration Disconnect Message Filter (continued) Error (continued): configuration error (0x300). Please contact your configuration error (0x301). Please contact your configuration error (0x302). Please contact your configuration error (0x303). Please contact your configuration error (0x305). Please contact your configuration error (0x400). Please contact your configuration error (0x401). Please contact your configuration error (0x402). Please contact your configuration error (0x403). Please contact your configuration error (0x404). Please contact your 25

26 VMware View Connection Configuration Disconnect Message Filter (continued) You can choose to display: 1 Show All messages This option shows all disconnect messages including Info, Warning, and Error messages. 2 Show Error and Warnings Only This option hides info messages and displays only error and warning messages. 3 Show Error Only This option hides Info and Warning messages and displays only Error messages. 4 Show None Don t show any disconnect messages. Custom Session SNI Enable DSCP Enable Transport Congestion Notification When enabled, sets a customized Server Name Indication (SNI) string on authorized man-in-the-middle-enabled clients. The SNI string is appended to the SSL/TLS HELLO when the client initates an SSL connection with the host. When enabled, the device populates the Differentiated Services Code Point (DSCP) field in the IP header, allowing intermediate network nodes to prioritize PCoIP traffic accordingly. When enabled, transport congestion notification is enabled to allow PCoIP endpoints to react accordingly if an intermediate network node sets the congestion notification bit in either the IP header or PCoIP transport header. Enable Self-Help Link The Self Help Link option lets you configure a self-help link for users that appears on the Connect window. When users click this link, they are automatically connected to a specific desktop that can be used as a corporate resource, for example, a desktop containing IT help information. After enabling this option, you then configure 26

27 VMware View Connection Configuration all the necessary details to automatically log users in to the desktop that you specify. You also configure the link text that you want to appear on the Connect window. Figure 14: Self-Help Link Page When you enable this field, the following options appear: Table 10: Enable Self-Help Link Page s View Connection Server Port Username Password Domain Desktop Name to Select Link Text Enter the name of the View Connection Server hosting the self-help virtual machine. By default this field is blank, and port 443 is used to communicate with the VMware View Connection server. If your network is set up to use a non-standard port for secure connections, enter the port number. To password protect the virtual machine for the self-help link, enter a username in this field. To password protect the virtual machine for the self-help link, enter a password in this field. Enter the domain name used by the virtual machine for the self-help link. Enter the pool/desktop name used by the virtual machine for the self-help link. Enter the text that you want to appear as hyperlinked texton the Connect window. VMware View Connection Configuration with Auto-Logon You can set up the client so that the user does not need to enter a username or password to start a VMware View session (that is, the usual login details are automatically entered for the user). Select the View Connection Server + Auto-Logon option from Session Connection Type field on the Session page. 27

28 VMware View Connection Configuration When you choose this connection type, the parameters are similar to those that appear for the View Connection Server with the addition of the parameters described in the following table. Figure 15: Administrative Web Interface VMware View Connection with Auto-Logon Page Figure 16: OSD VMware View Connection with Auto-Logon 28

29 VMware View Connection Configuration Figure 17: OSD Advanced Settings Table 11: VMware View Connection with Auto-Logon Page s Logon Username Logon Password Logon Domain Name Enter the username for the client. Enter the password. Enter the domain name. 29

30 Kiosk Mode Configuration Kiosk Mode Configuration You can configure kiosk mode by selecting the View Connection Server + Kiosk option as the Session Connection Type on the Session page on the OSD or the Administrative Web Interface. Kiosk mode requires 30

31 Kiosk Mode Configuration a properly configured VMware View environment. See the applicable VMware View documentation for more information. Figure 18: Administrative Web Interface Kiosk mode configuration page Figure 19: OSD Kiosk mode configuration page 31

32 Kiosk Mode Configuration Figure 20: OSD Kiosk mode configuration page (advanced settings) Table 12: View Connection Server + Kiosk s DNS Name or IP Address Enter the IP address or DNS name for the kiosk's View Connection Server. 32

33 Kiosk Mode Configuration Username Type Select the type of username that matches the naming you use for the devices on the View Connection Server. Zero Client MAC: Select this option to automatically populate the Username field with the MAC address of the zero client. Custom: Enter the username for the zero client. This username has the prefix "Custom". Username Password Port Certificate Check Mode When Custom is selected as the username type, enter the value for this component of the custom username. This field is limited to 13 characters. To password protect the virtual machine for the kiosk, enter a password in this field. This password must match the one entered for the device in the View Connection Server. By default this field is blank, and port 443 is used to communicate with the VMware View Connection server. If your network is set up to use a non-standard port for secure connections, enter the port number. Select how the client behaves if it cannot verify a secure connection to the server: Never connect to untrusted servers: Configure the client to reject the connection if a trusted, valid certificate is not installed. (This is the most secure option.) Warn before connecting to untrusted servers: Configure the client to display a warning if an unsigned or expired certificate is encountered, or if the certificate is not self-signed and the zero client trust store is empty. (This option is selected by default.) Do not verify server identity certificates: Configure the client to allow all connections. (This option is not secure.) Certificate Check Mode Lockout In the OSD, these settings are available from the User Settings > Options menu. Enable to prevent users from changing the VCS Certificate Check Mode settings from the OSD or Administrative Web Interface. 33

34 Kiosk Mode Configuration Trusted View Connection Servers Use OSD Logo for Login Banner Enable Peer Loss Overlay Enable Preparing Desktop Overlay Enable Session Disconnect Hotkey Session Negotiation Cipher Click the Show button to display VMware View Connection servers for which the client has received a valid certificate. Click the Clear button to clear this cache. When enabled, the PCoIP zero client OSD logo banner appears at the top of login screens in place of the default banner. You can upload a custom OSD logo from the OSD Logo Upload page. When enabled, the Network Connection Lost overlay appears on the display(s) when a loss of network connectivity is detected. Normal hypervisor scheduling delays can falsely trigger this message. This option is disabled by default. This option is only available for a zero client. Desktop applications that require the peer loss notification should re-enable the feature through the OSD or Administrative Web Interface. When enabled, the "Preparing Desktop" overlay appears on the display(s) when you log in. This option is disabled by default. This overlay provides assurance that login is proceeding if the desktop takes more than a few seconds to appear. When enabled, users can press the Ctrl+Alt+F12 hotkey sequence to pop up the "Zero Client Control Panel" overlay, which lets them disconnect the current session on the workstation or power off the workstation. Configure the Transport Layer Security (TLS) cipher the client will use to negotiate the TLS session between the PCoIP client and the virtual machine: TLS 1.0 with RSA keys and AES-256 or AES-128 encryption. The Cisco VXC 2111/2211 does not currently support AES-256 encryption. 34

35 Kiosk Mode Configuration Enabled Session Ciphers Enable or disable an encryption mode for the client. By default, both encryption modes are enabled: AES-128-GCM: An encryption method implemented in the TERA1x100 processor that allows best performance between hardware endpoints. Salsa Round12: A lighter encryption method implemented in firmware that may offer improved performance when connecting to VMware View 4 or later when there is more than about 7 Mbps available on the network. For more information, see documentation for using PCoIP zero clients with VMware View on the Teradici support site. The enabled encryption mode must match between the virtual machine and client for a session to be established. If both modes are enabled, the firmware selects SALSA Round12 for the PCoIP session (VMware View 4.5 and later). The Enabled Session Ciphers setting specifies the UDP packet encryption type used during the session. This setting has no effect on whether the client identifies the connection as trusted. The zero client identifies a View Connection Server (VCS) connection as trusted if a certificate is passed between the client and the VCS. 35

36 Kiosk Mode Configuration Disconnect Message Filter This field lets you control what type of messages appear when a session is disconnected. There are three categories: Information: User or administrator initiated actions affecting the session. You have been disconnected because you logged in from another location or your virtual machine was shut down or restarted. You have been disconnected because an administrator disconnected you. You have been disconnected because you logged in from another location. You have been disconnected because you disconnected from your workstation. Warning: System-initiated, but expected actions affecting the session. This occurs when a session is closed remotely (the global timeout value is reached). Error: Unexpected system-initiated actions causing session to fail. The following are Error messages: You have been disconnected. Unable to connect (0x1001). Please contact your IT administrator. Unable to connect (0x1002). Please contact your IT administrator. Session closed remotely. Session closed remotely (unknown cause). configuration error (0x100). Please contact your configuration error (0x201). Please contact your 36

37 Kiosk Mode Configuration Disconnect Message Filter (continued) Error (continued): configuration error (0x300). Please contact your configuration error (0x301). Please contact your configuration error (0x302). Please contact your configuration error (0x303). Please contact your configuration error (0x305). Please contact your configuration error (0x400). Please contact your configuration error (0x401). Please contact your configuration error (0x402). Please contact your configuration error (0x403). Please contact your configuration error (0x404). Please contact your 37

38 View Connection Server Setup - Imprivata OneSign Connection Configuration Disconnect Message Filter (continued) You can choose to display: 1 Show All messages This option shows all disconnect messages including Info, Warning, and Error messages. 2 Show Error and Warnings Only This option hides info messages and displays only error and warning messages. 3 Show Error Only This option hides Info and Warning messages and displays only Error messages. 4 Show None Don t show any disconnect messages. Custom Session SNI Enable DSCP Enable Transport Congestion Notification When enabled, sets a customized Server Name Indication (SNI) string on authorized man-in-the-middle-enabled clients. The SNI string is appended to the SSL/TLS HELLO when the client initates an SSL connection with the host. When enabled, the device populates the Differentiated Services Code Point (DSCP) field in the IP header, allowing intermediate network nodes to prioritize PCoIP traffic accordingly. When enabled, transport congestion notification is enabled to allow PCoIP endpoints to react accordingly if an intermediate network node sets the congestion notification bit in either the IP header or PCoIP transport header. View Connection Server Setup - Imprivata OneSign Connection Configuration If you want the zero client to authenticate through the Imprivata OneSign system, configure the View Connection Server + Imprivata OneSign option as the Session Connection Type on the Session page. 38

39 View Connection Server Setup - Imprivata OneSign Connection Configuration The Cisco VXC 2111/2211 does not currently support View Connection Server + Imprivata OneSign connections. Figure 21: Administrative Web Interface View Connection Server + Imprivata OneSign Connection Page Figure 22: OSD View Connection Server + Imprivata OneSign Connection Page 39

40 View Connection Server Setup - Imprivata OneSign Connection Configuration Figure 23: OSD View Connection Server + Imprivata OneSign Connection Page (Advanced Settings) Table 13: View Connection Server + Imprivata OneSign s DNS Name or IP Address Enter the VMware View Connection Server's DNS name or IP address. 40

41 View Connection Server Setup - Imprivata OneSign Connection Configuration Bootstrap URL OneSign Desktop Name Mode Enter the bootstrap URL used to find an initial OneSign server in a OneSign authentication deployment. Select whether the Desktop Name to Select property is used in OneSign Mode: Ignore Use If Set Desktop Name to Select Remember Username OneSign Appliance Verification Enter the desktop name. When the desktop pool list includes a pool with this name, the client will immediately start a session with that pool. This field is case-insensitive When enabled, the username text box automatically populates with the last username entered. Select whether the Desktop Name to Select property is used in OneSign Mode: No verification: Connect to any appliance. Full verification: Only connect to appliances with verified certificates. Certificate Check Mode Select how the client behaves if it cannot verify a secure connection to the server: Never connect to untrusted servers: Configure the client to reject the connection if a trusted, valid certificate is not installed. (This is the most secure option.) Warn before connecting to untrusted servers: Configure the client to display a warning if an unsigned or expired certificate is encountered, or if the certificate is not self-signed and the zero client trust store is empty. (This option is selected by default.) Do not verify server identity certificates: Configure the client to allow all connections. (This option is not secure.) In the OSD, these settings are available from the User Settings->Options menu. For details, see Vmware View Certificate Checking Configuration. 41

42 View Connection Server Setup - Imprivata OneSign Connection Configuration Certificate Check Mode Lockout Trusted View Connection Servers Login Username Caching Use OSD Logo for Login Banner Prefer GSC-IS Enable Peer Loss Overlay Enable Preparing Desktop Overlay Enable Session Disconnect Hotkey Enable to prevent users from changing the VCS Certificate Check Mode settings from the OSD or Administrative Web Interface. Click the Show button to display VMware View Connection servers for which the client has received a valid certificate. Click the Clear button to clear this cache. When enabled, the username text box automatically populates with the last username entered. On the OSD, this field is called "Remember Username." When enabled, the OSD logo banner appears at the top of login screens in place of the default banner. You can upload a custom OSD logo from the OSD Logo Upload page. When selected, the GSC-IS interface is used if a smart card supports more than one interface such as CAC (GSC-IS) and PIV endpoint. If a smart card supports only one interface, such as either CAC or PIV endpoint, then only the CAC or PIV endpoint interface is used regardless of this setting. This only affects smart card access performed outside of PCoIP sessions. When enabled, the Network Connection Lost overlay appears on the display(s) when a loss of network connectivity is detected. Normal hypervisor scheduling delays can falsely trigger this message. This option is disabled by default. This option is only available for a zero client. Desktop applications that require the peer loss notification should re-enable the feature through the OSD or Administrative Web Interface. When enabled, the "Preparing Desktop" overlay appears on the display(s) when you log in. This option is disabled by default. This overlay provides assurance that login is proceeding if the desktop takes more than a few seconds to appear. When enabled, users can press the Ctrl+Alt+F12 hotkey sequence to pop up the "Zero Client Control Panel" overlay, which lets them disconnect the current session on the workstation or power off the workstation. 42

43 View Connection Server Setup - Imprivata OneSign Connection Configuration Pre-session Reader Beep Configure whether the proximity card reader beeps when a valid card is tapped on the reader in OneSign mode: Use Existing Setting: Uses the existing setting (affects only devices runing firmware or greater) Disabled: Disables the feature. Enabled: Enables the feature. Session Negotiation Cipher Enabled Session Ciphers Configure the Transport Layer Security (TLS) cipher the client will use to negotiate the TLS session between the PCoIP client and the virtual machine: TLS 1.0 with RSA keys and AES-256 or AES-128 encryption. The Cisco VXC 2111/2211 does not currently support AES-256 encryption. Enable or disable an encryption mode for the client. By default, both encryption modes are enabled: AES-128-GCM: An encryption method implemented in the TERA1x100 processor that allows best performance between hardware endpoints. Salsa Round12: A lighter encryption method implemented in firmware that may offer improved performance when connecting to VMware View 4 or later when there is more than about 7 Mbps available on the network. For more information, see documentation for using PCoIP zero clients with VMware View on the Teradici support site. The enabled encryption mode must match between the virtual machine and client for a session to be established. If both modes are enabled, the firmware selects SALSA Round12 for the PCoIP session (VMware View 4.5). The Enabled Session Ciphers setting specifies the UDP packet encryption type used during the session. This setting has no effect on whether the client identifies the connection as trusted. The zero client identifies a View Connection Server (VCS) connection as trusted if a certificate is passed between the client and the VCS. 43

44 View Connection Server Setup - Imprivata OneSign Connection Configuration Disconnect Message Filter This field lets you control what type of messages appear when a session is disconnected. There are three categories: Information: User or administrator initiated actions affecting the session. You have been disconnected because you logged in from another location or your virtual machine was shut down or restarted. You have been disconnected because an administrator disconnected you. You have been disconnected because you logged in from another location. You have been disconnected because you disconnected from your workstation. Warning: System-initiated, but expected actions affecting the session. This occurs when a session is closed remotely (the global timeout value is reached). Error: Unexpected system-initiated actions causing session to fail. The following are Error messages: You have been disconnected. Unable to connect (0x1001). Please contact your IT administrator. Unable to connect (0x1002). Please contact your IT administrator. Session closed remotely. Session closed remotely (unknown cause). configuration error (0x100). Please contact your configuration error (0x201). Please contact your 44

45 View Connection Server Setup - Imprivata OneSign Connection Configuration Disconnect Message Filter (continued) Error (continued): configuration error (0x300). Please contact your configuration error (0x301). Please contact your configuration error (0x302). Please contact your configuration error (0x303). Please contact your configuration error (0x305). Please contact your configuration error (0x400). Please contact your configuration error (0x401). Please contact your configuration error (0x402). Please contact your configuration error (0x403). Please contact your configuration error (0x404). Please contact your 45

46 Bandwidth control for PCoIP sessions Disconnect Message Filter (continued) You can choose to display: 1 Show All messages This option shows all disconnect messages including Info, Warning, and Error messages. 2 Show Error and Warnings Only This option hides info messages and displays only error and warning messages. 3 Show Error Only This option hides Info and Warning messages and displays only Error messages. 4 Show None Don t show any disconnect messages. Custom Session SNI Enable DSCP Enable Transport Congestion Notification When enabled, sets a customized Server Name Indication (SNI) string on authorized man-in-the-middle-enabled clients. The SNI string is appended to the SSL/TLS HELLO when the client initates an SSL connection with the host. When enabled, the device populates the Differentiated Services Code Point (DSCP) field in the IP header, allowing intermediate network nodes to prioritize PCoIP traffic accordingly. When enabled, transport congestion notification is enabled to allow PCoIP endpoints to react accordingly if an intermediate network node sets the congestion notification bit in either the IP header or PCoIP transport header. Bandwidth control for PCoIP sessions The Bandwidth page lets you control the bandwidth used by the device during a PCoIP session. This applies to sessions between Cisco VXC clients and the remote virtual machine. The parameters in this page are applied after you click Apply. To configure the bandwidth used with a VMware View virtual desktop, adjust the PCoIP GPO session variables. 46

47 Bandwidth control for PCoIP sessions For more information, see WAN network guidelines for VMware View on the Teradici support site. Figure 24: Bandwidth Configuration Web Page Table 14: Bandwidth s Device Bandwidth Limit Defines the maximum bandwidth peak for the PCoIP system based on which side is sending data (for example, USB data from the client to the virtual machine). The usable range of the device bandwidth is 1000 to 220,000 kbps. The PCoIP processor uses only the required bandwidth up to the Device Bandwidth Limit maximum. The PCoIP processor dynamically adjusts the bandwidth in response to network congestion. Setting the Device Bandwidth Limit to 0 configures the PCoIP processor to adjust the bandwidth depending on network congestion. If there is no congestion, there is no limit on bandwidth. That is, the processor uses the maximum rate available. We recommend setting this field to the limit of the network connected to the client and virtual machine. The setting in this field is applied immediately after you click Apply. 47

48 Bandwidth control for PCoIP sessions Device Bandwidth Target Device Bandwidth Floor Defines the temporary limit on the network bandwidth during periods of congestion (packet loss). When the network experiences congestion, the device bandwidth is reduced rapidly to the target value and more slowly below this value. This allows for a more even distribution of bandwidth between users sharing a congested network link. After the congestion is alleviated, the bandwidth used increases depending on the available network resources up to the Device Bandwidth Limit. You must have a good understanding of the network topology before setting this to a non-zero value. Lets you configure the bandwidth floor used by the firmware when congestion is present and when bandwidth is required. This lets you optimize performance for a network with understood congestion or packet loss. If the bandwidth is not required, the bandwidth used drops below the floor. A setting of 0 lets the firmware reduce bandwidth to 1000 kbps for these network impairments. You must have a good understanding of the network topology before setting this to a non-zero value. The firmware implements a Slow Start Algorithm that: Increases the bandwidth used until the bandwidth required is reached, network congestion is detected, or the Device Bandwidth Limit is reached Begins at the lesser of the Device Bandwidth Limit and 8000 kbps Increases the bandwidth used within seconds Allows a graceful session startup for low bandwidth scenarios (for example, WAN) After initiating a PCoIP session, users may temporarily notice low bandwidth video artifacts while the algorithm ramps up bandwidth use. 48

49 User Interface Language Configuration User Interface Language Configuration The Language page allows the administrator to change the user interface language. This setting affects the local OSD GUI. Figure 25: Language Configuration Web Page Figure 26: OSD: Language Configuration Table 15: Language s Language Configure the OSD language. This setting determines the language for the OSD only. It does not affect the language setting for the actual user session. For more information about supported languages, see Language and Keyboard Layout. 49

50 Image quality configuration Keyboard Layout Change the layout of the keyboard. When the user starts a session, this setting is pushed to the virtual machine. If the Windows GPO is set to allow the keyboard layout setting, it is used during the user session. If the Windows GPO is not set to allow the setting, it is dropped. For more information about supported keyboard layouts, see Language and Keyboard Layout. Image quality configuration The Image page lets you make changes to the image quality of the PCoIP session. This applies to sessions between Cisco VXC clients and the virtual machine. To configure the image quality settings with a VMware View virtual desktop, adjust the PCoIP session variables. 50

51 Image quality configuration For more information, see the WAN network guidelines for VMware View on the Teradici support site. Figure 27: Image Configuration Web Page Figure 28: OSD: Image This page is available in the OSD from the Options > User Settings menu. 51

52 Image quality configuration Table 16: Image Page s Minimum Image Quality Lets you compromise between image quality and frame rate when network bandwidth is limited. Some use cases may require lower-quality images at a higher frame rate while others need higher-quality images at a lower frame rate. In environments where the network bandwidth is constrained, moving the slider towards Reduced allows higher frame rates. Moving the slider towards Perception-Free allows for higher image quality. When network bandwidth is not constrained, the PCoIP system maintains perception-free quality regardless of the Minimum Image Quality parameter. The Minimum Image Quality must be less than or equal to the Maximum Initial Image Quality. 52

53 Image quality configuration Maximum Initial Image Quality Image Quality Preference Maximum Frame Rate Move the slider towards Reduced to reduce the network bandwidth peaks caused by screen content changes, but produce lower quality images. Move the slider towards Perception-Free to produce higher quality images but also higher bandwidth peaks. This parameter limits the initial quality on the first display frame of a screen change. Unchanged regions of the image are built to a loss-less state regardless of this parameter. The Maximum Image Quality: Must be greater than or equal to the Minimum Image Qualified Does not have a corresponding parameter on the OSD because it is intended as an administrator-only parameter Move the slider towards Smoother Motion to result in a higher frame rate at a lower quality level. Move the slider towards Sharper Image to result in a lower frame rate at a higher quality level. The range is from 0 to 100 in steps of 5. This setting does not work in PCoIP sessions with VMware View virtual desktops running release 5.0 or earlier. The maximum frame rate helps you manage multiple PCoIP sessions over a single network link. This setting determines the limit that your users can reach. Set this field to 0 to set no frame limit. If you set a value, a single user is limited to that value. This helps to control the user experience for all your users. The Maximum Frame Rate does not have a corresponding parameter on the OSD as it is an administrator-only parameter. This setting does not work in PCoIP sessions with VMware View virtual desktops running release 5.0 or earlier. 53

54 NTP Configuration Disable Build to Lossless Leave this field unchecked to retain the PCoIP protocol's build-to-lossless feature, where images continue to be refined in the background until they reach a fully lossless state (that is, identical pixel-for-pixel rendering when compared to the host image source). This is the default (recommended) setting. Warning: Activating the Disable build-to-lossless feature will degrade the image presented to the user by the zero client. Do not activate the Disable Build to Lossless feature unless it has been determined by the administrator of the zero client that users do not require optimal image quality to perform critical functions. It is the sole responsibility of the zero client administrator to make this determination. If you do choose to turn on the Disable Build to Lossless field, the PCoIP protocol rapidly builds the client image to a high quality image that may be perceptually lossless, but is not a fully lossless state. This may provide some bandwidth savings, but is not recommended for use cases that require images and desktop content to be truly lossless. If you have any questions about this field setting, contact Teradici Support. This setting does not work in PCoIP sessions with VMware View virtual desktops running release 5.0 or earlier. There is no Disable Build to Lossless setting on the OSD as it is an administrator-only parameter. NTP Configuration The Time web page configures the Network Time Protocol (NTP) settings to allow the event logs of the client to be time-stamped based on NTP time. To simplify system troubleshooting, set the NTP parameters to allow correlation of user events to the relevant diagnostic event log entries. If the zero client is configured for DHCP and the DHCP server provides an NTP server address, this address will override any manually configured NTP server. It will also enable NTP if it is disabled. 54

55 NTP Configuration The zero client does not get time zone or Daylight Saving Time (DST) information from the NTP server. Figure 29: Time Configuration Web Page Table 17: Time s Current Time Enable NTP Identify NTP Host By Displays the time based on the NTP. Enable or disable the NTP feature. Choose if the NTP Host (that is, the NTP server) is identified by IP address or by FQDN. If NTP is disabled, this field is not required and is not editable. If you enter an invalid IP address or DNS name, a message appears to prompt you to correct it. The parameter depends on which method you choose: IP Address: Shows the NTP server IP address FQDN: Shows the NTP server DNS name NTP Host Port Lets you configure the NTP port number. 55

56 Password Update NTP Query Interval Time Zone Enable Daylight Savings Time Lets you configure the query interval. The first field is for the interval period and the second field is for the time unit in Minute(s), Hour(s), Day(s), and Week(s). Lets you select the local time zone. Enable or disable the automatic adjustment for daylight savings time. Password Update The Password page lets you update the local administrative password for the device. The password can be a maximum of 20 characters. Some PCoIP devices have password protection disabled by default. The Password page is not available on these devices. If a device is set up to have password protection disabled, the Password page on the OSD is not available. This parameter affects the web interface and the local OSD GUI. Take care when updating the client password because the client may become unusable if the password is lost. Figure 30: Password Configuration Web Page 56

57 Password Update In the OSD, this page is available from the Options > Password menu. Figure 31: OSD: Change Password Table 18: Password s Old Password New Password Confirm New Password Reset This field must match the current administrative password before you can update the password. The new administrative password for both the web interface and the local OSD GUI. This field must match the New Password field for the change to take place. If the client password is lost, you can click the Reset button to request a response code from the client vendor. The challenge code can be sent to the vendor. The vendor qualifies the request and returns a response code if authorized. When the response code is correctly entered, the client password is reset to an empty string. You must enter a new password. Contact the client vendor for more information when an authorized password reset is required. This option is not available through the Administrative Web Interface. It is available only through the OSD. 57

58 Reset to Factory Defaults Password Reset Figure 32: Authorized Password Reset Reset to Factory Defaults The Reset s page lets you reset configuration and permissions to factory default values stored in flash. 58

59 Reset to Factory Defaults Resetting parameters to factory default values does not revert the firmware or clear the custom OSD logo. Figure 33: Reset s Web Page Figure 34: OSD: Reset 59

60 Reset to Factory Defaults Table 19: Reset s Reset s Enable Keyboard Shortcut Hide Keyboard Shortcut Sequence in OSD When you click this button, a prompt appears for confirmation. This is to prevent accidental resets. When enabled, the user can press the combination of keys to automatically reset the parameters and permissions for the device. When the Enable Keyboard Shortcut field is enabled, and this field is: Disabled: The keyboard sequence appears on the Reset s page for the zero client. Enabled: The keyboard sequence does not appear on the Reset s page for the zero client. The user can still reset the parameters through the keyboard sequence. 60

61 EDID override mode configuration EDID override mode configuration The Display page lets you enable the Extended Display Identification Data (EDID) override mode. This function is only available through the OSD. Under normal operation, the virtual machine queries a monitor attached to the zero client to determine the monitor's capabilities. These are reported in the EDID information. In some situations, a monitor may be connected to a client in a way that prevents the client from reading the EDID information, such as when connecting through certain KVM devices. The options in this page configure the client to advertise default EDID information to the virtual machine. Caution Enabling display override forces default-monitor display information that may not comply with the connected monitor and result in a blank monitor. Enable display override only when there is no valid EDID information and monitor display characteristics are understood. Figure 35: OSD Display page 61