We are not able to fulfill the required scenarios without hitting that number and have full redundancy for specific access components

Availability: The maximum number of Connection Server that can be used (master & replica) is 7.

Why is that architectural approach not so beneficial? The following logical design would be a solution using windows based security server

Access from the internet for a specific User group.Access from a branch-office in a different not-so-well-trusted country that is only allowed to communicate with a single Endpoint within the (HQ) network.Access from a branch-office that must use RSA-token.Access from the internal head-quarters (HQ) – All virtual Desktops are hosted within the HQs datacenter.We need to offer access to 4 types of users:

How would we have dealt with this situation in an older environment including a Windows based Security Server? Since the Security Server required a 1:1 pairing between a Connection & a Security Server we would easily hit the maximum number of 7 Connection Server in case that we want to offer multiple accesses from different locations.

Constraints to always use tunneled connections (because of network-simplicity or security constraints).

Offering access to internal users coming from a not so trust-worthy site/location (including a second-factor authentication for those users).

There might be use cases where we want to design our horizon environment in a way that we use the UAGs not just for external unsecure access, but internally as well. Keep in mind the UAG is not just a replacement for the old Windows based Security Sever, it is also offering much more functionality (Edge Services for Airwatch / Workspace One, reverse proxy, 2nd-factor authentication integration, etc.). Over the last months I gathered more and more experience about VMware’s secure Linux appliance that allows secure access to a virtual Desktop (and more) over an unsecure network (e.g.) the Internet: Unified Access Gateway (UAG).

Uag vmware horizon