Access to Omnissa (VMware) Horizon with Symantec ZTNA Web Applications

Products

Symantec ZTNA

Issue/Introduction

In order to successfully provision a clientless (agentless) Symantec ZTNA Web Application for Omnissa (formerly VMware) Horizon remote desktops via HTML Access, administrators must properly align Horizon's dual-port architecture with ZTNA's secure edge routing.

During a standard desktop launch sequence, the initial web traffic and user authentication flow smoothly over standard HTTPS (port 443). Following authentication, the Horizon Connection Server natively instructs the client's browser to establish the Blast Extreme WebSocket (wss://) multimedia stream using port 8443. Because Symantec ZTNA Web Applications are designed to securely accept external traffic exclusively on port 443, a tailored routing architecture is necessary to seamlessly bridge the Blast protocol traffic and ensure a successful desktop session.

Environment

Symantec ZTNA (Clientless Web Applications)
Omnissa Horizon (formerly VMware Horizon) Connection Server(s)
Horizon HTML Access

Cause

Symantec ZTNA Web Applications only listen on port 443, while Horizon instructs the browser to use port 8443 for Blast Extreme streams.

Port mismatch between ZTNA (443) and Horizon Blast (8443).

The separation of ports in Omnissa Horizon designates port 443 for primary web authentication and port 8443 for the heavy multimedia stream.

Because Symantec ZTNA Web Applications only listen externally on standard port 443, they cannot accept external traffic routed to 8443. During the API handshake, the Horizon server uses the /broker/xml endpoint to hand the client browser the routing instructions for the desktop stream. By default, this payload contains the internal, non-routable network address of the Connection Server and specifies port 8443. The client browser then attempts to connect to this internal address directly over the internet, causing the connection to fail.

Resolution

This issue can be resolved entirely on the ZTNA side without requiring any configuration changes to the Omnissa Horizon Connection Servers (such as altering the local listening ports). By using linked ZTNA applications and dynamic Link-Translation rules, ZTNA can intercept the XML payload and rewrite the routing instructions on the fly.

Select the scenario below that matches your deployment architecture.

Important Configuration Note: Link-translation rules in Symantec ZTNA are case-sensitive. Additionally, certain special characters (such as hyphens - and periods .) must be escaped using backslashes \ in the Source URL field to be properly processed as regular expressions.

Scenario 1: Single Connection Server
In this scenario, traffic flows to a single backend Connection Server. You will use two linked ZTNA Web Applications.

Create the Blast Stream Application (Horizon-CS1)
Application Name: Horizon-CS1
Internal Address: https://cs01.internal.local:8443
External Address: https://horizon-cs1.tenant.luminatesec.com
Create the Main Broker Application (Horizon-Main)
Application Name: Horizon-Main
Internal Address: https://cs01.internal.local
External Address: https://horizon-main.tenant.luminatesec.com
Linked Applications: Link this app to Horizon-CS1.
Configure Link-Translation on Horizon-Main

Navigate to Advanced > Link-Translation Custom Rules on Horizon-Main, enable default content, and add the following Content Rule:

Content Type Message Type URI Source URL Destination URL
Empty or the exact content-type of /broker/xml HTTP Response /broker/xml cs01.internal.local horizon-cs1.tenant.luminatesec.com

Content Type	Message Type	URI	Source URL	Destination URL
Empty or the exact content-type of /broker/xml	HTTP Response	`/broker/xml`	`cs01.internal.local`	`horizon-cs1.tenant.luminatesec.com`

Scenario 2: Load Balancer and Two Connection Servers

In this scenario, a load balancer sits between the ZTNA connector and the Horizon front-end on port 443. The front-end dispatches requests to two available Connection Servers on port 8443. This requires three linked ZTNA applications.

Create the Blast Stream Applications (Horizon-CS1 & Horizon-CS2)
Horizon-CS1 Internal Address: https://cs01.internal.local:8443
Horizon-CS1 External Address: https://horizon-cs1.tenant.luminatesec.com
Horizon-CS2 Internal Address: https://cs02.internal.local:8443
Horizon-CS2 External Address: https://horizon-cs2.tenant.luminatesec.com
Create the Main Broker Application (Horizon-Main)
Application Name: Horizon-Main
Internal Address: https://vdi.internal.local (Load Balancer VIP)
External Address: https://horizon-main.tenant.luminatesec.com
Linked Applications: Link this app to both Horizon-CS1 and Horizon-CS2.

Configure Link-Translation on Horizon-Main

Navigate to Advanced > Link-Translation Custom Rules on Horizon-Main, enable default content, and add the following Content Rules.

Content Type	Message Type	URI	Source URL	Destination URL
Empty or the exact content-type of /broker/xml	HTTP Response	`/broker/xml`	`CS01\.internal\.local`	`horizon-cs1.tenant.luminatesec.com`
Empty or the exact content-type of /broker/xml	HTTP Response	`/broker/xml`	`CS02\.internal\.local`	`horizon-cs2.tenant.luminatesec.com`
Empty or the exact content-type of /broker/xml	HTTP Response	`/broker/xml`	`<port>8443<\/port>`	`<port>443</port>`