That way all of our client would connect to a single URL that would then redirect them to the UAG which are also publicly accessible but the user would not hit them directly. If the traffic does need to flow persistently through the F5 could we instead configure a VIP on our F5 that redirects to the UAG at a public IP? (e.g. If I understand correctly the display protocol traffic will still have to flow persistently through the F5 and UAG to the Horizon Agent. We will be doing SSL passthrough to minimize the CPU load on the F5. We then have two connection servers with private IP. We have a public IP that is NAT to a private IP on the F5 for the VIP. We then have a pair of UAG that are front-ended by a VIP on our F5 again using the iApp. We do not have any tunneling configured on the F5 or the Connection Servers. These are front-ended by a VIP on our F5 using the iApp.

We are standing up a new Horizon 7.1 environment and have some questions on the traffic flow when load balancing a pair of UAG.įor external access we have a dedicated pair of connection servers.

Unified access gateway appliance