VMware Horizon infrastructures often have the Unified Access Gateway (UAG) component to enable a secure connection from outside your corporate network to VDI.

This positioning makes the UAG subject to frequent updates, today we will see how to update it.

Download the ISO file of the version we want to update from the VMware Customer Site:

Check compatibility with your Horizon infrastructure:

Product Interoperability Matrix (vmware.com)

Download the INI file containing the current UAG configuration

• Access the Unified Access Gateway interface
  • HTTPS://<fqdnUAG>:9443

Using the credentials of the admin user

Once logged in, download the .ini file

Retrieving the information needed to complete the configuration file:

• Certificate for public access and password
• Certificate for the admin center and its password
• SAML component XML if integration with AZURE MFA
• Information on where to deploy (vCenter, Cluster, virtual network, datastore ) the Virtual Appliance of the new UAG

The data indicated will serve me to fill in the fields of the downloaded ini file

I summarize the info required in this table

Sector	Field	Description
General	netInternet	PortGroup on which to certify the network card that communicates to the internet world *
General	diskmode	Thin or Thick
General	Source	Absolute path where the ISO resides
General	Target	Path of the vSphere infrastructure where we will deploy the virtual appliance
General	Ds	Datastore where the VM will be created
General	netManagementNetwork	Portgroup on which to certify the network adapter for UAG management *
General	netBackendNetwork	Portgroup on which to certify the network adapter for UAG management *
General	Name	Virtual Machine Name
General	uagName	Hostname of the UAG (normally to be left that of the UAG to be replaced)
SSLCert	pfxCerts Property	Path where the SSL Certificate generated by a public CA in password protected PFX format used to access VDI by Horizon Clients resides
SSLCertAdmin	pfxCerts Property	Path where the SSL Certificate generated by a CA (normally Microsoft and Private) used to secure and validate access to the UAG Management Interface resides
IDPExternalMetadata1	metadataXmlFile Property	XML file of the Identity Provider (In this case Azure AD) to enable Azure MFA for access

*VMware recommends at least two network adapters in two different segments for production environments

• One for internet traffic (I call it the EXT-DMZ)
• One for traffic to the internal LAN (I call it the INT-DMZ)

It is possible to create environments with 1 or 3 network adapters, in the first case VMware recommends only one card only for test environments, and in the second to also differentiate the management traffic that otherwise, in the two-card configuration would pass through the card that communicates with the internal LAN.

At this point we can proceed with the deployment of the virtual appliance:

• The first step is Shutdown the old UAG Virtual Appliance (I suppose do you have at least two UAGs with a Load Balancer in front and at least a DNS round-robin for balancing the traffic to the Connection server)

.\uagdeploy.ps1 -iniFile UAG_Settings_VIUAG04.ini

Allow CEIP

Insert password for PFX Certificate File

Insert a new (or reuse the old) password for the Root account (for access to UAG OS) and Admin account (for access to UAG WEB admin console)

Waiting to complete the UAG Deploy (You can check the process from the vCenter task)

Now the new UAG virtual appliance is up and running!! Test it and apply the same step for all UAG virtual appliances of your VMware Horizon Infrastructure.