Two factor authentication for connecting to VMWare Horizon over the Internet

I am in discovery mode on this project.  I am using VMWare Horizon Client to allow users to access their virtual desktop from locations outside of the office.  I want to enable two factor authentication just for connections coming into the view connection server from the Internet.  I do not want two factor for connections made from my internal zeroclients and PC's (very few) that run Horizon client and connect over PCoIP.  Is it possible to do this type of separation?  I am also curious what authenticator you have had the best luck with.  I see Google Authenticator is pretty popular.
Steve BantzIT ManagerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Seth SimmonsSr. Systems AdministratorCommented:
we use duo for 2FA
for us, we created 2 separate connection servers; one internal, one external
there is 1 security server for the external connection server
the duo config is setup and works well with both the horizon client and web client
after putting in your password, then you have the duo 2FA prompt which most users opt for a push that will prompt for approval in the duo app on  your phone.  you can also use a yubi key and the duo app can generate a code to type

wanted to avoid using 2 connection servers but that was the only option
first attempted to use vmware unified access gateway which is a linux appliance that would not require having a security server on windows externally facing.  however, it was not working correctly with 2FA.  Seems it does not tell the connection server that it already authenticated so you get prompted for username and password a second time which we know users wouldn't want to do.  vmware support told me it will not work the way i was trying to do so just went with separate connection server with 2FA enabled.  turned off, of course, for the internal server for users on thin clients in conference rooms.  has worked well for us for over a year.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Steve BantzIT ManagerAuthor Commented:
That makes sense.  Is there additional vmware licensing that needs to be purchased to spin up another connection server and a security server?
Seth SimmonsSr. Systems AdministratorCommented: additional licenses (i had asked my reseller before the same thing)
Steve BantzIT ManagerAuthor Commented:
Thanks for the tips.  I am going to take the same route you did.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.