DXZ4-AM CPA-certified zero client manual v1.0 2nd June 2016

32 Pages·2016·6.83 MB·English

by  Amulet Hotkey

®
DXZ4 M
ANUAL
Security Edition
DXZ4-AM
PCoIP Zero Client
Revision 2.7
June 2016
HB-DXZ4-0003
DXZ4-AM Manual
Security Edition
Technical Support
Contact Amulet Hotkey technical support for expert
assistance:
Warnings
EMEA
■ To reduce the risk of electric shock, do not remove any
[phone]
circuit board or power supply covers. There are no user
[email protected]
serviceable parts inside; refer to qualified personnel.
■ To reduce the risk of fire or electric shock, do not N America
expose this appliance to rain and moisture. The [phone]
appliance should not be exposed to dripping or [email protected]
splashing and no objects filled with liquids should be
APJ
placed on or near the appliance.
[phone]
Safety instructions [email protected]
1 Clean the product only with a dry cloth.
Or, look at the resources page on our website:
2 Keep the product away from liquids. https://resources.amulethotkey.com/resources
3 Install in accordance with these instructions.
that you thoroughly examine all packaging and contents for
4 Do not install near significant sources of heat.
signs of physical damage before use.
5 Ensure the product is properly earthed.
If any damage has occurred, please notify the shipping company
6 Only use attachments and accessories approved by and your supplier immediately otherwise claims for damage or
Amulet Hotkey. replacement may not be granted.
7 Refer all servicing to qualified personnel. Retain the original packaging for use in the event that the
equipment has to be stored, shipped or returned for service. If
Laser Safety Notice
you choose to dispose of the packaging, please do so in an
The DXZ4-AM-AM zero clients can be fitted with SFP network
environmentally friendly fashion.
modules that contain Class 1 lasers. The SFP module emits
invisible radiation which can cause harm if installed or serviced Thank you
incorrectly. Follow the guidelines below: Thank you from everyone at Amulet Hotkey for purchasing this
Warning: Class 1 laser product. product. Much time and energy has gone into making this the
Warning: Invisible laser radiation can be emitted from the best and most reliable solution available.
aperture of the SFP port when no fibre is connected. To avoid
With over 20 years’ experience working around the world in a
exposure to laser radiation,do notstare into open apertures.
variety of installations, we are confident we have provided a
state-of-the-art unit that will provide you with long and reliable
Warning:Only trained and qualified personnel should be
service regardless of the application.
allowed to install, replace, or service this equipment.
To get the best from this product, please take time to study this
Shipment and Product Inspection
manual carefully even if you are familiar with other Amulet
Your zero client and cables were carefully packed prior to
Hotkey products.
despatch to guarantee safe transit. However, we recommend
© Amulet Hotkey Ltd. All rights reserved.
Information in this document is subject to change. No part of this document may be reproduced through any means including (but not limited to) electronic or
mechanical, without express written permission from Amulet Hotkey Ltd. Amulet Hotkey Ltd may have patents, patent applications, trademarks or copyrights or
other intellectual property rights covering subject matter in this document. PC-over-IP, PCoIP and the PCoIP logo are registered trademarks of Teradici Corp.
Amulet Hotkey and ‘solutions you can bank on’ are registered trademarks of Amulet Hotkey Ltd. Other product names and company names listed within this
document may be trademarks of their respective owners. Amulet Hotkey products are designed and built in the UK.
www.amulethotkey.com |2
DXZ4-AM Manual
Security Edition
IMPORTANT This manual covers Amulet Hotkey® zero clients that use the TERA2 range of PCoIP®
processors.
It covers the principle features of these zero clients, their specifications, operation and
connection to desktop peripherals. It also explains briefly how to create a PCoIP session
between a zero client and remote PCoIP host.
For a full and detailed understanding of the PCoIP protocol, options for connection, security
and management, please refer to thePCoIP Zero Client and Host Administrator Guide which
can be downloaded from the Amulet Hotkey website or directly from the Teradici website
technical support pages.
Amulet Hotkey zero clients are ready for use with VMware® View® version 4 and above.
This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This
device may not cause harmful interference, and (2) this device must accept any interference received, including
interference that may cause undesired operation.
This device has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of
the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a
residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed
and used in accordance with the instructions, may cause harmful interference to radio communications. However,
there is no guarantee that interference will not occur in a particular installation. If this device does cause harmful
interference to radio or television reception, which can be determined by turning the device off and on, the user is
encouraged to try to correct the interference by one or more of the following measures:
▪ Reorient or relocate the receiving antenna
▪ Increase the separation between the equipment and receiver
▪ Connect the equipment into an outlet on a circuit different from that to which the receiver is connected
▪ Consult the dealer or an experienced radio/TV technician for help
www.amulethotkey.com |3
DXZ4-AM Manual
Security Edition
Contents
1. Introduction................................................................5 6.1 Automatic connections to a host PC or virtual
desktop................................................................19
1.1 What is PCoIP®?.....................................................5
6.2 Connect manually to a host PC or virtual desktop
1.2 About PCoIP zero clients........................................6
.............................................................................19
1.3 About PCoIP hosts.................................................7
6.3 Disconnect from a host PC or virtual desktop.....19
6.4 DXZ4-AM support for 8 monitors........................20
2. Before you start..........................................................8
2.1 Firmware revisions ................................................8
7. Updating the BSM firmware......................................24
2.2 Change the default password ...............................8
7.1 Procedure summary............................................24
2.3 IP and MAC addresses...........................................8
7.2 Obtain the BSM firmware update file..................24
2.4 Power supply.........................................................8
7.3 Find the current version of the BSM firmware ...24
2.5 Dual redundant network connections...................9
7.4 Calculate the MAC address of the BSM...............24
2.6 DXZ4-AM SFP modules..........................................9
7.5 Activate the BSM network interface and
2.7 Network bandwidth...............................................9 acquire an IP address...........................................25
2.8 LED status indicators..............................................9 7.6 Transfer the firmware package to the target BSM
.............................................................................26
2.9 Support for connection brokers...........................10
7.7 Confirm that the firmware was updated ............27
2.10 Zero client management tools.............................10
7.8 Deactivate the BSM network interface ...............27
2.11 Cooling considerations........................................12
8. Known issues.............................................................28
3. Deployment security ................................................13
8.1 Monitors continually revert to incorrect display
3.1 Physical inspection of the DXZ4-AM enclosure...13
topology ..............................................................28
3.2 Controlling the use of USB devices......................13
8.2 Devices attached to Mouse port are blocked
3.3 Event logs ............................................................14 unexpectedly.......................................................31
3.4 Secure disposal of DXZ4-AM devices...................14
9. Specifications ...........................................................32
4. Your DXZ4-AM zero client at a glance........................15
4.1 Front panel..........................................................15
4.2 Rear panel............................................................16
5. Setting up the DXZ4-AM zero client...........................17
5.1 Connect the keyboard, mouse and monitors......17
5.2 Connect to a PCoIP host ......................................17
5.3 Connect the power supply ..................................17
5.4 (Optional) Deactivate the front panel switches ..18
5.5 Establish a new PCoIP session .............................18
6. Using the DXZ4-AM zero client..................................19
www.amulethotkey.com |4
1
1. Introduction
This manual covers the Amulet Hotkey DXZ4-AM series zero ■ Host rendering: PCoIP renders display images on the host PC
clients. The DXZ4-AM has been evaluated by the CESG (or virtual machine). Host rendering preserves the PC
Commercial Product Assurance Scheme and approved for use at environment so applications perform as they should. After
foundation grade for Remote Desktop v1.0. an image is rendered on the host, PCoIP broadcasts just the
encrypted pixels (not the data) across the network to the
Based on PCoIP Technology from Teradici Corporation, the
remote client. This makes it possible to have stateless,
DXZ4-AM zero clients supports four video heads in a compact
decode-only client devices – calledzero clients– with all the
tough case and is ideal for mission critical applications.
benefits they bring, such as low maintenance, increased
security, and cost savings. Seesection 1.2 for details.
1.1What is PCoIP®?
Note:Other remote computing protocols use client
The PCoIP (PC-over-IP) protocol compresses, encrypts and rendering. To render an image on the client, each
encodes the entire computing experience on a host PC. In a command from the host, and each response from the
PCoIP system, a PCoIP host transmits the computing experience client, must travel across the network. This degrades an
from a host PC 'pixels only' across a standard IP network to a application’s performance while it waits for image
remote zero client. Actual data never leaves the host PC and all rendering to complete.
pixel transfers are encrypted with advanced security algorithms.
■ Multi-codec display processing: A PC display includes
PCoIP supports high resolution, full frame rate 3D graphics and different types of image elements (text, graphics, icons,
HD media, multiple large displays, full USB peripheral video). Using the same codec to encode all these elements
connectivity, and high definition audio, all connected over the would use excessive network bandwidth. Instead, PCoIP
corporate LAN or WAN. continuously analyses and decomposes image elements,
using the right codec for each pixel.
Furthermore, PCoIP technology allows all desktops in your
enterprise to be centrally located and managed in a data centre, in PCoIP’s intelligent image decomposition and encoding
a geographically remote location if necessary, while providing results in efficient transmission and decoding. This saves
remote users with full desktop performance. bandwidth while delivering the best user experience. In
addition, PCoIP builds every pixel to a lossless state when
There are three essential features of PCoIP:
3
2
LAN/WAN
Copper/Fibre
4
Example PCoIP system
1 Zero client (quad video head). 1
2 Quad monitors.
3 Remote workstation or blade.
4 PCoIP host. Hosts can be implemented
in hardware (as shown here) or in
software, using VMware View.
www.amulethotkey.com |5
DXZ4-AM Manual
Security Edition
they stop changing, ensuring a pixel-perfect image on the Because zero clients just decode pixels to display images, they
zero client regardless of network limitations. can be far simpler and more secure than a traditional desktop
PC and other thin client solutions:
■ Dynamically adapts to network conditions: The PCoIP
protocol lets you easily set image quality settings to manage
■ Increased security: Because PCoIP zero clients have a
bandwidth use and ensure the best possible performance is
stateless architecture and no local data storage, they are the
delivered for the prevailing network conditions.
most secure endpoint available.
On congested networks , PCoIP adaptive encoders Pixel transfers to the zero client are encrypted with
automatically adjust image quality within the limits you set. advanced security algorithms. Zero clients are also immune
When the network is no longer congested, they to viruses and never need anti-virus updates. Finally, zero
automatically resume maximum image quality. clients comply with the most stringent government and
security mandates. In particular, they support robust USB
1.2About PCoIP zero clients hardware security authorization, including user
authentication and single sign-on (SSO) based on smart
PCoIP zero clients are secure, hardware-based endpoints that
cards, proximity cards and other SSO devices.
allow users to connect to a remote host PC or virtual desktop
over a local or wide area IP network. They support multiple ■ Low maintenance:Zero clients are extremely easy to
wide-screen formats, HD audio, and local USB peripherals, manage and do not require regular updates or patches.
providing a rich multimedia experience for users. They have no application operating system, no general
purpose CPU or RAM, no graphics processor. And they have
Zero clients can take many form factors, such as PCoIP
no fan or hard disk to fail.
integrated displays and touch-screen monitors. Amulet Hotkey
DXZ4-AM zero clients are small stand-alone devices. Because they perform only pure image decompression, they
are future proof. A zero client never needs a new operating
Users can interact with their desktops from any type of zero
system or updates for drivers, media codecs, or anti-virus
client and can even continue the same session if they move
signatures. Also, a zero client does not need to know about
between zero client devices.
the applications being used (it just has to decode the pixels
to display the image), so there are no version dependencies
PCoIP zero clients use a highly integrated TERA-series processor
between the zero client and the host PC. There is no risk
to perform image decompression and decoding. At the desktop,
that future versions of an application will render the zero
they decrypt, decompress and distribute video, audio and USB
client obsolete.
data to the standard desktop peripherals ie, monitors,
keyboard, mouse, and speakers or headset. A zero client also
■ Cost savings: Zero clients have significantly lower costs than
passes user-generated USB and audio data back to a remote
traditional PCs and thin clients. They use less power,
PCoIP host (seesection 1.3).
generate less heat, and often have a smaller footprint
(Amulet Hotkey zero clients are the size of a small book).
To ensure desktop responsiveness, the process of image
compression-encryption-transmission by the PCoIP host Also, because they are simple devices, zero clients require
and then decryption-decompression by the zero client minimal administration and have very low management
happens very quickly, typically in just one frame (or less than 15 costs. And because they are future proof, their extended life
msecs). span is assured and they rarely need replacing.
For more general information about PCoIP zero clients, visit
www.teradici.com.
www.amulethotkey.com |6
DXZ4-AM Manual
Security Edition
1.3About PCoIP hosts
A PCoIP host is a card that converts a remote PC (or blade) into
a pixel broadcast centre. The host's TERA-series processor
performs advanced display compression algorithms to encode a
user's full desktop environment, allowing the host to deliver
high-end images to a zero client in any location.
In a PCoIP system, the PCoIP host is installed inside or near to
the remote PC. The host takes digital video, audio and USB data
generated by the PC and compresses and encrypts this data. It
then transmits this data in real time over an IP network to the
user’s PCoIP zero client.
Amulet Hotkey PCoIP hosts are available in various form factors.
Some install inside a PC while others are located near to a PC
and connect to video, USB and audio ports using standard
cables.
Amulet Hotkey also supply a range of PCoIP blade workstations
based on the class leading Tier 1 devices from Dell. These
workstations include Amulet Hotkey BIOS and PCIe mezzanine
cards to provide hardware GPU and PCoIP acceleration.
For further details about Amulet Hotkey PCoIP hosts, visit
www.amulethotkey.com.
www.amulethotkey.com |7
2
2. Before you start
Before you connect a zero client to a PCoIP system, be aware of 2.2Change the default password
the following issues.
You must enter a password before changing the configuration
of the DXZ4-AM zero client. The factory pre-set password for all
2.1Firmware revisions
Amulet Hotkey zero clients isahkdante.
PCoIP devices operate on embedded code known as firmware.
At first login, the DXZ4-AM prompts for a new password. We
The firmware is constantly being improved and periodically
strongly recommend that you set a new, more secure password
updated. To check the current version of firmware on any PCoIP
before allowing end-users to use the DXZ4-AM.
device, use the On Screen Display or Administrative Web
Interface management tools built into PCoIP hosts and zero Important!Although the DXZ4-AM does not enforce a
clients. Seesection 2.10 for details. password policy for administrator logins, we strongly
recommend that you implement a robust and secure
2.1.1Firmware updates
password policy. Where possible, use a machine-generated
Amulet Hotkey periodically release new firmware to support password of eight or more characters. We also
continuous improvement of its products. Update notification recommend that you provide your DXZ4-AM users with
emails will sent be to nominated client representatives and guidance about the secure handling of pass phrases.
include a link to download a file containing the firmware update.
2.3IP and MAC addresses
We recommend that you apply new firmware releases at the
earliest opportunity to ensure that the latest improvements and
Before you set up a zero client, make a note of these details:
patches are active in any deployment.The latest firmware
■ MAC and IP address of the remote PCoIP host
release and instructions on how to update theDXZ4-AM are
available on theResourcespage of the Amulet Hotkey website. ■ MAC and IP address of the zero client
Note:You must register on the Amulet Hotkey website to Find this information on the base of the zero client and on the
access the download area. configuration record/serial number label of the remote host.
You can also use the Administrative Web Interface (seesection
2.1.2Security for downloaded firmware files
2.10.2) to find the MAC addresses.
Before downloading a firmware update from the Amulet Hotkey
If your network uses DHCP, the host and zero client obtain their
website, confirm that the SSL certificate for the Resources page
IP addresses from the DHCP server. If no DHCP server is
is valid and issued to the resources.amulethotkey.com domain
available, the host and zero client time out after approximately
(click the padlock icon in the address bar of your browser).
two minutes and adopt the following default IP addresses:
After downloading the file, we recommend that you confirm it
Zero client: 192.168.1.50
has not been modified by comparing its SHA-256 hash with the
Host card: 192.168.1.100
SHA-256 hash value listed next to the download link on the
Amulet Hotkey website. Use the hash calculator of your choice
2.4Power supply
to independently calculate the SHA-256 hash for the
downloaded file.
Amulet Hotkey zero clients are supplied with a mains to DC
power supply that self-senses the incoming voltage
(110-240VAC). This power supply has a locking DC connector for
use with the zero client. To release the connector, pull the
locking sleeve away from the rear of the zero client.
www.amulethotkey.com |8
DXZ4-AM Manual
Security Edition
Important!Use only this power supply with the product. settings made by the user. Different displays and usage will
generate different bandwidth requirements.
2.5Dual redundant network connections
For example, a dual head configuration running a word
Take care when using the dual redundant network connections processor, spreadsheets, and 2D illustrations/designs will
built into Amulet Hotkey DXZ4-AM zero clients. Both main and typically use between 1 and 10 Mbit/s. Conversely, a quad video
auxiliary network ports (seeitem 1 insection 4.2) are connected head system running real time full screen video might peak
to an internal, unmanaged network switch. The zero client itself at 70 Mbit/s.
does not monitor its network links and relies on the LAN
Because the exact bandwidth requirements for PCoIP are
spanning tree to prevent switching loops and to provide the
difficult to predict, use the following values as a guide only:
redundancy.
■ With no USB or audio data, PCoIP uses approximately
If the main and auxiliary ports are both connected when an 32Kbit/s per pair of monitors.
established connection between the zero client and PCoIP host
■ General office use (that is, writing documents) consume
is interrupted (for example, because a switch or switch port
between 300-500Kbit/s.
fails), the recovery process is as follows:
■ PCoIP only sends display changes, so an idle display
1 The Spanning Tree network protocol brings up the redundant
generates very little traffic.
path between the disconnected zero client and host.
■ A significant display change (such as minimising or restoring
2 The zero client attempts to resume the session. By default, it
a window) can cause a brief peak of around 4-5Mbit/s.
retries for up to 30 seconds. If the remote PCoIP host is
reachable within this time, the session resumes seamlessly. ■ USB transfers generate up to 6Mbit/s of traffic in the
direction of the transfer.
3 If the zero client cannot reach the host within the retry
period, it displays the Connect screen of the On Screen ■ Audio requires around 2Mbit/s.
Display (seesectionsection 2.10.3). ■ Playing full-screen video can use up to 70Mbit/s.
4 When the user re-authenticates themselves, they are
In all cases, PCoIP builds to a lossless image. If the required
reconnected to the previous session as it was at the time of
bandwidth is not available, PCoIP dynamically adjusts the quality
the failure.
to match. You can also use the zero client management tools
Note:If you use a connection broker to pair zero clients to (seesection 2.10) to optimise performance for most conditions.
PCoIP hosts (section 2.9), you can configure the session so
If bandwidth usage is a concern, we recommend testing and
that the Windows desktop is locked while disconnected.
monitoring on your network. For assistance, please contact
Amulet HotkeyTechnical Support.
2.6DXZ4-AM SFP modules
2.8LED status indicators
The DXZ4-AM has dual network ports that accept fiber or copper
SFP modules. Seeitem 1 insection 4.2.
Amulet Hotkey zero clients have status LEDs on the front and
Amulet Hotkey can provide a range of suitable SFP modules, rear panels. Seesection 4.1 andsection 4.2 for details.
including 1Gbps and 100Mbps fiber SFP modules for multi-mode ■ Front panel LEDs show the status of the PCoIP connection
fiber and copper SFP modules with RJ45 connectors. See the and the status of the zero client switches (you can optionally
Amulet HotkeySFP Modules Datasheet for details of currently deactivate these switches).
available modules.
■ Rear panel LEDs associated with the RJ45 or SFP network
connections indicate current network activity.
2.7Network bandwidth
Be aware that SFP modules have differing specifications, and the
PCoIP uses the Internet Protocol (IP) to transmit data
distances over which they can drive a signal vary. This especially
between the host and client. The data can be routed over any
applies to fiber SFP modules.
IP-compatible infrastructure between offices or across
continents. In every case, performance depends on the available Important!The DXZ4-AM only supports certain models of
bandwidth and signal latency. SFP module. If in doubt, contact Amulet Hotkey for advice.
How much bandwidth is required? This depends on several
factors, including the number of pixels changing from frame to
frame, the number and resolution of screens to be encoded, and
www.amulethotkey.com |9
DXZ4-AM Manual
Security Edition
2.9Support for connection brokers 2.10.1PCoIP Management Console
All Amulet Hotkey zero clients can be configured to use a third The PCoIP Management Console has a web interface that allows
party connection broker (also known as a connection you to manage multiple devices (PCoIP zero clients and hosts)
management server). For example, the following connection from a central console.
broker products include PCoIP support:
From the console, you can view the status and connection
■ VMware View Connection Server
information of all PCoIP devices. You can manage devices
■ Leostream Connection Broker
individually or by group. For example, you can create device
groups based on location or department.
Connection brokers simplify the administration effort for
managing large complex PCoIP systems. A connection broker
In particular, you can assign configuration profiles to PCoIP
interacts with systems such as Active Directory to dynamically
devices and update device firmware (for the Teradici processor).
assign PCoIP hosts to zero clients based on the identity of the
You can also view device log files, reset devices, and control the
user establishing a connection from the zero client. Connection
power state of devices.
brokers are also used to allocate a pool of hosts to a group of
zero clients.
You can use any of the available management tools (seesection
2.10) to specify the connection broker. You must provide the IP
address or DNS name of the connection broker. You must also
specify the ‘Connection Management Interface’ connection
type for the PCoIP session.
Instructions for using a connection broker to connect your zero
clients to hosts are available in the TeradiciPCoIP® Zero Client
and Host Administrator Guide (available to download from the
Teradici support site).
Note:For further information about using connection PCoIP Management Console home page
brokers, contact Amulet HotkeyTechnical Support. See
Note:The PCoIP Management Console plus supporting
also Knowledge Base article ‘Can I use a connection broker
documentation is available for download. For more
with PCoIP technology? (15134-24)’ on the Teradici
information on the PCoIP Management Console, please
support site.
contact Amulet HotkeyTechnical Support.
2.10Zero client management tools 2.10.2Administrative Web Interface (AWI)
The AWI is an embedded HTTPS web interface for PCoIP devices.
You can interact with PCoIP zero clients through various
It enables you to remotely configure individual PCoIP hosts and
management tools:
zero clients using a web browser. For example, you can set
■ The PCoIP Management Console allows you to centrally
device power settings, connection speeds, and define initial
administer large numbers of PCoIP devices. You can organize
setup parameters. The AWI also provides tools for updating the
zero clients into groups, define configuration profiles, and
device firmware (for the Teradici processor).
apply configuration profiles to groups.
■ The Administrative Web Interface (AWI) is a web application
that you can use to remotely configure individual zero clients
and PCoIP hosts.
■ The On Screen Display (OSD) runs directly on the zero client.
It allows you to configure and view information about the
local client.
Note:For full details about these management tools, see
theTeradici PCoIP® Zero Client and Host Administrator
Guide (available to download from the Teradici website).
www.amulethotkey.com |10