With the prerequisites in place and the pairing password set, we can now install the Security Server. As the screenshots are almost identical to those from the previous Connection Server installs, we will only highlight and show the differences in this section:

1. Open a console to the hzn7-sec.pvolab.com virtual machine, and then locate the Horizon View installation software. In the example lab, this was saved to a shared folder on the Domain Controller.
2. Launch the VMware-Horizon-Connection-Server-x86_64-7.6.0-9823717 file to start the installation. This is the same installer application that you used for the first Connection Server, but it will be configured differently to reflect the fact that this is a Security Server.
3. If you see the Open File - Security Warning message, click the Run button.
4. You will now see the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server screen.
5. Click the Next > button to start the installation. You will now see the License Agreement screen.
6. Click the radio button for I accept the terms in the license agreement, and then click the Next > button. You will now see the Destination Folder screen.
7. Leave the folder as the default setting and then click the Next > button to continue.

8. You will now see the Installation Options screen, as shown in the following screenshot:

9. As this is the third Connection Server instance, or Security Server, from the list of Horizon 7 Connection Server instances, select the option for Horizon 7 Security Server from the list (10).
10. The final option on this screen is to select which IP protocol to use: either IPv4 or IPv6. In the example lab, select the IPv4 option (11). Again, as a reminder, you cannot mix the IP protocol version between the different View Server instances.
11. Click the Next > button to continue. You will now see the Paired Horizon 7 Connection Server screen, as shown in the following screenshot:

12. In the Server box (12), enter the details of the Connection Server to pair with. In the example lab, we are going to pair with the server called hzn7-cs2.pvolab.com, which is the Replica Server we set up in the previous section.
13. Click the Next > button to continue. You will now see the Paired Horizon 7 Connection Server Password screen:

14. In the Password box (13), type in the pairing password that you specified when you configured it in the View Administrator.
15. Click the Next > button to continue.
16. You will now see the Horizon 7 Security Server Configuration, as shown in the following screenshot:

17. On this screen, you can specify the Security Server settings. First, in the External URL box (14), enter the address that users will use to connect their Horizon client to over an internet connection. In the preceding example, this has been left as the default; however, you would probably want to change this to something more user-friendly.
18. In the PCoIP External URL box (15), enter the IP address for the external PCoIP connection. Note that, this must contain an IP address rather than a URL, as the box suggests. The address must also have the port suffix added, so in this case, :4172 is the default PCoIP port.

19. Finally, in the Blast External URL box (16), enter the address for the Blast protocol. This is used for HTML5 access.
20. Click the Next > button to continue. You will now see the Firewall Configuration screen.
21. Click the radio button for Configure Windows Firewall automatically, and then click the Next > button to continue. You will see the Ready to Install the Program screen.
22. Click the Install button to start the installation process.
23. Once the Security Server has been installed, you will see the Installer Completed screen. Click the Finish button to exit.
    Unlike when we installed the Connection Server and the Replica Server, no Horizon icon is placed on the desktop. The settings are managed using the View Administrator console. However, to check whether the Security Server is installed and running, on the desktop of the Security Server, launch a Services console, as shown in the following screenshot:

Scroll down until you see the entry for VMware Horizon 7 Security Server (17), and then check that it is running.

You also need to check that the Security Server had registered with the View Administrator. To do this, perform the following steps:

1. From the Inventory menu, expand the View Configuration section, and then click on Servers (18). Click the Security Servers tab (19). You will now see the Security Server HZN7-SEC listed (20). This is shown in the following screenshot:

2. You have successfully installed and configured a Security Server.

As we mentioned earlier, we recommend installing Security Servers in conjunction with dedicated external View Connection Servers so that you can limit access to the virtual desktop machines from external connections by using the tagging functionality.

The first step in achieving this is by tagging your external Connection Servers. To tag a server, perform the following steps:

1. In the View Administrator, from the Inventory menu, expand the View Configuration section, and then click on Servers (21). Click the Connection Servers tab (22) and then highlight the Connection Server that is paired with the Security Server for the external connections. In the example lab, this server is called HZN7-CS2 (23).
2. Right-click and then from the contextual menu, click on Edit… (24), as shown in the following screenshot:

3. You will now see the Edit Connection Server Settings screen, as shown in the following screenshot:

4. In the Tags box (25), type in the name for this tag. In the example lab, this tag is called external. This means that only desktop pools that have also been configured with the tab named external can connect via this Connection Server.