In BFSI environments, secure remote access is a core operational requirement. Banks, financial institutions, stock exchanges, and insurance platforms depend on uninterrupted access for customer servicing, trading and settlement systems, regulatory operations, and internal teams. These environments demand high availability, strong security controls, and predictable behavior during failures, as any disruption at the access layer can directly impact business continuity and compliance.

To address these gaps, we introduced NGINX Plus as a dedicated load balancer in front of multiple VMware Horizon UAG instances. All inbound user traffic terminated at NGINX Plus, which allowed us to control how traffic was distributed and ensure that only healthy gateways were serving users.
Multiple NGINX Plus instances were deployed to avoid introducing any new single points of failure. To manage them consistently, NGINX Instance Manager was implemented centrally, giving us a single place to manage configuration, visibility and lifecycle operations across all load balancers.

Business and Technical Context

In this environment, VMware Horizon was used to provide remote access to internal applications and virtual desktops. Unified Access Gateway acted as the external entry point for all users. Given the scale and sensitivity of large operations, it was clear early on that the access architecture needed to meet a few non-negotiable requirements:

1. No single point of failure at the gateway layer
2. Seamless failover without impacting active user sessions
3. Secure exposure with a minimal public attack surface
4. Support for multiple Horizon protocols, including Blast
5. Centralized management and operational consistency

The existing setup did not fully meet these expectations, particularly when it came to predictable failover behavior during gateway outages.

Architecture Overview

To address these gaps, we introduced NGINX Plus as a dedicated load balancer in front of multiple VMware Horizon UAG instances. All inbound user traffic terminated at NGINX Plus, which allowed us to control how traffic was distributed and ensure that only healthy gateways were serving users.

Multiple NGINX Plus instances were deployed to avoid introducing any new single points of failure. To manage them consistently, NGINX Instance Manager was implemented centrally, giving us a single place to manage configuration, visibility and lifecycle operations across all load balancers.

Role of NGINX Plus in the Architecture

Advanced Load Balancing

NGINX Plus enabled intelligent traffic distribution across UAG instances. This ensured that traffic was always routed to healthy gateways and removed reliance on any single UAG node.

Multi-Protocol Support

One of the key considerations was support for multiple VMware Horizon protocols. The setup handled:

NGINX Plus handled these protocols reliably, even during peak usage periods.

Session Persistence

Session stickiness was configured so that users remained connected to the same UAG instance throughout authentication and active desktop sessions. This was essential to avoid session drops and maintain a consistent user experience.

Active Health Checks

Health checks were aligned with actual UAG service behavior rather than simple port checks. When a gateway became unhealthy, it was automatically removed from traffic rotation and added back only after services fully recovered.

Security Controls

TLS termination and traffic handling were centralized at NGINX Plus. Only the required ports were exposed externally, while backend communication with UAG instances was restricted to private networks, aligning well with BFSI security expectations.

Key Takeaways

As the number of NGINX Plus instances grew, centralized management became increasingly important. NGINX Instance Manager provided a single control plane that enabled:

This approach reduced manual effort and helped prevent configuration drift across the environment.

Outcomes and Benefits

The solution delivered tangible improvements:

The access platform is now resilient, scalable and significantly easier to operate.

Conclusion

By using NGINX Plus as the load-balancing layer and NGINX Instance Manager for centralized control, I was able to deliver the availability, security, and operational consistency expected in BFSI environments.

This experience reinforced the importance of designing remote access platforms with resilience and operations in mind and showed how the right application delivery platform can make a meaningful difference in mission-critical enterprise environments.