2012 TS Gateway and UDP

I have a 2012 TS gateway for remote access for our Session Host server.
The TS gateway is on the LAN and the Firewall forwards request from our external IP on to the TS Gateway, in the past 2008 and R2 we have just had 80 and 443 open and it works fine, as it still does on 2012.
I want to enable the 2012 UDP option 3391 so I asked our ISP to also open the UDP port 3391 both ways.
Now RDS doesn't work properly, I can see in the TS Gateway monitoring that clients are connected http and usually 2 UDP connections, The Client when you click on the connection button we get connection is good or excellent and UDP is enabled.
From the Client end the best way to explain the experience is things will work smoothly for a while then hang if you try to resize windows it takes a while to do, what is really interesting is if you set of a video in a portion of the screen this will continue
to stream ok whilst the rest fails to redraw correctly. Also interestingly if you move the Windows Media Player around the video moves around flawlessly but the surround stays where it was originally.
Turn off UDP and things go back to normal, I would like UDP to work because on constrained connections the experience isn't brilliant.
Is there anything I'm doing wrong should I ask for established related through the firewall? is there anything I can look at to see how I can improve this.
If I force an internal client to connect to the Gateway the UDP experience is absolutely fine.
Its a bit frustrating that I can only test this issue remotely.
Any help would be appreciated, as the information on the internet is scanty
Thanks Gordon.

Similar Messages

SCOM 2012 R2 Gateway installation error and no System Center Management server after install

Hi,
I have installed SCOM 2012 R2 Gateway and I got an error 25372 error at the start of the install. It still installs though. However I have no system center management service running in services but I can see healthservice.exe is running.
Why am I not seeing the system center management service?
Thanks.

Using gateways with certificates is always a bit complicated because there are several things that needs to be configured correctly.
DNS: The MS and the GW server need to be able to resolve each others FQDN. you can adjust the hosts files if needed.
Traffic is only TCP 5723 from the gateway to the MS. You can test this with the telnet client.
Certificates:
http://marthijnvanrheenen.wordpress.com/2012/03/28/scom-2012-connecting-a-gateway-server-using-certificates/
The gateway server should NOT be in pending management. Remove it from here before running the approval.
You should start by making sure DNS and the 5723 port are functioning because that is probably where the problem is.
Please remember, if you see a post that helped you please click (Vote As Helpful" and if it answered your question, please click (Mark As Answer).

Publish RD Gateway and Web Access with One-Time Password (OTP) / Two-factor Authentication WITHOUT ISA/TMG server

Hi everybody,
I've been struggeling with this problem for a few weeks now and can't find a way to solve it.
We have an RD farm (Server 2012) which consists of two Remote Desktop Servers with Connection Broker and Web Access.
I've recently published a new server, containing RD Gateway and Web Access in our perimeter network.
Now we've got restrictions that OTP/2FA must be used for the external deployment and we've decided to go for a solution from Gemalto.
The "program" is called IDConfim and the server is called SA Server (Strong Authentication).
Also it's important that NO ISA/TMG server is supposed to be used, the OTP/2FA is supposed to work seamless with the Web Access/Gateway.
After hours discuss we came to a point were their NPS agent setup would be the only way to accomplish our goals.
The setup is supposed to be like this:
LAN:
1 DC (2008 R2)
RD Farm (2012)
1 SA Server (2012)
DMZ:
RD Gateway/Web Access (2012)
Were Gateway and Web Access should forward the authentications with NPS to the NPS agent on the SA server.
When you print your AD account to authenticate you add the 6 digits of OTP which you recieve from you mobile app.
Initially this seems to work, the Gateway forwards the request to the remote NPS server, BUT only if you write the correct AD password
(without the OTP extension).
If you write the correct AD password the authentication is forwarded to out SA Servern and it's beeing rejeced because the password doesn't
contain the correct OTP extension.
The problem comes here.
When you write you AD password along with the OTP extension you get a Windows Security error in the eventlog (On thw Gateway server) like this:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: user
Account Domain: domain
Failure Information:
Failure Reason: Unknown username or password.
Status: 0xc000006d
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: server
Source Network Address: 192.168.x.x
Source Port: 63003
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
What i can see it's a NTLM error, but hey?! aren't we supposed to forward all authentication handeling to the remote NPS server?
The problem is that no matter what i try the above problem stays there.
Is it not possible to just forward ALL authentication handeling to a remote server?
The only solution I've found to get it working someday in the future is this:
"Remote Desktop Pluggable Authentication and Authorization", which is supposed to be introduced in 2012 R2.
Also this link describes it:
http://archive.msdn.microsoft.com/Release/ProjectReleases.aspx?ProjectName=rdsdev&ReleaseId=3745
Please, bring me some answers before my head explodes! :)
PS, long question = maybe some errors, ask me if something is unclear.

Hi,
Based on our experience, if the NTLM error occurs, please check the password.
Regards,
Mike
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Where/how to troubleshoot external gateway and internal connection brokers etc.??????

We have gateway.domain.org as our external/internal gateway server.
It goes from gateway.domain.org to rdbroker.domain.local, rdbroker is the DNS address for two connection broker servers.
After this it should set up the connection and create a remote desktop to one of the RDS host servers in the RDS host farm.
Sometimes this works, sometimes it doesn't -- for different user accounts and different computers.
How to troubleshoot this??
We know the firewall rules for DMZ etc. etc. are properly configured because everything IS observed to work, just not all the time consistently. We get errors about cannot contact the computer, cannot establish remote desktop connection...
Thank you, Tom

Hi Tom,
Firstly, you need to recheck the DNS entry is well setup for your case. Are you using DNS RR for Load balancing the server or 3rd party load balancer? Have you setup the proper certificate for your case?
Please check whether required ports is opened? We need to open TCP port 443 and UDP port 3391 and forward them to your RD Gateway server. Also need to specify the external FQDN of your RD Gateway server in deployment properties under RDS server manager. If
you have RDWeb and RDG on the same server this would be the same FQDN that your users will use for RDWeb. Please see whether you have properly configured RD RAP and RD CAP policy.
You can go through beneath article for more details.
Step by Step Windows 2012 R2 Remote Desktop Services – Part 3
https://msfreaks.wordpress.com/2013/12/26/windows-2012-r2-remote-desktop-services-part-3/
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

RD Gateway and RD Web Access - better together or on different servers?

I am evaluating Remote Desktop Services with 2012 R2 and initially I had all the roles on 1 server for testing. I began thinking it would be a better setup to split the RD Gateway role and the RD Webaccess role into different servers for security purposes.
This way I could expose only the RD Gateway to the internet and the Web Access role would not be exposed. In all my reading and searching it seems that nearly every article I come upon has both RD Gateway and Web Access installed on the same system.
What is the ideal setup from a security standpoint to have the these two roles separate or does it not mater? If it does not mater then I will setup 1 server with Gateway and Web Access and I will then have other servers for licensing, broker, session
host, and visualization host once I move this into production.
If these roles are on the same system how do I know if the gateway role is doing anything? Is the FQDN\rdweb the correct URL to use even when the gateway is implemented?
If they are separate how do I tell the gateway and web access servers to use each other?

Hi,
As far as I know, it’s fine to have RD Gateway and RD Web Access roles installed on the same server.
“Normally external users would log on to RD Web Access via tcp port 443, click on a RemoteApp and connect to RD Gateway via
tcp 443/udp 3391, RDG connects them to RDCB on tcp 3389 which redirects them to a RDSH server, finally the RDG connects to the RDSH on tcp 3389/udp 3389.”
Quoted from TP in this post below:
RD Gateway and RD web issue
https://social.technet.microsoft.com/Forums/windowsserver/en-US/5ab40559-23f7-4ebc-b60d-87375cc55674/rd-gateway-and-rd-web-issue?forum=winserverTS
More links below for you:
RD Gateway deployment in a perimeter network & Firewall rules
http://blogs.msdn.com/b/rds/archive/2009/07/31/rd-gateway-deployment-in-a-perimeter-network-firewall-rules.aspx
Remote Desktop Gateway/Web Server Placement
https://social.technet.microsoft.com/forums/windowsserver/en-US/b2970cf5-a5b5-494c-88b7-cd6e01f84bb6/remote-desktop-gatewayweb-server-placement
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]

TS 2012 seperate gateway setup

Hello,
I am looking for a replacement for Citrix. We are running Server 2012 R2 on Azure. I have a couple of quires about the roles: I thought the TS Gateway would act the same as the Citrix gateway in that it encapsulates all traffic to over port
443 but it appears that you need to give internet facing access to the web access, the connection broker and the gateway. If this is the case I have to ask what is the point of having the gateway?
What I am trying to do is have an application accessible via Web Access. Our clients are extremely restrictive and only allow ports 80 and 443 out. I would like to have a gateway server (eu-gw-01) internet facing and the actual server
running the application on the RD Session Host server (eu-ts-01) behind that. So in terms of best practices where abouts should the Connection Broker, Web Access and Gateway role be installed.
Ben

Hi Ben,
There are multiple ways to set things up depending on your needs and security requirements. For example, you could have one server running RD Web Access and RD Gateway, with TCP port 443 and UDP port 3391 open to Internet clients. Behind that
you could have your RDSH servers for your applications, a RDCB server, a DC, etc. In this example only the server running RDG/RDWeb is exposed directly to the Internet.
Purpose of RD Web Access is to deliver RemoteApps (and/or Full Desktops) in the form of .rdp files that have all the necessary settings embedded within them. RD Web Access requires TCP port 443.
Purpose of RD Gateway is to allow clients to connect over secure HTTP and UDP transport and allow them to connect to internal servers. In this way it acts as a middleman. For example, clients connect to the RDG using TCP 443 and UDP 3391, and
then the RDG connects to the internal RDSH servers using TCP 3389 and UDP 3389. RD Gateway requires TCP port 443 (at minimum) and preferably UDP port 3391 as well.
In order for your clients to be able to use UDP they will need to allow outgoing UDP 3391. If they block this it will still work, but will be TCP only. To take full advantage of the improvements in RDP 8.1 you will need to update the clients
to Remote Desktop Connection 8.1 (6.3.9600).
-TP

Remote Desktop Gateway and WebAccess Deployment - Multiple Logon Prompts

I'm having a few issues with some multiple logon prompts using "Connect to a remote PC" via RD Web Access.
I am able to log onto the RDWeb without a problem.
Essentially once I make a connection to my end-device I first receive a logon prompt, I'm authenticated, then I'm asked again for another logon prompt. Any ideas how to resolve this?
My layout is simple:
1 VM in the DMZ that has the Remote Desktop Gateway and Remote Desktop Web Access roles installed. No connection broker, or session host.
With my deployment I have a wildcard certificate bound to the Remote Desktop Gateway and it is bound properly in IIS. Remote Desktop functionality through the RDGateway works just fine. However, the only nuisance is that I get prompted multiple times for
credentials when accessing the end-device regardless if my connection is from a domain-joined machine or a non-domain joined machine.
I've tried using Web Single Sign On via http://anandthearchitect.com/2014/01/20/rds-2012-r2single-sign-on-using-windows-authentication-for-rdweb-page/ and it still does not work.
Any ideas?
Thanks,
Dan

Hi Dan,
How many prompts are you seeing? Expected behavior for Connect to a remote PC would be this:
1. Log on to RDWeb
2. Select Connect to a remote PC tab
3. Enter server name in Connect to box, click Connect
4. Unknown publisher warning, click Connect
5. Credentials prompt, it should say These credentials will be used to connect to the following computers: 1. rdgw.domain.com (RD Gateway server) 2. remote.domain.com (remote computer)
6. After entering credentials and clicking OK it should log you in to the remote computer. This assumes that the destination is authenticated properly (usually via certificate) and the credentials are valid for both the RDG and the remote
computer. Normally in a domain environment the same credentials (domain\username) would be valid for the RDG and the remote server.
-TP

How can we get the prompt to enter IP Address, Subnet Mask , gateway and DNS Server during Task Sequence?

How can we get the prompt to enter IP Address, Subnet Mask , gateway and DNS Server during Task Sequence?

This is for 2007 but may still be relevant for 2012
http://hexdump.net/?p=391
Cheers
Paul | sccmentor.wordpress.com

Support NTLM authentication against Windows 2012 RD Gateway on iOS/Android

iOS/Android clients use only Basic authentication against Windows 2012 RD Gateway (HTTP transport), while it provides more secure options like NTLM. Both Windows and Mac clients use NTLM in that case.

Hi,
For this you can specify the policy setting for “RD Gateway authentication mode” under below path.
User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\RD Gateway
In addition you can refer beneath article if find helpful in your case.
Remote Desktop Gateway client fails authentication with “Your user account is not authorized to access the RD Gateway”
http://blogs.technet.com/b/networking/archive/2010/01/14/remote-desktop-gateway-client-fails-authentication-with-your-user-account-is-not-authorized-to-access-the-rd-gateway.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

What's going on with Project "Gateway" and Sybase?

I've just returned from Teched in Berlin where I followed mostly the mobile track of sessions.
I've come away alternately energised and confused. Each topic in its own right is clear, but piecing allthe components together is a different matter.
Has anyone got opinions on the future role of project Gateway? I saw many sessions by Sybase on the SUP and only one which mentioned Gateway. Gateway didn't feature in the mobile strategy slides. However, I have seen material mentioning the future tie-up of the two. If this should happen, then how might they interact? And what future for the co-innovation platform? Can we draw any conclusions on this yet?
The instant value mobile apps session CD161 seems to build on top of the SAP Data Protocol (SDP), but thinking back, they didn't mention Gateway in there at all. And the co-innovation platform session was silent on both Gateway and SDP
So does "Instant Value" equal "Project Gateway"? It can't be since the Sybase guys talk a lot about Instant Value. Are there two interpretations of this term within the organisation?
Just hoping to kick off a general discussion on this subject. All opinions and replies welcome. Especially from insiders...
Alex.

Hi Steffan - good point. I kind of assumed that LMS is another term for Project Gateway... They seem to be addressing the same problem, and the architecture diagrams look qualitatively similar. The CD121 Sybase slides also talk about the "SAP Mobile Connector", which might be yet another name for the same thing. I think you would know better than me since you've already built that thing you showed at the Demo Jam - what data consumption technology was your demo-ed app using?
I get the impression that there have been a number of independent development streams within SAP which are only now being brought together. This manifests itself to us as mixed or incomplete messages. It's easy to see how at a teched, each group might be responsible for getting its own message out and not necessarily integrating into the overall message of the mobile strategy.
So essentially there are two categories of mobile app inthe SAP vision:
1. Instant Value and
2. Mission Critical.
Then there are various methods of consuming SAP backend data from our mobile apps:-
1. Netweaver mobile DOE (via co-innovation platform?)
2. LMS
3. Project Gateway
4. Web services
5. BAPIs (via JCA)
(This is five methods, not four, which is another reason why I thought LMS and Gateway were the same thing).
Then on top (or underneath?) of all this, you have to make a call on whether to make use of the SUP middleware and/or a security product like Afaria.
So perhaps the most likely combinations look like:-
Mission Critical apps with SUP ( + Afaria ) + DOE/Gateway
or
Instant Value apps with (LMS/Gateway or simply Web services/JCA)
But if you have a LOT of Instant-value apps to build I guess your landscape could become complicated enough to justify the middleware too.
Now please someone point out the flaws in this summary!
Alex.
Edited by: ajfear on Oct 20, 2010 6:44 PM

Is Distributed Transaction Coordinator services of the application role are required by SQL Server 2012 for clustering and support of SharePoint 2013.

All I want to know is if Distributed Transaction Coordinator services of the application role are required by SQL Server 2012 for clustering and support of SharePoint 2013.
I have been planning and deploying my companies first Windows Server 2012/SQL Server 2012 Always On cluster and Always On Availability Groups Multi-Subnet cluster and instances for SharePoint 2013, and I will be brutally honest, the documentation on either
the MSDN and TechNet leave alot to be desired. Continually finding links in the documentation will take me from a Windows 2012 reference to a page talking about Windows Server 2008 or R2, The differences of which there are so many when it comes to configurations,
settings, roles, services when working with SQL Server 2012. I have been confused, frustrated, screaming mad, with all the misdirection in this documentation. The documentation takes me windows 2008 R2 which is different than 2012!
Tired and trying to pick myself up off the floor!
Greg
Gman

In general, DTC is not required for SQL 2012. But, since you are asking specifically about SharePoint, it would be better to ask in a SharePoint forum. They would be more likely to know those situations where FTC might be needed by SharePoint.
.:|:.:|:. tim

Setting up gateway and firewall in OS X Server 10.3?

Hi all,
I have a G4 tower with two working ethernet cards in it that I would like to configure as a gateway and firewall. It has OS X Server 10.3 on it. I have easily found the firewall configuration in the Server Admin intrerface, but I can find nothing about configuring the server to act as a gateway. The only information I have found that is pertinent is related to the Gateway Setup Assistant that comes with OS X Server 10.4, which doesn't exaclty help me. Does anyone have any documentation on configuring OS X Server 10.3 to be a gateway? Thanks.

Actually, I may have marked this as answered too quickly...
So I followed the guide at the back of the getting started manual, and set everything up as follows:
- PCI ethernet card is set up as the connection to the outside world. It is plugged into a switch which connects to a wall jack. In Network under System Preferences, it is set up as the first internet conection to try. It has a static IP address, and is set up to use the organization's DNS servers. It is NOT plugged into the upstream port, but is instead in port #9. The light on the router is on.
- Built-in wireless is set up to be the internal connection. It is plugged into the upstream slot on anouther switch. It has a static IP address, and is set up to use the organization's DNS servers. The light on the router is on, so it appears there is a connection.
- A different computer is plugged into the second switch, which a static IP address and to use the organization's DNS servers.
So basically, unlike in the scenario in the manual, I am not using the OS X Server for DNS, DHCP or NAT services. That should, if anything, simplify it.
The firewall service is started, and is set to allow all traffic in and out, no problems. Nice and simple to start.
The server has an okay connection to the outside world via the PCI ethernet card. I can ping other machines and load web pages. I cannot, however, access the machine connected to the router which is connected to the built-in ethernet. Likewise, that machine has no access to either the OS X Server or the outsideworld.
How does OS X Server decide which ethernet card is to be connected to the outside world, and which is for the internal firewall? Is the confusion possible because I'm connected to two routers?

Trouble with socket gateway and an as3 xmlsocket connection

I succesfully set up the socket gateway and am able to conect to the CF socket gateway and send data from flash to the gateway.
The error I keep getting is when I add return value to the "onIncomingMessage"... cf error always logs "Cannot send outgoing message. OriginatorID "123124124" is not a valid socket id.
I am passing the originatorID as in the docs.... my question is what is a valid originatorID?
<cffunction name="onIncomingMessage" output="no">
<cfargument name="CFEvent" type="struct" required="yes">


   <cfset message="#CFEvent.Data.message#">
   
   <cfset orig="#CFEvent.OriginatorID#">
<cfset retValue = structNew()>
<cfset retValue.OriginatorID = orig>
<cfset retValue.MESSAGE = message>

<cfreturn retValue>
</cffunction>
I really hope I can get an answer hardly any docs or anything online on how to correctly return a message via a socket gateway.
Thank you.

I succesfully set up the socket gateway and am able to conect to the CF socket gateway and send data from flash to the gateway.
The error I keep getting is when I add return value to the "onIncomingMessage"... cf error always logs "Cannot send outgoing message. OriginatorID "123124124" is not a valid socket id.
I am passing the originatorID as in the docs.... my question is what is a valid originatorID?
<cffunction name="onIncomingMessage" output="no">
<cfargument name="CFEvent" type="struct" required="yes">


   <cfset message="#CFEvent.Data.message#">
   
   <cfset orig="#CFEvent.OriginatorID#">
<cfset retValue = structNew()>
<cfset retValue.OriginatorID = orig>
<cfset retValue.MESSAGE = message>

<cfreturn retValue>
</cffunction>
I really hope I can get an answer hardly any docs or anything online on how to correctly return a message via a socket gateway.
Thank you.

Can you run Embedded PL/SQL Gateway and Oracle HTTP Server at the same time

Hi,
I know this will sound a bit odd but their is a business case for asking this. Can you run APEX via the Embedded PL/SQL Gateway and the Oracle HTTP Server at the same time? Would their be any security/stability/etc issues I'd need to worry about? I know that I'll need to run them on different ports.
Thank you,
Martin Giffy D'Souza
[http://apex-smb.blogspot.com/]

I think I've done this in the past. Theres no technical reason why you can't do this as far as I know.
I can't remember if I used different ports or same port.

Can i run UDP client and UDP server socket program in the same pc ?

hi all.
when i execute my UDP client socket program and UDP server socket program in the same pc ,
It's will shown the error msg :
"Address already in use: Cannot bind"
but if i run UDP client socket program in the remote pc and UDP server socket program run in local pc , it's will success.
anybody know what's going on ?
any help will be appreciated !

bobby92 wrote:
i have use a specified port for UDP server side , and for client define the server port "DatagramSocket clientSocket= new DatagramSocket(Server_PORT);"Why? The port you provide here is not the target port. It's the local port you listen on. That's only necessary when you want other hosts to connect to you (i.e. when you're acting as a server).
The server should be using that constructor, the client should not be specifying a port.
so when i start the udp server code to listen in local pc , then when i start UDP client code in local pc ,i will get the error "Address already in use: Cannot bind"Because your client tries to bind to the same port that the server already bound to.

2012 TS Gateway and UDP

Similar Messages

Maybe you are looking for