RemoteApp with host connected to VPN

Question

Hi,
I have a question regarding RemoteApp vs regular Remote Desktop Connection spiced with a VPN connection initiated from the host.
We're in the process of moving from PCs to thin clients and we have set up an RDS farm (all servers are Windows Server 2012 R2, they are all in the same domain and same LAN) as follows:
1 x RD Connection Broker + RD Licensing + RD Web Access
3 x RD Session Host
The users/clients will connect with regular remote desktop connection software (no Citrix or anything). Two of the RD SHs will be providing the users access to their normal applications, but some users also need to use remote resources which are only available
via VPN connection, hence the third RD SH. (Currently it is solved by every user having a virtual machine on their PCs and connecting to the VPN from there.) We can't put the VPN connection to the two "regular" RD SHs, because we'll need more VPN
connections later. The idea was to install and set up the VPN on the third host and publish the needed apps by RemoteApp to the users who use it.
The problem:
Once the host connects to the VPN the users are unable to launch the RemoteApp applications. If it's not connected then they can start them. The VPN client is a Cisco AnyConnect Secure Mobility Client that can only connect if the connection is initiated
by a local user and no other user is currenty logged on (it's a remote side policy we can't change). If the users connect to the RD host with a regular remote desktop connection after the VPN is set up then it works as expected, they can launch the apps and
work with them.
The question:
What is the difference between launching a RemoteApp and connecting to the RD host via RDP? How can I debug this RemoteApp connection problem?
Please ask if something is not clear!
Thank you!
PS: If I'm not heading into the right direction and someone has a better idea, I'd be grateful to hear (read) it!

Answer 1

Hello Vargabes7,
You can configure a server that allows remote users to access resources on your private network over dial-up or virtual private network (VPN) connections. This type of server is called a remote access/VPN server. Remote access/VPN servers can also provide
network address translation (NAT).  With NAT, the computers on your private network can share a single connection to the Internet. With VPN and NAT, your VPN clients can determine the IP addresses of the computers on your private network, but other computers
on the Internet cannot.
Before you configure your server as a remote access/VPN server, you should verify whether or not:
The operating system is configured correctly.
Your server is correctly configured for optimal security for your network needs.  Because your remote access/VPN server will connect your private network, the Internet, and your remote clients, you must make sure the server is secure. The security
of your private network depends on the security of your remote access/VPN server. For more information, see
Security information for remote access.
This computer has two network interfaces, one that connects to the Internet and one that connects to the private network. The connection to the Internet must be a dedicated connection with enough bandwidth that VPN users can connect to your private network
and users on your private network can connect to the Internet. The connection to computers on your private network must be made through a hardware device, such as a network adapter.
All needed network protocols have been installed for your network interfaces. For more information, see
Network interfaces.  
Windows Firewall is disabled on the server that you want to configure for remote access/VPN. You will configure the Basic Firewall feature of Routing and Remote Access during setup, which will serve in place of Windows Firewall.
Internet Connection Sharing is disabled on the server that you want to configure for remote access/VPN.
The Security Configuration Wizard is installed and enabled.
To configure a remote access/VPN server, start the Configure Your Server Wizard by doing either of the following:
From Manage Your Server, click Add or remove a role. By default, Manage Your Server starts automatically when you log on.
To open the Configure Your Server Wizard, click Start, click
Control Panel, double-click Administrative Tools, and then double-click
Configure Your Server Wizard.          
On the Configuration Options page, click Custom configuration and click
Next. On the Server Role page, click Remote access/VPN server, and then click
Next.
Best regards,
Sophia Sun
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.