clareq Posted January 26, 2015 Posted January 26, 2015 I have a server 2012 R2 box configured with remote desktop and have setup some remote apps. I can logon to the website then click on an app, enter my credentials again, and it runs fine inside my network. I am publishing the site through TMG 2010 and my external users are able to log onto the website, but when they click on an app they just keep getting prompted for credentials over and over again. The prompt just says 'Enter your credentials', for TS Gateway Server and Remote Computer and at the bottom says 'The logon attempt failed'. Googling returns plenty of errors regarding redirection, but we don't redirect the site, so it can't be that. Can anyone help please?
DavetheITguy Posted January 26, 2015 Posted January 26, 2015 I had this issue, You will need to contact your local authority and make sure they aren't blocking anything. Once I explained to them what I was doing they made sure all the ports were unblocked. Also make sure you have the correct permissions set on the folders themselves, make sure correct authentication methods are enabled in IIS etc. it's sounds stupid but just double check everything. Mine is now working and staff use it to access a variety of programs and resources from home. Hope this helps. 1
nev104 Posted January 26, 2015 Posted January 26, 2015 Do you have port 3389 open towards the rdweb server? 1
RowlandoGloom Posted January 26, 2015 Posted January 26, 2015 (edited) I did notice too, you need to make sure port 443, HTTPS, is pointed towards your RDWeb server with the correct certificate for your farm. I've found issues can occur with SSL traffic if the certificate subject mis-matches. The RDWeb takes your credentials, and the connection broker uses SSL outside and RDP inside. Edited January 26, 2015 by RowlandoGloom 1
clareq Posted January 26, 2015 Author Posted January 26, 2015 No LEA in the way, so not that. I'll get port 3389 checked. Port 443 is right, as are the certificates.
Michael Posted January 26, 2015 Posted January 26, 2015 Port 3389 isn't the issue, as RDWeb uses port 443 only. It does sound like an SSL/cert issue to me, but just pure speculation. Users can get in, but does IE for example display any SSL type errors or warnings?
ITGuyWestMidlands Posted January 26, 2015 Posted January 26, 2015 Ont the gateway server you need to ensure you have it set up using the external fqdn. Also try prefixing your username with you domain name just imcase (i.e domain\username)
clareq Posted January 26, 2015 Author Posted January 26, 2015 No, no errors at all, apart from the repeated request for logon.
clareq Posted January 26, 2015 Author Posted January 26, 2015 Ont the gateway server you need to ensure you have it set up using the external fqdn. Also try prefixing your username with you domain name just imcase (i.e domain\username) Yes, done that.
ITGuyWestMidlands Posted January 26, 2015 Posted January 26, 2015 is the cert self signed? Does it match the external fqdn?
RowlandoGloom Posted January 26, 2015 Posted January 26, 2015 Is the farm's FQDN different externally? I.e. Is the internal domain something like: remote.domain.loc' And external remote.myexternaldomainname.co.uk? If so, you'll probably need a SAN certificate with both subjects. Try, in server manager, going to the properties of your collection and disabling the requirement for NLA, and allowing low security. You may be given a windows login screen as opposed to a dialogue when you try click an icon in RDWeb.
clareq Posted January 26, 2015 Author Posted January 26, 2015 Internal and external are on the same address https://access.domain.org We have a wildcard cert *.domain.org, which isn't self signed
clareq Posted January 27, 2015 Author Posted January 27, 2015 We have tried all the excellent suggestions here, and many found in google, and are no further forward. I'm thinking of ripping it all out and starting again. Before I do, can anyone recommend a walk through that worked for them, that we can follow?
ITGuyWestMidlands Posted January 28, 2015 Posted January 28, 2015 Will it let you authenticate using remote desktop connection externally?
clareq Posted January 28, 2015 Author Posted January 28, 2015 No it tells me the remote gateway address is incorrect - I assume I need to put access.domain.org in there?
RowlandoGloom Posted January 28, 2015 Posted January 28, 2015 One thing you can try. On your TMG - temporarily create a rule for forward all HTTPS traffic to your RDS server Firewall Config, "New Access Rule" and publish straight HTTPS which will eliminate the need for an SSL certificate at your TMG. Make sure you turn any HTTPS listeners off first.
clareq Posted January 28, 2015 Author Posted January 28, 2015 I know our certificates are OK - as I say it's a wildcard cert that works perfectly for other published sites. I have just discovered that I can't RD into any machines from the TMG - could that be affecting anything? It works perfectly internally, on the same URL as we'd use externally. The only difference is externally it's published through TMG. The listener is possibly the problem - we have a listener on TMG for OWA, and. I'm told, the authentication methods for OWA and RDWeb are different, and we can't have multiple listeners on the same port.
RowlandoGloom Posted January 28, 2015 Posted January 28, 2015 You can try mapping the port using a different number. Create a temporary listener on, say 8443 - then under bridging, "Redirect requests to SSL port:", then choose 443? On the TMG rule, are you using "Link Translation"? If so, try disabling it. Paul.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now