We set ours up back in April.
The gotchas that got us was making sure that the Load Balancing settings matched on the NPS on the Remote Desktop Gateway, and on the RAS/NPS server.
You can validated this by opening up the NPS (on both servers):
- Under RADIUS Clients and Servers -> Remote RADIUS Server.
- Right-click the Group Name, click Properties
- Edit the RADIUS Server
- On the Load Balancing Tab; Advanced settings
- Number of seconds between response. . . = 60
- Maximum number of dropped requests. . . = 5
- Number of seconds between requests. . . = 60
If these aren't set properly, then the RDGW and/or the RAS will timeout. If the user takes too long to approve the MFA notification or phone call, it'll also timeout.
If any users are using the phone call option, make sure you turn off or lower the reconnect option on the RDP client. We had users complaining about getting calls in the middle night from Microsoft because they'd leave their RDP connection and it disconnected.
