External Users getting blocked once inside a VDI instance

[BadfishGT]

Any guidance would be helpful.

Has anyone experience issues with external users not being able to access applications with a VDI environment from their corp networks where using a personal connection worked?  It appears that some corp networks don't like the Data flow from a Security server into a VDI application?  For example, the port 22443 seems to be giving some corp networks trouble.

Environment

2 DMZ Windows based Security servers fronted by F5 Load balancers and paired with 2 internal Connection servers.

Users can access the VDI portal and log into it seeing the apps, but once an application is clicked, the connection seems to fail access the .local RDSH server on port 22443. Users not able to connect from their corp environments can access the apps fine from an personal internet connection.  Something about some corp networks not liking the route and port the traffic takes.

Thanks

[techguy129]

Sounds a lot like a firewall issue on the corp network. They are probably blocking 8443 or 4172. If they are using blast, their clients will use 443/8443 to the security servers. If PCoIP they should be connecting by 4172. Only time 22443 is used is if you are using direct connect which it doesn't should like if they are logging into the portal.

Check out the client logs. That will tell you your issue.
Horizon Client for Windows Logs

List of Ports:

TCP and UDP Ports Used by Clients and Agents

[jmatz135]

Watch out for the protocol used.  If using PCOIP the corporate network will probably block the port.  Blast uses the standard 443 port so that shouldn't be blocked, but there is one more thing to watch out for.  If using the client some corporate networks flag the traffic as VPN traffic and block it.  See if the HTML 5 access works from the corporate network.

[BenFB]

In addition you need to allow the following internal traffic.

For Blast port 22443 TCP/UDP needs to be allowed from the Security Server/UAG to the Horizon agent.
For PCoIP port 4172 TCP/UDP need to be allowed from the Security Server/UAG to the Horizon Agent.

[sjesse]

This pdf is pretty good

https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/vmware-horizon-7-end-use...