Can you clarify if you are trying to authenticate against the UAG? Or are you trying to authenticate against the intranet page? The error makes it sound like, whatever "NetQ" is, is failing to accept the login. If you're on VPN, the UAG is doing its job, unless. you are doing some sort of brokering of authentication to the UAG instead of your internal IdP (AD).
Not even really sure what that would look like, I don't think its possible.
Is your test device configured with the SSO Extension for that fqdn / domain and the applicable identity cert?
