First I want to make sure it's understood what the gateway does for your endpoints (in this case your zero clients).

• With the gateway enabled, your endpoints only communicate with the connection server(s). The connection server(s) then initiate communication with the horizon agents. This is often used when security policies require restricted communication to the virtual desktops.
• With the gateway disabled, your endpoints still start with the connection server(s) for the horizon primary protocol (authentication and pool selection) but then communicate directly with the horizon agent for the secondary protocol (PCoIP, Blast, RDP).

When you disable the gateways on the connection servers what error are you receiving on the endpoints? We need to get that working first before introducing the UAG. Alternatively you can leave these connection servers as is and deploy new connection servers just for use with the UAG.

Can you provide the following (obfuscate as needed)?

Number of connection servers and version:

Any load-balancers in use:

Horizon agent version:

Subnets that your endpoints, connection servers, VDI (horizon agents) and UAG are on.