I am not sure what's going on, but I'm about at my wits end with this thing.

I have deployed a 2-NIC UAG in my environment.  NIC1 is in my DMZ (10.2.4.0/24) and NIC2 is in my internal LAN (10.2.200.0/24).  NIC1 has an IP of 10.2.4.16 and NIC2 is 10.2.200.16.  My desktop VMs are on the 10.2.204.0/24 subnet.  All of this is going through my firewall which is also performing my core routing, as such is also the default gateway for the subnets (.254).

I have 2 connection servers, CS1 (10.2.200.22) and CS2 (10.2.200.23), which full connectivity between them and the desktops.  They are also on the same subnet as the UAG NIC2.  CS2 is designated for connections from the UAG.  I have confirmed pingability from UAG to CS and UAG to desktop.

UAG has the following settings:

• Connection Server URL - https://10.2.200.23:443
• Tunnel External URL - https://myuag.mydomain.com:4437
• Blast External URL -  https://myuag.mydomain.com:8443
• Connection Server URL Thumbprint - SHA1 thumbprint from Cert
• Connection Server IP Mode - IPv4
• Default Gateway - 10.2.4.254 (DMZ Subnet GW)
• NIC1 Static Routes
  • 10.2.4.0/24 10.2.4.254
• NIC2 Static Routes
  • 10.2.200.0/24 10.2.200.254
  • 10.2.204.0/24 10.2.200.254

On firewall, I have the following NAT setup

• To 10.2.4.16
  
  • TCP/UDP 4437 -> TCP/UDP 443
• To 10.2.4.16
  • TCP/UDP 8443 -> TCP/UDP 8443

When connecting with the Horizon client externally, I get the authentication piece and desktop selection, but when selecting desktop I get the VDPCONNECT_GATEWAY_ERROR.  I'm not sure what I'm missing, the logs are no help whatsoever.  I can definitely tell something's going on because if I am logged into a desktop while on-prem, then connect to that desktop via the UAG, I do get the disconnect from the desktop in the on-prem client, so somethings talking to some point.