View HTML Blast, There is no available gateway for the display protocol

[Krede]

I'm playing around with the new HTML client for Horizon View - but when i connect externally (from Internet) i get this error when I click on my desktop:

Unable to connect to desktop: There is no available gateway for the display protocol. Try again, or contact your administrator if this problem persists.

From "inside" (through view connection server) it works fine - What could be wrong with my Security server (DMZ)?

I have opened port TCP 8443 to Security server (NAT from WAN) - and at this moment all traffic from Security server to connection server and desktops (LAN) is allowed.

[Linjo]

Have you installed the gateway-component on the Connection broker?

// Linjo

[Krede]

Im not sure what you mean - i've installed the HTML access component on the View Connection server - but not on the Security Server.

[Linjo]

Yes, that is the one. You also need to configure it on the connection broker to enable HTML access and set the port.

Does it work if you connect directly to the connection-broker?

// Linjo

[HIsgett]

I went through something similar. Do you have the Windows Firewall enabled on the security server? If so, you will need to enable the Inbound Rules for VMware Connection Server (Blast-in).

[admin]

Hi Krede,

My apologies for your trouble!

There is one known documented issue which could cause that error message, but it would only happen if you waited several minutes in between logging in and choosing a desktop.  See the known issues here for the specific steps and workaround.

https://www.vmware.com/support/viewclients/doc/horizon-view-html-access-release-notes.html#knownissu...

If that's not the case, one thing to check when troubleshooting is to restart your browser before trying to connect to the security server (if you've already connected to the CS during the same session).

Another thing to verify is whether you can connect to TCP 8443 on the Security Server from your WAN.  If this doesn't work, you may have a configuration issue on the security server itself.  A common problem is that the SSL certificate on the Security Server is not marked as "exportable", and it needs to be.

Please let me know if any of these steps help.

[jo_strasser]

Hi!

Same here, any solutions??

The ports are correct, also the exportable key.

Very frustrating...

Thanks, Jo!

[Krede]

I actually got my lab to work with HTML access from outside (through DMZ security server).

I needed two thinks to make it work:

1)      Enabled the windows firewall on the security server

2)      Opened port TCP 22443 from Security server to the desktops on my LAN.

[jo_strasser]

I have now checked this.

1) uninstalled SS

2) uninstalled CS

3) enabled Windows Firewall on both servers

4) reinstalled CS with firewall config

5) reinstalled SS with firewall config

6) reinstalled Feature Pack

not working. no blocks between servers. checked the firewall log.

tested the port 8443 and 22443 with netcat between SS, CS, Clients. Working!!

[Krede]

have you checked 8443tcp from outside? does normal View client work (is it only HTML access that doesnt?)

[jo_strasser]

Hi!

I have tried the last action plan without success (from VMware Support).

BUT: I have found the problem!!

The problem was my RADIUS configuration for external connections.

We are using a OneTimePassword System to enable 2-way auth for external connections.

The user must enter his username (without the domain), and his password.
This will be crosschecked with our domain controllers.

We have also enabled the option " Use the same user name and password for RADIUS and Windows authentication".
This is perfect working with the VMware Horizon View Client for Windows or Mac. The user needs only his user and password, and the passcode (will be sent via SMS).

But if this option is enabled and you try connect via the new HTML Access to a desktop after 2 way authentication, it will fail!
I think, the user redirection on the HTML Portal is not working like in the default client!!

Workaround: disable this option. Users must now authenticate at first with the username, password, get a passcode, then second with the domain credentials (not so user friendly).

Solution: is needed, I think it´s a bug! (informed VMware Support).

Thanks, Johannes!

[admin]

Thanks so much for the update and bug report!  I'll work to see if we can make can have our tech support handle other customers with similar environments more easily in the future.

- Chris

[jansson81]

Hi!

I have the same problem, but i'm not using RSA or RADIUS.

PCoIP is working from WAN, but I can't get the HTML gateway to work.

Should the feature pack be installed on the security server as well? I have only installed it on the connection server. LAN users can access HTML thru the connection server.

Should the "Blast Secure Gateway - Blast External URL" on the security server settings point to the connection server or the security server?

Best Regards

Anders Jansson

[admin]

jansson81,

My apologies for your trouble!

So far, the reported instances of this error message has been due to one of the following causes:

• Windows firewall was disabled on the security server.  It needs to be enabled.
• Some of the following traffic was blocked by a firewall:
  • TCP 22443 from the Security Server to the VM pools
  • TCP 8443 from the internet to the Security Server
  • (if blocked by a 3rd-party firewall) TCP traffic from the Security Server to itself over its loopback interface
• The SSL certificate on the security server was not marked at "exportable"

It would be good to know if any of these things help resolve what you're seeing, or if it is something else.

- Chris

[nikonau]

Yep, to get it to work - for me it was the following:

• permit tcp 8443 inbound from the WAN
• permit security servers to client pool/s on tcp 22443

my security server does not have exportable certificate and the windows firewall is not enabled, on either SS or CS

[jansson81]

Hi again!

I have now sorted out my problems.

• My security server didn't listen on the blast port (8443). I found that out after running "netstat -ano" in cmd.
• My security server didn't have the "VMware View Connection Server (Blast-In)" rule created in the firewall inbound rules.

What I did to fix it.

• Uninstalled the security server
• Run the command: "vdmadmin -S -r -s <security server name>" (from a cmd on the connection server to remove the security server from the config)
• Installed the security server again.
• Run "netstat -ano" to see that my server was listening on port 8443
• Enabled the "VMware View Connection Server (Blast-In)" rule created in the firewall inbound rules.

What I did different during the installation was that I specified the "correct" WAN-address directly during the installation (used the default LAN-values the first time, which I later changed in the View Admin console).

Everything is working fine now. Thank's for your replies!

Best Regards

Anders Jansson

[admin]

Thanks for your update!  I'm glad to hear that you got it working.

- Chris

[iefke]

I create two diagrams with the protocols and ports that's needs to be opened in the firewalls:

For blast:

http://www.ivobeerens.nl/2013/03/20/vmware-horizon-view-and-html-access-blast-protocol/

Complete diagram with Security Server and HTML access

http://www.ivobeerens.nl/2013/03/05/tips-for-implementing-a-vmware-horizon-view-security-server/

www.ivobeerens.nl

[moogeboo]

Nikonau,

Did you have to manually create any entries within the Windows Firewall on the Security Server to allow your security server to communicate to the desktop pools over port 22443?

Mooge

[nikonau]

Hi Mooge,

No, I'm not using windows firewall it's set to manual tho when I installed the security server - this will allow the installer to add any prerequisite rules if you use it.

Windows firewall is not required to get this all to work. It is required for the IPSec security server to connection server pairing connection.

In the end it was our ASA I had to open up the security server/s to the view desktop pool subnet on tcp 22443 - obv make sure the horizon experience agent is installed in the desktop pool.

Sent from my iPhone