View Security Server remote access with Linked Clones

[moto316]

Have any of you guys deployed or managed a View environment w a Security Server in the DMZ and had users connecting from the outside to linked clone desktops on the internal network? Currently our environment is this:

- Two internal connection servers, one for internal only connections and the second paired with our Security Server in our DMZ
- Palo Alto PA-3020 Firewall with rules to allow external connections being proxied through the security server to our internal desktops
- RSA 2-factor configured for the external connections

The issue is that to get external connections to work we have to explicity have the IP address or IP range of the VM being connected to in our firewall rule to allow PCoIP traffic to flow from the internal desktop towards our DMZ security server and vice versa. This is fine with persistent full desktops but we're trying to migrate towards linked clones which have dynamic IP's and different users (ones w remote access permissions and ones w no remote access permissions).

I've spoke with Palo Alto and had a couple tickets open w them on getting the user-id function to work in this use case but they were unable to get it to work because the user-ip mapping was not being recognized on the DMZ security server, only on the internal connection server was there an ip-user mapping.

Has anyone gotten remote access to linked clone desktops to work with an enterprise firewall without specifying an IP range in the firewall rule? Our main concern with doing that is that someone could pick up somebodies lost RSA key and use that token to get in and then be able to log into their own desktop/someone else's that theyve obtained credentials to.

 

[SeanusT]

I can share my experience.

I'm running a very similar configuration; two connection servers with a security server in my DMZ paired to one of them, ASA5515-X between the security server in DMZ and the paired connection server / View desktop subnet.
I'm using Duo 2FA SaaS (which is fantastic by the way) https://www.duosecurity.com/

If I've understood your post correctly, you're using your firewall to control which of your users is as isn't able to access their desktops externally through the security server by controlling the destination IPs that your security server is able to reach?

In my setup with Duo, primary authentication is carried out against AD, if they're not a member of my "View external users" security group the auth attempt stops there and they're denied. If they are though it progresses to the second factor, be that SMS, application or phone call.

 

[moto316]

SeanusT, thanks for your tip, on our RSA setup we were using unrestricted authentication agents, read up and saw they have restricted agents which allow you to query an AD group to permit access through the RSA authentication process. I then allowed the VDI subnet through on my palo alto rule and everything is working like we want it to. Thanks!