Hans Kraaijeveld

There is no RDS licensing model for the Windows Desktop operating system. The desktop model previously required either Microsoft Software Assurance or VDA licensing. So saving on licensing costs by using Windows 11? I wouldn't be so sure. Please consult a Microsoft licensing expert for this, as this tends to change over time and can be hard to find out for your specific situation.

Is that the most recent they have? I would be careful using something that outdated. Things changed quite a bit since 2020...

Did you know? F5's can actually be used (if properly licensed) to replace UAG's altogether. As I have seen many times though, you do need to have a decent amount of knowledge about F5 configuration.

The blast protocol can actually be configured to also use 443, for both tcp and udp traffic externally. 22443 tcp/udp from uag to agent will always be used. https://docs.omnissa.com/bundle/UnifiedAccessGatewayDeployandConfigureV2312/page/BlastTCPandUDPExternalURLConfigurationOptions.html

The pictures of all network flows in https://techzone.omnissa.com/resource/network-ports-horizon-8 will probably help. To determine which ports actually need to be open in you environment, for your specific situation, you first have to determine what you are going to use as a remoting protocol, among other things. Also, configuration depends on if and how you are going to load balance your uag's: https://techzone.omnissa.com/resource/load-balancing-unified-access-gateway-horizon

I think a colleague of mine solved (what I'm guessing is your) issue by implementing this, using the same CA that is responsible for issuing the TrueSSO user certificates: https://learn.microsoft.com/en-gb/entra/identity/authentication/how-to-certificate-based-authentication This is then coupled to the UPN of the user and when you allow Conditional Access Certificate Based Authentication, it should do the trick. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-certificate-based-authentication