An administrator recently deployed a Horizon pod with external access using Unified Access Gateway (UAG). While trying to launch VDI from an External…

The described behavior—a black screen followed by a disconnect for external UAG users while internal connections work—is a classic symptom of a role conflict between the Unified Access Gateway (UAG) and the Horizon Connection Server. When a UAG is deployed to handle external access, it must be the sole gateway for secure remote connections. If the Connection Server's own gateway services (Blast Secure Gateway and PCoIP Secure Gateway) are also enabled, the Connection Server incorrectly instructs the client to establish the protocol session with itself instead of through the UAG, causing the connection to fail. Disabling these gateway roles on the Connection Server resolves this conflict.

A. Update the Blast External URL in UAG with port number: The Blast External URL must be correct, but the root cause is the Connection Server's conflicting gateway role, not the URL itself.
B. Upload the Blast Proxy Certificate in Horizon Edge Settings: Certificate issues would typically cause trust errors or prevent the initial connection, not a black screen after authentication.
C. Enable Tunnel in UAG: The UAG tunnel is for the primary authentication traffic. The issue is with the secondary protocol (Blast) connection being misdirected by the Connection Server.

1. VMware Docs

Deploying and Configuring Unified Access Gateway

Section: "Configure Horizon Settings". This guide explicitly states: "When Unified Access Gateway is used

the secure gateways (Blast Secure Gateway and PCoIP Secure Gateway) on the Horizon Connection Server must be disabled."

2. VMware Tech Zone

Horizon Network Ports Diagram

Document ID: 20005308-GD. The diagrams illustrate that for UAG deployments

protocol traffic from external clients terminates at the UAG

not the Connection Server

reinforcing that the Connection Server should not act as a gateway.