2V0-51.23 · Question #82
Drag and Drop Question Drag and drop the ports on the left to allow an external Blast Extreme connection through Unified Access Gateway (UAG) into the diagram on the right. Answer:
The correct answer is TCP 443; TCP 443; TCP or UDP 443; TCP or UDP 443; TCP 22443 / UDP 22443. VMware UAG Blast Extreme Port Placement Explained Architecture Overview The diagram represents a standard two-firewall DMZ architecture for VMware Horizon: `` [Client] → [External FW] → [UAG in DMZ] → [Internal FW] → [Connection Server / Horizon Agent] `` Blast Extreme traffic fl
Question
Drag and Drop Question Drag and drop the ports on the left to allow an external Blast Extreme connection through Unified Access Gateway (UAG) into the diagram on the right. Answer:
Exhibit
Answer Area
Drag items
Correct arrangement
- TCP 443
- TCP 443
- TCP or UDP 443
- TCP or UDP 443
- TCP 22443 / UDP 22443
Explanation
VMware UAG Blast Extreme Port Placement Explained
Architecture Overview
The diagram represents a standard two-firewall DMZ architecture for VMware Horizon:
[Client] → [External FW] → [UAG in DMZ] → [Internal FW] → [Connection Server / Horizon Agent]
Blast Extreme traffic flows in two distinct legs: external (client-to-UAG) and internal (UAG-to-backend).
Why This Arrangement
Position 1 - TCP 443
External firewall, inbound from client. The initial connection is always TCP - HTTPS for authentication, session brokering, and the secure web tunnel. UDP has not been negotiated yet at this stage. No UDP allowed here.
Position 2 - TCP 443
UAG's external-facing listener. UAG accepts the incoming HTTPS/tunnel connection on TCP 443. This is still the control/auth plane. The Blast Extreme session setup happens over TCP before any UDP optimization kicks in.
Position 3 - TCP or UDP 443
UAG outbound through internal firewall (toward Connection Server or Blast stream). Once UAG has authenticated the user, it initiates the Blast Extreme display session. Blast Extreme is designed to use UDP 443 for performance (lower latency for real-time display) while falling back to TCP 443. Both must be permitted from this point inward.
Position 4 - TCP or UDP 443
Internal network segment continuing the Blast stream. Same reasoning as Position 3 - the Blast Extreme session traverses this segment and still requires both TCP and UDP 443. This is a common exam point: you must open both protocols here, not just TCP.
Position 5 - TCP 22443 / UDP 22443
UAG to Horizon Agent (the virtual desktop). The Horizon Agent running on the virtual desktop listens on port 22443, not 443. UAG proxies the Blast Extreme session and connects to the agent on this dedicated port. This is strictly internal - 22443 should never be opened on the external firewall.
Common Mistakes
| Mistake | Why It's Wrong |
|---|---|
| Putting TCP/UDP 443 in positions 1–2 | The initial external connection is TCP-only; UDP isn't negotiated until after session setup |
| Putting 22443 on the external firewall | Port 22443 is only used UAG-to-Agent internally; UAG terminates and re-proxies the session |
| Using only TCP in positions 3–4 | Blocking UDP 443 internally breaks Blast Extreme's performance optimization, forcing TCP-only fallback |
| Confusing PCoIP ports (4172) with Blast (443/22443) | These are separate protocols; Blast Extreme uses 443 externally and 22443 internally |
Key Rule to Remember
External = 443 (TCP only) → 443 (TCP or UDP) → Internal = 22443 (TCP/UDP)
UAG acts as a protocol bridge: it accepts Blast on 443 from the client and re-proxies it to the agent on 22443. The external firewall never needs to know about 22443.
Topics
Community Discussion
No community discussion yet for this question.