An administrator is setting up a VPN on an ASA for users who need to access an internal RDP server. Due to security restrictions, the Microsoft RDP client is blocked from running on client workstation

A clientless proxy forwards HTTP/HTTPS requests on behalf of the user but does not provide protocol-level support for non-web protocols such as RDP.

Smart tunneling provides TCP application forwarding over an SSL VPN session but still requires the actual RDP client application to be installed and permitted to run on the endpoint.

The clientless plug-in feature on the ASA extends the clientless SSL VPN portal to support application protocols such as RDP, SSH, VNC, and Telnet via a browser-hosted Java applet or ActiveX control. Because the plug-in renders the session inside the browser, the native Microsoft RDP client is never invoked, satisfying the Group Policy restriction. This makes it the correct solution when the full RDP client is blocked but browser access is still available.

The clientless rewriter transforms web content (HTML, JavaScript, CSS) so that URLs resolve correctly through the SSL VPN portal; it has no capability to handle RDP protocol traffic.