Azure应用程序网关和远程桌面Web服务

问题描述:

你好,
我已经在Azure中构建了一个远程桌面服务器场(一个具有网关,Web访问,连接代理和许可角色的VM,以及一个具有会话主机角色的VM).
我想通过在其前面放置一个Azure应用程序网关(带有WAF)并将所有HTTPS通信重定向到网关/Web访问VM来进一步保护它.

Hello,
I have built a remote desktop farm in Azure (one VM with Gateway, Web Access, Connection Broker and Licensing Roles and one VM with Session Host roles installed).
I would like to further secure it by putting an Azure Application gateway (with WAF) in front of this, and redirecting all HTTPS traffic to the Gateway/Web Access VM. 

第一个问题是这行得通吗?尽管我知道它可以保护HTTPS流量,所以我在Azure应用程序网关方面没有很多经验,所以从理论上讲应该可以.网关是否需要比HTTPS开放更多的资源才能工作?

我已经设置好了,并且遇到两个错误:-

-/RDWeb重定向不适用于App Gateway.尝试访问https://rds.domainname.com/rdweb
时收到ERR_TOO_MANY_REDIRECTSw
-当我尝试使用定义的RDP文件连接到RDGateway时,出现授权错误-即使密码正确.我认为应用程序网关未通过正确的端口/协议来允许身份验证?

最后,如果Azure应用程序网关无法在此环境中工作,是否还有其他Azure服务或最佳实践可用来确保RDWeb/网关的安全?

所有建议表示赞赏.

干杯,

阿奇

First question is will this work? I've not had a lot of experience with Azure Application Gateway, although I know it can secure HTTPS traffic so in theory should work. Does the Gateway need more than HTTPS open to the internet to work though?

I have set it up and am getting two errors:-

- the /RDWeb redirect does not work through the App Gateway. I get a ERR_TOO_MANY_REDIRECTSwhen trying to access https://rds.domainname.com/rdweb

- when I try and connect to the RDGateway with a defined RDP file I get an authorisation error - even though the password is correct. I presume the Application gateway is not passing through the correct ports/protocols to allow authentication?

Finally, if Azure Application Gateway isn't able to work in this environment are there any other Azure services or best practices to follow to secure the RDWeb/Gateway?

All advice appreciated.

Cheers,

Archie

Azure Application Gateway 是一个Web流量负载平衡器,使您可以管理到Web应用程序的流量.它不会同时支持RDS中所需的两个角色,因此不适合您的情况.

In an RDS deployment, the RD Web role and the RD Gateway role run on Internet-facing machines. Both are important as they both serve different functionality. Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. It will not support for both the roles required in RDS hence it doesn’t fit for your scenario.

如果您想要更安全地保护远程桌面服务场,则可以使用Azure AD应用程序代理对其进行发布.参考: 使用Azure AD应用程序代理发布远程桌面.

If you want to more secure your remote desktop service farm, then you can publish it with Azure AD Application Proxy. Refer: Publish Remote Desktop with Azure AD Application Proxy.

- -------------------------------------------------- ----------------------------------

如果是这样答案很有帮助,请单击标记为答案"或进行投票.为了提供有关您的论坛体验的其他反馈, 点击

If this answer was helpful, click "Mark as Answer" or Up-Vote. To provide additional feedback on your forum experience, click here