topic Re: Qlik Sense Server access through a TMG in Management & Governance

Qlik Sense Server access through a TMG

Fri, 27 Mar 2015 16:22:36 GMT

Hi Qlik Community

We are setting up external network access to a Qlik Sense Server on the corporate network. All external connections are authenticated and routed through a Microsoft Forefront Threat Management Gateway, a firewall, and finally onto the Qlik Sense Server. This set-up is working fine for our Qlikview server, which we can access externally once authenticated by the TMG, but it seems to have trouble communicating with the Qlik Sense server.

After authenticating with the TMG we are receiving a page with Error code 64: Host not available. Tests on the TMG are currently giving us a HTTP 301 error - moved permanently, when attempting the connection.

Any guidance or tips would be greatly appreciated.

Many thanks

Re: Qlik Sense Server access through a TMG

korsikov — Fri, 27 Mar 2015 19:25:38 GMT

if you foward to Qlik Sense server through a proxy, you must also traverse the web socket

Re: Qlik Sense Server access through a TMG

phaneendra_kunc — Thu, 11 Jun 2015 15:19:21 GMT

I have the same problem. Were you able to resolve.

Kind of odd that we have qlikview TMG and it works without a problem. Not sure why Sense has a problem.

Any help is greatly appreciated.

Re: Qlik Sense Server access through a TMG

korsikov — Thu, 02 Jul 2015 08:57:04 GMT

I ran into the same problem. If the user of the Internet everything works fine. and if users are in TMG problems begin

Re: Qlik Sense Server access through a TMG

Anonymous — Wed, 27 Jan 2016 19:05:04 GMT

Same issue here!

We get stuck when QlikSense redirects us to Port 4244 for Windows Authentication.

It points us to the internal servername, instead of the external URL.

Not quite sure if there is a way to configure TMG to replace the servername in the response...

Re: Qlik Sense Server access through a TMG

korsikov — Wed, 27 Jan 2016 19:25:50 GMT

You are wrong. Connect stuck after authentication. Tmg not allowed websocket on http. Try connect to you server use https.

Re: Qlik Sense Server access through a TMG

Anonymous — Thu, 28 Jan 2016 09:17:17 GMT

HI!

For testing I have now turned the Virtual Proxy to "Allow Anonymous".

--> now I agree with you, we get an HTTP 500 Error on the first request to "WSS://Servername"

--> websocket seems to be blocked.

Can you post your TMG configurations to allow websocket? It would help a lot!

Thx in advance

Roland

Re: Qlik Sense Server access through a TMG

korsikov — Thu, 28 Jan 2016 12:10:17 GMT

sorry but i not use TMG in my environment. My clients faced with this problem.

He always use workaround - connect through https. TMG allow WS on https connection.

Also same problem with SQUID. Solved with add line in config "Allow CONNECT on 80 ports" add edit two timeouts

read_timeout, client_lifetime

Re: Qlik Sense Server access through a TMG

Mon, 13 Feb 2017 14:11:35 GMT

Hi Roland,

Did you ever get this working for TMG inbound?

Thanks,

Marc

Re: Qlik Sense Server access through a TMG

Anonymous — Tue, 14 Feb 2017 20:28:19 GMT

hi!

no, we moved a proxy-node into the DMZ instead.

I think the problem was, that Qlik Sense Authentication does a port switch to 4244, which we never got working in TMG..

Re: Qlik Sense Server access through a TMG

Tue, 14 Feb 2017 20:33:53 GMT

Thanks for the reply.

I got SSL through port 4244 working, but need to pass through the web sockets calls.

I am configuring that tonight and if it works, I will post the steps for the correct config.

Marc

Re: Qlik Sense Server access through a TMG

Anonymous — Fri, 17 Feb 2017 11:38:05 GMT

Great to hear! Looking forward to see your config!

Roland

Re: Qlik Sense Server access through a TMG

Anonymous — Thu, 09 Mar 2017 10:01:51 GMT

Hi marcquimby‌‌,

Were you able to fix this ? Could you please help us with the configs if it worked for you ?

Best,

Hardik

Re: Qlik Sense Server access through a TMG

Thu, 09 Mar 2017 16:00:20 GMT

I was able to get port 4244 working for authentication, but hit a snag on web sockets through the TMG. I had to create a new web listener using port 4244 over HTTPS. I also added port 4244 to the SSL Tunnel range. Using this method: Fix my IT system: TMG : Allow SSL request on an additional port

The main app pages won't work. I was able to get access the QMC pages properly, but not the Apps/Sheets.

We have a project to replace the TMG and only a handful of users are external and they just go through our VPN for now. I didn't want to put a bunch of time in it knowing that we are moving off of the TMG soon.

Here is an image of the 4244 properties and the VB Script to add the SSL Tunnel Range

VBScript used

Dim root

Dim tpRanges

Dim newRange

Set root = CreateObject("FPC.Root")

Set tpRanges = root.GetContainingArray.ArrayPolicy.WebProxy.TunnelPortRanges

set newRange = tpRanges.AddRange("SSL 4244", 4244, 4244)

tpRanges.Save

Marc

Re: Qlik Sense Server access through a TMG

Thu, 23 Mar 2017 19:41:06 GMT

Hi Marc

Would you mind sharing some other parts of your config on the TMG you have to get QMC pages accessible? I followed your steps in the previous post, but am struggling to get it to work still. I'd like to know how you have your web site publishing rule setup and what your Auth settings are on the listener as well as the publishing rule. Thanks in advance

Tom

Re: Qlik Sense Server access through a TMG

Wed, 07 Jun 2017 16:22:28 GMT

     I've got it to the same point as Marc.
     I was able to publish the site through TMG and enabled the authentication through port 4244. This makes the management console available. However I was not able to configure the Websockets to work through the TMG so the main app pages cannot be used.
     Is there anybody who was able to make this work?

Atanas

Re: Qlik Sense Server access through a TMG

marcos_herrera — Fri, 18 Aug 2017 23:33:27 GMT

Hi Dear Atanas Koev

I need configure the same type of access to redirect from a IP Public Server with ForeFront to Qliksense Server, i don't have any idea about MS ForeFront, maybe do you have some article or procedure with the steps to achieve the requirement. I know that you have a problem in an specific part, but i want to get to the same step where you are.

Thanks

Re: Qlik Sense Server access through a TMG

fabio_ribeiro — Tue, 25 Jun 2019 13:03:49 GMT

Hi Everyone, I know this is a dead topic, but recently I have the same necessity.

Until now the client networking team has not yet positioned me on the solution I found. So if anyone here still has the need and/or an environment to validate, I found this topic talking about setting up TMG to work with WebSocket.

https://serverfault.com/questions/420197/does-microsoft-tmg-2010-handle-websockets-at-least-through-ssl

Re: Qlik Sense Server access through a TMG

patricesalem — Tue, 17 Dec 2019 07:24:16 GMT

Hi Fabio and others

has anybody managed to get websockets to work with TMG ? Maybe with Fabio's link.

Any advise would be welcome to make possible the access to the hub from outside (websocket must me activate with TMG).

Thanks

pat

Re: Qlik Sense Server access through a TMG

fabio_ribeiro — Mon, 10 Feb 2020 18:21:31 GMT

Hi, Pat.

As far as I could do the tests, I was unable to evolve. The TMG used was a slightly older version and did not have the feature described in the documentation.

Microsoft itself has discontinued TMG; therefore, the solution was to bypass the TMG.