Qlik Sense Server access through a TMG

[#1]

Hi Qlik Community

We are setting up external network access to a Qlik Sense Server on the corporate network. All external connections are authenticated and routed through a Microsoft Forefront Threat Management Gateway, a firewall, and finally onto the Qlik Sense Server. This set-up is working fine for our Qlikview server, which we can access externally once authenticated by the TMG, but it seems to have trouble communicating with the Qlik Sense server.

After authenticating with the TMG we are receiving a page with Error code 64: Host not available. Tests on the TMG are currently giving us a HTTP 301 error - moved permanently, when attempting the connection.

Any guidance or tips would be greatly appreciated.

Many thanks

[#2]

Thanks for the reply.

I got SSL through port 4244 working, but need to pass through the web sockets calls.

I am configuring that tonight and if it works, I will post the steps for the correct config.

Marc

[Anonymous]

Great to hear! Looking forward to see your config!

Roland

[Anonymous]

Hi marcquimby‌‌,

Were you able to fix this ? Could you please help us with the configs if it worked for you ?

Best,

Hardik

[#5]

I was able to get port 4244 working for authentication, but hit a snag on web sockets through the TMG. I had to create a new web listener using port 4244 over HTTPS.  I also added port 4244 to the SSL Tunnel range.  Using this method: Fix my IT system: TMG : Allow SSL request on an additional port

The main app pages won't work.  I was able to get access the QMC pages properly, but not the Apps/Sheets.

We have a project to replace the TMG and only a handful of users are external and they just go through our VPN for now.  I didn't want to put a bunch of time in it knowing that we are moving off of the TMG soon.

Here is an image of the 4244 properties and the VB Script to add the SSL Tunnel Range

VBScript used

Dim root

Dim tpRanges

Dim newRange

Set root = CreateObject("FPC.Root")

Set tpRanges = root.GetContainingArray.ArrayPolicy.WebProxy.TunnelPortRanges

set newRange = tpRanges.AddRange("SSL 4244", 4244, 4244)

tpRanges.Save

Marc

[#6]

Hi Marc

Would you mind sharing some other parts of your config on the TMG you have to get QMC pages accessible?  I followed your steps in the previous post, but am struggling to get it to work still.  I'd like to know how you have your web site publishing rule setup and what your Auth settings are on the listener as well as the publishing rule.  Thanks in advance

Tom

[#7]

Hi

     I've got it to the same point as Marc.
     I was able to publish the site through TMG and enabled the authentication through port 4244. This makes the management console available. However I was not able to configure the Websockets to work through the TMG so the main app pages cannot be used.
     Is there anybody who was able to make this work?

Atanas

[marcos_herrera]

Hi Dear Atanas Koev

I need configure the same type of access to redirect from a IP Public Server with ForeFront to Qliksense Server, i don't have any idea about MS ForeFront, maybe do you have some article or procedure with the steps to achieve the requirement. I know that you have a problem in an specific part, but i want to get to the same step where you are.

Thanks

[fabio_ribeiro]

Hi Everyone, I know this is a dead topic, but recently I have the same necessity.

Until now the client networking team has not yet positioned me on the solution I found. So if anyone here still has the need and/or an environment to validate, I found this topic talking about setting up TMG to work with WebSocket.

https://serverfault.com/questions/420197/does-microsoft-tmg-2010-handle-websockets-at-least-through-...

[patricesalem]

Hi Fabio and others

has anybody managed to get websockets to  work with TMG ? Maybe with Fabio's link.

Any advise would be welcome to make possible the access to the hub from outside (websocket must me activate with TMG).

Thanks

pat

[fabio_ribeiro]

Hi, Pat.

As far as I could do the tests, I was unable to evolve. The TMG used was a slightly older version and did not have the feature described in the documentation.

Microsoft itself has discontinued TMG; therefore, the solution was to bypass the TMG.