V-286585

Discussion

The primary function of the UAG is to proxy connections to a Horizon Connection Server. There are multiple methods that clients can use to connect to a Horizon Connection Server, including PCoIP, Blast, HTML Access, and Secure Tunnels. Any of the methods that are not used in the environment must not be enabled to limit attack surface area. Satisfies: SRG-NET-000131-ALG-000085, SRG-NET-000131-ALG-000086, SRG-NET-000313-ALG-000010

Check Content

Log in to the UAG administrative interface as an administrator.

Select "Configure Manually".

Navigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.

Click the gear icon next to "Horizon Settings".

If necessary, toggle the slider next to "Enable Horizon" to show the settings.

Check the status of the following toggle items:

Enable PCOIP
Enable Blast
Enable UDP Tunnel Server
Enable Tunnel
Disable Web Client

If any item is enabled but not in use in the environment, this is a finding.

Navigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.

Click the gear icon next to each of the following:

Reverse Proxy Settings (not supported in FIPS mode)
Tunnel Settings
Secure Email Gateway Settings
Content Gateway Settings (not supported in FIPS mode)

If any non-Horizon Edge Service is enabled, but not in use in the environment, this is a finding.