Fixed: VMware Horizon UAG "Unrecognized Request Detected" Warning

Horizon UAG: Solving the 'Unrecognized Request Detected' Mystery

Published: May 5, 2026 | Category: VDI Infrastructure & Security

---

Overview of the Symptom

In a VMware Horizon environment, administrators often encounter a yellow warning on the Unified Access Gateway (UAG) stating: "Unrecognized request detected." Curiously, the Connection Server remains healthy (Green), and the event often vanishes from the Horizon Console after a few minutes.

1. Root Cause Analysis

This alert is a result of the UAG’s built-in security filtering. It triggers when the UAG receives traffic that does not conform to the expected Horizon protocol or HTTP standards.

• External Bot Scanning: As an edge device, the UAG is frequently hit by automated scanners (e.g., Shodan, masscan). When these bots send malformed packets, the UAG drops the request and logs a warning.
• Misconfigured Load Balancer Health Checks: If your L4/L7 Load Balancer is sending generic TCP pings or incorrect HTTP GET requests to the UAG's port 443, the UAG will flag these as unrecognized.
• Intermittent Connection Drops: Brief network instability can cause truncated HTTP headers, which the UAG security logic interprets as a potential threat.
• Why it disappears: The Horizon Dashboard displays the current state. If the unrecognized traffic stops, the UAG clears the status, and the event is moved to the historical logs.

2. Technical Solutions

A. Optimize Load Balancer Health Checks

Ensure your Load Balancer uses the dedicated UAG health check endpoints instead of generic probes. Using the correct path prevents false positives.

• Recommended Path: /favicon.ico or /rest/v1/config/shared/health
• Expected Response: HTTP 200 OK

B. Deep Log Inspection

To identify the source IP and the nature of the "Unrecognized Request," you must analyze the UAG's internal logs:

# Log Location: /opt/vmware/gateway/logs/esmanager.log
# Search Query:
grep "Unrecognized request" esmanager.log

Look for the Source IP in the log entry. If the IP is external and unknown, the UAG is simply doing its job by blocking a scan.

C. Geo-Fencing & IP Whitelisting

If the alerts are constant due to external scans, consider implementing Geo-Blocking at your external firewall level to allow only specific regions or known VPN IPs.

3. Monitoring Strategy

Efficient monitoring focuses on distinguishing between operational noise and actual threats.

Metric / Point	Tool	Criticality
UAG esmanager.log	Syslog / Splunk	High (Identifies attack patterns)
HTTP 400/403 Errors	Load Balancer Analytics	Medium (Check for LB misconfigs)
Horizon Event Database	SQL Management Studio	Low (Used for historical audit)

Final Summary

Verdict: The 'Unrecognized Request' alert on a Horizon UAG is usually a sign of healthy edge protection. It indicates that the UAG successfully blocked non-standard traffic before it could reach your internal Connection Servers. Unless user connectivity is impacted, this is typically a "monitor and ignore" event, provided your Load Balancer health checks are correctly configured.