VMware View Security Server DMZ

Hi!

We are currently setting up a small VMware View installation in our office as a POC and i have a question about the security server and the need for open ports against the clients.

Our setup:

2 factor authentication (Active Directory and RADIUS)

Front End FW

Security server on DMZ

Backend FW

Connection server

The question i have is:

Does port 4172TCP/UDP and 3389 HAVE do be open from the security server to the clients?

Is there no way to tunnel this from the security server through the connection server on the inside?

Thanks,

Kenth