Forefront TMG 2010: Can you monitor realtime TCP connections and bandwidth on a per-user basis

NLB relies on nodes being on the same broadcast plane as each other, so doesn't usually work well in geographically distributed cluster scenarios (that, and it often costs you a lot in bandwidth broadcasting all incoming traffic across a WAN, only for it to be dropped over there).

Other clustering - perhaps, depending on what you have in mind. TMG doesn't lend itself to clustering except with its integrated NLB, so it'll have to be above (or below) the TMG level.

Having another VM ready to go in the DR site, and using DNS to direct traffic to the curent live node for internet clients, is probably the best solution. You could install this as another TMG Array member if it's used exclusively for publishing, and not enable NLB; that keeps the configuration consistent between the nodes, and allows for externally-driven failover.

From my reading, it looks like the Forefront TMG will not allow the passing of RDP connections through the firewall without configuring a non-standard port for each IP address of the internal servers and clients.

Well, from my reading of your question it looks like you dont know how to use RDP, at least the current iteration ;) I happily connect to whatever server I want behind my TMG without configuring a port per server.

TMG supports what has been standard in windows - a gateway server.

That pretty much means that your remote desktop client connects to the gateway server (using HTTP, btw.), then the calls get forwarded from there to the final server internally.

This is a standard setting in the remote desktop client where you can enter the gateway host address (url) which most administrators do not know because of not bothering to read the documentation.

http://technet.microsoft.com/en-us/library/cc731264%28v=ws.10%29.aspx

explains what a Terminal Services Gateway is and how it works in general.

http://www.isaserver.org/tutorials/Microsoft-Forefront-TMG-Publishing-RD-Web-Access-RD-Gateway-Part1.html

has some explanations how to set things up for TMG. This one creates a web site for connecting.

it reaslly is quite easy to set up. And using HTTP as carrier protocol for RDP has the serios advantage of being able to work quite often when normal TCP forwarding is disabled or limited by firewall rules ;)

http://www.windowsecurity.com/articles/Configuring-Windows-Server-2008-Terminal-Services-Gateway-Part2.html

talks of publishing TS Gateways directly ;)