Is 192.168.5.200 the external or internal interface IP on the SA? Do you have a one-armed (only internal i/f configured) or two-armed (internal and external i/f with SA sitting between the networks) set-up?
Is 192.168.20.0/24 and 192.168.21.0/24 reachable from the internal interface? Can you ping the hosts from the SA?
What access method you want to configure on the SA to allow the RDP connection through to the back-end server? You can create a Terminal Services Resource Profile and have the option to use an RDP applet instead of a locally installed RDP client to make the RDP connection - see http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB16835 for example.
Chapter 24 p.561 of the Admin Guide has more details on this.
You could also use Network Connect/Pulse or SAM to allow the traffic for the RDP port to pass and use an RDP client on the local PC.