SSL-VPN Web-only trying to connect to RDP server stuck at "configuring remote session"

6 replies
22215 views

I set up an SSL-VPN with a Web-only portal; I want users to be able to connect to internal servers using RDP. I created a bookmark for an internal terminal server.

The portal itself works fine. When I click on the bookmark, I get the usual Java security warnings, then RDP launches and reports "Configuring remote session" to 127.0.0.1:49152. RDP stays at that message and never connects. Eventually, the portal times out and logs out.

I've set up such an SSL-VPN before and got it to work with no problems, but can't figure out what I'm missing this time.

FortiOS 5.0 on a FGT 60D.

For my testing, the client is Windows 8.1 64 bit with Java 8 Update 45 and Java 7 update 75 both installed. Both the 32-bit and 64-bit versions of Java are installed. I am using IE 11.

Christopher_McMullanAnswer

Staff

Would it be accurate to say you're using RDP-Native? If so, what is the impact of changing the bookmark to use Java-based RDP?

Christopher_McMullanAnswer

Staff

Would it be accurate to say you're using RDP-Native? If so, what is the impact of changing the bookmark to use Java-based RDP?

kkeaneAuthor

New Member

Christopher McMullan_FTNT wrote:
Would it be accurate to say you're using RDP-Native? If so, what is the impact of changing the bookmark to use Java-based RDP?

Yes, your assumption is correct, I used RDP Native. When I use the Java-based RDP, I get an error message "Connection exception. SSL Negotiation failed. please check your Fortigate configuration". The computer I am trying to connect to uses the standard SSL self-signed certificate. I don't think the RDP Native implementation even gets to the point where it would check certificates; it seems to not even connect to port 3389 at all.

Christopher_McMullan

Staff

This is going to sound odd, but could you check to verify whether the destination address object in any ssl.<vdom> to internal policy is correctly defined for the resource you're trying to access?

I found one case where it was simply an ACL issue: the policy didn't allow the destination specified in the bookmark. This would apply equally to Java-based and native SSLVPN RDP connections.

kkeaneAuthor

New Member

Christopher McMullan_FTNT wrote:
This is going to sound odd, but could you check to verify whether the destination address object in any ssl.<vdom> to internal policy is correctly defined for the resource you're trying to access?

I found one case where it was simply an ACL issue: the policy didn't allow the destination specified in the bookmark. This would apply equally to Java-based and native SSLVPN RDP connections.

Not odd at all. And in fact, I had completely forgotten the police from the ssl.root interface to internal. Unfortunately, that's not the only problem; even after adding it, the problem still persists.

Christopher_McMullan

Staff

No problem! Glad it's working.

Sign up

Login with SSO

Login to the community

Login with SSO