Networking and routing for Remote Desktop on different internal LANs

[TonyS]

I have been corralled into helping a group get their Remote Desktop System into a more secure state. Up until now they were using a Cisco RV042 with port forwarding to connect remote desktop users to two VDI servers running terminal services and five other people to their desktop computers. With all of the RDP vulnerabilities, I told them that they needed to get the RDP servers behind a VPN instead of being exposed to the internet. 

They purchased a FortiGate 60E, but they were unable to get it to do what they wanted and they asked me to help. I have no Fortinet experience. I was able to get the device connected to their Active Directory Controller and users can login to the VPN using their AD credentials. The two VDI servers had extra network connections available, so I created a new 10.40.0.x network to put those on and assigned two ports on the FortiGate to that network and assigned the internal side of the VPN to the 10.40.0.0/255.255.255.0 network and remote users are now able to logon to the VDI servers.

The problem I am left with are the five people who must connect to desktop computers. These computers do not have extra adapters at this point, so I can't just connect them to that same 10.40.0.0/255.255.255.0 network. 

Is there some way that I can get the FortiGate to use port forwarding to access the Remote Desktop Services on those five computers? Those computers are on a network in the 192.168.1.0/255.255.255.0 range. I would prefer this to happen through port forwarding since the remote computers themselves should not have access to services on the internal network. That is just my initial thought on how to solve it. If there is some better way of providing access to the RDS, but no other services I am all for that.

Thanks for any assistance.

[sw2090]

those users that need to connect to those five computers use a vpn on your FGT too I suppose.

Well then you need a couple of things:

- the FGT needs to have access to 192.168.1.0/24 in some way (vlan or physical interface would be the easiest).

- The VPN must do split tunneling on a group containing either the two subnets 192.168.1.0/24 and 10.40.0.0/24 or the specific host ips. This is needed for client side routing.

- the FGT then has to have some policy that allows the traffic you need. Either vom vpn ip range to the two subnets or from vpn ip range to the specific host ips. You could limit it to RDP also. Just check if there already is a predefinied service RDP on the FGT and limit the policy(s) to it. If it don't exist create one. Should be easy to find which port(s) RDP uses ;)