RDP - block traffic depending on protocol conditions (local resource redirection)

[joh2k]

Hello everyone,

Outgoing Remote Desktop Protocol (RDP) are risky since it is possible for the client to share her local drives with the server (as well as network drives, usb drives, printers, ports, clipboard, etc.)

Is it possible for FortiGate to inspect outgoing RDP traffic in order to block connections sharing such resources?

Thank you,

[vsahu · Accepted solution]

The FortiGate can do data leak prevention and prevent certain file types from being transferred but the services that can be currently scanned are HTTP-POST, SMTP, POP3, IMAP, MAPI, and NNTP which unfortunately does not include the RDP.

Also, RDP works on 3389 we can either block/allow the same via blocking/allowing the 3389 port through the firewall. Unfortunately, we would not able to stop the copy/paste data or copy a file from the server and paste it on the machine since this is also considered RDP protocol.

Restriction of copying of files via RDP cannot be achieved via gateway firewall as the copying of files does not work on any specific ports or IP address.

You can go through the below-mentioned link for the windows RDP setting, which can be done at the system level.
https://automationadmin.com/2016/05/gpo-disable-clipboard-in-rdp/