Virtual IP for enable RDP

[ragno]

Hi,

I'm trying to make the settings on Fortigate to enable the RDP to a server but is not working.

I made the Virtual IP settings and I created the policy:

what is the problem?

VIRTUAL IP:

Name: RDP_virtualIP External Interface: wan1

External IP: 999.999.999.999 (I put the correct external ISP IP)

Mapped IP: 192.168.100.30

Port fowarding: enabled

External service port:3389/3389 Map to Port: 3389/3389

POLICY

From: wan1

To: vlan100

Source: all

Destination: RDP_virtualIP

Nat: disabled

In the logs I can see the pc outside that is trying to connect, it is not being blocked but doesn't works.

I placed the policy on the top of the rules but doesnt worked too.

[Christopher_McMullan]

Can you run a sniff and flow trace to see what is happening to the traffic each step of the way?

1. diag sniffer packet any "host w.x.y.z and port 3389" 4 //--replace w.x.y.z with the public IP of the client (not the External IP or the Mapped IP; both these will change between wan1 and vlan100) connecting inbound to the server

-Press Ctl+C to stop the capture once you gather enough packets to see where the problem occurs

2. Run the flow trace if the sniff doesn't make the problem obvious to find:

diag debug reset

diag debug enable

diag debug flow show console enable

diag debug flow show function-name enable

diag debug flow filter addr w.x.y.z //--again, use the public IP of the incoming client

diag debug flow filter port 3389

diag debug flow trace start 5000

<attempt to connect, then...>

diag debug flow trace stop

diag debug flow filter clear

diag debug reset

diag debug disable

If you perform a find/replace on the External IP that appears in the output, as well as the client IP, then you can still mask their real values and post the output to this chat thread.

[ragno]

The VLAN is 10 and not 100. But the ip is correct.

The 188.88.88.88 is my ISP ip connected to fortigate.

The 155.55.55.254 is the outside client IP.

[Christopher_McMullan]

Okay...the flow trace shows essentially what you said; the packets are not being blocked. The FortiGate recognizes subsequent packets to belong to the existing session.

Does the sniff show the packets leaving towards the server?

[ragno]

Christopher McMullan_FTNT wrote:

Okay...the flow trace shows essentially what you said; the packets are not being blocked. The FortiGate recognizes subsequent packets to belong to the existing session.

Does the sniff show the packets leaving towards the server?

In that image is all the logs that shown to me, nothing more...

[rwpatterson]

In the policy, what service did you use? All/Any, built-in RDP, or your own custom RDP?

[ragno]

rwpatterson wrote:

In the policy, what service did you use? All/Any, built-in RDP, or your own custom RDP?

The service is set to ALL

[ragno]

The only thing for me is very strange: I can connect to the server using the RDP from a computer in the lan.

I didn't make any type of block in the server. I also uninstalled the antivirus to check, and also the remote desktop connection fails.

[Christopher_McMullan]

Okay, try running the sniff again:

diag sniffer packet any "host w.x.y.z and port 3389" 4

[ragno]