Hi,
I'm trying to make the settings on Fortigate to enable the RDP to a server but is not working.
I made the Virtual IP settings and I created the policy:
what is the problem?
VIRTUAL IP:
Name: RDP_virtualIP External Interface: wan1
External IP: 999.999.999.999 (I put the correct external ISP IP)
Mapped IP: 192.168.100.30
Port fowarding: enabled
External service port:3389/3389 Map to Port: 3389/3389
POLICY
From: wan1
To: vlan100
Source: all
Destination: RDP_virtualIP
Nat: disabled
In the logs I can see the pc outside that is trying to connect, it is not being blocked but doesn't works.
I placed the policy on the top of the rules but doesnt worked too.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Can you run a sniff and flow trace to see what is happening to the traffic each step of the way?
1. diag sniffer packet any "host w.x.y.z and port 3389" 4 //--replace w.x.y.z with the public IP of the client (not the External IP or the Mapped IP; both these will change between wan1 and vlan100) connecting inbound to the server
-Press Ctl+C to stop the capture once you gather enough packets to see where the problem occurs
2. Run the flow trace if the sniff doesn't make the problem obvious to find:
diag debug reset
diag debug enable
diag debug flow show console enable
diag debug flow show function-name enable
diag debug flow filter addr w.x.y.z //--again, use the public IP of the incoming client
diag debug flow filter port 3389
diag debug flow trace start 5000
<attempt to connect, then...>
diag debug flow trace stop
diag debug flow filter clear
diag debug reset
diag debug disable
If you perform a find/replace on the External IP that appears in the output, as well as the client IP, then you can still mask their real values and post the output to this chat thread.
Regards, Chris McMullan Fortinet Ottawa
Okay...the flow trace shows essentially what you said; the packets are not being blocked. The FortiGate recognizes subsequent packets to belong to the existing session.
Does the sniff show the packets leaving towards the server?
Regards, Chris McMullan Fortinet Ottawa
Christopher McMullan_FTNT wrote:Okay...the flow trace shows essentially what you said; the packets are not being blocked. The FortiGate recognizes subsequent packets to belong to the existing session.
Does the sniff show the packets leaving towards the server?
In that image is all the logs that shown to me, nothing more...
In the policy, what service did you use? All/Any, built-in RDP, or your own custom RDP?
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
rwpatterson wrote:In the policy, what service did you use? All/Any, built-in RDP, or your own custom RDP?
The service is set to ALL
The only thing for me is very strange: I can connect to the server using the RDP from a computer in the lan.
I didn't make any type of block in the server. I also uninstalled the antivirus to check, and also the remote desktop connection fails.
Okay, try running the sniff again:
diag sniffer packet any "host w.x.y.z and port 3389" 4
Regards, Chris McMullan Fortinet Ottawa
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1705 | |
1093 | |
752 | |
446 | |
230 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.