Hi,
I'm trying to make the settings on Fortigate to enable the RDP to a server but is not working.
I made the Virtual IP settings and I created the policy:
what is the problem?
VIRTUAL IP:
Name: RDP_virtualIP External Interface: wan1
External IP: 999.999.999.999 (I put the correct external ISP IP)
Mapped IP: 192.168.100.30
Port fowarding: enabled
External service port:3389/3389 Map to Port: 3389/3389
POLICY
From: wan1
To: vlan100
Source: all
Destination: RDP_virtualIP
Nat: disabled
In the logs I can see the pc outside that is trying to connect, it is not being blocked but doesn't works.
I placed the policy on the top of the rules but doesnt worked too.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Alright...it looks as if the packet leaves 'on the wire' towards the RDP server. Can you check the server logs to see why it does not reply?
Regards, Chris McMullan Fortinet Ottawa
Hi to all!
maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?
Bye!
escudero wrote:Hi to all!
maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?
Bye!
That raises a good question: what is the server's gateway? Is it the FortiGate?
Better to check the server logs anyway, since we know the traffic reaches the server. The FortiGate is not blocking it. See if it's related to the source IP of the request, or source OS version (newer or older verion of Remote Desktop?), or else the wrong gateway in the host routing table.
Regards, Chris McMullan Fortinet Ottawa
Christopher McMullan_FTNT wrote:escudero wrote:Hi to all!
maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?
Bye!
That raises a good question: what is the server's gateway? Is it the FortiGate?
Better to check the server logs anyway, since we know the traffic reaches the server. The FortiGate is not blocking it. See if it's related to the source IP of the request, or source OS version (newer or older verion of Remote Desktop?), or else the wrong gateway in the host routing table.
The server pings the fortigate vlan 10 interface and vice-versa.
The gateway is the IP of the VLAN 10 interface on Fortigate since is it who is making the intervlan routing.
The route print shows the same gateway as the ethernet adapter properties.
Checked if Windows Firewall was turned on and is off already.
The windows logs in not showing any problem, is showing the lan RDP sessions only that a I did my self inside the LAN.
I installed wireshark on the server and tryed to monitor but no communications related to the RDP process is shown.
The server is completely updated.
I did another test on a PC instead the server and the same problem occurs.
Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden
robin.svanberg@ethersec.se
Again thinking outside the box. Is this the only policy with 'all' as the service? Did you upgrade to V5.2.x? If yes to both the prior questions, did you alter the 'All' service from protocol 6 to protocol 0?
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Hey just check at the server level whether RDP is enabled? Sometimes it could be an issue as well.
Karan
FCSNA | CCNP | VCP | CCNA | MCITP
In the VIP, set the source IP to wildcard 0/0. On the firewall rule, set the source IP to the outside IP/network belong to the outside PC. Don't know if you really want to expose RDP port on your server to outside elements; maybe change the outside port mapping to 63389 (or something) and source IP. IMHO.
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Since the traffic is allowed by policy 16 and traffic is sent out to VLAN 10, I don´t think there´s a problem with the configuration on the Fortigate.
Rather thinks that there´s some routing or other issues after the Fortigate.
If you try the source NAT as I asked earlier we will probably sort that issue out :)
Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden
robin.svanberg@ethersec.se
I changed the policy to this way:
From: wan1 To: vlan10
source: 155.55.55.254 (outside client public ip)
Destination: rdp_vip
Schedule: always Service: all
Action: Accept
NAT: I tryed the 3 ways = disabled, enabled, enabled+fixed port
Also I tryed to set in Virtual IP the External IP Address/Range as: 0.0.0.0/0.0.0.0
Using version v5.0,build0305 (GA Patch 10)
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1632 | |
1063 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.