Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ragno
New Contributor

Virtual IP for enable RDP

Hi,

 

I'm trying to make the settings on Fortigate to enable the RDP to a server but is not working.

I made the Virtual IP settings and I created the policy:

 

what is the problem?

 

VIRTUAL IP:

Name: RDP_virtualIP External Interface: wan1

External IP: 999.999.999.999 (I put the correct external ISP IP)

Mapped IP: 192.168.100.30

Port fowarding: enabled

External service port:3389/3389 Map to Port: 3389/3389

 

POLICY

From: wan1

To: vlan100

Source: all

Destination: RDP_virtualIP

Nat: disabled

 

In the logs I can see the pc outside that is trying to connect, it is not being blocked but doesn't works.

I placed the policy on the top of the rules but doesnt worked too.

23 REPLIES 23
Christopher_McMullan

Alright...it looks as if the packet leaves 'on the wire' towards the RDP server. Can you check the server logs to see why it does not reply?

Regards, Chris McMullan Fortinet Ottawa

Iescudero
Contributor II

Hi to all!

maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?

 

Bye!

Christopher_McMullan

escudero wrote:

Hi to all!

maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?

 

Bye!

That raises a good question: what is the server's gateway? Is it the FortiGate?

 

Better to check the server logs anyway, since we know the traffic reaches the server. The FortiGate is not blocking it. See if it's related to the source IP of the request, or source OS version (newer or older verion of Remote Desktop?), or else the wrong gateway in the host routing table.

Regards, Chris McMullan Fortinet Ottawa

ragno

Christopher McMullan_FTNT wrote:

escudero wrote:

Hi to all!

maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?

 

Bye!

That raises a good question: what is the server's gateway? Is it the FortiGate?

 

Better to check the server logs anyway, since we know the traffic reaches the server. The FortiGate is not blocking it. See if it's related to the source IP of the request, or source OS version (newer or older verion of Remote Desktop?), or else the wrong gateway in the host routing table.

The server pings the fortigate vlan 10 interface and vice-versa.

 

The gateway is the IP of the VLAN 10 interface on Fortigate since is it who is making the intervlan routing.

The route print shows the same gateway as the ethernet adapter properties.

 

Checked if Windows Firewall was turned on and is off already.

 

The windows logs in not showing any problem, is showing the lan RDP sessions only that a I did my self inside the LAN.

 

I installed wireshark on the server and tryed to monitor but no communications related to the RDP process is shown.

 

The server is completely updated.

 

I did another test on a PC instead the server and the same problem occurs.

Robin_Svanberg

Can you try enable sNAT on the policy just to make sure?

 

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden

 

robin.svanberg@ethersec.se

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden robin.svanberg@ethersec.se
rwpatterson

Again thinking outside the box. Is this the only policy with 'all' as the service? Did you upgrade to V5.2.x? If yes to both the prior questions, did you alter the 'All' service from protocol 6 to protocol 0?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Cyber_Guard

Hey just check at the server level whether RDP is enabled? Sometimes it could be an issue as well.

Karan

FCSNA | CCNP | VCP | CCNA | MCITP

Karan FCSNA | CCNP | VCP | CCNA | MCITP
Dave_Hall

In the VIP, set the source IP to wildcard 0/0.  On the firewall rule, set the source IP to the outside IP/network belong to the outside PC.  Don't know if you really want to expose RDP port on your server to outside elements; maybe change the outside port mapping to 63389 (or something) and source IP. IMHO.

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Robin_Svanberg

Since the traffic is allowed by policy 16 and traffic is sent out to VLAN 10, I don´t think there´s a problem with the configuration on the Fortigate.

 

Rather thinks that there´s some routing or other issues after the Fortigate.

If you try the source NAT as I asked earlier we will probably sort that issue out :)

 

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden

 

robin.svanberg@ethersec.se

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden robin.svanberg@ethersec.se
ragno
New Contributor

I changed the policy to this way:

 

From: wan1 To: vlan10

source: 155.55.55.254 (outside client public ip)

Destination: rdp_vip

Schedule: always Service: all

Action: Accept

NAT: I tryed the 3 ways = disabled, enabled, enabled+fixed port

 

Also I tryed to set in Virtual IP the External IP Address/Range as: 0.0.0.0/0.0.0.0

 

Using version v5.0,build0305 (GA Patch 10)

 

 

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors