Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ragno
New Contributor

Virtual IP for enable RDP

Hi,

 

I'm trying to make the settings on Fortigate to enable the RDP to a server but is not working.

I made the Virtual IP settings and I created the policy:

 

what is the problem?

 

VIRTUAL IP:

Name: RDP_virtualIP External Interface: wan1

External IP: 999.999.999.999 (I put the correct external ISP IP)

Mapped IP: 192.168.100.30

Port fowarding: enabled

External service port:3389/3389 Map to Port: 3389/3389

 

POLICY

From: wan1

To: vlan100

Source: all

Destination: RDP_virtualIP

Nat: disabled

 

In the logs I can see the pc outside that is trying to connect, it is not being blocked but doesn't works.

I placed the policy on the top of the rules but doesnt worked too.

23 REPLIES 23
Christopher_McMullan

Can you run a sniff and flow trace to see what is happening to the traffic each step of the way?

 

1. diag sniffer packet any "host w.x.y.z and port 3389" 4 //--replace w.x.y.z with the public IP of the client (not the External IP or the Mapped IP; both these will change between wan1 and vlan100) connecting inbound to the server

-Press Ctl+C to stop the capture once you gather enough packets to see where the problem occurs

 

2. Run the flow trace if the sniff doesn't make the problem obvious to find:

diag debug reset

diag debug enable

diag debug flow show console enable

diag debug flow show function-name enable

diag debug flow filter addr w.x.y.z //--again, use the public IP of the incoming client

diag debug flow filter port 3389

diag debug flow trace start 5000

<attempt to connect, then...>

diag debug flow trace stop

diag debug flow filter clear

diag debug reset

diag debug disable

 

If you perform a find/replace on the External IP that appears in the output, as well as the client IP, then you can still mask their real values and post the output to this chat thread.

Regards, Chris McMullan Fortinet Ottawa

ragno

The VLAN is 10 and not 100. But the ip is correct.

The 188.88.88.88 is my ISP ip connected to fortigate.

The 155.55.55.254 is the outside client IP.

 

 

 

Christopher_McMullan

Okay...the flow trace shows essentially what you said; the packets are not being blocked. The FortiGate recognizes subsequent packets to belong to the existing session.

 

Does the sniff show the packets leaving towards the server?

Regards, Chris McMullan Fortinet Ottawa

ragno

Christopher McMullan_FTNT wrote:

Okay...the flow trace shows essentially what you said; the packets are not being blocked. The FortiGate recognizes subsequent packets to belong to the existing session.

 

Does the sniff show the packets leaving towards the server?

In that image is all the logs that shown to me, nothing more...

rwpatterson
Valued Contributor III

In the policy, what service did you use? All/Any, built-in RDP, or your own custom RDP?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
ragno

rwpatterson wrote:

In the policy, what service did you use? All/Any, built-in RDP, or your own custom RDP?

The service is set to ALL

ragno
New Contributor

The only thing for me is very strange: I can connect to the server using the RDP from a computer in the lan.

I didn't make any type of block in the server. I also uninstalled the antivirus to check, and also the remote desktop connection fails.

Christopher_McMullan

Okay, try running the sniff again:

 

diag sniffer packet any "host w.x.y.z and port 3389" 4

Regards, Chris McMullan Fortinet Ottawa

ragno
New Contributor

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors