Virtual IP for enable RDP

[ragno]

Hi,

I'm trying to make the settings on Fortigate to enable the RDP to a server but is not working.

I made the Virtual IP settings and I created the policy:

what is the problem?

VIRTUAL IP:

Name: RDP_virtualIP External Interface: wan1

External IP: 999.999.999.999 (I put the correct external ISP IP)

Mapped IP: 192.168.100.30

Port fowarding: enabled

External service port:3389/3389 Map to Port: 3389/3389

POLICY

From: wan1

To: vlan100

Source: all

Destination: RDP_virtualIP

Nat: disabled

In the logs I can see the pc outside that is trying to connect, it is not being blocked but doesn't works.

I placed the policy on the top of the rules but doesnt worked too.

[Christopher_McMullan]

Alright...it looks as if the packet leaves 'on the wire' towards the RDP server. Can you check the server logs to see why it does not reply?

[Iescudero]

Hi to all!

maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?

Bye!

[Christopher_McMullan]

escudero wrote:

Hi to all!

maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?

Bye!

That raises a good question: what is the server's gateway? Is it the FortiGate?

Better to check the server logs anyway, since we know the traffic reaches the server. The FortiGate is not blocking it. See if it's related to the source IP of the request, or source OS version (newer or older verion of Remote Desktop?), or else the wrong gateway in the host routing table.

[ragno]

Christopher McMullan_FTNT wrote:

escudero wrote:

Hi to all!

maybe this is obvious, but just wondering. you get from the server to fortigate and vice versa with a ping?

Bye!

That raises a good question: what is the server's gateway? Is it the FortiGate?

Better to check the server logs anyway, since we know the traffic reaches the server. The FortiGate is not blocking it. See if it's related to the source IP of the request, or source OS version (newer or older verion of Remote Desktop?), or else the wrong gateway in the host routing table.

The server pings the fortigate vlan 10 interface and vice-versa.

The gateway is the IP of the VLAN 10 interface on Fortigate since is it who is making the intervlan routing.

The route print shows the same gateway as the ethernet adapter properties.

Checked if Windows Firewall was turned on and is off already.

The windows logs in not showing any problem, is showing the lan RDP sessions only that a I did my self inside the LAN.

I installed wireshark on the server and tryed to monitor but no communications related to the RDP process is shown.

The server is completely updated.

I did another test on a PC instead the server and the same problem occurs.

[Robin_Svanberg]

Can you try enable sNAT on the policy just to make sure?

[rwpatterson]

Again thinking outside the box. Is this the only policy with 'all' as the service? Did you upgrade to V5.2.x? If yes to both the prior questions, did you alter the 'All' service from protocol 6 to protocol 0?

[Cyber_Guard]

Hey just check at the server level whether RDP is enabled? Sometimes it could be an issue as well.

[Dave_Hall]

In the VIP, set the source IP to wildcard 0/0.  On the firewall rule, set the source IP to the outside IP/network belong to the outside PC.  Don't know if you really want to expose RDP port on your server to outside elements; maybe change the outside port mapping to 63389 (or something) and source IP. IMHO.

[Robin_Svanberg]

Since the traffic is allowed by policy 16 and traffic is sent out to VLAN 10, I don´t think there´s a problem with the configuration on the Fortigate.

Rather thinks that there´s some routing or other issues after the Fortigate.

If you try the source NAT as I asked earlier we will probably sort that issue out :)

[ragno]

I changed the policy to this way:

From: wan1 To: vlan10

source: 155.55.55.254 (outside client public ip)

Destination: rdp_vip

Schedule: always Service: all

Action: Accept

NAT: I tryed the 3 ways = disabled, enabled, enabled+fixed port

Also I tryed to set in Virtual IP the External IP Address/Range as: 0.0.0.0/0.0.0.0

Using version v5.0,build0305 (GA Patch 10)