Has anyone got XP remote desktop to work on a PC behing the firewall? I did everything per knowledge base article # 168179 but sitll doesn't work. Thanks
I've run across an interesting observation. With IPS enabled on both machines on each end of an IPSec VPN tunnel, and with "any-any" packet filter rules setup, so that all traffic can flow freely back & forth between each subnet across the IPSec VPN, Remote Desktop will not. Something in IPSec on the outgoing side keeps that traffic from reaching the other side.
For example, I'm on a machine (192.168.2.xxx) and am trying to RD into a machine on 192.168.1.xxx. The ASG on 2.xxx stops the RD traffic if IPS is enabled. Yet, I filtered the IPS rules and the above mentioned RDP rules have NO HITS detected. I went ahead & disabled them & still no dice.
This is strange because the 'any-any' packet filter I've been using for over two years has worked just fine with all types of services, including RDP. That was until IPS was enabled.
I was able to get everything working with IPS by adding the RDP specific packet filter entries as mentioned above. However, should I have really needed to add these? Other services like MS File & Printer sharing for example, work fine thur IPS & IPSec VPN.
Rules 1447 and 4060 in the IPS should be disabled or allowed. To find them, simply click the filters button in the top right of the rules page, and enter the string "RDP" in the substring blank.. and click Apply... it should list 4 rules total, 2 of which are RDP rules.
[/ QUOTE ]
This is incorrect, as I was getting NO hits for Rule 1447 & 4060. However, I was getting a BUNCH of hits on Rule 1448 (MISC MS Terminal server request - ID 1448) which is disabled by default, which is interesting, as I was trying to MS Remote Desktop between two XP SP2 machines. The firewall on the local side was keeping thte request from going out which I also thought was strange, as I thought IPS for the most part, kept undesirable stuff from coming in.
Rules 1447 and 4060 in the IPS should be disabled or allowed. To find them, simply click the filters button in the top right of the rules page, and enter the string "RDP" in the substring blank.. and click Apply... it should list 4 rules total, 2 of which are RDP rules.
[/ QUOTE ]
This is incorrect, as I was getting NO hits for Rule 1447 & 4060. However, I was getting a BUNCH of hits on Rule 1448 (MISC MS Terminal server request - ID 1448) which is disabled by default, which is interesting, as I was trying to MS Remote Desktop between two XP SP2 machines. The firewall on the local side was keeping thte request from going out which I also thought was strange, as I thought IPS for the most part, kept undesirable stuff from coming in.
[/ QUOTE ]
I believe the rule definitions changed slightly, hence the slightly different numbers... anyhow, how did setting the rule to pass (yeah, I know it says it's disabled, I think that's one I had to set to pass regardless.. I think it's a bug) help, or have you tried that yet?
CTO, Convergent Information Security Solutions, LLC
Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Setting this rule to allow traffic resolved all my RDP problems. I was even able to remove the RDP packet filter I had in place (actually, it never worked correctly as I always assumed it was the remote firewall blocking RDP, NOT my local firewall not letting RDP out!)
So to recap: Anyone wanting to RDP out thru ASL 6.xxx needs to change the default rule "MISC MS Terminal server request - ID 1448" to "Allow" as by default, it drops all internal attempts at RDP'ing into a remote computer.
BTW, this rule can easily be found by using the filter function and searching for "terminal server".
