topic Re: Terminal Services Client through VPN in Network Security

Terminal Services Client through VPN

ali-franks — Fri, 21 Feb 2020 06:24:10 GMT

Hi,

Having trouble with this one so I wonder if anyone can help please?

VPN establishes from client 3.5.1 to PIX no prob. Can establish mapped drives, browse network etc.

The PIX has an ACL allowing port 3389, the MS default port, to the server. Now, this works OK if you dial an ISP then connect using the Connection Manager, login as normal etc. but will not play using a VPN!

Any ideas please?

Cheers

Ali

Re: Terminal Services Client through VPN

bbaley — Tue, 03 Dec 2002 20:05:34 GMT

Based on the information here, I can only guess that your problem might have to do with routing. The first thing you need to check is which interface you are terminating your tunnel on. You need to verify that the PIX is forwarding traffic to the interface where the crypto map exists. You need to ensure that you have specified a route to the remote network with the appropriate next hop.

Re: Terminal Services Client through VPN

ali-franks — Thu, 05 Dec 2002 10:20:10 GMT

Hi Bill,

The VPN is terminating correctly on the outside interface.

When you say "You need to ensure that you have specified a route to the remote network with the appropriate next hop. " do you mean a route inside?

The WTS server is on the same LAN as the inside interface.

Ali

Re: Terminal Services Client through VPN

ajagadee — Sat, 07 Dec 2002 08:24:22 GMT

Hi Ali,

1. Using the same host that is having problems when connecting through the VPN, use the statically translated Public ip address and make sure that Terminal Services is working fine for this host. This is just to make sure that you are having issues only through VPN.

2. Now make an IPSec connection using the VPN Client and try pinging the Terminal Server and if that works fine then we know that there is IP Connectivity and your routing is looking good.

Now from the same host and through the IPSec connection, send ping packets with different packet size and see where the pings start failing.

And if possible, try to lower the MTU size on the host and then give it a shot.

Regards,

Arul

Re: Terminal Services Client through VPN

ali-franks — Mon, 09 Dec 2002 15:57:47 GMT

Arul,

1.The statically translated address works fine when used with normal dial access to an ISP

2. Using the VPN client I can ping the public IP address and the statically assigned

3. Pinging the Terminal Server with 992 bytes is no prob but it fails on 993 bytes

A colleague reckons that to change the MTU on the client involves using the command line and that in turn will change the MTU setting in the registry. Is that correct or am I of down the wrong road?

Ali

Re: Terminal Services Client through VPN

ajagadee — Mon, 09 Dec 2002 19:40:13 GMT

Hi Ali,

You can use a software called DrTCP to adjust the MTU.

Regards,

Arul

Re: Terminal Services Client through VPN

ali-franks — Wed, 11 Dec 2002 10:14:57 GMT

Arul,

I've tried that but DrTCP doesn't seem to pick up the Modem Interface on my Xircom PC card for some reason. Tried reboots, start/stop service etc but to no avail.

Any other ideas please?

Ali

Re: Terminal Services Client through VPN

ali-franks — Wed, 15 Jan 2003 09:23:54 GMT

FYI,

Using VPN Client 3.6.3, Set MTU to 576 and away you go! As long as the inbound ACL has 3389 allowed of course.

By the way, in case your wondering, NO I have not spent all this time figuring this out 🙂

Ali