topic ASA5510 not allowing RDP connections in Network Security

ASA5510 not allowing RDP connections

Quintin.Mayo — Fri, 21 Feb 2020 14:37:20 GMT

We are trying to configure an IPsec VPN with a vendor. They are using a Palo Alto firewall. The tunnel is up and online but we are unable to RDP to some devices on our network from their side. We have four devices in the 172.x.x.x range. Can someone provide an configuration example that would allow RDP connections from the devices? I'm new to ASA and any assistance would be appreciated.

Re: ASA5510 not allowing RDP connections

Flavio Miranda — Wed, 01 Nov 2017 18:58:04 GMT

Hello @Quintin.Mayo

Ideally we should see you firewall config. Allow traffic only may not be enough.

But, to start:

access-list OUTSIDE-IN extended permit tcp "Origin" "Dest" eq 3389

access-group OUTSIDE-IN in interface outside

Re: ASA5510 not allowing RDP connections

Marius Gunnerud — Wed, 01 Nov 2017 23:40:01 GMT

You say that it does not work for some devices, does that mean that there are some devices that this does work for?

It would help to see your full configuration (sanitized).

Assuming that the VPN configuration is correct then this is either an issue that the server is not listening for RDP or, and I am leaning towards this next possibility, Palo Alto has two routes through different interfaces back to the ASA and is sending return traffic through the wrong interface. With other words, a configuration fault on Palo Alto side. I have had this issue previously and it took a long time until the Palo Alto admins admitted there was an issue at their end.