topic Terminal server Cluster with asa in Network Security

Terminal server Cluster with asa

ovidio.catrina — Tue, 12 Mar 2019 00:22:07 GMT

Hy there

I have a problem with a terminal server cluster.

I have an asa with an interface sided to the terminal server cluster.

The problem is when someone is trying to connect to the cluster this gives back the answer with an different IP so the asa drops the connection.

Example :

Client_source : 192.168.1.1

TS_1 : 10.10.1.1

TS_2 : 10.10.1.2

TS_3 : 10.10.1.3

IP asa

inside : 192.168.1.254

TS_int: 10.10.1.254

When the client 192.168.1.1 attacks the main IP of the TS cluster 10.10.1.1 this loadbalance and answers for example with the IP 10.10.1.2 or 10.10.1.3

The asa drops the connection because it expect and answer from 10.10.1.1 not from other source.

Thank you.

Terminal server Cluster with asa

Collin Clark — Mon, 12 Nov 2012 14:44:53 GMT

Take a look at source NAT (SNAT). I beleive that will take care of the problem.

Terminal server Cluster with asa

ovidio.catrina — Mon, 12 Nov 2012 14:50:23 GMT

Yeap I was thinking so, but isn't there another way, like some kind of asymetric routing.

Terminal server Cluster with asa

Collin Clark — Mon, 12 Nov 2012 18:14:37 GMT

TCP Bypass may work as well-

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b2d922.shtml