topic Re: Allowing RDP over VPN through my firewall in Network Security

Allowing RDP over VPN through my firewall

RussellTarpleyTL — Fri, 21 Feb 2020 16:37:17 GMT

Let me preface by saying that I am a beginner and do not have a lot of experience with firewalls.

I have a Cisco ASA 5506-x running ASA Ver 9.8 and ASDM 7.8 Firewall mode is set to routed.

My goal is to be able to rdp into any machine on the inside network from machines outside the network connected via AnyConnect VPN. I have tried allowing port 3389 but have been unsuccessful in being able to establish a remote desktop connection. My internal network is 10.10.0.x

Additionally, I have not be able to allow ping successfully over VPN as well.

Any help is appreciated.

Russell

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Tue, 01 Jan 2019 00:40:23 GMT

You can change the ip addresses according to you requirments.

Create a ‘pool’ of IP addresses that the ASA will allocate to the remote clients, also create a network object that covers that pool of addresses we will use later.

ASA(config)# ip local pool ANYCONNECT-POOL 192.168.100.1-192.168.100.254 mask 255.255.255.0
ASA(config)# object network OBJ-ANYCONNECT-SUBNET
ASA(config-network-object)# subnet 192.168.100.0 255.255.255.0

Enable webvpn, set the package to the one you uploaded, then turn on AnyConnect.

ASA(config)# webvpn
ASA(config-webvpn)# enable outside
INFO: WebVPN and DTLS are enabled on 'outside'.
ASA(config-webvpn)# tunnel-group-list enable
ASA(config-webvpn)# anyconnect image disk0:/anyconnect-win-3.1.05152-k9.pkg 1 
ASA(config-webvpn)# anyconnect enable

I’m going to create a local username and password,I am also going to create an ACL that we will use for split tunneling in a minute.

ASA(config)# username Admin password Cisco123
ASA(config)# access-list SPLIT-TUNNEL standard permit 10.0.0.0 255.255.255.0

Create a group policy, change the values to match your DNS server(s), and domain name.

ASA(config)# group-policy GroupPolicy_ANYCONNECT-PROFILE internal
ASA(config)# group-policy GroupPolicy_ANYCONNECT-PROFILE attributes
ASA(config-group-policy)# vpn-tunnel-protocol ssl-client
ASA(config-group-policy)# dns-server value 10.0.0.10 10.0.0.11
ASA(config-group-policy)# split-tunnel-policy tunnelspecified
ASA(config-group-policy)# split-tunnel-network-list value SPLIT-TUNNEL
ASA(config-group-policy)# default-domain value mydomain.com

Create a matching tunnel-group that ties everything together.

ASA(config-group-policy)# tunnel-group ANYCONNECT-PROFILE type remote-access
ASA(config)# tunnel-group ANYCONNECT-PROFILE general-attributes
ASA(config-tunnel-general)# default-group-policy GroupPolicy_ANYCONNECT-PROFILE
ASA(config-tunnel-general)# address-pool ANYCONNECT-POOL
ASA(config-tunnel-general)# tunnel-group ANYCONNECT-PROFILE webvpn-attributes
ASA(config-tunnel-webvpn)# group-alias ANYCONNECT-PROFILE enable

7. Then stop any traffic that is going to (or coming from) the remote clients from being NATTED

ASA(config)# nat (inside,outside) 1 source static any any destination static OBJ-ANYCONNECT-SUBNET OBJ-ANYCONNECT-SUBNET no-proxy-arp route-lookup

Save the changes.

write me

Re: Allowing RDP over VPN through my firewall

RussellTarpleyTL — Tue, 01 Jan 2019 02:31:24 GMT

Didn't have any problems until I got to step 7. I get an error when attempting to execute the command
nat (inside,outside) 1 source static any any destination static OBJ-ANYCONNECT-S ^UBNET OBJ-ANYCONNECT-SUBNET no-proxy-arp route-lookup

ERROR: % Invalid input detected at '^' marker.

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Tue, 01 Jan 2019 02:49:17 GMT

Hi you put the command wrong

nat (inside,outside) 1 source static any any destination static OBJ-ANYCONNECT-S ^UBNET OBJ-ANYCONNECT-SUBNET no-proxy-arp route-lookup

ERROR: % Invalid input detected at '^' marker.

see below the correct and i high ligthed what you putting above

ASA(config)# nat (inside,outside) 1 source static any any destination static OBJ-ANYCONNECT-SUBNET OBJ-ANYCONNECT-SUBNET no-proxy-arp route-lookup

Re: Allowing RDP over VPN through my firewall

RussellTarpleyTL — Tue, 01 Jan 2019 02:54:51 GMT

I entered the command as follows:
nat (inside,outside) 1 source static any any destination static OBJ-ANYCONNECT-SUBNET OBJ-ANYCONNECT-SUBNET no-proxy-arp route-lookup

The console output is indicating that it doesn't like the first OBJ-ANYCONNECT-S(^)UBNET. I double checked and it is created and spelled correctly. It's like I am supplying an invalid parameter.

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Tue, 01 Jan 2019 09:40:17 GMT

please instead of pasting the command please type it in.

you make sure you have a correct object name this could be reason it not taking the command.

to check if you have the correct object name. run this command

show run object network in-line | i OBJ-ANYCONNECT-SUBNET

if still problem. share your anyconnect configuration.

Re: Allowing RDP over VPN through my firewall

RussellTarpleyTL — Thu, 03 Jan 2019 03:57:37 GMT

Still a problem.

Re: Allowing RDP over VPN through my firewall

RussellTarpleyTL — Wed, 02 Jan 2019 21:24:30 GMT

I tried manually entering the command and I continue to receive an error message. using the show command, OBJ-ANYCONNECT-SUBNET does exist. I've attached a redacted config for further review.

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Wed, 02 Jan 2019 22:16:39 GMT

thanks i have re-config them the configuration which are reverent to anyconnect. please test them.

ip local pool ACONNECT-POOL 10.10.10.1-10.10.10.254 mask 255.255.255.0

object network ANYCONNECT
subnet 10.10.10.0 255.255.255.0

nat (inside,outside) 1 source static any any destination static ANYCONNECT ANYCONNECT no-proxy-arp route-lookup

tunnel-group ANYCONNECT-PROFILE general-attributes
address-pool ACONNECT-POOL

Re: Allowing RDP over VPN through my firewall

RussellTarpleyTL — Wed, 02 Jan 2019 22:31:37 GMT

having trouble with the nat command still this time the console says invalid in n^o-proxy-arp. Any suggestions?

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Wed, 02 Jan 2019 22:37:05 GMT

what you see after this give a ?

nat (inside,outside) 1 source static any any destination static ANYCONNECT ANYCONNECT ?

Re: Allowing RDP over VPN through my firewall

RussellTarpleyTL — Wed, 02 Jan 2019 22:38:31 GMT

Unrecognized command.

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Wed, 02 Jan 2019 22:41:59 GMT

i just tested them on my box 5506-x version 9.8.

let me have one time more look at the config.

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Wed, 02 Jan 2019 22:45:10 GMT

can you please confirm you see these config in your box. the highlighted one

ip local pool ACONNECT-POOL 10.10.10.1-10.10.10.254 mask 255.255.255.0

object network ANYCONNECT
subnet 10.10.10.0 255.255.255.0

nat (inside,outside) 1 source static any any destination static ANYCONNECT ANYCONNECT no-proxy-arp route-lookup

tunnel-group ANYCONNECT-PROFILE general-attributes
address-pool ACONNECT-POOL

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Wed, 02 Jan 2019 22:53:43 GMT

can you put these command

no nat (inside,outside) 1 source static any any destination static ANYCONNECT ANYCONNECT no-proxy-arp route-lookup

nat (any,outside) 1 source static any any destination static ANYCONNECT ANYCONNECT no-proxy-arp route-lookup

Re: Allowing RDP over VPN through my firewall

RussellTarpleyTL — Wed, 02 Jan 2019 23:00:13 GMT

Latest config attached.

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Wed, 02 Jan 2019 23:07:04 GMT

Thank you

put this command please

nat (any,outside) 1 source static any any destination static ANYCONNECT ANYCONNECT no-proxy-arp route-lookup

Re: Allowing RDP over VPN through my firewall

Sheraz.Salim — Thu, 03 Jan 2019 23:50:04 GMT

did you try this command

nat (any,outside) 1 source static any any destination static ANYCONNECT ANYCONNECT no-proxy-arp route-lookup

Re: Allowing RDP over VPN through my firewall

RussellTarpleyTL — Fri, 04 Jan 2019 01:33:06 GMT

I reset to factory and reworked all my configuration and followed your steps. I was able to successfully rdp over vpn to machines on the inside. Thanks for your help! Your steps did the trick!

Re: Allowing RDP over VPN through my firewall

vsurresh — Sat, 05 Jan 2019 16:08:17 GMT

Could you please post your entire running-config? Please remove any sensitive information.

Thanks

Suresh