topic Allowing RDP traffic in Network Security

Allowing RDP traffic

kcgpassport — Mon, 11 Mar 2019 13:30:03 GMT

I am using a Cisco PIX 515e with three interfaces outside, inside, DMZ. I am providing VPN access via the pix the issue I am having is when I connect to my network via VPN I cannot RDP to servers in my DMZ. I can RDP to servers on my internal network.

When I connect to the VPN I get an IP address of 192.168.10.x, My inside IP addresses are 192.168.1.x my DMZ addresses are 192.168.5.x.

I created an ACL to allow traffic over port 3389 (RDP) from 192.168.10.0 to 192.168.5.13 (server in my dmz) the acl looks like:

access-list vpn_access_dmz permit tcp host 192.168.10.0 host 192.168.5.13 eq 3389

The issue is I am not sure which interface this access list should be applied to (inside, outside, dmz?) Does anyone have an idea or can give me some pointers?

Thanks for any help!

Bill

Re: Allowing RDP traffic

acomiskey — Tue, 12 Aug 2008 16:01:07 GMT

Don't worry about that access list, you shouldn't need it.

You most likely need to add nat exemption for the dmz hosts.

access-list DMZ_nat0_outbound extended permit ip 192.168.5.0 255.255.255.0 192.168.10.0 255.255.255.0

nat (DMZ) 0 access-list DMZ_nat0_outbound

Re: Allowing RDP traffic

kcgpassport — Tue, 12 Aug 2008 16:48:57 GMT

Thanks for the help, in your access-list command what is the 'extended' command for?

Re: Allowing RDP traffic

ray_stone — Tue, 12 Aug 2008 16:50:48 GMT

it is used for (Outbond) connection.

Re: Allowing RDP traffic

acomiskey — Tue, 12 Aug 2008 17:00:09 GMT

Sorry, I had ASA on the brain, you don't need "extended".

access-list DMZ_nat0_outbound permit ip 192.168.5.0 255.255.255.0 192.168.10.0 255.255.255.0

nat (DMZ) 0 access-list DMZ_nat0_outbound