PIX and Terminal Services or alternative

[gheatley]

Hi,

our need is this: To allow access to a TS server when requests for 3389 are sent to the outside of the PIX. To direct all other traffic (VPN/Email/FTP etc) to our existing authentication server.

I have updated the PIX software to allow port redirection and with the help of TAC came up with a solution they said should work, but didn't. It killed off inbound VPN connections and failed to forward the TS traffic to the server. Thus getting me nowhere.

Anyone have any ideas?

My alternative is to move the TS machine to a DMZ and create an ACL that specifies that only that machine (by IP) can have access inside the firewall to everything.

Is this possible?

PIX 515 running 6.1 software, connecting to NT and Win 2000 servers.

[thomas.chen]

Re-open your tac case and let them know their solution didn't work. You had to be at an escalation engineer to get as far as you did. You're probably very close if it's possible at all.