changed IP and name of terminal server, now no one can access it!

I'm doing a restructure of our internal network and I changed the static IP of our terminal server (which is not on a domain) to near the end of the range rather than the middle.
I also changed the name of it from "new-tserver" (because it is far from new now) to "rdp-server".
I've done a number of restarts, but no one can access it (using the normal RDC in windows) from OUTSIDE our office.  We can access it internally by typing in 192.168.1.253, but if someone is outside the office, they'd normally type our DSL's external IP.... this isn't working now.
LVL 8
Reece DoddsAsked:
Who is Participating?
 
yo_beeConnect With a Mentor Director of Information TechnologyCommented:
Have you read this kb article ?
http://kb.juniper.net/InfoCenter/index?page=content&id=KB6659&cat=NS_5XP&actp=LIST

Looks like you need to remove the policy first then you can modify or delete the MIP.
0
 
archmukCommented:
I understand that if someone has to access this server from outside the office, he has to come through firewall (or gateway security as implemented). Since you have changed both IP & name, you need to make the rules accordingly at the firewall for access from outside, only then the DSL / router / firewall can redirect the request to the terminal server at the nw IP.
Regards
Archmuk
0
 
Reece DoddsAuthor Commented:
i did that.
We have a Juniper NetScreen-25 firewall and the RDP (TCP 3389) service was already there.
The policy was already there too, all I did was change the destination address.

I don't know what is going on...
0
Managing Security Policy in a Changing Environment

The enterprise network environment is evolving rapidly as companies extend their physical data centers to embrace cloud computing and software-defined networking. This new reality means that the challenge of managing the security policy is much more dynamic and complex.

 
yo_beeDirector of Information TechnologyCommented:
What are you using as a dest address (ip or name)?
0
 
Reece DoddsAuthor Commented:
i've tried the new IP and the private IP range (192.168.1.0/24) and the option "ANY"

is there something on the terminal server that needs to be modified?
(but don't forget we can access it with RDC using the local IP)
0
 
archmukConnect With a Mentor Commented:
Have you  NATed the internal IP also ? can u check the firewall log to see what is blocking the request?
 
0
 
Reece DoddsAuthor Commented:
i've NATed it now, and turned on logging...
I had someone outside our office try again and they can't connect.
The log shows:

2011-09-29 16:19:54      
DESTINATION= 165.228.xxx.yyy:3389      
SOURCE= 165.228.xxx.yyy:3482      
TRANSLATED DESTINATION= 192.168.1.204:3389         
SERVICE= TCP PORT 3389      
DURATION= 21 sec.      
BYTES SENT= 132      
BYTES RECEIVED= 0

The translated destination it shows is the old local IP.  The new one is .253
0
 
Reece DoddsAuthor Commented:
i think i found where the problem is...
in the firewall, under interfaces, I can see the "ethernet3" interface, which connects to the DSL modem.
It's public IP is assigned by the ISP, which I can't change, but if I look at the MIP page (there is Basic, MIP, DIP, VIP, Track IP and Track IP Options), I can see a MIP existing that has our public IP as the Mapped IP and the terminal server's old private IP as the Host IP.    It says that it's "In Use".
There is no option to delete or edit this, but I can create a new one.
If I do this and set it up the way I think it should go, then click OK, I get an error that says "One IP in range [165.228.xxx.yyy-165.228.xxx.yyy] is in use!! Mip: can't be added"
0
 
archmukCommented:
Is the server mapped IP the same as the DSL modem public IP provided by the ISP?
I can suggest a work around, as you have not changed the subnet, why do you not configure an additional IP which is the old IP on the server network adapter in use? (through advanced tab in the TCP/IP properties)
0
 
yo_beeDirector of Information TechnologyCommented:
Can you reboot the router?
0
 
Reece DoddsAuthor Commented:
ok, the issue is definately in the juniper firewall.
i changed the IP back to 192.168.1.204 and rebooted and external staff can access it fine.

I really do want to move this server to an end-range IP, so I somehow need to change/delete this MIP in the firewall.
Any ideas how I can do this?
0
 
Reece DoddsAuthor Commented:
@archmuk:  yes, the mapped IP is the same as the public IP the DSL modem gets given by the ISP...
0
 
yo_beeDirector of Information TechnologyCommented:
Did you try rebooting router?
0
 
Reece DoddsAuthor Commented:
yes, I have rebooted the Juniper firewall and the d-link DSL modem... twice.
Once with the RDP server's IP set as 1.204 and once with it set as 1.253

I can see how to create a MIP, but how do I delete or modify an existing one?  I assume it has something to do with it being "in use", but how can I even change that status?
0
 
Reece DoddsAuthor Commented:
looking at the logs helped me find that it was being forwarded via a MIP not using NAT.
0
 
Reece DoddsAuthor Commented:
thanks guys
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.