Solved

Sophos UTM9 and Remotedesktop-Gateway

Posted on 2013-01-23
2
3,314 Views
Last Modified: 2016-02-25
Hello Experts,

I use a privat Sophos UTM 9 / Hardware  / Software Firewall (Astaro).

For testing purpose furthermore I want to access a Remote Desktop Gatewayserver (Windows 2008 R2) via https-RDP (3389 over 443) respectively via Sessionbroker Remotedesktop hosts over Sophos firewall.

I "googled" many Examples treats about Port forwarding Webserver, Fileserver ect. over Sophos Firewall but none about Remotedesktopgateway.

I don't know if my strategy is correct:
---------------------------------------------------
First I need to reserve Port 443 which is Part of VPN Client, Userportal, https to my "Remotedesktopgateway-Service"
Second I must define a host (Remotedesktopgateway), a network (my internal Windows Domain Network which covers my RD, Sessionbrocker ect.), a service (3389 over 443).
Than I'll produce a NAT Rule (DNAT?)  and a Firewall Rule to bypass Fireway for that purpose.

Has anyone realized this szenario with Sophos and 've some hint for me?

Thanks a lot.

reredok
0
Comment
Question by:reredok
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 37

Assisted Solution

by:ArneLovius
ArneLovius earned 200 total points
ID: 38812676
if you are using RD Gateway, it is just HTTPS traffic on port 443 that is being forwarded over the UTM box, the RDP traffic is tunneled over the HTTPS traffic.

However please see this
0
 
LVL 64

Accepted Solution

by:
btan earned 300 total points
ID: 38813117
As ArneLovius shared, I also see that in order to have Remote Desktop exposed over port 443, you have a two options that I can think of:

1) Use firewall or NAT to expose port 3389 (or event to extend on your target PC) as port 443 to external (Internet) clients - most relatively modern cable/DSL routers have this capability. For RDS,  it definitely need to use RDS gateway as you also stated. On the FW setting for such deployment from MS, pls see (4) of this link @ http://blogs.msdn.com/b/rds/archive/2009/07/31/rd-gateway-deployment-in-a-perimeter-network-firewall-rules.aspx

2) Change the port Remote Desktop listens on to port 443 - probably requires a change in the Registry (old - http://support.microsoft.com/kb/304304). But not something you will want to touch on client machine

Further add that user has issue using it as well for the RPC over HTTP/S, may want to confirm on FW aspects with principle
http://www.astaro.org/gateway-products/network-protection-firewall-nat-qos-ips/34685-unable-pass-rpc-over-https-trafic-through-web-application-security.html
0

Featured Post

Is your NGFW recommended by NSS Labs?

Ours is! NSS Labs Next Generation Firewall Test gives the WatchGuard Firebox M4600 a "Recommended" rating! Curious where your NGFW landed on the  Security Value Map? See the map and download the full report today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question