Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Can RD Gateway allow SSL certs if the backend RDP computer has a different domain name?

Posted on 2013-01-25
4
Medium Priority
?
610 Views
Last Modified: 2013-02-07
Here is my issue. Our internal AD domain name is not the same as what we own in the outside world.

Lets say our internal AD is called internal.com and the one we own is called external.com

Naturally our internal computers are named desktop1.internal.com, desktop2.internal.com, etc.

our outside services are called webmail.external.com, client.external.com, etc.

for our outside services we just add the SSL to the IIS (or apache) site and we are good, even though internally it might be named e2k10.internal.com.

the problem i am coming across is this:
we've pointed login.external.com to an internal RDP server using port 3389 (NAT). when connecting to it via RDC program we get a cert error saying pretty much "you tried to get to login.external.com but the computer that responded was rdpserver1.internal.com. do you want to continue?"

we have to say yes and then we get access. We would like to secure this so that we dont get the error and use a valid SSL Cert and I'm not sure of the best way. I can't buy internal.com because someone else owns it in the outside world.

instead of making a direct connection to the internal RDP Server,  we were thinking of putting the RD Gateway on a DMZ and see if this would act as a passthrough. But I'm not sure if it will do what we need. We can't change our internal AD domain name and i cant buy the internal.com domain name.

I saw this:http://blogs.msdn.com/b/rds/archive/2009/07/31/rd-gateway-deployment-in-a-perimeter-network-firewall-rules.aspx but it looks like it needs a lot of servers and firewalls in the DMZ and im not sure if i want an AD DC in a DMZ.

Is it possible to put the RD Gateway on a DMZ (or NAT), when the user puts in login.external.com in the RDP program, it will hit the RD Gateway and then send it to an internal RDP server that doesnt have any type of SSL cert?
0
Comment
Question by:msidnam
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 51

Accepted Solution

by:
ahoffmann earned 1400 total points
ID: 38821746
your RD Gateway needs to be a proxy which terminates the external SSL connection and opens a new won to your internal AD
this means that you need a valid cert for external.com on your gateway
0
 
LVL 18

Expert Comment

by:Netflo
ID: 38833332
In answer to your question and supporting Ahoffmanns response.

Yes, you can create a RDG server and put it in your internal or DMZ zone. You would have a SSL cert for login.external.com linked to this server. The RDG would be aware of this certificate and along with respective RAP and CAP policies will allow login to internal assets. Only port 443 TCP needs to be opened up to this server.

If the server is in the DMZ, you need to open up 3389 to your internal network, along with respective ports for domain communication.

The target machines on the inside need to have RD enabled for users to logon. When users logon remotely to a 2008+ server, they will receive a certificate prompt as you don't have the option of buying the internal domain, however you can just tick the box 'don't remind me again' and connect as normal. If connecting to a 2003 box, just connect and no prompt.

Best of luck and get in touch if you have any further questions.
0
 
LVL 2

Author Comment

by:msidnam
ID: 38836944
The main problem we are trying to avoid is having them click the cert prompt. we also ntoiced even if we select dont prompt me again, it still does it.
0
 
LVL 18

Assisted Solution

by:Netflo
Netflo earned 600 total points
ID: 38837141
The don't prompt again should go away, assuming the following option is set on your RDC properties:

Right click RDC icon -> Advanced Tab -> Server Authentication: Connect and don't warn me.
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SSL stands for “Secure Sockets Layer” and an SSL certificate is a critical component to keeping your website safe, secured, and compliant. Any ecommerce website must have an SSL certificate to ensure the safe handling of sensitive information like…
Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question