Solved

terminal server RDP session through site-to-site VPN

Posted on 2014-01-29
5
937 Views
Last Modified: 2014-05-10
Well, here I am with another stumbling block.

Desired Outline:

RDP terminal server session ---> Cisco ASA 5505 ---> Colo ASA 5510 ---> switch ---> TS



Our branch office has a MPLS T1 as their primary and the Site-to-site VPN is their backup. I was all TS rdp session to go through the VPN, and everything else to use the T1.

I assume I can do this via policy based routing or a general ip route.

Test:
I configured a ip route <server IP> <ASA inside interface>

Branch office ASA ACL:
access-list outside-in extended permit any interface outside eq 3389

Colo ASA ACL:
access-list outside-in extended permit any interface outside eq 3389


Other configs:
I create a rdp-mss class-map

and I tried "crypto ipsec df-bit clear"

I can ping the Terminal server, but, it will not initiate a RDP session.

I also performed a telnet <server IP> 3389, but, the connection failed.


Thank you again ahead of time. I'll paste my configs later.
0
Comment
Question by:RenoGryphon
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 7

Expert Comment

by:Ned Ramsay
ID: 39819790
1) confirm with traceroute that the packets are going on the desired path, not going over the MPLS.
2) try pinging/traceroute from the terminal server back to HQ (did you setup a static route on the terminal servers end to route back via the VPN?)

If 1 and 2 work then the problem is likely the server.

Check the TS for OS based static routes (ive seen this happen so many times).
Ensure the terminal server has the VPN network in its allowed list for RDP and the firewall is disabled (may not see it as a trusted connection).
0
 
LVL 28

Expert Comment

by:asavener
ID: 39838913
I don't think you need the firewall rules; the traffic should be coming in over the VPN, which will bypass firewall rules.

Can you run "show crypto ipsec sa" on both ASAs?

Then try the RDP session.

Then "show crypto ipsec sa" again on both ASAs.

We're looking for the encaps/decaps counters to increase symmetrically on both ASAs.


I suspect what is happening is that you've got an asymmetric route.  Pings will work because they're stateless; RDP fails because the ASA doesn't see a successful 3-way handshake.


Example:  

SYN:  ServerA->MPLSRouterA->ASA-A->VPN->ASA-B->ServerB

SYN-ACK: ServerB->MPLSRouterB->MPLS->MPLSRouterA->ServerA

ACK: ServerA->MPLSRouterA->ASA-A (Blocked!  The ASA never saw the SYN-ACK from ServerB, so it doesn't think it's a valid connection.)


You will have to add a route on the RDP server to route all traffic to SiteA through the VPN.

If this test works, then you can configure policy-based routing so that only RDP traffic is sent over the VPN.

The more complexity you add, though, the more difficult it will be to support the solution.
0
 

Author Comment

by:RenoGryphon
ID: 39855071
Thank you both for your help!! ASAvener, I don't know why I didn't consider this reason for ICMP working and not TCP.
I'll make sure to do what you instructed on each ASA and then post the results.

After this I can then start working on the rest.
0
 

Accepted Solution

by:
RenoGryphon earned 0 total points
ID: 40024580
Very sorry for the long wait we have been able to resolve this issue.
Thank again everyone for the help!!
0
 

Author Closing Comment

by:RenoGryphon
ID: 40055625
We were able to provide a different solution :)
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question