1

I have recently added a dell sonicwall TZ 215 wireless-N to my network and have found that I can no longer RDP onto any of my windows 2012 servers. If I run a cable directly from my router to my machine I can connect, but not via the sonicwall.

I have 12 servers to test this issue on and the behaviour is very consistent... all server 2008 machines work, all server 2012 do not.

Thanks in advance.

8
  • 1
    Can you scan the ports from outside? Is the port 3389 open? If you start wireshark on the server, are the packets to port 3389 coming to the server at all?
    – mulaz
    Apr 16 '14 at 11:50
  • yes the connection is "working": Once I click connect I get the username/password dialogue and then once I have been authenticated the screen opens to begin the RDP session, but it is black. It feels like the RDP authenticates over TCP and then the data is sent over UDP once authenticated.
    – Greg Hesom
    Apr 16 '14 at 13:38
  • @GregHesom, you need to prove this is a problem with the firewall before we can assist. Apr 16 '14 at 14:05
  • I'm with @Mulaz, put Wireshark on a server and monitor the traffic to see what is actually happening there as well as on your machine to see where packets are dropped. Also what version of SonicOS are you running on the TZ 215? Apr 16 '14 at 15:07
  • @MikePennington - this issue only exists when I connect via the firewall. If I bypass the firewall I can connect with no issue.
    – Greg Hesom
    Apr 16 '14 at 20:42
1

Just an idea: Is there some kind of protocol inspection for RDP enabled on the firewall?

If seen this with other vendors as well. Most (un)famous Cisco Pix and SMTP, but also CheckPoint with MS-SQL.


The exact changes Greg made were:

I have disabled the Local Appflow monitor. The setting can be found under Appflow > Flow Reporting > Settings Tab: I unchecked the following: Enable Real-Time Data Collection, Enable Aggregate AppFlow Report Data Collection, Enable AppFlow To Local Collector. I rebooted the firewall after these changes

4
  • Awesome. I've been fighting this issue for weeks. The appflow monitor was enabled. I disabled it and now I can connect. Thanks for the help.
    – Greg Hesom
    Apr 16 '14 at 21:07
  • Why does protocol inspection discriminate between win 2008 and win 2012 rdp? Apr 16 '14 at 21:36
  • Firewalls try to be smart. In this case the firewall knows how RDP should look like. At least for 2008. If i had to guess I'd say that there are some changes inside the protocol for 2012.
    – user2084
    Apr 17 '14 at 7:16
  • Based on the sparse evidence we have, it seems that something about the Appflow monitor configuration triggered RemoteFX for WAN in Windows 2012... RemoteFX for WAN uses UDP... Apr 17 '14 at 10:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.