Configure custom RDP protocol for Cisco ASA 5510

[JDMils]

I'm configuring a Cisco ASA5510 to allow RDP into the private network, from the internet (port 3389) so that home users can use WinXP RDP to log into the Win2003 Terminal Server.

I don't think the ASA has a definition for RDP protocol so I wanted to make one. I want to create a protocol defined as port 3389, call it "RDP" and then configure a policy to allow incoming RDP traffic to the Terminal Server.

Can this be done in the Cisco ASDM software?

|
+-- Julian
|

 

[Supergrrover]

Just add a static for that port to your Term Serv. I don't think you can add a name for the port.

static (inside,outside) tcp [ExternalIP] 3389 [InternalIP] 3389 netmask [MASK]


Unless your server is locked down and users have pretty strong passwords, having the default port 3389 visible outside is tempting. I can't tell you how many of my firewalls get people trying to log in who don't belong (script kiddies mostly.) If you can use a non standard port for the external port. Just connect with IPORT to use a non-standard RDP port.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[JDMils]

Thanks Brent. Yeah, I have all my internal users VPN in first, the run Terminal Server using the internal IP of the TS server. But for the small number of suppliers we have who need TS access to our system, I had setup a RDP access policy for only their specific IPs. Thus, if you don't have a VPN connection and your IP is not that defined on the firewall, then there is NO TS access.

Wrt naming the RDP protocol, on my old DLINK DFL-1000 firewall, you could create custom names for protocols, networks, servers/workstations, etc. I find it amazing that the 5510 has this ability also, but lacks the facility to do it for protocols.

Note that I'm using the ASDM software (Java console running in a browser) not the Command Line Interface. Thanks

|
+-- Julian
|

 

[JDMils]

I think I found the answer....Service Groups. Edit a Security Policy and you will find a button called "Manage Service Groups". I defined a SG called "RDP" with port 3389 to 3389.

|
+-- Julian
|