We'd love to hear about it! Click here to go to the product suggestion community
We recently started having a strange VPN connection issue. Our users can successfully connect to the VPN (we use the Sophos client and an XG Firewall) with no issues. Once connected they can ping their desktop computer, but as soon as you try to connect a RDP session, the pings drop and the RDP link fails. After about 30 seconds or so, RDP pops up the failed to connect message and the pings resume.
I tried this on a known good computer that was working with VPN and RDP just a few days ago and encountered the same thing. There have been no recent changes to the firewall or computers (other than things like definition updates). RDP works internally and when I connect the VPN I can access other resources (AD, file shares, etc).
I checked the firewall and IPS logs, but nothing stands out. Any thoughts on where to begin?
Hi,
Please share TCPDUMP for RDP session.
In reply to Deepak Verma:
You can perform this dump with following Post:
https://community.sophos.com/products/community-chat/f/knowledge-base-article-suggestions/105811/how-to-tcpdump-on-xg
In reply to LuCar Toni:
Thanks, but we found the 'solution' (workaround?). It required a registry key addition:
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client\Create a dword and assign a value of 1 to:fClientDisableUDP
Not sure if this one is a MS or Sophos issue since it only happens with RDP over the VPN, but it is working and we have too many projects to take a deep dive.
I am not sure why are you going to force TCP on RDP protocol? As per my understanding, this is a workaround on;y this is not a root cause.
You could try to check, if there is an issue with the UDP Timeout on your XG. https://community.sophos.com/kb/en-us/127785
Try to rise the UDP Timeout and try again.
I called support and they were pretty confident that the issue was not with the XG. That said, I tried adjusting the UDP timeout, but without that registry key I still am unable to connect a RDP session over the VPN. It might be worth noting that when I do not have the registry key and try to RDP, I am also unable to ping any devices on the network for about 30 seconds. It almost seems like a false positive on a threat detection (IPS?), but there don't appear to be any logs.
In reply to K M:
It would appear this issue is more widespread than Sophos would want us to think:
https://community.sophos.com/products/xg-firewall/f/intrusion-prevention/109828/xg-firewall---windows-remote-desktop-freezing/395767#395767
Thank you for the info. This proves it is a UDP issue within the XG firewall as TCP RDP connections are not affected. By forcing RDP to use TCP you lose the advantages of UDP. RDP uses both UDP (Primary) and TCP to transmit data up to 8 time faster then TCP alone. I guess if the users have fast Internet connections and they don't notice a difference in speed that is good workaround but Sophos needs to look at this issue and fix it. We should not have to downgrade our PCs to get it to work with their firewall.
Deepak Verma LuCar Toni
Was this ever resolved? I was reviewing our GPOs and found we still have the workaround of forcing TCP in place.
I am not sure if Sophos fixed this or not but I never made the change to registry that was listed in this thread and my users are connected fine now. I would test it with one PC and see if it is working properly before changing the GPO. Also make sure the PC and the Sophos firewall are fully patched before testing.
In reply to Jae Lupo:
Might be this?
https://serverfault.com/questions/945591/rdp-over-udp-failing-on-windows-10-1809-with-reduced-mtu-links
See KB127785.
This command works for me: set vpn conn-remove-tunnel-up disable
In reply to MarkusWelten:
Sorry, but where did you run this command at? I am having the same issue after moving over to Sophos XG for our vpn connections. It is being reported that RDP will be fine then just freeze up. I don't really want to force RDP over TCP, unless I have to.
Regards and Thanks,
Scott McHenry
In reply to Network Inter-State:
Sorry. I had to RTFM or at least the KB article. I know it dealt with VOIP instead of RDP, but giving it a shot. I will advise if the users report all is better now.
Best Regards,Scott M.
I had the issues every 2-3 minutes. After I used the command "set vpn conn-remove-tunnel-up disable", the issues are immediately gone.
Another way is to create policy rule that deny all RDP UDP service for instance for VPN to LAN.