This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG Firewall - Windows Remote Desktop freezing

Hi,

We have just started using XG (upgraded from UTM 9) and we are having difficulty with Windows Remote Desktop going through the XG Firewall via an IPsec VPN connection. The Remote Desktop connections temporarily disconnect or pause dozens of times a day. Sometimes they connect back up, sometimes they drop. I have added a DoS Bypass rule for the subnet and the RDP server on the other side. It helped a lot but it is still continuing. Does anyone know why XG would consider RDP connections as a DoS attack and how to fix this? This issue is happening in 2 different offices in two different countries (so I know it is not the Internet connection, modem or router). If I put our old UTM 9 firewall back in the issue goes away. Any help would be appreciated. Thanks.

Jae

Running the latest firmware SFOS 17.1.4 MR-4 on all sites.

This thread was automatically locked due to age.

0 LuCar Toni over 5 years ago

Most of the time, Port 3389 (RDP) issues are caused by the Endpoint / protocol.

https://www.speedguide.net/port.php?port=3389

But you can perform a Drop packet capture on CLI and look out for the reason, every time, the RDP Session drops.

https://community.sophos.com/kb/en-us/115863

drppkt | grep -i 'Port 3389'

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Jae over 5 years ago in reply to LuCar Toni

Thank you for the reply. I will give this a try and report back.

Jae
Cancel
Vote Up 0 Vote Down

Cancel
0 Jae over 5 years ago in reply to LuCar Toni

When I try to SSH into the box using Putty I get an error that says, "Software caused the connection to abort". I have SSH turned on for the LAN side in the firewall. Any ideas? Thanks.

Jae
Cancel
Vote Up 0 Vote Down

Cancel
0 ADH over 5 years ago

Watch the IPS/IDS logs for a signature for an RDP exploit. I have had similar things happen with RDP and had to allow a bypass for this signature ID. The disconnects/hangs stopped.
Cancel
Vote Up 0 Vote Down

Cancel
+1 Jae over 5 years ago in reply to ADH

It turns out the issue was DoS blocking RDP traffic through the VPN. I had to add a DoS Bypass Rules for the RDP server (Internal IP) and the destination subnet for both TCP and UDP for port 3389. I am surprised that the firewall was this strict on VPN traffic for a common protocol but I guess everything is considered a threat unless you tell it that it is not. I hope this helps anyone that has a similar issue. Thank you everyone for the help.
Cancel
Vote Up 0 Vote Down

Cancel
0 RickardNordahl over 5 years ago in reply to Jae

Hello Jae and thank you for your finding.

We have been having the same issues for a long time and your solution worked for us as well. I think Sophos Really should look in to this and until they have a solution, write a KB with your findings.

Best Regards

Rickard Nordahl
Cancel
Vote Up 0 Vote Down

Cancel
0 ADH over 5 years ago in reply to RickardNordahl

Unfortunately with IDS they always say "sometimes false positives happen. Please open a case. I have the same problem with kaspersky security center being blocked pulling updates, citing an IIS vulnerability. It has caught me 2 times in about 3 months.
Cancel
Vote Up 0 Vote Down

Cancel
0 waghelak over 5 years ago in reply to Jae

same issue here, thought it was far end internet.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jae over 5 years ago in reply to waghelak

It took forever to figure this out. I thought it was the other side as well until I installed another firewall in another location and had the same issue. We had UTM 9 firewalls forever and never had this issue. Did the DoS exception fix it???
Cancel
Vote Up 0 Vote Down

Cancel
0 Jae over 5 years ago in reply to RickardNordahl

Good to hear!!! Yes, Sophos needs to fix this ASAP!!
Cancel
Vote Up 0 Vote Down

Cancel