topic Re: Block the remote desktop acces with Palo Alto Network in General Topics

Block the remote desktop acces with Palo Alto Network

RCHAIBI — Fri, 27 Nov 2015 10:35:34 GMT

Hello,

In or company i need to block the remote desktp access of a specific address to the critical server like database server.

I add a security rule in the PA-500 by block (ms-rdp and t.120) applictions to a specific address by without any result.

How could i blck the remote access ?

Please i need you help

Re: Block the remote desktop acces with Palo Alto Network

iweltag — Fri, 27 Nov 2015 10:48:54 GMT

hm..maybe another rule above allows the connection. You can check this in your traffic log which rule is triggered. can you post your rule?

Re: Block the remote desktop acces with Palo Alto Network

RCHAIBI — Fri, 27 Nov 2015 11:28:45 GMT

Hello,

You find in the attachment a screnshoot of the recurity rules in the PAN

Thank you

Re: Block the remote desktop acces with Palo Alto Network

iweltag — Fri, 27 Nov 2015 12:36:39 GMT

you want to block same zome traffic? so if your client and server are on the same subnet the traffic will not forward to your palo alto (which is the default gw from your clients i think).

Re: Block the remote desktop acces with Palo Alto Network

RCHAIBI — Fri, 27 Nov 2015 13:06:38 GMT

Yes the servers and the clients desktop are in th same subnet , the same security zone . So , I can't block the traffic in this case with the PAN?

Re: Block the remote desktop acces with Palo Alto Network

Raido_Rattameister — Fri, 27 Nov 2015 13:44:33 GMT

If you can't put server to seperate subnet then you could do it with virtual wire or layer 2 setup.

Keep in mind that traffic has to pass the firewall.

If client and server are both connected to switch then they talk directly and traffic does not pass firewall and you can't block this traffic.

Re: Block the remote desktop acces with Palo Alto Network

RCHAIBI — Fri, 27 Nov 2015 15:04:56 GMT

ok thank you, so i can this by configuring a virtual wire in the firewall , i connect the servers directly to the firewall or by usig another switch . It it in the zoe named "serverzone". Then, i add a security rules from "internal" rules to the "serverzone" by restrict the ms-rdp.

Re: Block the remote desktop acces with Palo Alto Network

Raido_Rattameister — Fri, 27 Nov 2015 15:57:55 GMT

It is best practise to have users and servers in diferent zones.

What you could do at the moment is to add another layer 3 interface to same zone you have already (inside) and attach server directly to it.

Multiple interfaces can be in same zone.

But in this case your traffic from inside zone to inside zone passes firewall and you can control this traffic.

Re: Block the remote desktop acces with Palo Alto Network

reaper — Mon, 30 Nov 2015 11:11:33 GMT

you could split up the user and server space by putting them in different VLANs and then using the firewall as bridge, that way you should be able to keep your subnet configuration

please take a look at this guide: Getting Started: Layer 2 Interfaces