topic Re: Cant deny users from using remote desktop on non standard tcp port in General Topics

Cant deny users from using remote desktop on non standard tcp port

MarioMarquez — Wed, 02 Jan 2019 16:10:40 GMT

I am trying test app id & put a rule in (all the way on top) denying my work station from accessing RDP on machines in other zones. I have successfully blocked users from accessing RDP on standard port 3389 but can still access RDP on a machine that listens for RDP on a non standard port (tcp 51000). I did not specify the non standard port in the security policy like I did port 3389 but I did use app ID in the rule for "ms-rdp" and "t.120" and expected the app ID feature to catch the connection and deny it. What am I missing & why wont the PA deny the RDP connection using app ID on the non standard tcp port?

Re: Cant deny users from using remote desktop on non standard tcp port

Mick_Ball — Wed, 02 Jan 2019 16:33:53 GMT

your rule is set explicitly for port 3389. it doesn't matter what you have in any other of the boxes as it has to match 3389.

can you monitor the allowed traffic on port 51000, is it recognised as ms-rdp.

if not then you will have to rethink your policy but as it stands it can be either ms-rdp or t.120 but must be 3389 to be denied.

Re: Cant deny users from using remote desktop on non standard tcp port

Raido_Rattameister — Wed, 02 Jan 2019 22:50:43 GMT

You have to change Service field to "Any" to block ms-rdp on any port.