topic PaloAlto FW RDP Across multiple AD domains in General Topics

PaloAlto FW RDP Across multiple AD domains

PhlackJack — Fri, 22 Jan 2021 05:19:56 GMT

I'm part of a cloud team that does not manage the FW but am not getting clear answers from them.

My operations counterparts have the following issue:

Support person logs into IP address x.x.x.x into production domain. As part of their function, they must RDP into servers on prod/dev/pat/sit domains. Each domain with a separate ID once the rdp client hits the end point.

After some time passes, RDP stops working to a particular domain or set of domains.

To resolve this at times, the network team has restarted some agent.

They can't explain why it happens. It's become a huge nuisance.

Thoughts?

Re: PaloAlto FW RDP Across multiple AD domains

Mick_Ball — Fri, 22 Jan 2021 12:23:11 GMT

quick question,,,

does the rdp sessions to that domain get disconnected whilst in use or are new connections not allowed through?

it may be that there is not enough domain activity for the user agent to be updated. if so then it may be worth trying to increase the user timeout from default 45 mins to 8 hours or so...

Re: PaloAlto FW RDP Across multiple AD domains

BPry — Mon, 25 Jan 2021 04:36:49 GMT

@PhlackJack,

So the thing with RDP is that, depending on the configuration, the endpoint that you are using authenticates the request and user-id on the firewall can switch to the authenticated RD user instead. Depending on the firewalls configuration, this may make it so that the endpoint is identified with a user that doesn't actually have the proper permission on the firewall to work properly. So what the admin is likely doing is simply clearing the user-id entry associated with the endpoint.

It could also easily be that the user-id information is aging out like @Mick_Ball mentioned. Again, this would mean that if user-id is being leveraged in the rulebase they would no longer be able to do certain actions.

Regardless of the issue, it sounds like you're running into a user-id issue. Your network team should be able to address this relatively easily through various methods.