How to change RDP's default port

[xiaguoxian]

As you know, the RDP's default port is 3389,  but someone always try to connect via this default port, this result the domain 

accounts are locked frequently. so I would like to chang its default port,such as 33089, then others don't know the port,

so they can't use this port to try remote desktop access, the question is How I config in Palo Alto to achieve this target?

My device is PA-500.

thanks in advance

[reaper]

you can accomplish this by creating a NAT policy to do port translation

[xiaguoxian]

Thank you for your reply, but could you tell me the entire process?  what is the service 7777 in your screenshot?

[reaper]

in my example port 7777 is the 'original' destination port

so what this rule does is from my trust network 192.168.0.0/24 to my dms 10.0.0.0/24

the firewall takes the role of host 192.168.0.5

anyone in the trust network connecting to 192.168.0.5 from trust, on port 7777 will be translated to dmz server 10.0.0.5 on port 3389

i can create a security policy that blocks direct connections to 3389 and only allows 7777

[xiaguoxian]

Ok ,my question is where I can create the "original' destination port 7777"? Thanks

[xiaguoxian]

could you kindly show me the service 7777's screenshot?

[reaper]

sure! you can create service objects in 'Objects > Services'

Here's an article that might be useful: Getting Started: Network Address Translation (NAT)

[Mark_Silva]

You can also try to change the default port of the RDP via the registry on the server itself. 😉

[xiaguoxian]

Hi,

I have tried to change the default port number 3389 to 33089 in the server in registry. and I can use remote desktop to 

connect to this server by 192.168.0.5:33089 in my LAN, but I can't connect to this server's external IP address  in the internet,

I mean I can't connect to 218.104.xxx.xxx:33089 in the internet,  then could you tell me how should I config in the  PALO ALTO?

Thanks in advance.

[BPry]

@xiaguoxian,

That would depend on how your NAT and security policies are setup. Is your NAT statement an any-any bi-directional policy or do you have NAT policies specific to service? You're security policy will also need to have ms-rdp allowed on the service port that you've specified, or create a custom app-id based off of the ms-rdp signature but with the service being the 33089. 

[xiaguoxian]

Hi,

I have created a app-id based on ms-rdp, could you have a look at the screenshot and tell me is it right?

[reaper · Accepted solution]

you won't need the custom application as your connection is normal RDP and APP-ID will identify it as that application, even if it is not running on the default port

you will need to make sure your security policy allows the connection

[xiaguoxian]

Hi,

According to your suggestion, my situation now is :

1. the server's RDP port is default port 3389

2. I create a new service on Palo Alto named  KJC-RDP,please see pic1

3.In the security policy,I create a policy,please see pic 2

4.In the NAT policy, Icreate a policy,please see pic 3

Is it correct? anything else should I do?

[xiaguoxian]

Hi,

With the help of two experts, I've solved this problem. Thank you so much.