How to change RDP's default port

[xiaguoxian]

As you know, the RDP's default port is 3389,  but someone always try to connect via this default port, this result the domain 

accounts are locked frequently. so I would like to chang its default port,such as 33089, then others don't know the port,

so they can't use this port to try remote desktop access, the question is How I config in Palo Alto to achieve this target?

My device is PA-500.

thanks in advance

[reaper]

you can accomplish this by creating a NAT policy to do port translation

[xiaguoxian]

Thank you for your reply, but could you tell me the entire process?  what is the service 7777 in your screenshot?

[reaper]

in my example port 7777 is the 'original' destination port

so what this rule does is from my trust network 192.168.0.0/24 to my dms 10.0.0.0/24

the firewall takes the role of host 192.168.0.5

anyone in the trust network connecting to 192.168.0.5 from trust, on port 7777 will be translated to dmz server 10.0.0.5 on port 3389

i can create a security policy that blocks direct connections to 3389 and only allows 7777

[xiaguoxian]

Ok ,my question is where I can create the "original' destination port 7777"? Thanks