I'm unable to use Remote desktop from internet to PC in Trust zone

[Hongson]

Hello all,

I wanna Remote desktop from my PC in home to PC in my company but not success

This is my connection diagram

I wanna remote to PC 10.126.123.132 (belong to VLAN 123, I use several VLANs in Core switch) but not success, NAT seems not to work, there's no traffic logs

This is my config..

Virtual router config.

Security rules

NAT rule

I can remote from internet to a server in DMZ zone successfully but L3_Trust zone, so I think because of using VLAN in core switch, it requires some other config.. Please help me 🙂

P/S: The public IP in the pictures is just an example IP 

[aleksandar.astardzhiev]

One more think - If you don't see logs for your attempts, please check if you have enabled log for default Intra and Inter zone security policy? If traffic doesn't match any explicit rule is probably being dropped by the default zone rules, and by default they are not logging.

another you can check is  run test security-policy-match <fill in the rest> under the CLI

[mgarg]

the reason there is no session on the firewall because i think it dropping the packet due to security rule . You can confirm this by creating a deny alll rule at the bottom and see if your traffic hits this rule.

The service object rdp that you have created, make sure you just put 3389 in destination port and leave the source port as blank and the protocol is tcp.

If this still does not work, open the rule to allow any service. For security just mention your public ip as source.

Check if you are still hitting the same rule or the default deny.

[Hongson]

Yes, I use a "Deny all" rule, I'm sure RDP service is correct with 3389 port 'cause I'm using it to remote to a server in DMZ zone. I create rule with permit access from my PC in internet to any zone and any address in internal network. But it's still not working and there's no any log except ping or telnet (but ping and telnet is not success and destination address is not NATed)

It seems hard to connect directly from internet to L3_trurst zone, so I'll use Globalprotect to setup VPN client to site.

[yihhow]

Hi,

I am having the same issue exaclty you facing now, All the while is working fine, The issue is onli happen i update the PA to 8.0.5, Are you using the same OS version.

Thanks

[Hongson]

I'm using 6.1.16, I think it's not relate to PAN-OS version

[yihhow]

Hmm..I still in the mide to troubleshoot on this issue, As this issue happen out of sudden,I try capture log from my Public IP, But packet is not reaching to FW

[Hongson]

Can you create a ticket support in customer support page? I tried but in step 3, there's no checkbox to select device

[yihhow]

Hi,

To open case with PAN Tac, I think you need to engage with your local ASC tReam assist you to create the support ticket.

Thanks

[BPry]

@Hongson,

Do you have an active support contract on your device? 

[c.huang]

Hi Hongson -- Think you're looking for a U turn NAT.  Since I don't know your network configuration. 

Please see this article: 

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-U-Turn-NAT/ta-p/61889

Or contact PAN-TAC.  Hope that works for you. 

[Hongson]

@BPryI got 1 year support contract

Thank you guys, I've setup Globalprotect to establish VPN to my PC in workplace, it's pretty cool 🙂

[yihhow · Accepted solution]

I just found out my root issue that cause my incoming nat is not working, The reason been block is due to my dos policy, After disable the dos policy, It was working fine

[Hongson]

Holy sh***!! Yes, you're right, I'm using Dos protection too and forgot about it :))

[yihhow]

Try to chnage the action on your dos policy from deny to protect

[Hongson]

Yes, you're right, I got this problem once time before, when setup remote from the internet to DMZ, I also fixed it by changed the Dos protection action from deny to protect. But after along time, I completly forgot about Dos protection