I am looking for a method to force identify users coming in over the internet trying to connect to an internal resource using MS-RDP.
I originally thought I could use Captive Portal for this but CP documentation indicates its only works with HTTP & HTTPS....obviously this makes sense because without an http interpreter, how else could an app that is not designed to talk to http recognize the HTTP/HTTPS Captive Port web-form or redirect.
Is it possible to force a type of user authentication for users coming from Untrust Internet (any IP) to Trust internal (specific IP). Or what other method could I use or investigate?
Use of User-ID based rules from Untrust (Internet) to Trust (internal) is discouraged.
As User-ID creates a mapping of the IP address to a single user, the multiple NAT scenarios that can come into play here can give you unintended results.
If we both happened to be at the same coffee shop and NAT'd to the same IP address, if you were the first to access the corporate resource and challenged by captive portal, I and all of the others in the coffee shop would inherit your access rights.
You might consider deploying a GlobalProtect gateway, and then using your App-ID/User-ID based rules to permit access for the appropriate users to the systems via RDP.
as @asilliker already mentions, I'd deploy GlobalProtect from a best practices perspective
it will allow you to identify your users more easily and apply security policy based on their identity, plus will add a layer of security (ipsec/ssl) to prevent snooping or MitM attacks when your users are making rdp connections from any random uncontrolled location to your infrastructure
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!