PaloAlto FW RDP Across multiple AD domains
cancel
Showing results for 
Search instead for 
Did you mean: 

PaloAlto FW RDP Across multiple AD domains

L0 Member

I'm part of a cloud team that does not manage the FW but am not getting clear answers from them.

My operations counterparts have the following issue:

 

Support person logs into IP address x.x.x.x into production domain. As part of their function, they must RDP into servers on prod/dev/pat/sit domains. Each domain with a separate ID once the rdp client hits the end point.

 

After some time passes, RDP stops working to a particular domain or set of domains.

 

To resolve this at times, the network team has restarted some agent.

 

They can't explain why it happens. It's become a huge nuisance.

 

Thoughts?

2 REPLIES 2

L7 Applicator

quick question,,,

 

does the rdp sessions to that domain get disconnected whilst in use or are new connections not allowed through?

 

it may be that there is not enough domain activity for the user agent to be updated. if so then it may be worth trying to increase the user timeout from default 45 mins to 8 hours or so...

Cyber Elite
Cyber Elite

@PhlackJack,

So the thing with RDP is that, depending on the configuration, the endpoint that you are using authenticates the request and user-id on the firewall can switch to the authenticated RD user instead. Depending on the firewalls configuration, this may make it so that the endpoint is identified with a user that doesn't actually have the proper permission on the firewall to work properly. So what the admin is likely doing is simply clearing the user-id entry associated with the endpoint. 

It could also easily be that the user-id information is aging out like @MickBall mentioned. Again, this would mean that if user-id is being leveraged in the rulebase they would no longer be able to do certain actions.

 

Regardless of the issue, it sounds like you're running into a user-id issue. Your network team should be able to address this relatively easily through various methods. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!