Forum Discussion

pspecht_152507's avatar
pspecht_152507
Icon for Nimbostratus rankNimbostratus
Nov 19, 2014

Cant use windows remote assistance to VPN clients

While testing several of my remote sales employees with the F5 Edge client we found that after they connect, our helpdesk team cannot use remote assistance, remote control, or RDP to the remote sales...
BIG-IP Access Policy Manager (APM)
microsoft
security
ssl vpn
brad_11480's avatar
brad_11480
Icon for Nimbostratus rankNimbostratus

Is it any different if you split tunnel or not? At one point I could route back if all traffic was in the tunnel but did not when split.. but then I got that to work too..

 

Things that seemed to have solved it: 1. No SNAT - Source Address Translation set to None on virtual server. 2. Preserve Source Port Strict set to ALL on the network stttings of the access profile (advanced). 2. Network must route the VPN pool subnet traffic back to the F5.

 

At one time I had also put the VPN pool subnet in the tunnel address space, but then I found it wasn't needed. It is probably implied.

 

I also found clients weren't resolving DNS. Well the DNS servers were internal IP's so those IP's also have to be in the split tunnel IP list in order for the queries to be routed through the VPN. Alternative would be to have the VPN use an external/public DNS/NS.

 

We are also using DTLS and it works well-- this is a VoIP application.

 

Think that was all, but it was a struggle to get it going.

 

Mark_129802's avatar
Mark_129802
Icon for Nimbostratus rankNimbostratus
Jun 08, 2015
I'm just doing Full Tunnel: 1. No SNAT - Check set to none on the Virtual Server and Snat Pool none on NA Network Settings 2. Perserve Source Port Strict - Check enabled in NA Network Settings 3. Return Route - Check, route is in place pointing to the Inside vIP of the BIG-IP 3 I suspect is fine as I can initiate connections from Edge Client NA to the servers and receive traffic back. I just can initiate connections from the Network Side. If I point my return route anywhere else (vIP of Virtual Server) Both ways break. So I think the route is okay. I did a tcpdump in the tunnel and I can't even sing icmp requests when intiated from the Network Side, Client side I see the request and reply just fine. I'll have to open a case I suppose.