ben604 Posted April 15, 2011 Posted April 15, 2011 Hello, just trying to set up remote access through RDWeb to a Session Host, but while it works fine internally, as soon as I try to connect from an external network, I get a "Remote Desktop can't find the computer "sessionhost.blah.local". This might mean that "sessionhost.blah.local" does not belong to the specified network. Verify the computer name and domain that you are trying to connect to." Do I need to set up a broker or gateway? Massively confused, as usual....
SYNACK Posted April 15, 2011 Posted April 15, 2011 It looks like your system is configured to point to an internal address rather than an external one. You need to setup RD gateway and an external subdomain remote.yourschool.school.uk or whatever, get an SSL certificate for that and allow port 443 through the firewall from the external IP that your subdomain points to in to the internal IP of your RD web site server. You should also setup an internal DNS record pointing remote.yourschool.school.uk to the internal IP of the RDweb server so that users inside are not bouncing out to the beb to access it. 1
ben604 Posted April 15, 2011 Author Posted April 15, 2011 It looks like your system is configured to point to an internal address rather than an external one. You need to setup RD gateway and an external subdomain remote.yourschool.school.uk or whatever, get an SSL certificate for that and allow port 443 through the firewall from the external IP that your subdomain points to in to the internal IP of your RD web site server. You should also setup an internal DNS record pointing remote.yourschool.school.uk to the internal IP of the RDweb server so that users inside are not bouncing out to the beb to access it. Thanks for that. We've got a remote subdomain set up which has an SSL cert attached, so the users get to the RDWeb page with no problems and authenticate too, it's at the point when they click on Remote Desktop that we get the error. I'll take a look at setting up an RD Gateway.
SYNACK Posted April 15, 2011 Posted April 15, 2011 As I remember it there is a setting in the remoteapp bit where you pick the SSL cert and site name that you use for the published packages. If you have it setup with the external SSL etc you should just be able to chanage the publishing cert and address to the external one which should point it the right way and hopefully sort it.
EduTech Posted April 15, 2011 Posted April 15, 2011 RDS can be a pain sometimes i have uninstalled it and installed it again and it just worked fine :/ can be very random! lol Have you specified which server it connect to or/ have you said any device on network... I can't remember where now.. (boots RDS box up) James.
ben604 Posted April 15, 2011 Author Posted April 15, 2011 RDS can be a pain sometimes i have uninstalled it and installed it again and it just worked fine :/ can be very random! lol Have you specified which server it connect to or/ have you said any device on network... I can't remember where now.. (boots RDS box up) James. It's pretty frustrating, to be honest! When I click on Remote Desktop (the icon, not the tab where you can enter a computer name) it has the session host server specified. It looks as if it can't resolve the DNS name to the server as it's not on the internal network. At a guess, I need to point the RD icon to the RDGateway which will resolve the DNS name of the session host...but it's working out where to put what names and redirects!
EduTech Posted April 15, 2011 Posted April 15, 2011 Is that the RD Icon on your RemoteWebApps..? on your internal DNS do you have an A Record setup for remote.domain.sch.uk pointing to the RDS Server? I generally use the External FQDN everywhere in the settings.. and have a Forward looking up zone for external domain and an A Record for 'remote' set to point to RDS Server.. Works fine for me, James.
ben604 Posted April 15, 2011 Author Posted April 15, 2011 Ok, sort of getting there...I'm no longer getting the "Remote Desktop can't find the computer "sessionhost.blah.local"...." error as it's pointing to the RDGateway server, however, I'm getting a "Your computer can't connect to the remote computer because the Remote Desktop Gateway server address is unreachable or incorrect. Type a valid RDG server address". Would that point to a certificate problem? I've created one for http://www.remote.prentonxxx.local and imported it into the client, but that hasn't fixed the problem..?
EduTech Posted April 15, 2011 Posted April 15, 2011 you should not to have "www" certificate should just be for remote.domain.lea.sch.uk and that should be imported into RDS and Digitally Signed Cert Parts also. If the certificate is done properly you should not have to import it to a client. James.
ben604 Posted April 15, 2011 Author Posted April 15, 2011 Hi James, thanks for your pointers here and there, I've got it working. It's a self signed jobbie to start with, just to prove the concept and it's working finally... Just for my sanity, what certificates do I need? One for the RDWeb access and one for the Session Host server?
Guest Guest Posted April 15, 2011 Posted April 15, 2011 Hi James, thanks for your pointers here and there, I've got it working. It's a self signed jobbie to start with, just to prove the concept and it's working finally... Just for my sanity, what certificates do I need? One for the RDWeb access and one for the Session Host server? You only need one for your gateway. The others can be self signed, the users will just get prompted to accept it. They will have internal hostnames which makes life difficult anyway x
SYNACK Posted April 15, 2011 Posted April 15, 2011 (edited) You should only need one, the remote.yourschool.school.uk one which is used for everything to do with it. You should have an internal DNS record for remote.yourschool.school.uk that points to the internal IP so that internally it resolves to that name and the cert works both inside and outside the network. In your onsite DNS, create a new Primary zone named mail.domain.org In this zone, create an A record with a blank name and the IP address that mail.domain.int uses. Once created, it will show as as having a name of (same as parent folder). That's it. Edited April 15, 2011 by SYNACK
ben604 Posted May 13, 2011 Author Posted May 13, 2011 Sorry to ressurect an old thread, but I had to take a bit of time off from this, so didn't manage to try out those certificate suggestions. Here's where I'm at... Staff will log into https://remote.schooldomain.co.uk/rdweb, currently I have a self created certificate securing that site. Staff then click on the Remote Desktop icon which redirects them to a server called session.schooldomain.local. Currently, when you click that icon, it displays a warning that the identity of the session host can't be verified, do you want to proceed anyway. It gives the certificate name as: session.schooldomain.local which isn't from a trusted authority. I've tried a redirection within DNS from remote.schooldomain.co.uk to the IP of the session host, but that had no effect, same thing happens... Am I being stupid?!
ben604 Posted May 13, 2011 Author Posted May 13, 2011 Do you have a RD Gateway setup? Yes, the RD Gateway role is on the RDWeb server, whether it's configured correctly is a different matter... The self signed certificate, remote.schooldomain.co.uk is installed on on the Gateway.
5tu Posted May 13, 2011 Posted May 13, 2011 In RemoteApp Manager, what are the RD Gateway Settings set to? In Remote Desktop Session Host Configuration, double-click the 'RDP-TCP' connection and on the general tab check what the security certificate is set to?
ben604 Posted May 13, 2011 Author Posted May 13, 2011 In RemoteApp Manager, what are the RD Gateway Settings set to? In Remote Desktop Session Host Configuration, double-click the 'RDP-TCP' connection and on the general tab check what the security certificate is set to? The Gateway is set to use the following settings: And the session host is set to the default cert:
5tu Posted May 13, 2011 Posted May 13, 2011 When using an Auto Generated cert for the session host, I think I'm correct in saying that the RD Gateway needs to trust the CA for that certificate. Does your RD Gateway have your root CA installed?
ben604 Posted May 13, 2011 Author Posted May 13, 2011 It doesn't no, we don't have any AD CA's installed actually.
ben604 Posted May 13, 2011 Author Posted May 13, 2011 I think this might be the problem: http://farm3.static.flickr.com/2270/5715825048_f8b1995f2c.jpg I try to assign a cert, there are none available. Do I need to install an Enterprise CA role to request a certificate for the Session server?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now