We have a fairly basic ACL and NAT rule allowing RDP inbound and NAT'd to a LAN IP (all IPs replaced with IP)
object network STATIC-PAT-RDP
host IP
access-list outside_access_in extended permit object TerminalServices any object IP log debugging
access-list OUTSIDE-IN remark Allow RDP
access-list OUTSIDE-IN extended permit tcp any object STATIC-PAT-RDP eq 3389
object network STATIC-PAT-RDP
nat (inside,outside) static interface service tcp 3389 3389
access-group OUTSIDE-IN in interface outside
However, the connection is being dropped when it hits the WAN Interface:
7 May 05 2015 11:37:56 IP 4335 IP 3389 TCP request discarded from IP to outside:IP
I've personally never seen this before - the device is listening on 3389 via a netstat -ano and I can RDP internally.