Branch office with about 30 users all connecting via RDP to 3 terminal servers. A few times per day all users are disconnected for a brief period of time (10 seconds) and then reconnected. It affects all users, although some are connected via site-site vpn and some are going over the public internet (yes, we have port 3389 open on the remote TS, not my choice). The network looks like this - internet access is 10Mb, Fortigate 110C firewall, and Cisco 4500 series flat switch.

Thus far I haven't been able to find any event that is common to these instances except for the disconnected RDP sessions. There is some other traffic over the VPN such as print jobs, some SMB/CIFS traffic, etc. but most users are in remote desktop all the time.

Any thoughts or suggestions are appreciated!

  • Are the users disconnected simultaneously? When that happens, can you ping your router? Can you ping the next hop? What kind of firewall do you have, and can you monitor sessions on it? – Matt Simmons Jan 25 '10 at 15:25
  • Yes, users are disconnected simultaneously. Internet access is metro ethernet - ISP provides Hatteras Networks HN400-CP. Firewall is Fortinet Fortigate 110C and is connected directly to HN400-CP. I don't think I can monitor sessions on the FW & it points to a gateway controlled by the ISP. Next time I see or hear of RDP drops I will see if I can ping that IP. – Rob Jan 25 '10 at 15:51

I think your next step should be to isolate the problem. It could be the network or Windows, so right now I think the question is about troubleshooting technique. I would start with running a constant ping to the machines you are RDPing to to see if there is packet loss. Then troubleshoot "up" or "down" from there.

If there is packet loss, go "down" and start looking for the network problem. You could also be running a couple of pings at the same time -- one to the servers, one to the router at the same time etc. So this way if it is a network problem, you might be able to see which hop it is at. Also, you didn't mention if both the public and VPN users are in the same location, if they are not, than the network problem would probably not be at the user end.

If the ping is fine and there is no packet loss when they get disconnected, than I would start looking at the server itself. You could also check the event logs while the ping is going as well to be proactive about the problem.

  • I'm running the constant ping right now. There are 3 terminal servers and it affects users similarly across all 3. Also, this problem does not affect other users who telecommute from other locations (4-5 people). So, that doesn't necessarily rule out a server-side problem, but it seems to point to a network issue IMO. – Rob Jan 25 '10 at 16:04
  • Kyle is correct, although I think you've already isolated the problem to your network connection. If the TS servers have other users connected from different locations that are not timed out, then it's not the servers at fault. Site-site VPN is completely different than a regular TCP or UDP connection, so that does not serve to exhonerate your firewall/switch. I'm not familiar with Fortinett, but I would check your documentation for some default timeout values that would be incompatible with long-running TCP connections, especially if you're running PAT. – Greeblesnort Jan 26 '10 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.