Unable to boot clients using DHCP and RDP V2.2 with Windows 2003 firewall

[David Beary]

I'm hoping there is a simple workaround for this problem...

The issue is that we have installed RDP V2.2 on a new ProLiant DL380 G4 server running Windows 2003 with SP1. When an RDP client tries to boot and looks for a DHCP server it can't retrieve an IP address because it goes via the PXE server (ie. the RDP server) which has the standard Windows 2003 SP1 firewall turned on.

We thought it may have been a DHCP problem and it took quite a while to troubleshoot. We eventually discovered that the Windows 2003 SP1 firewall on the RDP server was causing the clients (ProLiant Blades) not to boot.

We have proved the point by disabling the Windows 2003 SP1 firewall and all the Blades are able to boot fine and retrieve an IP address automatically from the DHCP server.

The issue is that the customer's security policy states that the Windows firewall must be truned on at all times, thus we need to know a workaround by enabling certain ports at the Windows firewall. For RDP to work properly there must be specific ports we need to allow access in the Windows firewall.

Has anybody else seen this issue? If so, what workaround should be put in place to reconfigure the Windows firewall thus allowing the RDP clients to boot? Is this documented somewhere?

Cheers,

David

[Gopi Sekar]

Hai,

I believe following are the ports to be opened on the firewall in the deployment server.

TCP/402 -> Listens for client connections
UDP/402 -> Listens for server discovery packets
TCP/405 -> Listens for file transfer requests
UDP/67 -> PXE Server when the Use DHCP option is set to true
UDP/4011 -> PXE Server
UDP/1759 -> PXEmtftp when Multicasting is enabled
UDP/69 -> tftp

Firewall should also allow incoming NETBIOS requests, which will be used by target servers for file transfer. I believe it is port tcp/udp 137 to 139

If DHCP Server runs on the Deployment Server itself, then the firewall should allow incoming DHCP requests. I believe it is tcp/udp port 67


I would suggest to try enabling them one after the other with various combinations to know the working combination with full security as desired by the customer.

Hope this helps,
Gopi

[Ken Henault]

See attached

[David Beary]

Ken / Gopi,

Thanks you very much for your replies. This is exactly what I'm looking for. This is sure to solve our problem.

Cheers,

David