RDS Proxy targets

Remote Desktop and VNC servers published by the RDS Proxy, NLA mode and connection test.

Targets are the servers users reach through the gateway.
Open RDS Proxy » Policies » Targets.

Targets tab

Read the targets tab

Tiles: configured targets per protocol, enabled targets, open sessions, and targets reachable through at least one active policy.
A target that no active policy covers cannot be reached by anyone.
Status: the gateway tests each target the way a session would reach it, after the page is displayed.
The lightning button runs the test again.
See Read the status column below.
Target & description: the alias, the protocol and, for RDP, the NLA mode.
Host / IP: the address the gateway connects to.
Target account: the account used on the server, and whether its password is stored.
Policies: the policies that give access to this target.

Read the status column

The test follows the real path of a session.
It changes with the protocol of the target and with the route of its active policies.
It only opens a connection.
It never signs in and changes nothing.

Status column of the targets

Web targets routed by a PAC file, direct targets, a tunnel agent offline and a target that does not answer.

Target	Test	Status shown
RDP, VNC or SSH target	TCP connection of 2 seconds to the address, or to the host name, and the port.	Reachable with the connection time (TCP connect), or Unreachable.
RDP or VNC target behind a tunnel agent	State of the agent on the tunnel receiver. The target is never tested directly, since the bastion cannot reach it.	Tunnel agent <name> connected, or offline. Also offline when the tunnel receiver does not run.
Web target, policy without proxy	TCP connection to the host and the port of the application address.	Reachable or Unreachable.
Web target, policy with an upstream proxy	Through the proxy, with its account. HTTPS: `CONNECT host:port`. HTTP: a `HEAD` request in absolute form, like a session. 6 seconds. A proxy that resolves the target for the first time has time to answer.	Reachable via proxy <name>, or Unreachable via proxy with the reason: proxy unreachable, proxy authentication failed, proxy refused the destination, proxy disabled. Below it, Latency gives the time of the request through the proxy.
Web target, policy with a PAC file	The PAC file is evaluated on the application address. Its answers are tried in order, like a session: `DIRECT`, or a declared and enabled proxy.	Reachable through the PAC file, followed by direct, proxy <name> or direct, PAC failure fallback. Or Unreachable through the PAC file with the reason. Below it, Latency gives the time of the PAC evaluation and of the request.
Disabled target, or Active Directory group	No test.	Disabled, or Active Directory group.

When several active policies give a web target an upstream proxy or a PAC file, each of them is tested, three of each at most.
The first one that works is shown.
Otherwise the first failure is shown.

The test of a web target starts from the network of the bastion.
It does not enter the network namespace of the policy.
A target reachable only from that namespace can show Unreachable while the sessions work.

See PAC files for web targets and Network confinement and upstream proxies.

REST API: GET /rdpproxy/targets/{id}/reachability returns mode (direct, proxy, pac, tunnel, ad_group, disabled), ok, latency_ms, detail, via and address.
It is a read-only call.

Create a target

New target

Field	Meaning
Alias	The name users see in the list of servers. It does not need to be the real host name.
Description	A description shown in the list of servers.
Protocol	RDP, VNC, SSH or Web application. Web targets are described in Create a web target. SSH targets are described in Create an SSH target and its policy.
Hostname	The real host name of the server. It only needs to resolve on the appliance.
Address	Optional IP address. When set, the gateway connects to this address.
Remote port	The port of the RDP or VNC service on the server (3389 for RDP).
Username / Password	The account used to open the session on the server, for example `user@domain`. Users never see it.
Network Level Authentication	How the gateway authenticates to the server (RDP only), see below.

Network Level Authentication (NLA) mode

Mode	When to use it
NLA with NTLM (default)	Works with any Windows server, including one addressed by its IP address.
Kerberos, then NTLM	Tries Kerberos first and falls back to NTLM when no ticket can be obtained.
Kerberos only	Requires the server's DNS name and a domain controller the appliance can reach.
No NLA (TLS only)	Only for old servers that do not support NLA.

If users get an NLA error, see NLA authentication failed.

Publish an Active Directory group of computers

Click Active Directory group to publish every computer of an AD group as a target.
Users then connect with their own Active Directory credentials.
See Use Active Directory with your RDS Proxy.