Teamviewer being blocked by ASA 5515

[jnicholson]

                   We are trying to get Teamviewer to work on our WAN, from the log traffic from the PC's to our Cisco IronPort Web Filter it looks like the ASA Firewall is blocking the traffic. We have opened everything we can open on our Cisco IronPort Web Filter and I have a Cisco TAC case open and they said it appears the ASA Firewall must be blocking the traffic.

Has anyone worked through this issue before?

[Julio Carvajal]

Hello Jason,

Hope you are doing fine,

We need way more information

Why do you think is the ASA

What are the logs you are seeing on the ASA

From wich interface to wich interface are you trying to connect

May we see the running config

[jnicholson]

Below is the Grep log of a computer at one of our remote sites that TeamViewer keeps trying to activate and failing. The Cisco TAC ticket I have open, they told me that the 502 is normally a firewall or IPS/IDS block. The behavior will show a TCP SYN request sent by the WSA but no SYN, ACK returned from the server.  Verify your firewall is not blocking the return traffic.

I have Access Rules in place on the ASA to allow inside to outside traffic to TeamViewer on port 5938 and there is 0 hits. TeamViewer support isn't of any help at all. I'm just curious what Firewall rule must I have in place in order for TeamViewer to function properly. What is SO ODD is that TeamViewer works fine in 3 of our Subnets and not in 10 of our Subnets. It's almost like a routing issue instead of a Firewall issue.

1366253032.267 229 172.23.20.100 TCP_MISS/502 39 CONNECT tunnel://178.255.153.10                                                                                        :443/ - DIRECT/178.255.153.10 - PASSTHRU_WEBCAT_7-Exempt_User_Agents-Exempt_User                                                                                        _Agents-NONE-NONE-NONE-DefaultGroup -

1366253032.561 233 172.23.20.100 TCP_MISS/502 39 CONNECT tunnel://178.255.153.10                                                                                        :443/ - DIRECT/178.255.153.10 - PASSTHRU_WEBCAT_7-Exempt_User_Agents-Exempt_User                                                                                        _Agents-NONE-NONE-NONE-DefaultGroup -

1366253032.267 229 172.23.20.100 TCP_MISS/502 39 CONNECT tunnel://178.255.153.10                                                                                        :443/ - DIRECT/178.255.153.10 - PASSTHRU_WEBCAT_7-Exempt_User_Agents-Exempt_User                                                                                        _Agents-NONE-NONE-NONE-DefaultGroup -

1366253032.561 233 172.23.20.100 TCP_MISS/502 39 CONNECT tunnel://178.255.153.10                                                                                        :443/ - DIRECT/178.255.153.10 - PASSTHRU_WEBCAT_7-Exempt_User_Agents-Exempt_User                                                                                        _Agents-NONE-NONE-NONE-DefaultGroup -

[Julio Carvajal]

Hello Jason,

Okay so do you see the traffic going to port 5938???

do the following

packet-tracer input inside tcp 192.168.12.10 ( Inside host IP) 1025 x.x.x.x ( team viewer server IP address ) 5938

Share the output

Regards