07-27-2023 07:58 AM - edited 07-28-2023 12:19 PM
Hey folks,
I am wondering if anyone has run into AnyDesk dropping connection over a Firepower Remote Access VPN connection. It appears to happen randomly. The users are connecting with the Cisco AnyConnect client with split tunneling enabled (I know--Bad idea but its an operational commitment). I had them disable Allow direct connections on the client and host per AnyDesk's directions. Any suggestions on how to nail down what may be the root cause would be great.
I am in the process of capturing packets on the interface to see if there is anything there. I also have the end user capturing the trace logs from the application and will have those soon.
----
So it is not as random as we thought. The sessions are ending closing every 60 minutes. I have changed the re-key timers & Sessions timers with no change to the problem. The AnyDesk log just shows that the connection timed out with no other error messages.
We are running a licensed version so of AnyDesk so it should not close the session after 60 minutes.
07-29-2023 08:57 PM
Hello Keiber,
Have you tried looking into Analysis > Unified Events and Edit Search to check if you see anything for the interesting source & destination IPs?
08-01-2023 10:16 AM
I have but i am unable to find any reason for the disconnect.
08-01-2023 10:20 AM
I did some additional testing and it is just not isolated to the VPN connection. When AnyDesk goes through the FW it disconnects at 60 minutes either on the VPN or from zone to zone. I put a temp router in place and tested the AnyDesk connection from another subnet & within the same subnet. The session did not disconnect at all. So am wondering if their is a timer that I am missing on the FTD that is set to 60 minutes. I have an open case with AnyDesk and if I get anything from them i will follow up.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide