Firepower Remote Access and AnyDesk resets

[keibler]

Hey folks,

  I am wondering if anyone has run into AnyDesk dropping connection over a  Firepower Remote Access VPN connection.  It appears to happen randomly.  The users are connecting with the Cisco AnyConnect client with split tunneling enabled (I know--Bad idea but its an operational commitment).  I had them disable Allow direct connections on the client and host per AnyDesk's directions.   Any suggestions on how to nail down what may be the root cause would be great. 

I am in the process of capturing packets on the interface to see if there is anything there.  I also have the end user capturing the trace logs from the application and will have those soon.

----

So it is not as random as we thought.  The sessions are ending closing every 60 minutes.  I have changed the re-key timers & Sessions timers with no change to the problem.  The AnyDesk log just shows that the connection timed out with no other error messages.  

We are running a licensed version so of AnyDesk so it should not close the session after 60 minutes.  

[rhingel]

Hello Keiber,

Have you tried looking into Analysis > Unified Events and Edit Search to check if you see anything for the interesting source & destination IPs?

[keibler]

I have but i am unable to find any reason for the disconnect. 

[keibler]

I did some additional testing and it is just not isolated to the VPN connection.  When AnyDesk goes through the FW it disconnects at 60 minutes either on the VPN or from zone to zone.  I put a temp router in place and tested the AnyDesk connection from another subnet & within the same subnet.  The session did not disconnect at all.  So am wondering if their is a timer that I am missing on the FTD that is set to 60 minutes.  I have an open case with AnyDesk and if I get anything from them i will follow up.