topic Re: Anydesk issue. in General Topics

Anydesk issue.

AzerbaijanSupermarkets — Mon, 05 Feb 2018 06:43:32 GMT

Hi everyone!
I have some issues with anydesk application. It has ssl issue because of decryption, I think.

I've added *.anydesk.com ind 'SSL decryption exclusion', but it didn't worked.

Maybe some of you have faced such kind of issue?

Thanks in advance!

Re: Anydesk issue.

Mick_Ball — Mon, 05 Feb 2018 07:06:15 GMT

Sorry never used it but your url *.anydesk.com will only cover www.anydesk.com or uk.anydesk.com.

try adding both...

*.anydesk.com and anydesk.com

Re: Anydesk issue.

AzerbaijanSupermarkets — Mon, 05 Feb 2018 07:39:32 GMT

Nope, it didn't help. Thank you.

Re: Anydesk issue.

Mick_Ball — Mon, 05 Feb 2018 08:07:52 GMT

Ok so turn off decrypt for your ip address and check the urls its using. It may be also .en.com or any other url that you are not aware of.

See if it recocnised as an app.

Re: Anydesk issue.

AzerbaijanSupermarkets — Tue, 06 Feb 2018 05:56:55 GMT

Hi!
I made as you adviced, but this didn't work also.

Re: Anydesk issue.

Pollux — Mon, 19 Nov 2018 18:24:21 GMT

Hi all

I'm having the same issue. Did anyone resolve it?

To get it to work i have to stop decryption for everyting.

Re: Anydesk issue.

BPry — Mon, 19 Nov 2018 18:33:50 GMT

@Pollux,

Build out a 'No-Decrypt' decryption policy with a custom URL. In that custom URL category include the Anydesk URLs as you're seeing in the logs. The traffic would then not be decrypted by the firewall and everything should function correctly.

Re: Anydesk issue.

Pollux — Mon, 19 Nov 2018 18:39:49 GMT

Thanks. Tried that with no result.

*.anydesk.com/*

*.net.anydesk.com/

and any possible compination.

Re: Anydesk issue.

BPry — Mon, 19 Nov 2018 18:41:52 GMT

@Pollux,

Is that the URL that the firewall is actually recording though. Don't trust what you're seeing in your browser, look at what the firewall is recording in the URL Filtering logs with a test policy where all the categories are set to 'alert'.

Re: Anydesk issue.

AzerbaijanSupermarkets — Tue, 20 Nov 2018 05:54:38 GMT

I tried may combinations, which were logged in URL filtering, but nothing worked.

So I just added private-ip-address to no-decrypt policy.

Re: Anydesk issue.

Pollux — Tue, 20 Nov 2018 06:42:58 GMT

You mean insdide ip address? but how did you manage to avoid decryption for olny anydesk sides?

Re: Anydesk issue.

AzerbaijanSupermarkets — Tue, 20 Nov 2018 07:37:53 GMT

Hi,

I avoid decryption for whole <private-ip-addr> category, as I could't make it only for anydesk. As I said earlier I tried many combinations.

Re: Anydesk issue.

UNAPEC — Tue, 10 Sep 2019 13:52:21 GMT

Any update??? still not working for me.

Paloalto has predefined "SSL Descryption Exclusion" for "AnyNet Relay" and "AnyDesk Client" and I manually add "AnyNet Root CA" "*.net.anydesk.com" "net.anydesk.com".

Also try with Custom URL List...

Re: Anydesk issue.

SOCBME — Thu, 13 Feb 2020 12:25:04 GMT

Hello,

Any update? Anydesk not working for me neither.

Regards,

Re: Anydesk issue.

Nehmaan — Wed, 26 Feb 2020 10:03:39 GMT

Having the same issue. Pain in the ass!

Re: Anydesk issue.

Nehmaan — Wed, 26 Feb 2020 10:44:07 GMT

OK got this working for now but not exactly the way I want.

1) Tag

2) Address Group

3) SSL Decryption Policy

4) Log Forwarding

5) Built-in Actions

6) Security Rule

Re: Anydesk issue.

Ilya_Kuranov — Wed, 26 Feb 2020 11:00:01 GMT

Hello, guys!

I met this issue and found out the root cause. Many of you know that desktop applications often check certificate. Anydesk does it. So we need to exclude it from SSL decryption, but here is the trick: *.anydesk.com works only for Anydesk website (NGFW detects web-browsing application, see that URL match *.anydesk and exclude the session from decryption), but it doesn't work for the desktop application and here is why:

I made a little investigation and found out that the application makes DNS query for random URL, generated upon installation. (Guess it called DGA, but correct me if I wrong)

Here is an example:

Then it establishes TCP session to IP, that was previously taken from DNS Query and that's all:

So our exclusion rules will not work for IP.

Solution:

1. Go to Monitor>Traffic and filter logs by application "Anydesk".

2. Export logs to CSV and open it in Excel

3. Find Destination IP column, select all items and delete duplicates

4. Copy this list to *.txt file and create EDL.

5. Use this EDL in No-Decrypt policy

6. PROFIT!

You also can go further. According to WHOIS service - backend IP addresses are located in different DCs all over the world. You can take IPs you found in logs and find the whole IP ranges in WHOIS info and use these ranges in EDL. But it doesn't seem safe to me, because many of those IPs in IP range can be used by other applications, not Anydesk, so this is a potential risk.

Re: Anydesk issue.

Ilya_Kuranov — Wed, 26 Feb 2020 11:13:00 GMT

Looks cool!

But I think 6 should be after 3. Because you use the security rule name in the filter in Log Forwarding settings

Re: Anydesk issue.

Nehmaan — Wed, 26 Feb 2020 11:17:58 GMT

Yes, On the assumption that the security rules doesn't exist. It does in my case.

Re: Anydesk issue.

tienngo — Sun, 10 May 2020 08:54:18 GMT

Hi @Ilya_Kuranov

Could you please show me how to create a custom EDL IPv4 with Minemeld. Currently I have created and using Office365 IPv4 list but I don't know how to create a custome EDL IPv4 list with a text file as you mentioned.