Skip to main content
kulas
kulas
New Member
June 29, 2018
Question

AnyDesk SSL error when Deep Packet enabled

  • June 29, 2018
  • 3 replies
  • 99464 views

Hi Experts,

 

Please help me regarding this. I have applied deep packet inspection in the firewall policy but AnyDesk application shows SSL error. When I try to change the inspection mode to SSL Certificate, the AnyDesk shows no error. I also created custom deep packet inspection profile and add AnyDesk FQDN on the exemption list but no luck. I have to use deep packet inspection to block facebook comments, likes, and file uploads.

 

I am also searching regarding troubleshooting of deep packet inspection and I found this thread https://forum.fortinet.com/tm.aspx?m=148759

After running this command "diagnose ips debug enable ssl", the dubug output shows

[189/0]create_run_mode: SSL CA name: Fortinet_CA_SSL, untrust CA name: Fortinet_CA_Untrusted, VDOM: 0, enable: 1, mode: 2, verifyca: 1, invalid_cert_action: 2, untrust_ca_action: 4, whitelist: 0 [189/0]confirm_ssl: confirm SSL. [8076/0]create_run_mode: SSL CA name: Fortinet_CA_SSL, untrust CA name: Fortinet_CA_Untrusted, VDOM: 0, enable: 1, mode: 2, verifyca: 1, invalid_cert_action: 2, untrust_ca_action: 4, whitelist: 0 [8076/0]confirm_ssl: confirm SSL. [192/0]create_run_mode: SSL CA name: Fortinet_CA_SSL, untrust CA name: Fortinet_CA_Untrusted, VDOM: 0, enable: 1, mode: 2, verifyca: 1, invalid_cert_action: 2, untrust_ca_action: 4, whitelist: 0 [192/0]confirm_ssl: confirm SSL. [8076/0]create_run_mode: SSL CA name: Fortinet_CA_SSL, untrust CA name: Fortinet_CA_Untrusted, VDOM: 0, enable: 1, mode: 2, verifyca: 1, invalid_cert_action: 2, untrust_ca_action: 4, whitelist: 0

 

What does those output means? Thank you.

 

Regards,

Kulas

    3 replies

    jpcastilloux
    jpcastilloux
    New Member
    August 28, 2018

    I have exactly the same problem.

    I cant even create a Deep Inspection exception for *.anydesk.com

    The Internet service available in the list is only for the website

     

    If I remove the deep inspection on my computer, the software is working.

    But as soon that I enable it, I got a ssl_14090086 error in the bottom of the software.

     

    I think there is a problem with the deep inspection and the relay servers they are using. Might be a man in the middle detected in their platform so the TCP session is resetted. That would be logical with this kind of software where's  critical vulnerability as been detected.

     

    I've found a thread that is talking about a certificate that can be installed on the Fortigate to make it works but the user havent posted his solution ( thanks bruh !!! ). I tried to install the CA and Root-CA certificates of the *.anydesk.com certificate but it didnt worked at all, even if I can see the certificates in the trusted CA certificate white list for the Deep Inspection.

    https://community.spiceworks.com/topic/1263442-how-to-open-fortiguard-for-use-with-remote-control-app-anydesk-ssl-error

     

    So if anybody got an idea how to resolve this problem or how to create an exception for the anydesk relay servers, that would be nice

     

    Thanks in advance !

    soomelol
    soomelol
    New Member
    November 13, 2018

    I resolve this problem, FortiOS v5.6.3 build1547 (GA), i create a IPv4 Policity, Incoming Interface: lan, Outgoing Interface: sd-wan, source: lan, destination: "Anydesk-Web", Action ACCEPT, nat activated, in security profiles its desactivated Antivirus, Web Filter, DNS filter, Application Control and SSL Inspection.

     

     

     

     

    kostas22
    kostas22
    New Member
    February 13, 2019

    soomelol wrote:

    I resolve this problem, FortiOS v5.6.3 build1547 (GA), i create a IPv4 Policity, Incoming Interface: lan, Outgoing Interface: sd-wan, source: lan, destination: "Anydesk-Web", Action ACCEPT, nat activated, in security profiles its desactivated Antivirus, Web Filter, DNS filter, Application Control and SSL Inspection.

     

     

     

     

    It doesn't work for me! Fortigate 60E(Firmwarev6.0.4 build0231 (GA))

    james_hardin
    james_hardin
    New Member
    May 2, 2019

    How To Fix Anydesk Errors On Windows

    Hi, Some commonly thrown error or problems which a user may face includes:

     Anydesk not working  Anydesk audio not working  Anydesk mouse not working  Anydesk forbidden mouse cursor
    Anydesk audio not working problem is also very common among its users. Well, this is not an error if you have not provided the app permissions to access system audio. Means, to let the software audio function properly, you must need to assign its permissions to access audio settings of your device. To check if it’s configured properly, you should investigate audio settings of the software. For more information, you can visit https://www.techsmagic.com/how-to-fix-anydesk-errors-on-windows

    sw2090
    SuperUser
    sw2090
    SuperUser
    May 2, 2019

    I guess this is related to the way deep inspection works. This means the FortiGate has to decrypt your SSL and then after inspecting the data to recrypt it. It cannot use the original certificate for recryption because it din't have the private key to this (only the cert creator has this) (that is why using the AnyDesk Cert  + CA doesn't work). So the fortigate uses yet annother certificate to do this. By factory default (and that is what your log shows: Fortinet_CA_SSL) this is a self signed certificate from fortinet. Addidtionally in older Firmware versions this cert became even invalid due to validity time exceeded btw was revoked by Fortinet. In either case it is untrusted (even if not invallid and not revoked) because its self-signed. If you want Deep inspection to work without certificate errors you will have to replace the  fortinet factory certificate by a certifcate (of type Sub CA) from a trusted Certificate  Authority (CA) which you will have to purchase...

    Or do it they way we do here: have your own CA plus have your clients know and trust its CA Certificate and so trust also the certificates signed by it.

    Terms & ConditionsAccessibility statement