Description

Anydesk application is not working when SSL proxy is applied on the respective security policy.

Symptoms

  • ANYDESK application stopped working after applying the SSL proxy policy on the security policy.
  • If the same policy is removed the application starts working.
  • Applying the URL pattern whitelist for UTM did not help.

Solution

There are 3 methods to bypass SSL proxy for Anydesk application.

1. Create a whitelist under the SSL proxy
  • For this whitelist, we would require all IPs and corresponding FQDN names in the Global address-book individually as the wildcard for FQDN is not supported in this hierarchy. This is a time consuming task and we might leave out the latest IPs.
set security address-book global address anydesk1 239.255.102.18/32
set security address-book global address anydesk2 dns-name boot.net.anydesk.com
set security address-book global address anydesk3 dns-name net.anydesk.com

2. Create a whitelist-url-categories
  • In this method, we will need to leverage the UTM custom-object URL pattern feature to add the FQDN wild card entires.
** This would mean that while applying SSL proxy the system will also ask us to apply UTM policy just because we are using whitelist-url-categories in SSL proxy.

set security utm custom-objects url-pattern anydesk value *.net.anydesk.com
set security utm custom-objects url-pattern anydesk value boot.net.anydesk.com
set security utm custom-objects url-pattern anydesk value *.anydesk.com
set security utm custom-objects url-pattern anydesk value boot-01.net.anydesk.com
set security utm custom-objects url-pattern anydesk value boot-02.net.anydesk.com
set security utm custom-objects url-pattern anydesk value relays.net.anydesk.com
set security utm custom-objects url-pattern anydesk value relay-ce59fdb0.net.anydesk.com
set security utm custom-objects url-pattern anydesk value relay-4eedeab0.net.anydesk.com
set security utm custom-objects url-pattern anydesk value relay-cde85b05.net.anydesk.com
set security utm custom-objects url-pattern anydesk value relay-c9b5be97.net.anydesk.com
set security utm custom-objects url-pattern anydesk value relay-5c3e138c.net.anydesk.com
set security utm custom-objects url-pattern anydesk value relay-ca111041.net.anydesk.com
set security utm custom-objects url-pattern anydesk value relay-a9fa3480.net.anydesk.com

** Create a category for these URL patterns
set security utm custom-objects custom-url-category ALLOWED-SITES value anydesk

** Apply that category in the whitelist-url-categories for our respective SSL proxy profile.
set services ssl proxy profile SECURITY-SSL-PROXY whitelist-url-categories ALLOWED-SITES

** Apply them to the security policy.
set security policies from-zone trust to-zone untrust policy INTERNET match source-address any
set security policies from-zone trust to-zone untrust policy INTERNET match destination-address any
set security policies from-zone trust to-zone untrust policy INTERNET match application any
set security policies from-zone trust to-zone untrust policy INTERNET then permit application-services ssl-proxy profile-name SECURITY-SSL-PROXY
set security policies from-zone trust to-zone untrust policy INTERNET then permit application-services utm-policy UTM-policy1

3. Create a new security policy on the top to allow TCP port 6568 and DNS applications. You may restrict the policy for specific sources and 

set applications application ANYDESK-PORTS protocol tcp
set applications application ANYDESK-PORTS destination-port 6568

set security policies from-zone trust to-zone untrust policy Anydesk-allow match source-address any
set security policies from-zone trust to-zone untrust policy Anydesk-allow match destination-address any
set security policies from-zone trust to-zone untrust policy Anydesk-allow match application ANYDESK-PORTS
set security policies from-zone trust to-zone untrust policy Anydesk-allow match application junos-dns-tcp
set security policies from-zone trust to-zone untrust policy Anydesk-allow match application junos-dns-udp
set security policies from-zone trust to-zone untrust policy Anydesk-allow then permit

Modification History

2024-05-16 : Article Created

Related Information