Cant connect till Connectwise Control Server port 8040

Just had this issue myself and here is what I had to do to resolve. I was messing around in the Web section under protect, particularly the General Settings tab, and had turned on Block unrecognized SSL protocols. Once I turned that option back off the ScreenConnect sessions were able to connect once again. Not sure why that caused the issue or if there is a place we can put exceptions to this rule. Oddly enough I do not have HTTPS scanning turned on in the firewall rule that governs access to the WAN yet the firewall is still blocking it for some reason.

Thanks, but EVERYTHING is turned off that possible can be turned off right now to testning. And still the same problem.

Thanks, but EVERYTHING is turned off that possible can be turned off right now to testning. And still the same problem.

Did you ever get a resolution to this? Since EAP 2 we are now experiencing the same issue you describe here.

So turning SSL/TLS inspection off did the trick for us, however, we are using ScreenConnect which is a hosted version of ConnectWise. Obviously we don't want to have SSL/TLS inspection turned off for the entire firewall, defeats the purpose really. This is most definitely a BUG and should be reported as such if it has not already. 

Hello JTBrunner,

Can you make an exception just for the IP targets/Ports of the ScreenConnect/ConnectWise services?

If turning off SSL/TLS inspection worked then placing a targeted exception should be fine.

I hope that Dev come back saying it is a bug, however it is more likely that the ScreenConnect system does not accept the Certificate from the XG so therefore terminates the connection. This happens with LogMeIn, Zoho Assist, Join.me, some elements of Zoom and Office 365 (needs at least 92 exceptions).

Emile

Just as the OP stated, I have created exceptions for screenconnect in all possible locations. Even went as far as to create a special firewall rule just for that application and turned off everything possible, the traffic should be passing without interference. I suspect it has something to do with AWS, my latest pcap indicates that traffic is returned from an amazonaws.com address and not screenconnect.com. I had created exceptions for AWS also but it did not help. Next I will add AWS to the special firewall rule and see if that works. It may be possible that this is the root of the problem with other sites as well.

Here is my URL Group containing all pertinent URLs and IP addresses...

And here is my SSL/TLS Inspection Rule (Exceptions by Website) where I added the URL group to the websites...

Even went as far as to create a new SSL/TLS Inspection Rule just for ScreenConnect...

Also created a Decryption Profile just for Screenconnect with absolutely nothing being decrypted or blocked (MAXIMUM COMPATIBILITY)...

Still no help, the only thing that "fixes" this is to turn off SSL/TLS Inspection...