Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Replies 17 replies
  • Answers 1 answer
  • Subscribers 7 subscribers
  • Views 13132 views
  • Users 0 members are here
Options
Suggested

BUG - SSL/TLS Inspection Breaking ConnectWise/ScreenConnect

JTBrunnerACS

What feature is impacted?

ConnectWise/ScreenConnect remote admin sessions from behind Sophos XG firewall

What is the severity of the issue? (High, medium, low, minimal) 

HIGH

Summary of the issues:

When attempting to remote control a PC using the ScreenConnect service by ConnectWise (screenconnect.com) using a PC behind a Sophos XG firewall running SFOS v18 EAP2

the machine will fail to be able to negotiate a session with the remote PC via the ConnectWise Control client app. 

Observed behavior (What it did or didn’t do):

ConnectWise Control app would attempt to connect but retry repeatedly ending in failure.

Desired behavior (How is it expected to or should behave):

Should work as it did prior to v18 EAP2.

How do we reproduce it (Provide instructions to help us reproduce the behavior):

Obtain an account at screenconnect.com, add some PCs you wish to remote control, attempt to remote control from behind a Sophos XG, observe failure.

Other (Any other detail that we need to know about):

Turning SSL/TLS Inspection off temporarily will allow this to work 

Supporting logs, pcaps, etc.:

Will do some pcap for you but it won't be easy since you broke the pcap facility in EAP 2.

 

Here are some screen shots of Wireshark, PM with an e-mail address if you would like the actual pcap files... 

 

The problem lies in the response we get from ScreenConnect when SSL/TLS is enabled on the firewall. It appears that we lose 40 bytes somewhere in the translation...

 

This is interesting, I took a packet capture at the firewall to see what was going on between AWS and it...

Looks like the packets are being sent to the destination twice, once without NAT and once with?!?!?!?

Also interesting is the fact that the response from AWS isn't getting truncated here, only when it gets to the client behind the firewall.

 

 Note that the response packet at the firewall is still the proper size and contains all of the data...

Parents
  • 0

    It is entirely possible that the application ignores the OS' certificate store.   How do we reproduce this or get access to a system?   Can you get a sniff of the traffic with and without SSLx on the impacted client?

  • 0 in reply to Rob Andrews

    See updated post above...

    I also have .pcap files of working and non-working connections but I could find no way to attach them to this post.

  • 0 in reply to JTBrunnerACS

    Hi JTBrunner,

    Are you intending that HTTPS traffic is decrypted?  Based on "Turning SSL/TLS Inspection off temporarily will allow this to work" I assume you want it decrypted.

    Do you have the Certificate Authority installed onto the PC, in IE.  When you load https websites such as google is the certificate signed by the XG and the browser not giving any errors?

    Can you screenshot/describe the firewall rule that the traffic is flowing through?

    If you have web filtering enabled, does it behave the same in DPI mode and web proxy mode?  There is a checkbox in the firewall rule.  Please note that HTTPS decryption is controlled by TLS/SSL Inspection Rules when in DPI mode, and by the "Decrypt HTTPS" checkbox in the firewall rule for proxy mode.

    Can you go into the Policy Tester and fill in all the details that match the failed connection.  Screenshot/describe the results.

Reply
  • 0 in reply to JTBrunnerACS

    Hi JTBrunner,

    Are you intending that HTTPS traffic is decrypted?  Based on "Turning SSL/TLS Inspection off temporarily will allow this to work" I assume you want it decrypted.

    Do you have the Certificate Authority installed onto the PC, in IE.  When you load https websites such as google is the certificate signed by the XG and the browser not giving any errors?

    Can you screenshot/describe the firewall rule that the traffic is flowing through?

    If you have web filtering enabled, does it behave the same in DPI mode and web proxy mode?  There is a checkbox in the firewall rule.  Please note that HTTPS decryption is controlled by TLS/SSL Inspection Rules when in DPI mode, and by the "Decrypt HTTPS" checkbox in the firewall rule for proxy mode.

    Can you go into the Policy Tester and fill in all the details that match the failed connection.  Screenshot/describe the results.

Children
  • 0 in reply to Michael Dunn

    No, I don't want it decrypted, in fact I put exceptions in place to prevent that. The firewall is decrypting the traffic regardless of my intentions and messing things up in the process. I'm only able to make it work if I go into the advanced setting in the SSL/TLS settings and disable SSL/TLS Inspection. I created a special firewall rule just for screenconnect which has no scanning whatsoever so the firewall shouldn't be even attempting to decrypt the traffic. Why disabling SSL/TLS Inspection makes it work is truly a mystery although I suspect it has something to to with the fact that they use AWS.

Unfiltered HTML