LSAgent updating via Cloud Relay, but not directly from LanSweeper server

[saml]

I've recently updated my Lan Sweeper server to 9.0.10.2 and I can see the Windows LSAgent versions updating via the cloud relay.

For the few machines that are local or using VPN the agent fails to get the update from the server, with the following in the local lsagentlog.txt:

2021-10-07 15:49:41,260 [7] INFO CreateReachableEndPoint for <removed_id>
2021-10-07 15:49:41,494 [7] DEBUG Creating InternalCommunicationSender to URL <removed_url>
2021-10-07 15:49:41,555 [7] DEBUG Asset is enabled.
2021-10-07 15:49:41,561 [7] DEBUG Retrieving configuration...
2021-10-07 15:49:41,644 [7] DEBUG Updating local config
2021-10-07 15:49:41,672 [7] DEBUG Checking version.
2021-10-07 15:49:41,680 [7] DEBUG No installer found.
2021-10-07 15:49:41,687 [7] DEBUG Update needed to version 8.4.100.149
2021-10-07 15:49:43,100 [7] ERROR System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
--- End of inner exception stack trace ---
at System.Net.ConnectStream.Read(Byte[] buffer, Int32 offset, Int32 size)
at Lansweeper.Echo.Client.SA213928. .()
at Lansweeper.Echo.Client.SA213928. .(Byte[] , Int32 , Int32 )
at Lansweeper.Echo.Client.SA.InternalCommunication.HttpMultipartParser.MultipartFormDataParser.(Dictionary`2 , Lansweeper.Echo.Client.SA213928.  )
at Lansweeper.Echo.Client.SA.InternalCommunication.HttpMultipartParser.MultipartFormDataParser.(Lansweeper.Echo.Client.SA213928.  )
at Lansweeper.Echo.Client.SA.InternalCommunication.HttpMultipartParser.MultipartFormDataParser.(Lansweeper.Echo.Client.SA213928.  )
at Lansweeper.Echo.Client.SA.InternalCommunication.HttpMultipartParser.MultipartFormDataParser..ctor(Stream stream, String boundary, Encoding encoding, Int32 binaryBufferSize)
at Lansweeper.Echo.Client.SA.InternalCommunication.PrivateComm.(String , RequestAction , Dictionary`2 , Dictionary`2 , CookieContainer )
2021-10-07 15:49:43,106 [7] DEBUG No installer found
2021-10-07 15:49:43,113 [7] DEBUG Waiting for schedule...
2021-10-07 15:49:43,120 [7] DEBUG Schedule triggered
2021-10-07 15:49:43,126 [7] DEBUG Starting scan
2021-10-07 15:49:43,134 [7] DEBUG Detected OS: Windows
2021-10-07 15:49:49,551 [7] DEBUG Scanning computer...
2021-10-07 15:49:58,455 [7] DEBUG Computerscan completed.
2021-10-07 15:49:58,462 [7] DEBUG Compressing scanfile.
2021-10-07 15:49:58,643 [7] DEBUG Scan has been sent.

I can't see anything in the local firewall log on the server to indicate it's blocking/dropping the connection.

Anyone else seen this scenario?

[vinothgovind]

If the existing asset goes to VPNless, does it get the cloud relay key from the on-prem server, update the existing asset, and start communicating with the Cloud once the machine is VPNLESS? 

[saml]

When we install the agent on each endpoint we provide it with the cloud relay key, so yes, when they are no longer on the same network as the server they communicate and update via the cloud, which is then picked up by the on-prem LanSweeper server.