Forum Discussion

Allwyn_Mascaren's avatar
Allwyn_Mascaren
Icon for Cirrus rankCirrus
Oct 09, 2017

Server RST SSL connection from LTM but works without LTM for the same Cipher

HI,

 

So the client hello from the LTM contains the cipher 0X009d and the client hello from ltm also contains the same cipher but the server at 10.223.42.112 RSTs it.

 

While when the user directly accesses the server without the ltm in between the same server accepts the cipher 0x009d.

 

Any ideas on why this happens, or any other reasons for the ssl handshake to fail?

 

Thanks.

 

 

 

BIG-IP
LTM
security

2 Replies

Sort By
  • amintej's avatar
    amintej
    Icon for Cirrus rankCirrus
    Oct 09, 2017

    Hello,

     

    Did you compare the protocols in the Client Hello not only ciphers ? It seems TLS 1.2 is not being used in the failed Client Hello.

     

  • amintej's avatar
    amintej
    Icon for Cirrus rankCirrus
    Oct 10, 2017

    Hello, you can try also the next command,because maybe the server requires SNI. Servername option will set the header TLS-Server Name Indication, please replace domain.tld for the common name configured in the server certificate, and check this headers in the pcap capture when the client iniated the connection and when the LTM iniated:

     openssl s_client -connect domain.tld:443 -servername domain.tld