Forum Discussion

MadMick's avatar
MadMick
Icon for Nimbostratus rankNimbostratus
Apr 26, 2022

Proxy Handhsake failure

Hi all,
sorry, I'm not an expert using F5 but I got a question for you.

I'm using an iRule Proxy configured on a BIG-IP 13.1.1.

Suddenly...and I don't know why, this proxy is still working but an antivirus agent provided me an error about handshake activation.

"2022-04-26 14:11:28.000000 [+0100]: [Error/1] | SSL_connect:failed in SSLv3 read server hello A | http\SSLContext.cpp:266:DsaCore::CSSLContext::SSLContextInfoCallback | 17F4:1B94:ActivateThread
2022-04-26 14:11:28.000000 [+0100]: [Error/1] | CHTTPServer::HandshakeSSL(192.168.201.37:8081) - BIO_do_handshake() failed - peer closed connection. | http\HTTPServer.cpp:272:DsaCore::CHTTPServer::HandshakeSSL | 17F4:1B94:ActivateThread"

Have you got any experience on a similar issue?

What could I check?

Thanks,

TM.

event
security
  • PSFletchTheTek's avatar
    PSFletchTheTek
    Icon for MVP rankMVP
    Apr 26, 2022

    it looks like its a failure in the handshake. SSLv3 is quite old this wouldn't be the web server or client using this has been updated to not use SSL but upto TLS1.2 or TLS1.3??

    Other than that, i'm stuck to!

    • MadMick's avatar
      MadMick
      Icon for Nimbostratus rankNimbostratus
      Apr 26, 2022

      Thank you mate.

      Yes, it is possible but...I cannot reconfigure my antivirus agent.
      The only solution for me is let to disable SSL inspection or https decryption or allow the agent to use SSLv3.

      Do you know how to do it?

      • PSFletchTheTek's avatar
        PSFletchTheTek
        Icon for MVP rankMVP
        Apr 26, 2022

        It's not McAfee is it??? I recongise the Port number! (but others may use it as well - just a guess!)
        So where is this flow error coming from? AV to Virtual server? Or f5 to pool member?
        Where is 192.168.201.37:8081?? I'm guessing this is a f5 to pool member flow?

        So to remove the encryption you just need to remove the client and server SSL profiles from the virtual server.
        But there must be a way to check this, maybe even take a pcap of the flow and have a better look,
        Possible f5 support could look at the config and that pcap for you with more understanding of what those errors mean.

  • MadMick's avatar
    MadMick
    Icon for Nimbostratus rankNimbostratus
    Apr 26, 2022

    AV is TrendMicro 🙂

    I got some servers that are using BigIp proxy in order to contact a central console located in the cloud and not managed by me.

    192.168.201.37:8081 is the proxy address set in an iRule in Big IP

    how can I do the checks you suggested me?

  • MadMick's avatar
    MadMick
    Icon for Nimbostratus rankNimbostratus
    Jul 05, 2022

    Hi guys,
    one more time...thank you for you time and you help.

    I solved the issue disabling and re-enabling the proxy virtual server.

    The problem is that these solution worked for 1 week to now...and now I've done the same workaround.

    Do you know what can be happened?
    Maybe there is a kind of cache to clear?

     

    thanks,

    M.