Forum Discussion

Andrea_Colombo_'s avatar
Andrea_Colombo_
Icon for Nimbostratus rankNimbostratus
Oct 24, 2017

Adding Peer device issue

Hi Guys,

 

I have a problem with my customer. We are working in Test Plant, where we would replace 2 F5 Viprion 4400 (version 11.4.1) with an F5 i2600 (version 12.1.2). I'm telling you what we would like to do to migrate everything (in Test Plant we are testing the procedure we would like to implement in production, where we will replace two Viprion 4400 with two Viprion 2400):

 

  • Added the new F5 to the existing Device Group by creating a new sync VLAN between the 3 devices
  • Sync the configuration on the new device
  • Failover of traffic on the new device
  • Remove from the device group the two old Viprion

We immediately encountered a problem when we tried adding a peer to insert the new device into the current cluster, in particular we get the following error (via GUI the same error exists on both Viprion and i2600):

 

iControl connection to 172.16.4.242 failed (where IP 172.16.4.242 is the IP of the new F5 i2600)

 

Checking the ltm log file, we find the following errors:

 

Viprion (LTM) Side: SSL_handshake: error: 14094410: SSL routines: SSL3_READ_BYTES: sslv3 alert handshake failure

 

I2600 (LTM) Side: SSL_handshake: error: 14077102: SSL routines: SSL23_GET_SERVER_HELLO: unsupported protocol

 

Any idea about this?

 

BR

 

application delivery
iControl
LTM
    • Andrea_Colombo_'s avatar
      Andrea_Colombo_
      Icon for Nimbostratus rankNimbostratus
      Oct 25, 2017

      Hello Kevin, thank you for your response. We tried the solution on K13405, but the problem is the same: iControl connection to 172.16.4.242 failed

       

      Any idea?

       

      BR

       

      Andrea

       

    • Kevin_K_51432's avatar
      Kevin_K_51432
      Historic F5 Account
      Oct 25, 2017

      Hi Andrea,

      I've not encountered this issue on any of my BIG-IPs. It looks like the default setting is: 
      tmsh list sys httpd ssl-protocol
sys httpd {
    ssl-protocol "all -SSLv2 -SSLv3"
}

      Do you have the ability to set this on both devices and test? 

      tmsh
modify sys httpd ssl-protocol "all -SSLv2 -SSLv3"
save sys config
load sys config
restart sys service httpd

      I know you intend to use stronger ciphers only, but it appears this is only possible in v13.0.0 per the bug mentioned above.

      Thanks!

      Kevin
  • amintej's avatar
    amintej
    Icon for Cirrus rankCirrus
    Oct 25, 2017

    Hello, We had a similar problem when we turned off TLS 1.0 in the httpd interface but it looks like your problem is with SSLv3 protocol. Check the current configuration with the next command:

    list sys httpd ssl-protocol 
sys httpd { ssl-protocol "all -SSLv2 -SSLv3"}

    You can add SSLv3 using modify:

     modify sys httpd ssl-protocol "all -SSLv2 +SSLv3"