Forum Discussion
NimbostratusHandshake fails with error TLS_FALLBACK_SCSV with a lower protocol (86)
Usually handshake failures are caused by no cipher suite overlap between our Big-IP and the target server, but this one is different. I see in a packet capture that on the external side Big-IP sends Client Hello and the server responds with Server Hello with the chosen cipher suite etc. From the experience I have I see no problems with this exchange, but Big-IP still resets the connection. On the internal side the client only sends Client Hello before Big-IP resets the connection. Here is the output from SSL debug in /var/log/ltm.
Jun 10 10:42:06 pri-f5 info tmm2[5135]: 01260013:6: SSL Handshake failed for TCP X.X.119.254:50517 -> 77.88.21.127:443
Jun 10 10:42:06 pri-f5 info tmm2[5135]: 01260013:6: SSL Handshake failed for TCP 77.88.21.127:443 -> X.X.119.254:50517
Jun 10 10:42:06 pri-f5 info tmm3[5135]: 01260013:6: SSL Handshake failed for TCP X.X.119.254:50516 -> 77.88.21.127:443
Jun 10 10:42:06 pri-f5 info tmm3[5135]: 01260013:6: SSL Handshake failed for TCP 77.88.21.127:443 -> X.X.119.254:50516
Jun 10 10:42:06 pri-f5 info tmm1[5135]: 01260013:6: SSL Handshake failed for TCP X.X.119.254:50518 -> 77.88.21.127:443
Jun 10 10:42:06 pri-f5 info tmm1[5135]: 01260013:6: SSL Handshake failed for TCP 77.88.21.127:443 -> X.X.119.254:50518
Jun 10 10:42:06 pri-f5 debug tmm[5135]: 01260009:7: Connection error: ssl_select_suite:5814: TLS_FALLBACK_SCSV with a lower protocol (86)
Jun 10 10:42:06 pri-f5 info tmm[5135]: 01260013:6: SSL Handshake failed for TCP X.X.119.254:50519 -> 77.88.21.127:443
What could be going wrong here and how can I proceed to figure it out?
1 Reply
David_StoutMy first hunch was that someone was attempting a protocol downgrade attack. Quick google turned up this link which probably explains what you are seeing above :)
Poodle Downgrade attacks and TLS SCVS
