Forum Discussion
cmcnicholas
Cirrus
Cirrusserver_name extension missing from Client Hello
I ran a trace recently on some traffic and while reviewing in Wireshark I see that in some instances the server_name extension details are visible in the client hello. However, seconds later in clien...
cmcnicholas These are the actual client connections failing or is this a log you are parsing through that shows the SSL error? The reason I ask is because it could be the health check from the F5 that is causing the error because health checks originate from the self IP while load balanced traffic originates from the floating IP of the F5. If it's the client IP it might be worth running some captures to see if the F5 receives the SNI because it could be a miss-configuration on the client side. If you want to enable SNI on the health monitor make sure you have the SSL profile associated to the health monitor and you fill in the SNI filed in the SSL profile shown below.
Amine_Kadimi
MVP
MVPIf the server name is missing from the client, I suggest to try to troubleshoot this on the client itself. However, if your virtual server is doing re-encryption (client and server ssl profiles) then you may need to configure your server ssl profile to include the sni server name in the requests from F5 to the backend server : https://my.f5.com/manage/s/article/K39408450