SSL Handshake failed between F5 and backend server

Hi Team ,

We have an issue accessing the url test-dev-01.example.com via F5 VIP but direct access to server one-test-dev.trading.net is working fine . 

Error : "connection reset" 

Please find the vip configuration details below…

Please advice if anyone has faced similar issues or possible root cause …

thank you.

VIP : 10.128.10.5

Url : test-dev-01.example.com 

port : 443 

VIP has http profile , Client SSL profile , Server SSL profile , no default pool ( redirection to pool via policy ) , no persistence profiles.

Policy/Irule:

HTTP Host host is 'test-dev-01.example.com' at request time.

1. Replace HTTP Host with value 'one-test-dev.trading.net' at request time.

2. Forward traffic to pool '/Common/P_one-test-dev.trading.net' at request time.  

SSL handshake error message : 100.19.10.10 is backend server 10.10.10.250 is SNAT Ip  

Oct 26 11:20:53 bigip-test-f5.com warning tmm[21070]: 01260013:4: SSL Handshake failed for TCP 100.19.10.10:443 -> 10.10.10.250:11158

Oct 26 11:20:53 bigip-test-f5.com warning tmm3[21070]: 01260013:4: SSL Handshake failed for TCP 100.19.10.10:443 -> 10.10.10.250:1955

Oct 26 11:21:23 bigip-test-f5.com warning tmm6[21070]: 01260013:4: SSL Handshake failed for TCP 100.19.10.10:443 -> 10.10.10.250:18610

Oct 26 11:22:23 bigip-test-f5.com warning tmm4[21070]: 01260013:4: SSL Handshake failed for TCP 100.19.10.10:443 -> 10.10.10.250:58704

Oct 26 11:22:50 bigip-test-f5.com warning tmm1[21070]: 01260013:4: SSL Handshake failed for TCP 100.19.10.10:443 -> 10.10.10.250:1303

Oct 26 11:27:23 bigip-test-f5.com warning tmm4[21070]: 01260013:4: SSL Handshake failed for TCP 100.19.10.10:443 -> 10.10.10.250:5403

Oct 26 11:29:08 bigip-test-f5.com warning tmm1[21070]: 01260013:4: SSL Handshake failed for TCP 100.19.10.10:443 -> 10.10.10.250:23029

Oct 26 11:37:24 bigip-test-f5.com warning tmm[21070]: 01260013:4: SSL Handshake failed for TCP 100.19.10.10:443 -> 10.10.10.250:48470

[root@bigip-test-f5.com:Active:Standalone] config # curl -kvv https://test-dev-01.example.com

* Rebuilt URL to: https://test-dev-01.example.com/

* Trying 10.128.10.5...

* Connected to test-dev-01.example.com (10.128.10.5) port 443 (#0)

* ALPN, offering h2

* ALPN, offering http/1.1

* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH

* successfully set certificate verify locations:

* CAfile: /etc/pki/tls/certs/ca-bundle.crt

CApath: none

* TLSv1.2 (OUT), TLS header, Certificate Status (22):

* TLSv1.2 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (IN), TLS handshake, Server key exchange (12):

* TLSv1.2 (IN), TLS handshake, Server finished (14):

* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):

* TLSv1.2 (OUT), TLS change cipher, Client hello (1):

* TLSv1.2 (OUT), TLS handshake, Finished (20):

* TLSv1.2 (IN), TLS change cipher, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Finished (20):

* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256

* ALPN, server did not agree to a protocol

* Server certificate:

* subject: C=IN; ST=IDV; L=INDIA; O=EXAMPLE; OU=IT; CN=*.example.com; emailAddress=globalitteam@EXAMPLE.com

* start date: Jul 30 12:10:00 2020 GMT

* expire date: Nov 1 12:10:00 2022 GMT

* issuer: DC=EXAMPLE; DC=atlas; CN=Atlas Issuing CAv2 1

* SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.

> GET / HTTP/1.1

> Host: test-dev-01.example.com

> User-Agent: curl/7.47.1

> Accept: */*

>

* SSL read: error:00000000:lib(0):func(0):reason(0), errno 104

* Closing connection 0