SSL protocol mismatch

To confirm the issue is with the TLS cipher negociation between the client and the VS, you should get a ssldump. Overview of packet tracing with the ssldump utility (f5.com)

The client hello part of the dump will show you what cipehrs are supported by the client, you can then cross check them with the 'DEFAULT' ciphers

irbk Some of this doesn't make sense because having a virtual server (VS) configured to listen on 443, no SSL profiles on the VS, and the pool members with port 7246 should result in a passthrough of SSL communication direclty to the pool members. Can you provide the configuration of the VS that is the standard VS without any SSL profiles?

Sorry Paulius I guess I didn't post the VS configuration.  Thought I did.  The VS isn't configured to listen on 443.  It's configured to listen on 7246.  The pool members are also configured for 7246.  A wireshark of communication between the client and server with no F5 in place is what told me there is TLSv1.2 going on between the two devices on that port.

In this configuration, the client will connect without issue, because it's just doing the SSL forwarding:

ltm virtual Nav_7246 {
creation-time 2023-09-26:16:00:07
destination <VS IP>:7246
ip-protocol tcp
last-modified-time 2023-10-04:16:58:23
mask 255.255.255.255
persist {
source_addr {
default yes
}
}
pool Nav_Pool_7246
profiles {
LC-http { }
fastL4 { }
}
serverssl-use-sni disabled
source 0.0.0.0/0
source-address-translation {
pool Nav
type snat
}
translate-address enabled
translate-port enabled
vs-index 4
}

ltm pool Nav_Pool_7246 {
load-balancing-mode predictive-member
members {
Nav01:7246 {
address <Nav01 IP>
session monitor-enabled
state up
}
Nav02:7246 {
address <Nav02 IP>
session monitor-enabled
state down
}
}
monitor tcp
}

When I try with this VS configuration (same pool as above) is when I get the protocol errors

ltm virtual Nav_7246 {
creation-time 2023-09-26:16:00:07
destination <VS IP>:7246
ip-protocol tcp
last-modified-time 2023-10-05:08:35:17
mask 255.255.255.255
persist {
source_addr {
default yes
}
}
pool Nav_Pool_7246
profiles {
LC-http { }
LC-oneconnect { }
LC-tcp-lan { }
Wildcard23-24 {
context clientside
}
serverssl {
context serverside
}
}
serverssl-use-sni disabled
source 0.0.0.0/0
source-address-translation {
pool Nav
type snat
}
translate-address enabled
translate-port enabled
vs-index 4
}

An SSL protocol mismatch error typically occurs when there's an inconsistency between the SSL/TLS protocols supported by the client and the server. This can happen for various reasons:

1. Outdated SSL/TLS versions: The client or server might be using outdated versions of SSL/TLS that are not compatible with each other. For example, if the server only supports TLS 1.2 and the client is trying to connect using SSL 3.0, a protocol mismatch error will occur.
2. Configuration issues: Sometimes, the SSL/TLS configuration on either the client or the server side is incorrect, leading to a mismatch in supported protocols.
3. Firewall or proxy interference: Firewalls or proxies can sometimes interfere with SSL/TLS connections, causing protocol mismatches if they don't handle the protocols properly.

Solution for this : 

• Update SSL/TLS certificates 
• Check the SSL/TLS configuration settings 
• Disable outdated protocols
• Inspect network devices

Still if you are facing any error kindly take help from technical support team.