Virtual server unreachable with 3g and 4g only ADSL

Question

Hello Team,&nbsp;on our production , we have a virtual server with two node . the web site is published on port 443 ,  it was working normaly but 5 days ago it's doesn't work with 3G and LTE connexion and works good with ADSL .&nbsp;there are no restriction in firewall and when i see traffic bigip on this virtual server  , i see all IP address range reach the VS but the web site return ERR_SSL_PROTOCOL_ERR .&nbsp;certificat on virtual server is good when i checked with sslabs  &nbsp;procol profile : Fast Layer 4 &nbsp;&nbsp;&nbsp;someone has any idea ? &nbsp;Thanx you&nbsp;Best regards&nbsp;&nbsp;&nbsp;&nbsp;

simon_blakely · Answer

If the virtual server is a Fastl4, then the certificate comes from the pool member - FastL4 is a TCP passthrough with no SSL termination. Any SSL protocol issues are between the pool member and the client.

Try getting a tcpdump of the traffic between a client and the virtual server, and look at the ClientHello, ServerHello and any Fatal alerts to see who terminates the handshake.

To me, it sounds like a Certificate Trust issue with mobile clients, but I'd need more data to be sure.

mmwolf · Answer

hello Blakely , &nbsp;please can you give me the command please to use it ? &nbsp;thanx a lot&nbsp;Regards

mmwolf · Answer

Hello , &nbsp;this is return log with TCPDUMP&nbsp;13 2&nbsp;0.0193 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;ServerHello&nbsp;&nbsp;&nbsp;&nbsp;Version 3.3&nbsp;&nbsp;&nbsp;&nbsp;session_id[32]=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;19 55 fc 80 e4 56 e3 6d 73 3b aa 33 a4 0d 09 64&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;d3 71 e4 ae 20 15 98 2e c7 11 ca ad 1e b2 99 44&nbsp;&nbsp;&nbsp;&nbsp;cipherSuite&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_RSA_WITH_AES_256_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;compressionMethod&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NULL13 3&nbsp;0.0193 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;Certificate13 4&nbsp;0.0193 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;ServerHelloDone13 5&nbsp;0.1083 (0.0889)&nbsp;C&gt;S&nbsp;Handshake&nbsp;&nbsp;&nbsp;ClientKeyExchange13 6&nbsp;0.1083 (0.0000)&nbsp;C&gt;S&nbsp;ChangeCipherSpec13 7&nbsp;0.1083 (0.0000)&nbsp;C&gt;S&nbsp;Handshake13 8&nbsp;0.1099 (0.0016)&nbsp;S&gt;C&nbsp;Alert&nbsp;&nbsp;level&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fatal&nbsp;&nbsp;value&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;handshake_failure13&nbsp;&nbsp;0.1099 (0.0000)&nbsp;S&gt;C&nbsp;TCP FIN13&nbsp;&nbsp;0.1274 (0.0174)&nbsp;C&gt;S&nbsp;TCP FIN&nbsp;

simon_blakely · Answer

So the server is rejecting the handshake after the ChangeCipherSpec:&nbsp;There should be a value (just a number) for the fatal alert.  What is that?

mmwolf · Answer

this is capture about error &nbsp;source : our virtual server on Big Ip and Destination is client IP&nbsp;Regards&nbsp;&nbsp;

Forum Discussion

Virtual server unreachable with 3g and 4g only ADSL

Recent Discussions

Help needed with iRule (connection closed log )

AS3 Limitations

Use of SSL Decryption.

VLAN Failsafe Functionality

FTP PASV mode to Extended Passive mode

Related Content

iControl REST Cookbook - Virtual Server (ltm virtual)

virtual server config

Check a Virtual Server's SSL Status

Virtual Server graphical App for F5 LTM

iControl REST Cookbook - Virtual Server Profile (LTM Virtual Profiles)

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS