Virtual server unreachable with 3g and 4g only ADSL

Question

Hello Team,&nbsp;on our production , we have a virtual server with two node . the web site is published on port 443 ,  it was working normaly but 5 days ago it's doesn't work with 3G and LTE connexion and works good with ADSL .&nbsp;there are no restriction in firewall and when i see traffic bigip on this virtual server  , i see all IP address range reach the VS but the web site return ERR_SSL_PROTOCOL_ERR .&nbsp;certificat on virtual server is good when i checked with sslabs  &nbsp;procol profile : Fast Layer 4 &nbsp;&nbsp;&nbsp;someone has any idea ? &nbsp;Thanx you&nbsp;Best regards&nbsp;&nbsp;&nbsp;&nbsp;

simon_blakely · Answer

If the virtual server is a Fastl4, then the certificate comes from the pool member - FastL4 is a TCP passthrough with no SSL termination. Any SSL protocol issues are between the pool member and the client.

Try getting a tcpdump of the traffic between a client and the virtual server, and look at the ClientHello, ServerHello and any Fatal alerts to see who terminates the handshake.

To me, it sounds like a Certificate Trust issue with mobile clients, but I'd need more data to be sure.

mmwolf · Answer

hello Blakely , &nbsp;please can you give me the command please to use it ? &nbsp;thanx a lot&nbsp;Regards

mmwolf · Answer

Hello , &nbsp;this is return log with TCPDUMP&nbsp;13 2&nbsp;0.0193 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;ServerHello&nbsp;&nbsp;&nbsp;&nbsp;Version 3.3&nbsp;&nbsp;&nbsp;&nbsp;session_id[32]=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;19 55 fc 80 e4 56 e3 6d 73 3b aa 33 a4 0d 09 64&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;d3 71 e4 ae 20 15 98 2e c7 11 ca ad 1e b2 99 44&nbsp;&nbsp;&nbsp;&nbsp;cipherSuite&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_RSA_WITH_AES_256_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;compressionMethod&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NULL13 3&nbsp;0.0193 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;Certificate13 4&nbsp;0.0193 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;ServerHelloDone13 5&nbsp;0.1083 (0.0889)&nbsp;C&gt;S&nbsp;Handshake&nbsp;&nbsp;&nbsp;ClientKeyExchange13 6&nbsp;0.1083 (0.0000)&nbsp;C&gt;S&nbsp;ChangeCipherSpec13 7&nbsp;0.1083 (0.0000)&nbsp;C&gt;S&nbsp;Handshake13 8&nbsp;0.1099 (0.0016)&nbsp;S&gt;C&nbsp;Alert&nbsp;&nbsp;level&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fatal&nbsp;&nbsp;value&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;handshake_failure13&nbsp;&nbsp;0.1099 (0.0000)&nbsp;S&gt;C&nbsp;TCP FIN13&nbsp;&nbsp;0.1274 (0.0174)&nbsp;C&gt;S&nbsp;TCP FIN&nbsp;

simon_blakely · Answer

So the server is rejecting the handshake after the ChangeCipherSpec:&nbsp;There should be a value (just a number) for the fatal alert.  What is that?

mmwolf · Answer

this is capture about error &nbsp;source : our virtual server on Big Ip and Destination is client IP&nbsp;Regards&nbsp;&nbsp;

Forum Discussion

Virtual server unreachable with 3g and 4g only ADSL

8 Replies

Recent Discussions

preserve client IP on layer 4 VIP

Failed to convert character dclid=%EDclid!

ASM - Parent policy vs OWASPcompliance

Rewrite uri translation not working

CONNECTION IS LOST DUE TO SELF IP IS DELIVERED

Related Content

Check a Virtual Server's SSL Status

Virtual Server graphical App for F5 LTM

Reviewing vulnerability scanner results for an Access Policy Manager (APM) protected Virtual Server

virtual server config

Integrating SSL Orchestrator with Fortinet FortiGate Virtual Edition as a Virtual Wire