SSL/TLS handshake fails due to RST sent by firewall

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 373

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

Applies to

ONTAP 9
SSL/TLS handshake
OpsRamp
Palo Alto Firewall

Issue

Client cannot perform SSL/TLS handshake with ONTAP
OpsRamp monitoring tool cannot perform NetApp discovery due to errors and closes SSL connections
- No peer certificate available: The client did not receive a certificate from the server, which is required for SSL/TLS handshake
ONTAP packet trace shows that ONTAP sends Server Hello to the client IP/firewall MAC, and then the client IP/firewall MAC sends RST
Client packet trace shows that the client does not receive the Server Hello, but receives RST from the ONTAP IP/firewall MAC.

If a client within the same subnet of the LIF attempts a TLS handshake, it succeeds, because the firewall is not between the client and the LIF

[fchen@localhost ~]$ openssl s_client -connect 10.216.29.203:443
CONNECTED(00000004)
depth=0 CN = nas-cm913, C = US
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = nas-cm913, C = US
verify error:num=10:certificate has expired
notAfter=Sep 28 20:08:03 2024 GMT
verify return:1
depth=0 CN = nas-cm913, C = US
notAfter=Sep 28 20:08:03 2024 GMT
verify return:1
---
Certificate chain
 0 s:CN = nas-cm913, C = US
   i:CN = nas-cm913, C = US
---
Server certificate
-----BEGIN CERTIFICATE-----