This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL/TLS inspection errors

Hi,

I have a IPSEC VPN between XG <--> UTM all good and stable, but when I try from XG LAN to access webadmin on remote UTM, I often get timeouts in the browser and sometimes some pages of the UTM works.

I am using DPI engine and found out, that if I disable DPI entirely, it works perfect, so I looked into the logs:

Theese two tend to show up:

Dropped due to TLS engine error: SESSION_UNKNOWN[5]

Dropped due to TLS engine error: BAD_VERDICT[2]

My profile matches is "Do not encrypt"

i am running SFOS 18.0.0 GA-Build339

This thread was automatically locked due to age.

Parents

0 FormerMember over 5 years ago

Hi twister5800,

Are you trying to access the UTM on WAN IP address or LAN IP address?

Can you post your VPN rules from the XG?

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 twister5800 over 5 years ago in reply to FormerMember

I access the LAN IP :-)
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to twister5800

There was a Bug about IP Addresses.

That SSLx pick up traffic, which it should not, because of IP Addresses.

You are using IPsec Policy Based? If accessing the WAN IP of UTM, will it work? Just to figure out, if the same connection, going to WAN is working fine, only internal (Behind Policy based) is affected.
Cancel
Vote Up 0 Vote Down

Cancel
0 twister5800 over 5 years ago in reply to LuCar Toni

Yes Policy based, I have now tried RED site2site same result.

When accessin the WAN IP of UTM, it still does not work :-(
Cancel
Vote Up 0 Vote Down

Cancel
0 twister5800 over 5 years ago in reply to LuCar Toni

Hi,

Can you assist me in some direction to fix this or shall I create a case?
Cancel
Vote Up 0 Vote Down

Cancel
0 KingChris over 5 years ago in reply to twister5800

Hi

If you are a licensed user, then yes please create a case so that this can get debugged.

If disabling TLS makes everything work fine, then there must be something going on with the DPI engine.

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 KingChris over 5 years ago in reply to twister5800

Hi

If you are a licensed user, then yes please create a case so that this can get debugged.

If disabling TLS makes everything work fine, then there must be something going on with the DPI engine.

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data