topic Re: Mobile Access portal problem in SASE and Remote Access

Mobile Access portal problem

abihsot__ — Wed, 06 Feb 2019 10:35:46 GMT

Hi Guys,

Have anyone encountered such error in trace logs between gateway and backend server:

[LOGGER_CURL_INFO/] |11:25:28.998| TLSv1.2 (OUT), TLS alert, Server hello (2):
[LOGGER_CURL_INFO/] |11:25:28.998| SSL read: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac, errno 0
[LOGGER_CURL_INFO/] |11:25:28.998| Closing connection 0
[LOGGER_CURL_INFO/] |11:25:28.998| TLSv1.2 (OUT), TLS alert, Client hello (1):

This happens on both R80.10 and R80.20 any JHF.

Gateway is a VM on esx.

Due to this error some files are partially downloaded, hence the webpage is broken.

Re: Mobile Access portal problem

PhoneBoy — Fri, 08 Feb 2019 22:51:58 GMT

The error suggests the SSL/TLS negotiation is failing.

What happens when you access the site in question without going through MAB?

Can you validate the TLS version used by your browser?

Re: Mobile Access portal problem

abihsot__ — Mon, 11 Feb 2019 07:18:43 GMT

Hi Dameon,

Thanks for reply. Going directly to website - no problem. Connection is established using TLS1.2. By the way, forgot to mention:

* Using R77.30 works fine

* R80.10 MAB - I get this error with multiple web apps. This suggests it is not specific to that particular website.

Re: Mobile Access portal problem

abihsot__ — Mon, 11 Feb 2019 07:48:07 GMT

During the event in tcpdump I can see rst flag is sent by gateway. But why?

I have done so far:

* changed TLS1.2 ciphers

* downgraded to TLS1.1 and TLS1.0

* Installed GW in different VLAN.

* tested with all vmware network adapter types

Re: Mobile Access portal problem

PhoneBoy — Mon, 11 Feb 2019 16:58:43 GMT

I would open a TAC case so we can troubleshoot this.

How To Open a Case with TAC and/or Account Services‌

Re: Mobile Access portal problem

abihsot__ — Tue, 12 Feb 2019 06:42:35 GMT

Been there too case is open for months now with almost no progress I was thinking giving a shot here

Re: Mobile Access portal problem

PhoneBoy — Tue, 12 Feb 2019 17:04:58 GMT

Please send me the SR in a Private Message.

Re: Mobile Access portal problem

abihsot__ — Tue, 06 Aug 2019 15:53:33 GMT

This issue definitely shortened my life expectancy 😄 Overall TAC help was very poor. The ticket lasted almost a year 😞

Finally after many experiments the only thing which helped is the gateway with 3.10 kernel...