Unable to access Site(CPNotEnoughDataForRuleMatch)

[Saranya_0305]

Dear Team,

Management Server : R81.20 Take 99
FWs : R81.10 Take 172
Setup: Cluster

When I try to access the site https://ebiz.ril.com unable to access the site.

When I checked the logs, the logs showing "Reason: Connection terminated before the Security Gateways was able to make the decision: Insufficient data passed. To learn more see SK113479"

The below are the Matched Rules

Layer                                 Rule Name                                                 Action
Network-Comm               Implicit Cleanup                                       Accept
Network                            Rule Name(Matched)                               Accept
Application(shared)         CPNotEnoughDataForRuleMatch          Accept
Content(shared)               CPNotEnoughDataForRuleMatch          Accept

The web browser showing error

"Access to ebiz.ril.com was denied.
You don't have authorized for to view this page.
HTTP ERROR 403"

Later I added the rules at the top of both Application and Content Layers as "Action: Accept" to ebiz.ril.com.

After that we are still not able to access the site.

The below are the Matched Rules after adding rules.

Layer                                Rule Name                                               Action
Network-Comm              Implicit Cleanup                                     Accept
Network                           Rule Name(Matched)                             Accept
Application(shared)        CPNotEnoughDataForRuleMatch        Accept
Content(shared)              Rule Name(Matched)                             Accept

But this time browser is showing error

"This site can't provide a secure connection
ebiz.ril.com uses an unsupported protocol
ERR_SSL_VERSION_OR_CIPHER_MISMATCH"

I have enabled HTTPS Inspection, but there is no rule for this site.

Please find the attached screenshots for reference.

Regards,

Saranya

[Lesley]

Error means there was no data backup from the website to client.  (Unable to access Site(CPNotEnoughDataForRuleMatch)

So -> syn -> syn ack -> ack etc but no data that shows websites.

It get stuck because the client has not the same SSL ciphers as website.

If you run https://www.ssllabs.com/ssltest/analyze.html?d=ebiz.ril.com&hideResults=on

you can see website is outdated. No TLS 1.3 and mostly weak ciphers.

To prove this make wireshark capture on client and both website and client will share the SSL cipher suite list.

https://osqa-ask.wireshark.org/questions/62098/how-to-find-out-which-ssl-cipher-suite-is-being-used/

Note IF the firewall does HTTPS inspection it is the firewall that builds the connection to the website, not the client. Then it is a different story. 

[PhoneBoy]

More specifically @Saranya_0305, this error comes up when the client and server cannot agree on specific TLS ciphers.
Usually this is because the server does not support stronger ciphers than the client is configured to allow.

Unless this connection is subject to HTTPS Inspection, this is 100% not a firewall issue.

[Tal_Paz-Fridman]

Have you looked at

https://support.checkpoint.com/results/sk/sk113479

[the_rock]

https://community.checkpoint.com/t5/Security-Gateways/quot-CPNotEnoughDataForRuleMatch-quot-and-quot...