- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: No TLS Server Hello Response issue - Networkin...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No TLS Server Hello Response issue - Networking Troubleshoot
Hello, I am currently with a Tshoot on two scenarios from LAN.
IP A: Original IP
IP B: NAT IP
IP C: WebServer
Scenario A that works:
Flow:
IP A -> IP C leng 517 (Client Hello TCP with TLS packet)
IP B -> IP C leng 517 (Client Hello TCP with TLS packet)
IP C -> IP A ackno 518 (Server Hello TCP with TLS packet)
IP C-> IP B ackno 518 (Server Hello TCP with TLS packet)
At this point this is expected, and the user can open the browser and connect to the webserver from LAN over HTTPS 443.
Scenario B does Not Work:
Flow:
IP A -> IP C leng 517 (Client Hello TCP with TLS packet)
IP B -> IP C leng 517 (Client Hello TCP with TLS packet)
IP C -> IP A ackno 518 (ONLY TCP ack packet ) no Server Hello response
IP C-> IP B ackno 518 (ONLY TCP ack packet ) no Server Hello response
The user can't connect to this webserver from LAN, browser and over HTTPS 443.
On scenario B: I receive the acknowledge 518 without TLS Server Hello Payload.
Based on your experience could you infer this packet could be lost somewhere on the LAN network? or if Check Point Firewall at some point could block the Server Hello payload response?.
Could be something about Threat Prevention suite ? SecureXL?
I also created TCP State Exceptions but did not work.
I appreciate you response
Have a gr8 day!!!!!!!!!!!!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You would need to do packet captures when it works and when it does not work, so comparing those would probably show you the difference.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, this description is from pcaps that I took from traffic that does work and other that does not work.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Say if you took fw monitor, what do you see? Is it taking the same path?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To understand this better, it is important to know, where you did the traffic capture. On the client, on the server, at the firewall itself, at the client side of the firewall, at the server side of the firewall?
And, as the_rock already said: A fw monitor would be interesting. Please take care of SecureXL or use multiple -F arguments.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I also have the same issue.
Both boxes have the same config for httpd, and httpd_ssl. Even when I use the same browser, one gets a Server key and Server Hello back, the other one doesn't.
I see a notification that the responses cannot be displayed. If anyone has figured out a fix, can you share? Thanks in advance.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Facing similar issue. Website is working fine on ASA firewall. When ASA is replaced with Checkpoint it is not working. It has been observed that server hello is not received when Checkpoint is in place. We are using only firewall blade and no HTTPS inspection. Also tried disabling stateful inspection in global properties but no luck. Unable to find the cause of the issue as server team is not ready to troubleshoot the issue from their end as all other locations are able to connect to the same server. Also raised TAC but they are asking to get server team on call.
Any clue why server hello is not received when Checkpoint is in place.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can see why TAC is asking you that, I would be doing exactly the same thing. It would be useful to see working and non-working captures for comparison. Btw, when this fails, do you have any logs/debug you can share?
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Kindly find attached pcap file. src: 192.168.226.55 dst:10.45.74.18. tcp.stream eq 9.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dont see any files...
