topic Re: Intermittent SSL in General Topics

Intermittent SSL

Tom-T — Tue, 21 Feb 2017 16:42:39 GMT

SSL traffic stops after about 45 minutes and is restored in about the same time frame (maybe longer). Firewall is not configured to decrypt. HTTP traffic has no problems. Just deployed (test network) low use firewall (3050) running 7.1.7.

Re: Intermittent SSL

TranceforLife — Fri, 03 Mar 2017 09:51:34 GMT

What can you see in the logs? Reason for drop

Re: Intermittent SSL

Tom-T — Tue, 21 Feb 2017 17:32:52 GMT

Action is allow. Connections act like they are timing out. Not receiving “age-out” for session end. When I put Force Point fw back in, all is good.

Re: Intermittent SSL

TranceforLife — Wed, 22 Feb 2017 15:21:46 GMT

So what do you see in the "Session End Reason" column? Can you post a snip of the session from the monitoring tab please. Worth to get a PCAP from the firewall on when the issue is happening (use filter option ).

Re: Intermittent SSL

Tom-T — Wed, 22 Feb 2017 15:58:40 GMT

Session End Reason is "tcp-rst-from-client". The device is on another network will limited access. I am pushing to see if I can get the FW back online to troubleshoot some more.

Re: Intermittent SSL

TranceforLife — Thu, 23 Feb 2017 15:45:06 GMT

We need more details, but the end reason quite clear:"tcp-rst-from-client"

Re: Intermittent SSL

Tom-T — Fri, 24 Feb 2017 17:42:28 GMT

I agree on more info. The bad thing is putting the device back online has been put on hold for a few days. Hopefully I can post a status early next week.

A little more information. I have control over two workstations behind the firewall. They are configured not to use a proxy server at this time. When the firewall is first brought up, access to http and https sites work. After around 45 min or so, access to https sites stop, from the same device. Then a while later it starts working again. To me it does not look like a workstation issue.

Re: Intermittent SSL

TranceforLife — Fri, 24 Feb 2017 20:58:33 GMT

Most of the times log never lie but we will continue to troubleshoot when the device back online. Just drop a message

Re: Intermittent SSL

Tom-T — Thu, 02 Mar 2017 18:00:51 GMT

Device back online for 2 days. No problem. If it is going to come back, it will be in a few weeks when it gets moved to production.

Re: Intermittent SSL

BPry — Thu, 02 Mar 2017 19:20:21 GMT

I think that @TranceforLife probably nailed it initially when you two were troubleshooting; logs on the PA are correct probably 99% of the time.