OPERATIONAL DEFECT DATABASE
...
...
GTM HTTPS monitor fails. Tcpdump shows the server is sending a TCP reset in the packet following big3d sending Client Hello trying to reuse a session.
Monitored resource is stuck in a down state.
Monitored server has changed SSL protocol requirements, for example, changes to no longer accept TLS 1.1 connections.
The cached SSL sessions can be cleared by restarting big3d, or by following the process below: If restarting big3d is not possible, the cached SSL sessions can be expired by triggering an SSL alert from the webserver instead of a TCP reset. The process varies based on the webserver and the protocols and ciphers involved. The following example is for the case where the server had been reconfigured to no longer accept TLSv1.1. 1. Re-enable the server disallowed protocol TLSv1.1. 2. Change the server allowed cipher list to only allow TLSv1.2 ciphers. 3. Verify monitors have no been marked up (big3d should now be sending TLS1.2 client hello). 4. Now the server can be configured to refuse TLSv1.1.
None
Click on a version to see all relevant bugs
F5 Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
