topic Re: Cisco ACE SSL termination problem in Application Networking

Cisco ACE SSL termination problem

Vladimir Pavlinic — Mon, 30 May 2011 06:31:50 GMT

Hi,

I have problem setting up the SSL termination on Cisco 4710 ACE. Setup is in One-arm mode.

On ACE I need to do SSL client authentication.

We have 2 types of devices connecting to ACE.

With first one everything is working fine. But with second one i cant make client authentication to work.

When I issue "show stats crypto server", I see following counters increasing:

SSL alert BAD_CERTIFICATE sent:

I will appriciate some explanation about this issue.

Best regards,

Vladimir

Re: Cisco ACE SSL termination problem

Daniel Arrondo Ostiz — Mon, 30 May 2011 13:29:02 GMT

Hi Vladimir,

This counter indicates that connections are being dropped because the client certificate is not valid (or at least the ACE is not able to validate it).

I would start by finding the differences between the working and failing clients. At first sight, I wouldn't be surprised if they are using diferent CA or certificate types. Once you know better what is different, we can troubleshoot further.

Regards

Daniel

Re: Cisco ACE SSL termination problem

Francesco Casotto — Mon, 30 May 2011 13:38:32 GMT

Hello Vladimir,

it looks like the ACE ir refusing the certificate sent by the client for authenthication, I would check:

are the 2 devices connecting to the same VIP/authgroup?
I would take a capture to check if the client is actually sending the certificate and which, in the trace i would capture also a successful session from the other device for comparison.
I would check wich other counters are increasing together with

SSL alert BAD_CERTIFICATE sent

I would raise the logging level and check for messages like:

%ACE-6-253003: Certificate /CN=user1 is signed by an unknown C


Hope it helps,
Francesco

Re: Cisco ACE SSL termination problem

Vladimir Pavlinic — Thu, 02 Jun 2011 07:26:40 GMT

Hi All,

I am trying to find differences between certificates.

* are the 2 devices connecting to the same VIP/authgroup?

No. Different VIP/authgroup.

I will let You know of any findings.

Regards,

Vladimir

Re: Cisco ACE SSL termination problem

Vladimir Pavlinic — Thu, 09 Jun 2011 12:33:11 GMT

Hi,

We managed to correct issues with certificates. There was a problem with time synchronization.

Now SSL termination works as expected.

Aftrer fixing SSL problems, we found another problem.

After client (device) hits VIP and SSL terminates on ACE, client (end device) is expecting to recive packet from Real server before sending enything to Real.

When ACE is doing SSL termination, there is no TCP conn to REAL SERVER until the APP Data is seen from client.

Is there any way to force ACE to open tcp connection to REAL without receiving APP data after SSL termination?

Regards,

Vladimir

Re: Cisco ACE SSL termination problem

Daniel Arrondo Ostiz — Thu, 09 Jun 2011 13:57:25 GMT

Hi Vladimir,

The moment SSL termination is done, the ACE will treat the connection as a L7 one, and therefore, it will wait to get the HTTP request before it tries to contact the server.

Normally, this should not cause any issues to the application, so, could you please let me know why this behavior is not desirable?

Daniel

Re: Cisco ACE SSL termination problem

Vladimir Pavlinic — Thu, 09 Jun 2011 14:16:35 GMT

Hi Daniel,

This is normal and expected behavior for L7 on ACE.

Application on end device is configured to send packets only after first packet is recived from Real.

We are trying to migrate existing SSL termination from STunnel to ACE. Stunnel is not an LB and it opens TCP connection to real after SSL termination. In this case Real can send required packet to end device and everything works fine.

Our end devices are configured this way and it will take a lot of time to reconfigure them to work with ACE.

I am just searching for an answer is this behavior achievable with ACE.

Vladimir

Re: Cisco ACE SSL termination problem

Daniel Arrondo Ostiz — Thu, 09 Jun 2011 14:22:06 GMT

I'm afraid this behavior is not configurable. With L7 connections, the ACE will always wait for the client request before opening the connection to the server.

Daniel

Re: Cisco ACE SSL termination problem

Vladimir Pavlinic — Thu, 09 Jun 2011 14:31:08 GMT

Thank You Daniel.

Best regards,

Vladimir