topic Firewall Migration Tool 5.01 - SSL: WRONG_VERSION_NUMBER in Network Security

Firewall Migration Tool 5.01 - SSL: WRONG_VERSION_NUMBER

seahorse — Mon, 20 Nov 2023 11:10:30 GMT

We use the Cisco Firewall Migration Tool 5.01 on a MS Windows Server and cannot start the the tool.
Error message: [INFO | cco_login.py] > EULA check for an user
DEBUG | common.py] > session table records count:1
[INFO | common.py] > Telemetry push : Unable to connect to SSE Cloud server https://sign-on.security.cisco.com HTTPSConnectionPool(host='sign-on.security.cisco.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1125)')))

seperate access to https://sign-on.security.cisco.com from the windows server is possible, but not from the FMT. Within there is no window opening to type in the user/credentials for sign-on.

It is chrome browser used.

Do you have a hint how to fix the following error?

Thanks

Re: Firewall Migration Tool 5.01 - SSL: WRONG_VERSION_NUMBER

Marvin Rhoads — Mon, 20 Nov 2023 11:40:03 GMT

Does your environment use a proxy server? That could cause a problem like this.

I just did a fresh download of the 5.0.1 version on my Windows Server 2022 and it launches and runs fine for me.

Re: Firewall Migration Tool 5.01 - SSL: WRONG_VERSION_NUMBER

Mark Elsen — Mon, 20 Nov 2023 11:48:38 GMT

- It relates to the underlying Python (version) being used by the firewall migration tool :
(FYI) : https://support.chainstack.com/hc/en-us/articles/9117198436249-Common-SSL-Issues-on-Python-and-How-to-Fix-it

Re: Firewall Migration Tool 5.01 - SSL: WRONG_VERSION_NUMBER

Marvin Rhoads — Mon, 20 Nov 2023 11:56:42 GMT

I doubt it is the FMT's included Python as it includes all the necessary executables and supporting libraries in a self contained installer. I just now verified 5.0.1 is working fine on another PC - neither of which had any Python previously installed.

Re: Firewall Migration Tool 5.01 - SSL: WRONG_VERSION_NUMBER

seahorse — Mon, 20 Nov 2023 12:15:26 GMT

Thanks for your answers.
On my PC it is also working.
Yes, on windows there is proxy server used.

With older FMT vesion there was no issue, as there was no SSO before.

Re: Firewall Migration Tool 5.01 - SSL: WRONG_VERSION_NUMBER

Mark Elsen — Mon, 20 Nov 2023 13:03:55 GMT

>...Yes, on windows there is proxy server used.
- Check the proxy server's logs for the https request coming from FMT