Hi All,
After certain FMC and FTD upgrades, it is possible to encounter a situation where the FTD fails to register back to the FMC even though all connectivity checks appear normal. FMC and FTD can reach each other, port 443 is open, and the sftunnel process shows as UP on both sides. Despite this, the registration may remain stuck during the discovery phase for an extended period (sometimes 30 minutes or more) before ultimately failing. In many cases, FMC may also report the error “Could not establish sftunnel connection” even though the tunnel is active.
A deeper inspection using pigtail traces during the registration attempt typically reveals a repeating error on both FMC and FTD:
SSL Handshake failed
This indicates that the issue is not related to basic IP reachability or routing, but rather to a failure during the TLS negotiation phase of the sftunnel.
It is important to note that the sftunnel communication between FMC and FTD uses TCP port 8305 on the FMC side. Even if this port is reachable and the tunnel comes up, the registration can still fail if the TLS parameters do not match.
In the observed scenario, the root cause was a TLS version mismatch in the sftunnel configuration files. After the upgrade, the FMC was configured to enforce TLS 1.2, while the FTD was using TLS 1.3. This mismatch causes the SSL handshake to fail silently, preventing the discovery phase from progressing even though sftunnel is operational.
To resolve this issue, the sftunnel.conf file on both the FMC and FTD should be inspected from expert mode:
vim /etc/sf/sftunnel.conf
Inside the proxyssl section, the FTD may show an entry such as:
proxy_tls_version TLSv1.3;
This needs to be aligned with the FMC setting, typically:
proxy_tls_version TLSv1.2;
Once the TLS version is corrected to match the FMC, saving the file and restarting the sftunnel service allows the registration process to complete successfully.
In summary, when FMC–FTD registration fails after an upgrade—especially when connectivity, reachability, and sftunnel status appear normal—verify that both devices use the same TLS version in:
/etc/sf/sftunnel.conf
Ensuring TLS alignment resolves the SSL handshake failure and allows the FTD to register with the FMC without further issues. This check is particularly useful when port 8305 is open and the tunnel indicates an UP state, yet registration continues to fail.
Hope this saves someone hours of troubleshooting!
