Hi there!
After upgrade from 6.5.0 to 6.5.2 we've got an issue on one of the FTD in a HA pair.
We are getting "stunnel exited 5 time(s)" warning.
In the logs I see attempts:
stunnel[15463]: Generating stunnel config file at /ngfw/usr/local/sf/lib/perl/5.10.1/SF/AMPProxy.pm line 777.
stunnel[15463]: PRECMD generated configuration at /ngfw/usr/local/sf/lib/perl/5.10.1/SF/AMPProxy.pm line 672.
stunnel[15463]: [ ] Clients allowed=500
stunnel[15463]: [.] stunnel 5.06 on x86_64-unknown-linux-gnu platform
stunnel[15463]: [.] Compiled/running with CiscoSSL 1.0.2n.6.2.194-fips
stunnel[15463]: [.] Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS
stunnel[15463]: [ ] errno: (*__errno_location ())
stunnel[15463]: [.] Reading configuration from file /ngfw/etc/sf/amp-stunnel.conf
stunnel[15463]: [.] FIPS mode enabled
stunnel[15463]: [ ] Compression disabled
stunnel[15463]: [ ] Snagged 64 random bytes from /dev/urandom
stunnel[15463]: [ ] PRNG seeded successfully
stunnel[15463]: [ ] Initializing inetd mode configuration
stunnel[15463]: [!] Service [stunnel]: Inetd mode must define one endpoint
cat /ngfw/etc/sf/amp-stunnel.conf show me this:
client = yes
pid = /var/sf/run/stunnel.pid
debug = 3
foreground = yes
options = NO_SSLv2
options = NO_SSLv3
options = NO_TLSv1
options = NO_TLSv1.1
fips = yes
delay = yes
however on the active and working FTD I see another additional section:
[ NetworkAMP ]
verify = 2
CAPath = /etc/sf/CA
accept = 32137
connect = cloud-sa.amp.cisco.com:443
It seems like stunnel is constantly exiting because config file misses NetworkAMP section. But why AMPProxy.pm is generating such a trimmed file.
