CONNECT_FAILED(35) to satellite server

[kjp1231]

I am trying to register an ASAv via my Satellite server but when I test the smart call home profile via CLI to my satellite server I get this message.

call-home test profile License

INFO: Sending test message to https://F.Q.D.N/Transportgateway/services/DeviceRequestHandler...

ERROR: Failed: CONNECT_FAILED(35)

I can't find anything out about this message

[Walter Thompson]

Hi kjp1231,

What ver are you running?

Run the following debugs to help narrow the issue down and share the output here.

debug call-home smart-licensing all
debug license agent all
debug ip http client all

[Walter Thompson]

Scap the debug call-home smart-licensing all and instead use only debug call-home all.

[kjp1231]

I am running ASAv version 9.14(1) and satellite version 7-201907

I was able to 'debug call-home all' and 'debug license agent all' but the other debug commands didn't work.

Debug output shows - 

call-home test profile License

INFO: Sending test message to https://F.Q.D.N/Transportgateway/services/DeviceRequestHandler...

ssh: processing test(Test) SCH Configuration Test

ssh: [0] dispatching test message to https://F.Q.D.N/Transportgateway/services/DeviceRequestHandler

ssh: Dispatch to destination https://F.Q.D.N/Transportgateway/services/DeviceRequestHandler

ssh: Opening dispatch channel: httpc/2/X.X.X.X/443/ssl/verify/sch//

ssh: Opened dispatch channel: httpc/2/X.X.X.X/443/ssl/verify/sch//

ssh: upload 2737 bytes

ERROR: Failed: CONNECT_FAILED(35)

R13-SDWAN-FW01# ssh: http request to https://F.Q.D.N/Transportgateway/services/DeviceRequestHandler failed, rc -1

ssh: [0] Dispatch message(52) test to https://F.Q.D.N/Transportgateway/services/DeviceRequestHandler failed: CONNECT_FAILED(35)

[Roy Yuan]

@kjp1231, did you ever get this issue resolved?

[kjp1231 · Accepted solution]

Yes, support had me change to http instead of https. Don’t know why https wouldn’t work. I would think the preference would be https

[khrakesh]

Dear All 

  In may case it is related to TLSv1.3    packet cap (TLSv1.3 Record Layer: Alert (Level: Fatal, Description: Handshake Failure) to licensing server 

SSL lib error. Function: tls_process_client_certificate Reason: certificate verify failed <==================== (Relegated to bug CSCvw31514 current ver 9.19.1)

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvw31514

changed call-home  destination address  https to http

Nov 11 2024 08:58:20 ASA : %ASA-7-725013: SSL server management:1.1.1.1/61791 to CSSM/443 chooses cipher TLS_AES_256_GCM_SHA384
Nov 11 2024 08:58:20 ASA : %ASA-7-717025: Validating certificate chain containing 3 certificate(s).
Nov 11 2024 08:58:20 ASA : %ASA-7-717029: Identified client certificate within certificate chain. serial number: 0xxxxx, subject name: O=Cisco,C=US,OU=TC,CN=cissm.
Nov 11 2024 08:58:20 ASA : %ASA-3-717009: Certificate validation failed. serial number: 01, subject name: CN=Cisco Licensing Root CA,O=Cisco.
Nov 11 2024 08:58:20 ASA : %ASA-3-717027: Certificate chain failed validation. Generic validation failure occurred.
Nov 11 2024 08:58:20 ASA : %ASA-7-725014: SSL lib error. Function: tls_process_client_certificate Reason: certificate verify failed <==================== (Relegated to bug CSCvw31514 current ver 9.19.1)
Nov 11 2024 08:58:20 ASA : %ASA-4-120006: Call-Home license message to https://CSSM/Transportgateway/services/DeviceRequestHandler failed. Reason: CONNECT_FAILED <====================
Nov 11 2024 08:58:20 ASA : %ASA-4-120005: Call-Home license message to https://CSSM/Transportgateway/services/DeviceRequestHandler was dropped. Reason: CONNECT_FAILED <====================
Nov 11 2024 08:58:20 ASA : %ASA-3-444303: %SMART_LIC-3-AGENT_REG_FAILED:Smart Agent for Licensing Registration with the Cisco Smart Software Manager (CSSM) failed: Communication message send error
Nov 11 2024 08:58:20 ASA : %ASA-3-444303: %SMART_LIC-3-COMM_FAILED:Communications failure with the Cisco Smart Software Manager (CSSM) : Communication message send error
Nov 11 2024 08:58:20 ASA : %ASA-6-302014: Teardown TCP connection 1077232250 for management:CSSM/443 to identity:1.1.1.1/61791 duration 0:00:00 bytes 779 TCP FINs from identity
Nov 11 2024 08:58:20 ASA : %ASA-7-609002: Teardown local-host management:CSSM duration 0:00:00