cancel
Showing results for 
Search instead for 
Did you mean: 

https failing, but not other, more basic protocols.

Highlighted
New Contributor

https failing, but not other, more basic protocols.

This issue has been perplexing me for some time, and I am running out of ideas, so here goes:

I recently stood up an SA-4500 (6.5r6) in a remote office (India) as a point of ingress for local users to access local resources more quickly.

Ever since we have deployed this appliance in the field, I have gotten some very strange behavior out of it.

1.  I can ping and traceroute it by name and IP.

2.  nslookups resolve.

3.  http redirect works

https fails, but not across the board.  Half of our users get sign-in pages just fine.  The other half just time out.

Doing a packet trace from a failed client, I see the SSL client hello send out, but no SSL server hello return.  

I have run TCP dumps on the IVE, and I see server hellos attempting to go out, but It just retransmits as if it cannot reach the client.

The network setup is simple - a single router and switch comprise the edge (only one simple inbound access list that should not affect SSLVPN).  The IVE is plugged into the switch.  I removed the ACL just in case, and the same behavior occured.

I have adjusted the IVE for what TLS/SSL settings it accepts, and no change. 

I have flattened the box to a factory state (6.3r7), and put on a bare-bones config - no change.

I set up an https web server on a switch on the same network and tested.  All clients could connect to it.

Ideas?  Thanks in advance.