由于防火墙发送的 RST，SSL/TLS 握手失败
适用于
- ONTAP 9
- SSL/TLS 握手
- OpsRamp
- Palo Alto Firewall
问题描述
- 客户端无法与 ONTAP 执行 SSL/TLS 握手
- OpsRamp 监控工具由于错误无法执行 NetApp 发现并关闭 SSL 连接
No peer certificate available: The client did not receive a certificate from the server, which is required for SSL/TLS handshake
- ONTAP 数据包跟踪显示 ONTAP 发送
Server Hello到客户端 IP/防火墙 MAC，然后客户端 IP/防火墙 MAC 发送RST - 客户端数据包跟踪显示客户端未收到
Server Hello，而是从 ONTAP IP/防火墙 MAC 接收RST - 如果 LIF 的相同子网中的客户端尝试 TLS 握手，则成功，因为防火墙不在客户端和 LIF 之间
[fchen@localhost ~]$ openssl s_client -connect 10.216.29.203:443 CONNECTED(00000004) depth=0 CN = nas-cm913, C = US verify error:num=18:self signed certificate verify return:1 depth=0 CN = nas-cm913, C = US verify error:num=10:certificate has expired notAfter=Sep 28 20:08:03 2024 GMT verify return:1 depth=0 CN = nas-cm913, C = US notAfter=Sep 28 20:08:03 2024 GMT verify return:1 --- Certificate chain 0 s:CN = nas-cm913, C = US i:CN = nas-cm913, C = US --- Server certificate -----BEGIN CERTIFICATE-----