topic Extreme Control TLS Alert in ExtremeControl

Extreme Control TLS Alert

RobertD1 — Mon, 15 May 2023 09:09:32 GMT

Hello,

Rather than wasting time troubleshooting the below error I wondered if the Extreme Control Engine will reject older encryption protocols such as SSL V3.0?

Old Windows XP with 802.1x PEAP:

Event:

eap_peap: TLS Alert write:fatal:handshake failure eap_peap: Failed in __FUNCTION__ (SSL_read): error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher eap_peap: System call (I/O) error (-1) eap_peap: TLS receive handshake failed during operation

Thanks,

Rob

Re: Extreme Control TLS Alert

Ryan_Yacobucci — Mon, 15 May 2023 12:12:48 GMT

Hello Robert,

This is likely the case.
https://extremeportal.force.com/ExtrArticleDetail?an=000066220

I will need to get this article modified. You can test the appliance property in the article, but I believe at this point these ciphers have been completely deprecated and are not available for use at all.

Thanks
-Ryan

Re: Extreme Control TLS Alert

Robert_Haynes — Mon, 15 May 2023 12:13:04 GMT

Correct. Control will reject any SSLv3 based encipherment. It will also reject a core list of now defunct / legacy ciphers from older clients as listed in GTAC KB @ https://extremeportal.force.com/ExtrArticleDetail?an=000100637.

Re: Extreme Control TLS Alert

Ryan_Yacobucci — Mon, 15 May 2023 12:14:17 GMT

A more recent article:

https://extremeportal.force.com/ExtrArticleDetail?an=000100637

Thanks
-Ryan

Re: Extreme Control TLS Alert

Robert_Haynes — Mon, 15 May 2023 12:15:49 GMT

... take a trace of the PEAP connection to expose the ciphers the client is requesting and compare against what is set as seen in the NSJBoss.properties 'tomcat.ciphers' entry.

Re: Extreme Control TLS Alert

RobertD1 — Mon, 15 May 2023 14:00:05 GMT

Thanks Robert!

Based on your response it does look like the issue is that neither the client or server can agree on a cipher to use after taking a capture of the client hello.

Trace shows client hello...

The enterasys.tomcat.ciphers list:

enterasys.tomcat.ciphers=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256

Re: Extreme Control TLS Alert

Robert_Haynes — Tue, 16 May 2023 12:13:23 GMT

Thank you for the trace. The client cipher list presented is wholly deprecated at this point, a collection of RC4 (cryptographically weak), CBC (Beast/Poodle Attacks) and defunct EXPORT ciphers. OpenSSL long ago deprecated these ciphers which our Control appliance uses.