Cluster AG behind F5

Islam_Zedan — Wed, 09 Aug 2023 12:27:35 GMT

Hello,

We have a customer who want to deploy 2 CAG behind a F5, they configured an endpoint with a public IP to receive the traffic on port 443 they reroute from the LB to CAGs on port 9999. currently we are getting "OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 104" error even with certificate applied on both AGs.

Anyone faced that before? and what is the recommended configuration for such setup.

Thanks,

Islam

Re: Cluster AG behind F5

DanielS — Thu, 10 Aug 2023 17:34:58 GMT

Hello @Islam_Zedan There are probably many reasons why you might get this. I used to have a similar setup with no issues, what I kept in mind is the following:

Name-mismatch error: Your certificate is associated with a specific host name. To avoid a name-mismatch error, make sure that the common name (domain name) in the SSL certificate matches the address displayed in the address bar of the browser.
Do not configure the SSL certificate directly on the device. Do not attempt to configure SSL certificates directly to your Cluster ActiveGate, by uploading them to the device itself. If you do this, the certificate will be overwritten by automatic management performed by Dynatrace. Upload your certificate using the Cluster Management Console or the Cluster REST API v1.
https://www.dynatrace.com/support/help/shortlink/rum-firewall
Also we used a Ping/Pong dummy server to test just networking configuration without the added complexity of Dynatrace config.

Hope it helps!

topic Re: Cluster AG behind F5 in Dynatrace Managed Q&A

Cluster AG behind F5

Re: Cluster AG behind F5