Cluster AG behind F5

[islam_zidan]

Hello,

We have a customer who want to deploy 2 CAG behind a F5, they configured an endpoint with a public IP to receive the traffic on port 443 they reroute from the LB to CAGs on port 9999. currently we are getting "OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 104" error even with certificate applied on both AGs.

Anyone faced that before? and what is the recommended configuration for such setup.

Thanks,

Islam 

[DanielS · Accepted solution]

Hello @islam_zidan There are probably many reasons why you might get this. I used to have a similar setup with no issues, what I kept in mind is the following:

• Name-mismatch error: Your certificate is associated with a specific host name. To avoid a name-mismatch error, make sure that the common name (domain name) in the SSL certificate matches the address displayed in the address bar of the browser.
• Do not configure the SSL certificate directly on the device. Do not attempt to configure SSL certificates directly to your Cluster ActiveGate, by uploading them to the device itself. If you do this, the certificate will be overwritten by automatic management performed by Dynatrace. Upload your certificate using the Cluster Management Console or the Cluster REST API v1.
• https://www.dynatrace.com/support/help/shortlink/rum-firewall
• Also we used a Ping/Pong dummy server to test just networking configuration without the added complexity of Dynatrace config.

Hope it helps!