Wireless Access

After upgrading my 7210's to 6.3.1.2 I get error message: "Sever Connection Failed. SSL peer reports incorrect Message Authentication Code. (Error code: ssl_error_bad_mac_alert)." I've tried deleting my certificate database and adding the cert back in, but keep getting the same message. We also changed the IP's on the controllers from using the loopback IP to using the management VLAN IP to try and resolve a separate issue.

On another note, I just finished upgrading Airwave to 7.7.9 and Firefox just shows a blank screen when trying to connect to Airwave.

So now Firefox doesn't work with my controllers or Airwave. Internet Explorer works fine with the new versions.

Anyone else experiencing this?

#7210

I just put in a TAC case on mine, having the same issues after an upgrade to 6.3.1.3.

 

I re-tried using Safari instead of firefox and it worked fine.  Only the 7240s had this issue, the M3s worked fine.

Me too. I thought this was just me. My M3s are OK also as are my 620s running the same release of code. Internet explorer will, well..., display anything and still works in so far as it does not format the display correctly, but internet explorer is like that for me on multiple products not just Aruba.

Try this... In the Firefox browser’s address field, type “about:config” and enter ,then web page will be shown, Click on “I’ll be careful, I promise”. A list of all the configurable entities and associated values are shown in the browser, in the ‘search:’ field in the top, type ‘ssl3’ and enter, List of cipher suites will be displayed. Find the row with ‘security.ssl3.dhe_rsa_des_ede3_sha’ and this will be set to ‘true’ in the fourth column, change the value to ‘false’ by double clicking on fourth column. Refresh the browser setting using the ‘reload’ icon in address field, Close the browser and rerun it. Cheers! Mo

This is a known issue.  Please open up a case.  Support can implement a workaround.  

Hi,

 

Instead of all having to open the TAC cases about the same issue, can someone please post the necessary steps, here?

 

Thanks.

garryshtern,

 

Support has to do it for you, unfortunately.

 

Well... I just posted the workaround. If you want, go open a case. If you don't want to open a case, just follow what I said. It works!

 

 

Cheers!

 

 

Mo

Thanks, Mo!  That def worked.

Thanks for the replies. I tried the posted workaround but still receive the error. I'll just use IE until the issue is resolved.

Thanks Mo, it works

It worked thanks.  I used a shortcut and instead of first searching for ssl just searched for security.ssl3.dhe_rsa_des_ede3_sha and then double clicked it and it changed it to false.  Thanks again.

 

Ian

 

We're getting tired of having to spend large amounts of our time opening TAC cases and working with TAC for work arounds for Aruba bugs. Either Abuga (new name suggesting) needs to drastically improve it's QA process or it's going to have to start providing compensation to all of the customers QAing Abuga's products for them.

I agree. Our department spends a lot of time working out bugs, with Aruba, for features that should be working from the start. 

I must concede my "workarounds" directory is rather comprehensive :(

Thanks for the work around MO, but I am curious does anyone if the work around provided by MO different than the work around provided by TAC.

just wondering is this solved in 6.3.1.4, i notice this in the release notes

---

96465 Symptom: Some cipher suites were not working when the operations were offloaded to hardware. This issue was resolved by disabling the cipher suites which were not working with the hardware engine.
Symptom: This issue was observed during any crypto operation that uses DH key exchange.

---

the management i dont care too much about, always another browser around and i can understand it. but i saw the same error on the captive portal, that is more annoying as the guest users are probably a little less likely to solve it themselves and it makes the product look bad.

there is a workaround fix (that TAC can apply) on the controller side that removes the affected cipher suites so the aruba controller doesn't offer them and takes care of the negotiation bug.  this is different than the per-browser firefox fix.  this should be properly fixed in a future release but i don't have any info on a specific release yet.

I did test it for 6.3.1.4 and it works. Not sure about the impact on Captive Portal though.

 

Mo

The problem is with Firefox 27+. Version 26 works fine. I had downrevved Firefox, but Mo's solution works well.

Thanks a lot for the workaround in about:config, it worked !

I appreciate your frustration, seriously I do; but you have to direct this kind of feedback to your SE and account manager. This is the only way you'll make constructive progress. Like I say I do appreciate where you're coming from. Forums are not going to be a productive place for this kind of stuff. Please don't be offended.

Hi Nik,

 

I'm not offended. I do disagree though. I believe forums are the perfect medium for this kind of stuff.

Glad to know it is fixed in 6.3.14. I was trying to confirm that as well. It should be fixed for all https access to the controller both management and captive portal.

i can confirm it indeed works with 6.3.1.4 and ff 27 for both captive portal and management.