All Apps and Add-ons

Splunk_TA_cisco-ips handshake failure

szaboszilard
Path Finder

Hello

After upgrading my cisco ips from 7.1(6)E4 to 7.1(10)E4 I get these error messages from get_ips_feed.py in Splunk_TA_cisco-ips add-on.

Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/get_ips_feed.py", line 295, in <module>
    run(sys.argv[1],sys.argv[2],sys.argv[3],sys.argv[4],"https","yes")
  File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/get_ips_feed.py", line 116, in run
    sdee.open()
  File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 187, in open
    self._request(params)
  File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 163, in _request
    data = urllib2.urlopen(req)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 127, in urlopen
    return _opener.open(url, data, timeout)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 404, in open
    response = self._open(req, data)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 422, in _open
    '_open', req)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 382, in _call_chain
    result = func(*args)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 1222, in https_open
    return self.do_open(httplib.HTTPSConnection, req)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 1184, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [Errno 1] _ssl.c:527: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure>

Upgrading ips addon to 2.1.2 to 2.1.4 don't resolve connection problem to my IPS. The credential are OK, using curl with --insecure mode i gen get over the handshake. Splunk was restarted, machine was restarted. Any idea how can i resolve this?

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...