Polling Tentacle not work with F5 VIP - Unable to receive remote identity; identity line empty

Octopus 3.7.3 (both server & client) HA install - 2 server nodes behind internal F5 VIP, using internal CA issued SSL cert. No issue with Tentacle in Listen mode.

But for Poll mode, got ’ Unable to receive the remote identity; the identity line was empty’. Details below. If change Tentacle to poll directly from server instead VIP (by adding local host entry of server IP), then the error goes away. Something got lost when F5 is involved.

2017-01-24 15:56:00.4042 8 INFO https://octopus.starbucks.net:10943/ 8 Opening a new connection
2017-01-24 15:56:00.4510 8 INFO https://octopus.starbucks.net:10943/ 8 Performing TLS handshake
2017-01-24 15:56:00.5602 8 INFO https://octopus.starbucks.net:10943/ 8 Secure connection established. Server at [::ffff:10.13.252.55]:10943 identified by thumbprint: 8DFDEE813A9A43914EA170C93D07EE08B570348E, using protocol Tls12
2017-01-24 15:56:00.6070 8 INFO https://octopus.starbucks.net:10943/ 8 Unable to receive the remote identity; the identity line was empty.
Halibut.Transport.Protocol.ProtocolException: Unable to receive the remote identity; the identity line was empty.
at Halibut.Transport.Protocol.MessageExchangeStream.ReadRemoteIdentity()
at Halibut.Transport.Protocol.MessageExchangeStream.ExpectServerIdentity()
at Halibut.Transport.Protocol.MessageExchangeProtocol.ExchangeAsSubscriber(Uri subscriptionId, Func2 incomingRequestProcessor, Int32 maxAttempts) at Halibut.Transport.SecureClient.ExecuteTransaction(Action1 protocolHandler)
Halibut.Transport.Protocol.ProtocolException: Unable to receive the remote identity; the identity line was empty.
at Halibut.Transport.Protocol.MessageExchangeStream.ReadRemoteIdentity()
at Halibut.Transport.Protocol.MessageExchangeStream.ExpectServerIdentity()
at Halibut.Transport.Protocol.MessageExchangeProtocol.ExchangeAsSubscriber(Uri subscriptionId, Func2 incomingRequestProcessor, Int32 maxAttempts) at Halibut.Transport.SecureClient.ExecuteTransaction(Action1 protocolHandler)

Hi,

From your logs we are opening a successful SSL connection, but the server doesn’t provide the correct response to the first request made, which may indicate something interfering with the message stream.

Problems like these are often caused if the F5 is doing any sort of SSL off-loading. Can you check that SSL is tunneled directly through to the Octopus Server?

Regards,
Mark

Mark - Thanks for the response! Sorry for the delayed follow-up (I was out-of-office). I’ve just passed on your suggestion to our network team. Will get back to you soon.

I’ve confirmed that the issue is resolved after removing SSL off-loading on F5.