Splunk_TA_cisco-ips handshake failure

[szaboszilard]

Hello

After upgrading my cisco ips from 7.1(6)E4 to 7.1(10)E4 I get these error messages from get_ips_feed.py in Splunk_TA_cisco-ips add-on.

Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/get_ips_feed.py", line 295, in <module>
    run(sys.argv[1],sys.argv[2],sys.argv[3],sys.argv[4],"https","yes")
  File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/get_ips_feed.py", line 116, in run
    sdee.open()
  File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 187, in open
    self._request(params)
  File "/opt/splunk/etc/apps/Splunk_TA_cisco-ips/bin/pysdee/pySDEE.py", line 163, in _request
    data = urllib2.urlopen(req)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 127, in urlopen
    return _opener.open(url, data, timeout)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 404, in open
    response = self._open(req, data)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 422, in _open
    '_open', req)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 382, in _call_chain
    result = func(*args)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 1222, in https_open
    return self.do_open(httplib.HTTPSConnection, req)
  File "/opt/splunk/lib/python2.7/urllib2.py", line 1184, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [Errno 1] _ssl.c:527: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure>

Upgrading ips addon to 2.1.2 to 2.1.4 don't resolve connection problem to my IPS. The credential are OK, using curl with --insecure mode i gen get over the handshake. Splunk was restarted, machine was restarted. Any idea how can i resolve this?

[jcoates_splunk · Accepted solution]

perhaps try TLS? http://docs.splunk.com/Documentation/AddOns/latest/CiscoIPS/Troubleshooting