Getting TLS error with FOS9.0.1c & HTTPS TLSv1.3

[autocoder10]

Hello, I am getting the below TLS error when running the gather facts playbook on Gen7 switch with FOS v9.0.1c and HTTPS TLSv1.3. Can you please let me know how to fix this issue.

Kernel: 4.1.35rt41 Fabric OS: v9.0.1c

TLS Protocol: HTTPS : TLSv1.3

TASK [gather facts] **** task path: /var/lib/awx/tmp/awx_230418_uck8xlwe/project/get_zones.yml:10 The full traceback is: Traceback (most recent call last): File "/usr/lib64/python3.6/urllib/request.py", line 1349, in do_open encode_chunked=req.has_header('Transfer-encoding')) File "/usr/lib64/python3.6/http/client.py", line 1254, in request self._send_request(method, url, body, headers, encode_chunked) File "/usr/lib64/python3.6/http/client.py", line 1300, in _send_request self.endheaders(body, encode_chunked=encode_chunked) File "/usr/lib64/python3.6/http/client.py", line 1249, in endheaders self._send_output(message_body, encode_chunked=encode_chunked) File "/usr/lib64/python3.6/http/client.py", line 1036, in _send_output self.send(msg) File "/usr/lib64/python3.6/http/client.py", line 974, in send self.connect() File "/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/urls.py", line 430, in connect File "/usr/lib64/python3.6/ssl.py", line 365, in wrap_socket _context=self, _session=session) File "/usr/lib64/python3.6/ssl.py", line 776, in init self.do_handshake() File "/usr/lib64/python3.6/ssl.py", line 1036, in do_handshake self._sslobj.do_handshake() File "/usr/lib64/python3.6/ssl.py", line 648, in do_handshake self._sslobj.do_handshake() ssl.SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:877)

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/home/awx/.ansible/tmp/ansible-tmp-1657915961.4039485-10-196938600716432/AnsiballZ_brocade_facts.py", line 102, in _ansiballz_main() File "/home/awx/.ansible/tmp/ansible-tmp-1657915961.4039485-10-196938600716432/AnsiballZ_brocade_facts.py", line 94, in _ansiballz_main invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS) File "/home/awx/.ansible/tmp/ansible-tmp-1657915961.4039485-10-196938600716432/AnsiballZ_brocade_facts.py", line 40, in invoke_module runpy.run_module(mod_name='ansible.modules.brocade_facts', init_globals=None, run_name='main', alter_sys=True) File "/usr/lib64/python3.6/runpy.py", line 205, in run_module return _run_module_code(code, init_globals, run_name, mod_spec) File "/usr/lib64/python3.6/runpy.py", line 96, in _run_module_code mod_name, mod_spec, pkg_name, script_name) File "/usr/lib64/python3.6/runpy.py", line 85, in _run_code exec(code, run_globals) File "/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/modules/brocade_facts.py", line 495, in File "/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/modules/brocade_facts.py", line 269, in main File "/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/brocade_connection.py", line 54, in login File "/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/brocade_url.py", line 242, in url_helper File "/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/urls.py", line 1390, in open_url File "/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/urls.py", line 1294, in open File "/usr/lib64/python3.6/urllib/request.py", line 223, in urlopen return opener.open(url, data, timeout) File "/usr/lib64/python3.6/urllib/request.py", line 526, in open response = self._open(req, data) File "/usr/lib64/python3.6/urllib/request.py", line 544, in _open '_open', req) File "/usr/lib64/python3.6/urllib/request.py", line 504, in _call_chain result = func(args) File "/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/urls.py", line 448, in https_open File "/usr/lib64/python3.6/urllib/request.py", line 1351, in do_open raise URLError(err) urllib.error.URLError: <urlopen error [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:877)> fatal: [testswitch]: FAILED! => { "changed": false, "module_stderr": "Traceback (most recent call last):\n File \"/usr/lib64/python3.6/urllib/request.py\", line 1349, in do_open\n encode_chunked=req.has_header('Transfer-encoding'))\n File \"/usr/lib64/python3.6/http/client.py\", line 1254, in request\n self._send_request(method, url, body, headers, encode_chunked)\n File \"/usr/lib64/python3.6/http/client.py\", line 1300, in _send_request\n self.endheaders(body, encode_chunked=encode_chunked)\n File \"/usr/lib64/python3.6/http/client.py\", line 1249, in endheaders\n self._send_output(message_body, encode_chunked=encode_chunked)\n File \"/usr/lib64/python3.6/http/client.py\", line 1036, in _send_output\n self.send(msg)\n File \"/usr/lib64/python3.6/http/client.py\", line 974, in send\n self.connect()\n File \"/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/urls.py\", line 430, in connect\n File \"/usr/lib64/python3.6/ssl.py\", line 365, in wrap_socket\n _context=self, _session=session)\n File \"/usr/lib64/python3.6/ssl.py\", line 776, in init\n self.do_handshake()\n File \"/usr/lib64/python3.6/ssl.py\", line 1036, in do_handshake\n self._sslobj.do_handshake()\n File \"/usr/lib64/python3.6/ssl.py\", line 648, in do_handshake\n self._sslobj.do_handshake()\nssl.SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:877)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/home/awx/.ansible/tmp/ansible-tmp-1657915961.4039485-10-196938600716432/AnsiballZ_brocade_facts.py\", line 102, in \n _ansiballz_main()\n File \"/home/awx/.ansible/tmp/ansible-tmp-1657915961.4039485-10-196938600716432/AnsiballZ_brocade_facts.py\", line 94, in _ansiballz_main\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n File \"/home/awx/.ansible/tmp/ansible-tmp-1657915961.4039485-10-196938600716432/AnsiballZ_brocade_facts.py\", line 40, in invoke_module\n runpy.run_module(mod_name='ansible.modules.brocade_facts', init_globals=None, run_name='main', alter_sys=True)\n File \"/usr/lib64/python3.6/runpy.py\", line 205, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib64/python3.6/runpy.py\", line 96, in _run_module_code\n mod_name, mod_spec, pkg_name, script_name)\n File \"/usr/lib64/python3.6/runpy.py\", line 85, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/modules/brocade_facts.py\", line 495, in \n File \"/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/modules/brocade_facts.py\", line 269, in main\n File \"/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/brocade_connection.py\", line 54, in login\n File \"/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/brocade_url.py\", line 242, in url_helper\n File \"/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/urls.py\", line 1390, in open_url\n File \"/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/urls.py\", line 1294, in open\n File \"/usr/lib64/python3.6/urllib/request.py\", line 223, in urlopen\n return opener.open(url, data, timeout)\n File \"/usr/lib64/python3.6/urllib/request.py\", line 526, in open\n response = self._open(req, data)\n File \"/usr/lib64/python3.6/urllib/request.py\", line 544, in _open\n '_open', req)\n File \"/usr/lib64/python3.6/urllib/request.py\", line 504, in _call_chain\n result = func(args)\n File \"/tmp/ansible_brocade_facts_payload_z7l6sj_i/ansible_brocade_facts_payload.zip/ansible/module_utils/urls.py\", line 448, in https_open\n File \"/usr/lib64/python3.6/urllib/request.py\", line 1351, in do_open\n raise URLError(err)\nurllib.error.URLError: <urlopen error [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:877)>\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1 }

PLAY RECAP ***** testswitch : ok=0 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0

[autocoder10]

@daniel-chung-broadcom @raghavbrocade Can someone please help me with this error. Thanks!!

[prasad-valmeti-broadcom]

Could you please confirm the openssl version that you are using on ANSIBLE server?

FOS switches support openssl 1.1.1d from 9.0.x onwards. So TLS1.3 is supported on FOS switches. To resolve this issue, could you please check the following on the server that has ANSIBLE scripts: openssl version python upgrade it to 3.8.5 version. install requests[security]

Could you please follow the link below and see if it helps to resolve the issue: https://stackoverflow.com/questions/44316292/ssl-sslerror-tlsv1-alert-protocol-version

[autocoder10]

Thanks for the info. Let me check with our Ansible team on the details.

[prasad-valmeti-broadcom]

Did you get the details of the version of the software used on the Ansible server? Could you please share with us?

[autocoder10]

Sorry, for the delayed reply. I have checked with our internal Ansible team and they mentioned they have plans to update python later in the year. So, I worked with Our switch support vendor and updated the TLS version from 1.3 to 1.2 for HTTPS on the new switches. Once updated the config it worked.

[prasad-valmeti-broadcom]

Could you please let us know if we can close this issue since the issue is resolved?

[autocoder10]

Sorry for the late reply. Yes, we can close this issue for now.