topic Re: Issues with SSL Forward Proxy in Lab Environment in General Topics

Issues with SSL Forward Proxy in Lab Environment

benball — Sun, 31 Oct 2021 00:47:09 GMT

Hi!

I've recently been trying to setup decryption on my PA-220 in a lab environment and have not been able to get it set up correctly so far. It is licensed, up-to-date, and currently running 8.1

The steps that I've taken so far are to setup a decryption policy (the settings of which are included above), generate a self-signed certificate, set that certificate as the Forward Trust Certificate, commit and install the certificate onto one of the machine's.

However, after each attempt, I'm getting the above traffic; I seemingly get an allow followed by a policy-deny against the interzone-default.

Does anyone have any ideas what I may be doing incorrectly? Any help is greatly appreciated.

Thanks!

Additionally, I'm including my general setup below. If any additional information is needed, feel free to ask.

Re: Issues with SSL Forward Proxy in Lab Environment

TomYoung — Sun, 31 Oct 2021 03:58:31 GMT

Hi @benball ,

This is very common with PAN-OS 8.1 and below. Once the traffic is decrypted, the NGFW recognizes the decrypted application as web-browsing. Web-browsing on tcp/443 does not match any of your rules and therefore is dropped by the interzone-default rule.

Create a new rule to allow web-browsing on service-https, and your configuration will work. This means that you configured decryption correctly! [Edit yet again.] Now that you are decrypting traffic, your NGFW will recognize many more web apps like facebook, google, etc. So, you may as well allow any app outbound on 443 until you decide if you will build a full whitelist.

PAN-OS 9.0 added secure ports to applications so that web-browsing with application-default will work with SSL decryption and you do not need to create a separate rule. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-release-information/features-introduced-in-pan-os-9-0/app-id-features.html#id1787EF00LF4

Thanks,

Tom

PS You can also add the Decrypted column in the traffic logs to verify if the NGFW is decrypting traffic.

Re: Issues with SSL Forward Proxy in Lab Environment

benball — Sun, 31 Oct 2021 15:11:07 GMT

Thank you for the help! That was the problem. I updated to PAN OS 9.0 and everything worked as expected.