topic How to find a URL for session_end_reason eq decrypt-error in General Topics

How to find a URL for session_end_reason eq decrypt-error

thompso104 — Tue, 01 Feb 2022 14:27:31 GMT

I have SSL Decryption and URL Filtering implemented and I see lots of decrypt-errors listed as session_end_reason. Is there a way to see the exact URL that the user was attempting to connect to? That way I can troubleshoot the site and see if an exclusion is needed. Version 9.1.10

Re: How to find a URL for session_end_reason eq decrypt-error

OtakarKlier — Tue, 01 Feb 2022 19:53:50 GMT

Hello,

Check the unified logs to see any activity around the same time and source/destination. You can find the correlated traffic by clicking the magnifying glass icon on the left of the traffic. Sometimes I have to find the source and destination IP and then check the URL logs. You might have to check the DNS logs of your dns server to find out.

Regards,

Re: How to find a URL for session_end_reason eq decrypt-error

BPry — Wed, 02 Feb 2022 01:41:45 GMT

@thompso104,

Just some advice, I personally wouldn't try to chase down potential issues with decryption until a user actually reports something. You'll end up chasing a lot of ad networks and stuff like that which doesn't cause any issues for the user.