topic ssl-inbound inspection problem in General Topics

ssl-inbound inspection problem

porq91 — Sun, 04 Sep 2022 20:19:17 GMT

Hello everyone.

i'm configuring decryption with ssl-inbound inspection towards a nas synology via DNAT port-forwarding but i'm having trouble working with the following error that gives me the browser "PR_END_OF_FILE_ERROR". DNAT without ssl-inbound inspection works fine without certificate errors if I try to reach the web server from outside.

I have imported the certificate and the priv-key of the synology correctly on the fw and applied to the decryption policy, but I doubt that the zone-level decryption policy is wrong.

I post a couple of screens for completeness, decrypt, nat, security and logs

Actually topology: internet--->router(dnat to ptp-fw)--->FW(dnat to synology TCP 5001)---->SYNOLOGY

Thanks in advice,

Angelo.

Re: ssl-inbound inspection problem

nikoolayy1 — Mon, 05 Sep 2022 15:27:29 GMT

There are other posts for such issues and you can google them but "PTP-FW-WAN2" is the destination address in your nat and security policies and for the security policy I think it should the translated internal zone address "SYNLOGY-NAC-...".

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/nat/nat-policy-rules/nat-policy-overview

If you still have issues see drop packet captures, global counters, flow basic etc:

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-palo-alto-checking-for-drops-rejects-discards/td-p/402102

Still check that the app is indeed using normal SSL and that it is not using pinned SSL certs that can't be decrypted. You can look at the SSL logs:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloUCAS

Re: ssl-inbound inspection problem

nikoolayy1 — Thu, 13 Oct 2022 21:24:23 GMT

If you managed to get the needed answers, please flag the question as answered.