topic decrypt-unsupport-param error with no decryption in General Topics

decrypt-unsupport-param error with no decryption

Claw4609 — Tue, 27 Jun 2023 18:56:01 GMT

We are receiving a decrypt-unsupport-param to a specific destination with no ssl inspection applied. I created a no decrypt rule and didnt apply a decryption profile so we weren't checking for expired or untrusted certs either. There is also nothing in the decryption logs for this destination IP address (we only log on failure)

If I filter and check the counters in the firewall I am met with TCP sessions closed via injecting RST. I can not find an indication as to why we are actually hitting an error with this site. This is a public site that we do not host.

In the traffic logs it shows action allow, type deny, session end reason decrypt-unsupport-param error

Re: decrypt-unsupport-param error with no decryption

JayGolf — Wed, 28 Jun 2023 06:28:33 GMT

Hi @Claw4609 ,

Which PAN-OS version are you currently running? I would triple-check to make sure you currently do not have any decryption policies created that could catch this traffic.

Re: decrypt-unsupport-param error with no decryption

Claw4609 — Wed, 28 Jun 2023 12:11:42 GMT

Hello @JayGolf ,

We're running Pan-OS 10.2.3. To ensure it wasnt hitting a decrypt rule I placed a no decrypt decryption policy at the top with the destination of the IP address, with no decryption profile attached.

Re: decrypt-unsupport-param error with no decryption

Claw4609 — Wed, 28 Jun 2023 12:58:12 GMT

And for whatever reason the site it working today. If worked from devices outside of the network perfectly fine so the site itself was functioning fine. So no idea why it wasnt working yesterday but it is today.

Re: decrypt-unsupport-param error with no decryption

SandipSingh — Fri, 12 Apr 2024 07:35:39 GMT

I too have the same issue, can anyone suggest the solutions on this.

Re: decrypt-unsupport-param error with no decryption

CPayne4 — Fri, 12 Jul 2024 17:40:41 GMT

We had this issue. Palo support said that the issue observed matches one of the known reports with the engineering team.

They upgraded all Prisma portals and gateway instances to the fixed version 10.2.4-h19 to resolve the issue.