Palo Alto Application ms-office365-base not working

Stellinger — Thu, 16 Nov 2023 08:18:28 GMT

Hello Everybody,

i thought i try the community for a change with my problem.

One of our departments recently asked for a policy change, so their server could access a ressource in the internet.

The rule is as simple as it gets. Source is their Server, Destination is a FQDN, Application SSL. (we don't decrypt). We already had a policy which allowed access to another FQDN which works perfectly fine.

With the new Destination though the palo alto recognizes the application as ms-office365-base. Even though communication is ssl encrypted. I read, that the palo can detect applications through ssl decryption and that i have to add that application to that policy for it to work.

Sooo i did exactly that and now i have a new weird problem. Connections are still denied. If i test the policy with ms-office365-base as application i land on the deny rule. If i change the app to ssl and leave the rest in the policy tester it works perfectly fine and matches my rule.

Any Idea what could be the Problem?

Re: Palo Alto Application ms-office365-base not working

JayGolf — Fri, 17 Nov 2023 01:41:12 GMT

Hi @Stellinger ,

When you go onto the monitor tab and click on the detailed log view, does the traffic show the Decrypted flag checked?

Re: Palo Alto Application ms-office365-base not working

Stellinger — Mon, 20 Nov 2023 08:56:08 GMT

Hi, sorry for the late reply,

Nope no decrypted flag set here.

topic Re: Palo Alto Application ms-office365-base not working in General Topics

Palo Alto Application ms-office365-base not working

Re: Palo Alto Application ms-office365-base not working

Re: Palo Alto Application ms-office365-base not working