topic SSL Decryption and Cisco Jabber client in General Topics

SSL Decryption and Cisco Jabber client

bgranholm — Wed, 30 Apr 2014 20:44:04 GMT

We currently use Cisco Webex for desktop sharing, video conferencing and IM. Our environment has mostly people using the old Webex connect client and a few 'pilot' users of the Cisco Jabber client.

Recently we implemented SSL Decryption and everything in the webex environment worked fine for the Webex connect client but people using the jabber client cannot send or receive images over IM. I have started a case with Cisco on this, however, their documentation leads me to believe images used to be sent insecurely in the old client and securely in the new client.

I was wondering if there is anyone out there with experience with both Cisco Jabber and SSL Decryption who might be able to shed some insight into this issue?

TIA,

Ben

Re: SSL Decryption and Cisco Jabber client

tasonibare — Fri, 02 May 2014 19:58:10 GMT

Hello Ben,

There are some applications that do not play nice when decryption is turned on, on the PA firewall.

Here is a document with a list of the applications we've already identified that should be excluded from decryption:

List of Applications Excluded from SSL Decryption

It is possible that Cisco Jabber is one of those applications that are not yet on the list, but you could open a ticket with us to investigate this further.

Regards,

tasonibare

Re: SSL Decryption and Cisco Jabber client

bgranholm — Mon, 05 May 2014 14:19:08 GMT

I opened a ticket with Cisco on this one. Seems to me that if file transfer works and desktop sharing and chat all work, then image transfer should work and that would be on their end, hopefully. Maybe that functionality isn't using the windows certificate repository and that is the issue.

I will open a case with Palo Alto only if Cisco cannot hash this out.

Re: SSL Decryption and Cisco Jabber client

bgranholm — Tue, 13 May 2014 19:24:20 GMT

So far Cisco's only real help has been clearing cache and trying newer versions of the client software. But they have escalated it to engineers, so maybe that is a good sign?