topic Re: Response Page for virus (e.g. Eicar test) when using SSL inspection in General Topics

Response Page for virus (e.g. Eicar test) when using SSL inspection

nickcx1 — Thu, 26 Sep 2013 14:43:54 GMT

As the title suggests, I'm getting to grips with SSL decryption (which is working fine). We use a response pages for a virus notices and I'm testing the eicar site (Download ° EICAR - European Expert Group for IT-Security). Over HTTPS the 'virus' is blocked however I don't receive a response page, whereas I do for HTTP. I have tried having a play with the the options here (though not quite the same) How to Configure the Palo Alto Networks Device to Serve a URL Response page Over an HTTPS Session without SSL Decryption but no joy.

Reading posts on here it's similar to this problem (No Malware Block Page When Using SSL Decryption), but any advice would be gratefully received. I'm sure I'm missing something simple.

PanOS 4.1.14 - PA200.

Re: Response Page for virus (e.g. Eicar test) when using SSL inspection

kadak — Thu, 26 Sep 2013 15:52:04 GMT

Hello Nick,

Could you please provide us the output for:

# show deviceconfig setting ssl-decrypt

I am trying to replicate this issue on 5.0.7 to see what behavior I get.

Regards,

Kunal Adak

Re: Response Page for virus (e.g. Eicar test) when using SSL inspection

nickcx1 — Thu, 26 Sep 2013 15:57:35 GMT

Kunal,

admin@PA-200# show deviceconfig setting ssl-decrypt

ssl-decrypt {

url-proxy yes;

crl yes;

crl-receive-timeout 5;

ocsp yes;

ocsp-receive-timeout 5;

block-unknown-cert yes;

block-timeout-cert no;

cert-status-timeout 5;

}

Additionally, if of use:

admin@PA-200> show system setting ssl-decrypt setting

vsys : vsys1

Forward Proxy Ready : yes

Inbound Proxy Ready : no

Disable ssl : no

Disable ssl-decrypt : no

Notify user : no

Proxy for URL : yes

Wait for URL : no

Deny session if setup fails : no

Block revoked Cert : yes

Block timeout Cert : no

Block unknown Cert : yes

Cert Status Query Timeout : 5

URL Category Query Timeout : 5

Use Cert Cache : yes

Verify CRL : yes

Verify OCSP : yes

CRL Status receive Timeout : 5

OCSP Status receive Timeout : 5

Thanks!

Re: Response Page for virus (e.g. Eicar test) when using SSL inspection

Retired Member — Fri, 27 Sep 2013 19:13:57 GMT

We are using this as education in every lab.

Also I tried this today, no problem.

Better you open a case.