topic Exclude www.google.* from decryption in General Topics

Exclude www.google.* from decryption

Hithead — Tue, 26 Mar 2013 09:16:14 GMT

Hello,

are you able to exculde https://www.google.com ; https://www.google.de and other domains from SSL decryption?

Or clients complain about the slow loading of the website when they open Google or try to search something.

Currently i add in a white custom URL category:

www.google.com

www.google.com/

www.google.com/*

www.google.*

www.google.*/

www.google.*/*

and still the PA decrypt the traffic. If i try the policy from our location in US, it works (www.google.com). But if i try it from Germany - or other locations - the white list don't take affect.

Do you also have a slow loading of www.google.* if you enable ssl decyption?

Re: Exclude www.google.* from decryption

mikand — Tue, 26 Mar 2013 19:56:04 GMT

If Im not mistaken you are supposed to use the stuff mentioned in the CN part of the cert being used at the server. Thats the only way PA can identify which site you are trying to reach when using HTTPS without actually decrypt anything.

Also it sounds strange that only google would be "slow".

Which hardware and panos do you use?

I know that PA-2000 series uses mgmtplane to generate the mitm-certs on the fly so in case mgmtplane is at 100% cpu then generating these mitm-certs would take an additional second(s) to complete and the client would experience this as a "slow" connection. However once terminated (since these certs I belienve are being cached) the speed should be good.

Other things to look into is how many bits the CA-cert is using (which will affect the time it takes to generate the mitm-cert on the fly).

Re: Exclude www.google.* from decryption

Hithead — Wed, 27 Mar 2013 12:57:39 GMT

Hi,

the thing is: www.google.(whatever) loads slow. Some second delay. Also when established once a connection (Google open in your browser and search again something).

And yes, we are using the "powerful" and "stable" PA2000 series......with 5.0.3.....In the last versions the problem was also available....

Checked the bits: With/Without Decryption - www.google.de - 1024

Checked also hotmail.com: With Decryption: 1024 Without: 2048

(btw we using PA generated certificate for the ssl-decryption)

Whatever, i though to exclude the URL www.google.* as a workaround. But with my entries in the URL whitelist the PA still decrypt the session...?!

Re: Exclude www.google.* from decryption

ewilen — Thu, 25 Apr 2013 20:26:47 GMT

Possibly this document will help:

What I take away from it is that if you want to exclude a site from decryption, you need to create a custom URL category that lists that site by ip address (page 3) not by name.

Re: Exclude www.google.* from decryption

Hithead — Fri, 26 Apr 2013 08:56:26 GMT

I know its possible to exclude websites from decryption by adding the IP address....But i don't want to use IP address. Really need to exculde the URL www.google.* ...

Re: Exclude www.google.* from decryption

ewilen — Fri, 26 Apr 2013 16:55:32 GMT

I understand--I'm dealing with a similar issue myself. I'm working with support, and if I can get a config working I'll update this thread.

Re: Exclude www.google.* from decryption

Hithead — Mon, 06 May 2013 07:49:02 GMT

Thanks. Will be helpful!

Re: Exclude www.google.* from decryption

oneidanation — Mon, 03 Jun 2013 17:32:55 GMT

You can exclude URLs by creating a Custom URL Category and add the sites into that URL Category then use the custom URL Category in your do not decrypt rule.

Re: Exclude www.google.* from decryption

Hithead — Tue, 04 Jun 2013 12:14:22 GMT

yes, i know...

thats my problem in this thread....its not possible.

Re: Exclude www.google.* from decryption

goku123 — Tue, 04 Jun 2013 13:14:30 GMT

Hi,

You could try to import cert used by google on the german site onto the PA device and then select the usage as "SSL Exclude Certificate" & see if you could prevent it from being decrypted.

Re: Exclude www.google.* from decryption

Hithead — Thu, 06 Jun 2013 11:36:40 GMT

Hi,

no it doesn't work. Whatever, our clients become accustomed to wait few seconds.

Re: Exclude www.google.* from decryption

ericgearhart — Thu, 06 Jun 2013 11:41:40 GMT

Hithead wrote:

And yes, we are using the "powerful" and "stable" PA2000 series......with 5.0.3.....In the last versions the problem was also available....

I hope you're being sarcastic here The PA2000 series is neither powerful nor stable in my experience

Re: Exclude www.google.* from decryption

Hithead — Thu, 06 Jun 2013 11:56:49 GMT

egearhart wrote:

Hithead wrote:

And yes, we are using the "powerful" and "stable" PA2000 series......with 5.0.3.....In the last versions the problem was also available....

I hope you're being sarcastic here The PA2000 series is neither powerful nor stable in my experience

:smileylaugh: yes. Also had and have bad experience with the PA2000 series...

But however, the software should be able to exclude http://www.google.(de, com, nl, com.mx,... etc.) from the ssl decryption.

Re: Exclude www.google.* from decryption

mr.linus — Thu, 06 Jun 2013 12:54:51 GMT

I was able to get this to work, but only with a custom category including:

*.google.*

*.google.*/*

google.*

google.*/*

so this would include mail.google.com, which I guess you don't want...

If I put in www.google.* some traffic remains undecrypted, but other is decrypted just like you said.

This means that making your own custom category to excluded from decryption does work, but just not always :-s

Do you have a support ticket open for this? If so, please keep us informed of the output.

Re: Exclude www.google.* from decryption

oneidanation — Wed, 17 Jul 2013 19:18:57 GMT

Did you ever get his working for some reason ours that was working with a custom url category now is not working for wildcard urls in the category.

Re: Exclude www.google.* from decryption

Hithead — Thu, 18 Jul 2013 09:24:09 GMT

No,

i spent a lot of time to get this running. No way...

abandon it.

Re: Exclude www.google.* from decryption

Hithead — Mon, 21 Oct 2013 07:11:04 GMT

Hi,

it seems to work with Version >5.0.7 . Currently i'm running version 5.0.8 on a PA 2050... i will take a look and care on it...

Only added ' www.google.*/ ' and ' www.google.*/* ' into a "NONE - SSL Decription" URL category...

Re: Exclude www.google.* from decryption

EGarza — Tue, 04 Jun 2024 21:17:53 GMT

Were you able to fix this issue?
Im having similar issue were all my remote networks are experiencing latency loading webpages that use fonts.googleapis.com