topic SSL Decryption in General Topics https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30515#M22323 <HTML><HEAD></HEAD><BODY><P>Hey</P><P></P><P>why PA doesnt do SSL Decryption for this site: <A href="https://www.wetransfer.com/" title="https://www.wetransfer.com/">WeTransfer</A></P><P>i can see PA is recognizing it as this application: wetransfer</P><P>but ican see the original Go daddy ceritifcate in the browser windows, and in the PA logs i cannot see "decrypted" on this traffic why is this?</P><P></P><P>this is my decryption policy:</P><P>------------------------------------------------------------------------------------------------------------------------------------------------------------------</P><P>admin@PA-500# show rulebase decryption rules</P><P>rules {</P><P>&nbsp; "no Decrypt" {</P><P>&nbsp;&nbsp;&nbsp; category any;</P><P>&nbsp;&nbsp;&nbsp; type {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl-forward-proxy;</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; from trust;</P><P>&nbsp;&nbsp;&nbsp; to untrust;</P><P>&nbsp;&nbsp;&nbsp; source any;</P><P>&nbsp;&nbsp;&nbsp; destination Hilan3-192.168.210.154;</P><P>&nbsp;&nbsp;&nbsp; source-user any;</P><P>&nbsp;&nbsp;&nbsp; negate-source no;</P><P>&nbsp;&nbsp;&nbsp; negate-destination no;</P><P>&nbsp;&nbsp;&nbsp; action no-decrypt;</P><P>&nbsp;&nbsp;&nbsp; disabled no;</P><P>&nbsp; }</P><P>&nbsp; Decrypt {</P><P>&nbsp;&nbsp;&nbsp; category any;</P><P>&nbsp;&nbsp;&nbsp; type {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl-forward-proxy;</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; from trust;</P><P>&nbsp;&nbsp;&nbsp; to untrust;</P><P>&nbsp;&nbsp;&nbsp; source any;</P><P>&nbsp;&nbsp;&nbsp; destination any;</P><P>&nbsp;&nbsp;&nbsp; source-user any;</P><P>&nbsp;&nbsp;&nbsp; negate-source no;</P><P>&nbsp;&nbsp;&nbsp; negate-destination no;</P><P>&nbsp;&nbsp;&nbsp; action decrypt;</P><P>&nbsp;&nbsp;&nbsp; disabled no;</P><P>&nbsp; }</P><P>}</P><P></P><P></P><P>this is one of the session opened to the IP</P><P>------------------------------------------------------------------------------------------------------------------------------------------------------------------</P><P></P><P>admin@PA-500&gt; show session id 21323</P><P></P><P></P><P>Session&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 21323</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; c2s flow:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; source:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.149 [trust]</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dst:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 173.241.240.180</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proto:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sport:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 52891&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dport:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; state:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACTIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLOW</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; src user:&nbsp;&nbsp;&nbsp; unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dst user:&nbsp;&nbsp;&nbsp; unknown</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; s2c flow:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; source:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 173.241.240.180 [untrust]</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dst:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.149</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proto:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sport:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dport:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 52891</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; state:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACTIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLOW</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; src user:&nbsp;&nbsp;&nbsp; unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dst user:&nbsp;&nbsp;&nbsp; unknown</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; start time&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : Wed Jun 26 13:34:22 2013</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; timeout&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 30 sec</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; time to live&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 19 sec</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; total byte count(c2s)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 1792</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; total byte count(s2c)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 4725</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 packet count(c2s)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 9</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 packet count(s2c)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 10</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; vsys&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : vsys1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; application&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : wetransfer</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rule&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : rule1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session to be logged at end&nbsp;&nbsp; : True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session in session ager&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session synced from HA peer&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 processing&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : completed</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; URL filtering enabled&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; URL category&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : online-personal-storage</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session via syn-cookies&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session terminated on host&nbsp;&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session traverses tunnel&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; captive portal session&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ingress interface&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : ethernet1/2</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; egress interface&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : ethernet1/1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session QoS rule&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : N/A (class 4)</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session tracker stage l7proc&nbsp; : ctd err bypass</P><P>admin@PA-500&gt;</P></BODY></HTML> Wed, 26 Jun 2013 10:35:00 GMT minow 2013-06-26T10:35:00Z SSL Decryption https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30515#M22323 <HTML><HEAD></HEAD><BODY><P>Hey</P><P></P><P>why PA doesnt do SSL Decryption for this site: <A href="https://www.wetransfer.com/" title="https://www.wetransfer.com/">WeTransfer</A></P><P>i can see PA is recognizing it as this application: wetransfer</P><P>but ican see the original Go daddy ceritifcate in the browser windows, and in the PA logs i cannot see "decrypted" on this traffic why is this?</P><P></P><P>this is my decryption policy:</P><P>------------------------------------------------------------------------------------------------------------------------------------------------------------------</P><P>admin@PA-500# show rulebase decryption rules</P><P>rules {</P><P>&nbsp; "no Decrypt" {</P><P>&nbsp;&nbsp;&nbsp; category any;</P><P>&nbsp;&nbsp;&nbsp; type {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl-forward-proxy;</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; from trust;</P><P>&nbsp;&nbsp;&nbsp; to untrust;</P><P>&nbsp;&nbsp;&nbsp; source any;</P><P>&nbsp;&nbsp;&nbsp; destination Hilan3-192.168.210.154;</P><P>&nbsp;&nbsp;&nbsp; source-user any;</P><P>&nbsp;&nbsp;&nbsp; negate-source no;</P><P>&nbsp;&nbsp;&nbsp; negate-destination no;</P><P>&nbsp;&nbsp;&nbsp; action no-decrypt;</P><P>&nbsp;&nbsp;&nbsp; disabled no;</P><P>&nbsp; }</P><P>&nbsp; Decrypt {</P><P>&nbsp;&nbsp;&nbsp; category any;</P><P>&nbsp;&nbsp;&nbsp; type {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl-forward-proxy;</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; from trust;</P><P>&nbsp;&nbsp;&nbsp; to untrust;</P><P>&nbsp;&nbsp;&nbsp; source any;</P><P>&nbsp;&nbsp;&nbsp; destination any;</P><P>&nbsp;&nbsp;&nbsp; source-user any;</P><P>&nbsp;&nbsp;&nbsp; negate-source no;</P><P>&nbsp;&nbsp;&nbsp; negate-destination no;</P><P>&nbsp;&nbsp;&nbsp; action decrypt;</P><P>&nbsp;&nbsp;&nbsp; disabled no;</P><P>&nbsp; }</P><P>}</P><P></P><P></P><P>this is one of the session opened to the IP</P><P>------------------------------------------------------------------------------------------------------------------------------------------------------------------</P><P></P><P>admin@PA-500&gt; show session id 21323</P><P></P><P></P><P>Session&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 21323</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; c2s flow:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; source:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.149 [trust]</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dst:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 173.241.240.180</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proto:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sport:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 52891&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dport:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; state:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACTIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLOW</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; src user:&nbsp;&nbsp;&nbsp; unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dst user:&nbsp;&nbsp;&nbsp; unknown</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; s2c flow:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; source:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 173.241.240.180 [untrust]</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dst:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.149</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proto:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sport:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dport:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 52891</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; state:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACTIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLOW</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; src user:&nbsp;&nbsp;&nbsp; unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dst user:&nbsp;&nbsp;&nbsp; unknown</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; start time&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : Wed Jun 26 13:34:22 2013</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; timeout&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 30 sec</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; time to live&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 19 sec</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; total byte count(c2s)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 1792</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; total byte count(s2c)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 4725</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 packet count(c2s)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 9</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 packet count(s2c)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 10</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; vsys&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : vsys1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; application&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : wetransfer</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rule&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : rule1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session to be logged at end&nbsp;&nbsp; : True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session in session ager&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session synced from HA peer&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 processing&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : completed</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; URL filtering enabled&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; URL category&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : online-personal-storage</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session via syn-cookies&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session terminated on host&nbsp;&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session traverses tunnel&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; captive portal session&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ingress interface&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : ethernet1/2</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; egress interface&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : ethernet1/1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session QoS rule&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : N/A (class 4)</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session tracker stage l7proc&nbsp; : ctd err bypass</P><P>admin@PA-500&gt;</P></BODY></HTML> Wed, 26 Jun 2013 10:35:00 GMT https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30515#M22323 minow 2013-06-26T10:35:00Z Re: SSL Decryption https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30516#M22324 <HTML><HEAD></HEAD><BODY><P>With my configuration, too. It isn't decrypted...</P></BODY></HTML> Wed, 26 Jun 2013 10:52:20 GMT https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30516#M22324 Hithead 2013-06-26T10:52:20Z Re: SSL Decryption https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30517#M22325 <HTML><HEAD></HEAD><BODY><P>any idea why?</P></BODY></HTML> Wed, 26 Jun 2013 10:54:36 GMT https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30517#M22325 minow 2013-06-26T10:54:36Z Re: SSL Decryption https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30518#M22326 <HTML><HEAD></HEAD><BODY><P>Just tried it again with Chrome. Our own certificate was used but at the logs still encrypted....try it also with chrome...</P></BODY></HTML> Wed, 26 Jun 2013 11:00:11 GMT https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30518#M22326 Hithead 2013-06-26T11:00:11Z Re: SSL Decryption https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30519#M22327 <HTML><HEAD></HEAD><BODY><P>yes with chrome it is beeing decrypted by the certificate that i see in browser</P><P></P><P>but i can see different logs when accessing the website using chrome and using explorer</P></BODY></HTML> Wed, 26 Jun 2013 11:05:10 GMT https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30519#M22327 minow 2013-06-26T11:05:10Z Re: SSL Decryption https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30520#M22328 <HTML><HEAD></HEAD><BODY><P>Contact the PaloAlto support. They should be able to fix it. I guess the application is the issue... We had similar problems with youtube...</P></BODY></HTML> Wed, 26 Jun 2013 11:17:06 GMT https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30520#M22328 Hithead 2013-06-26T11:17:06Z Re: SSL Decryption https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30521#M22329 <HTML><HEAD></HEAD><BODY><P>It doesnt seem to be part of the internal whitelist at least: <A __default_attr="1423" __jive_macro_name="document" class="jive_macro jive_macro_document" href="https://live.paloaltonetworks.com/"></A></P><P></P><P>Also it seems to be hosted by amazon in case that somehow affects this "bug" (or whatever it is thats happening to you):</P><P></P><P><A class="active_link" href="https://www.ssllabs.com/ssltest/analyze.html?d=www.wetransfer.com" title="https://www.ssllabs.com/ssltest/analyze.html?d=www.wetransfer.com">https://www.ssllabs.com/ssltest/analyze.html?d=www.wetransfer.com</A></P><P></P><P>PA devices have had problems with TLS in the past... even if SSL 3.0 is supported the only support ciphersuits are TLS-based:</P><P></P><P><A class="active_link" href="https://www.ssllabs.com/ssltest/analyze.html?d=www.wetransfer.com&amp;s=176.34.236.232" title="https://www.ssllabs.com/ssltest/analyze.html?d=www.wetransfer.com&amp;s=176.34.236.232">https://www.ssllabs.com/ssltest/analyze.html?d=www.wetransfer.com&amp;s=176.34.236.232</A></P><P></P><P>Cipher Suites (sorted by strength; the server has no preference)</P><P>TLS_RSA_WITH_RC4_128_MD5 (0x4)&nbsp;&nbsp;&nbsp;&nbsp; 128</P><P>TLS_RSA_WITH_RC4_128_SHA (0x5)&nbsp;&nbsp;&nbsp;&nbsp; 128</P><P>TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)&nbsp;&nbsp;&nbsp;&nbsp; 128</P><P>TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)&nbsp;&nbsp;&nbsp;&nbsp; 168</P><P>TLS_RSA_WITH_AES_256_CBC_SHA (0x35)&nbsp;&nbsp;&nbsp;&nbsp; 256</P></BODY></HTML> Wed, 26 Jun 2013 19:46:08 GMT https://live.paloaltonetworks.com/t5/general-topics/ssl-decryption/m-p/30521#M22329 mikand 2013-06-26T19:46:08Z