topic Re: Application web-browsing blocked using ssl decryption in General Topics

Application web-browsing blocked using ssl decryption

rainer.kranz@sab.sachsen.de — Fri, 08 Mar 2013 14:15:59 GMT

I've defined a simple rule for acces to a ssl-crypted website using application filtering.

Also all ssl-crypted access to that site will be decrypted.

The running Software ist PanOS 5.02.

When I define a rule for access to that destination and leave the service in "application-default"

The access wil be blocked an I get two entries in my LOG-File:

1. start <src> <dst> <src_port> <dst_port: 443> <application: ssl>

2. deny <src> <dst> <src_port> <dst_port: 443> <application: web-browsing>

When I change the service from "application" to: "service-https" (port 443) the communication works.

Is that a desired behavior of PaloAlto Firewall?

Sincerly Rainer

Re: Application web-browsing blocked using ssl decryption

mharding — Fri, 08 Mar 2013 14:19:34 GMT

Yes, because when you're decrypting a SSL session to expose the underlying application. To the firewall, it will look like web-browsing over port 443.

Re: Application web-browsing blocked using ssl decryption

mikand — Sat, 09 Mar 2013 08:35:05 GMT

Which would mean that you can remove the appid:ssl from your second example (only allowing web-browsing or whatever is detected within the ssl-session).