topic Re: Clear SSL opt-out response cache for client in General Topics

Clear SSL opt-out response cache for client

nickcx1 — Wed, 02 Oct 2013 09:54:27 GMT

PanOS 4.1.14

How does one clear the cache for an individual client IP, so that the end-user is presented with the SSL Opt-Out page again when they next try a site which uses SSL? All I can think of is clear session all filter ssl-decrypt yes. If I do a show session all I don't know which session ID I should be clearing, if any...

Thanks

Re: Clear SSL opt-out response cache for client

harshanatarajan — Wed, 02 Oct 2013 10:10:46 GMT

Have you tried using the following command -

clear session all filter ssl-decrypt yes source <source ip>.

Also, By design, the user's choice to opt-out is honored for a fixed period of 24 hours and cannot be changed. For the purpose of testing the opt-out page, the user may wish to use a different PC / different source IP / different user.

Re: Clear SSL opt-out response cache for client

nickcx1 — Wed, 02 Oct 2013 10:20:12 GMT

Hmm, that doesn't seem to clear the Opt-out choice. Any other suggestions; I'm testing against a single machine - I'm sure it must be possible? I do a similar thing to clear the test user's Captive portal mapping to force reauthentication when I was testing CP.

Thanks

Re: Clear SSL opt-out response cache for client

nickcx1 — Wed, 02 Oct 2013 10:25:10 GMT

Worked it out:

debug dataplane reset ssl-decrypt notify-cache source <IP ADDRESS>

Re: Clear SSL opt-out response cache for client

harshanatarajan — Wed, 02 Oct 2013 10:28:03 GMT

Awesome..I was about to give you the same command.