topic Re: Block page and SSL in General Topics

Block page and SSL

mrsold — Fri, 02 Nov 2012 13:32:37 GMT

Hey all,

So, we have a need to block everyone but a small AD group access to a couple pages. Now, we don't want to just "deny" them in the rule (we have a comfort page that promps them they are blocked and allows them to request access) - I don't want to see all those tickets about a site not loading. So, here is what I did:

Rule 1 Allow: Anyone from "AD Group" via "web-browsing" or "ssl" to (website 1 and website 2) - allowed.

Rule 2 Block: Anyone from anywhere else via "web-browsing" or "ssl" to (website 1 and website 2) - allowed. However, I created a "block all" URL group so that nothing is allowed through and they are given our block page.

Website 1 is a standard http site and works great. Website 2 is an SSL site. When I try and go to it, I see that it's hitting the "block" rule but it never presents the block page. It just sits there churning.

Any thoughts?

Re: Block page and SSL

mrsold — Fri, 02 Nov 2012 13:52:36 GMT

Just a note. I've confirmed if I manually go to the http site (which will by default redirect to https) the block page is presented. However, if you google search the site, it will take you to the https site which does NOT present a block page.

Re: Block page and SSL

sdurga — Fri, 02 Nov 2012 16:40:48 GMT

Hi msoldner,

You can achieve block pages over SSL in two ways.

1) One is through SSL decryption of the websites so that Paloalto has visibility into the websites traffic. Here is a document to do the same.

2) The other way is paloalto will act as a proxy for ssl sessions if the IP's URL category is blocked.

This can be done by the command from coniguration mode

"set device config setting ssl-decrypt url-proxy yes"

also can you please let me know which pan-os version are you running.

Thanks,

Sandeep T

Re: Block page and SSL

mrsold — Fri, 02 Nov 2012 17:27:48 GMT

Hey Sandeep,

We are currently running 4.1.6 with plans to move to 4.1.7 in the short-term.

The command you note will only decrypt if the page is supposed to be blocked, correct? Are there any other known effects that command will have?

Thanks,

-Mike

Re: Block page and SSL

mrsold — Tue, 06 Nov 2012 23:54:38 GMT

Unfortunatly Sandeep it doesn't appear to work.

I did issue the "set deviceconfig setting ssl-decrypt url-proxy yes" command however it's still not presenting a block page. It shows the session as "DISCARD" but never presents a block page. At this point, at least as of yet, we don't want to start using certificats to break the SSL stream to block.

Re: Block page and SSL

sdurga — Wed, 07 Nov 2012 08:13:54 GMT

Hi msoldner,

On 4.1.6 this is command is not working as expected as a result you are not seeing the block pages. Can you open a ticket with support so that we can guide you to a proper pan-os version which has fix.

Thanks,

Sandeep T

Re: Block page and SSL

sberti — Fri, 09 Nov 2012 15:30:07 GMT

The issue with "set deviceconfig setting ssl-decrypt url-proxy yes" was tracked with bugid 43872 and it's fixed in 4.1.9.

In 4.1.6 you can use SSL Decryption rule as an alternative

-Salvo