topic Re: Decrypting Dropbox in General Topics

Decrypting Dropbox

cryptochrome — Fri, 09 Nov 2012 21:11:29 GMT

Hi,

I want to decrypt Dropbox but it doesn't work. I have a catch-all decrypt policy that decrypts any-any SSL. It works fine except for Dropbox. My understanding is that Dropbox is on the PanOS internal exception list so decryption is supposed to be disabled automatically for DB. Looking at my traffic logs, I can confirm that application dropbox is not decrypted. However, my Dropbox client still reports it's unable to establish a secure connection.

Is there anything I need to do to make it work?

Thanks

Re: Decrypting Dropbox

u13550 — Fri, 09 Nov 2012 21:28:42 GMT

this is because it's not on the default exclusion list anymore.

Search the forum for "dropbox" and you get numerous resources and explanations, but the short way to get the client running again is to do the following on the CLI:

set shared ssl-decrypt ssl-exclude-cert "*.dropbox.com"

Re: Decrypting Dropbox

cryptochrome — Fri, 09 Nov 2012 21:50:32 GMT

Thanks Andre!

Re: Decrypting Dropbox

u13550 — Fri, 09 Nov 2012 21:52:32 GMT

Happy to help.

If it works for your, just mark your question as "answered"

Andre

Re: Decrypting Dropbox

mikand — Sat, 10 Nov 2012 09:20:19 GMT

Also note that when you add dropbox to exclude list the PA will not be able to perform IPS/AV/DLP on the contents of the dropbox traffic.

Re: Decrypting Dropbox

cryptochrome — Sat, 10 Nov 2012 09:28:40 GMT

I figured that one

Re: Decrypting Dropbox

cryptochrome — Sat, 10 Nov 2012 21:43:34 GMT

Now this is strange. With the config in place it worked, and now it stopped working. Dropbox client reporting the same error as before, while *.dropbox.com is in the ssl-decrypt exlude list. Are there other domains that should be on the exclude list for Dropbox?

Thanks

Sascha

Re: Decrypting Dropbox

cryptochrome — Sat, 10 Nov 2012 21:44:17 GMT

Two minutes later it's working again. Huh???

Re: Decrypting Dropbox

mikand — Sun, 11 Nov 2012 23:51:44 GMT

How is your device configuration regarding CRL and OSCP checks etc?

Re: Decrypting Dropbox

dat.tran — Fri, 23 Nov 2012 09:46:27 GMT

thanks

Re: Decrypting Dropbox

MMCiobanu — Thu, 23 Oct 2014 23:04:58 GMT

I have set this: set shared ssl-decrypt ssl-exclude-cert "*.dropbox.com" on our firewalls; however, the dropbox application is still complaining that it "Can't establish secure connection" once in a while; it shows the error, then a few minutes later, it connects and sync.

Re: Decrypting Dropbox

MMCiobanu — Tue, 20 Jan 2015 21:03:27 GMT

Sascha,

Are you still having issues with Dropbox? I am having the exact same issue, after I excluded *.dropbox.com from decryption. Also, I noticed that while doing a packet capture that the connection breaks when client tries to get to Amazon, where the actual file are stored. I am just wondering if you were able to make it work and would share the information.

Thank you

Re: Decrypting Dropbox

PAN-3020-1 — Tue, 09 Feb 2016 11:23:18 GMT

Is it possible to rename the title to "How to not decrypt dropbox" ?

Because the so-called solution does not decrypt dropbox at all, it just excludes it from decryption.