Can I choose what categorizes I choose for allowing SSL-Opt Out Pages?

JohnMerry — Wed, 18 Nov 2015 12:23:30 GMT

Hello All,

I am after some help with SSL decryption?

We currently want to decrypt ALL SSL traffic. However moving forward there are 3 catorgies we wish to bypass SSL decyption for BUT only with the use of the opt-out pages not a blanket SSL catorgoy bypass. Is this possible on the Palo?

We are running currently 6.1.3 but can upgrade to 7.0.3 so versions are not a issue if we need to upgrade

But does anyone know if possible and if so how - or possbile other ideas to do this?

Many thanks

Re: Can I choose what categorizes I choose for allowing SSL-Opt Out Pages?

glastra1 — Wed, 02 Dec 2015 16:36:55 GMT

I think could be possible with a javascript so in all cases the firewall will send the block page but depending on the category you'll have 2 cases: one redirect without user interaction and the other one with the normal page when the user needs to click on the continue botton.

https://live.paloaltonetworks.com/t5/Documentation-Articles/Customizing-Response-Pages/ta-p/57809

Additionally, you can create a response page to show a different message depending on a variable.In the following code, a different message is shown depending on the URL category. If the URLcategory is games, Message 1 would be displayed, if the category as travel, Message 2 would bedisplayed.

If you go for it and start testing it you can use the SDK forum for questions,

https://live.paloaltonetworks.com/t5/SDK-API/bd-p/TechnologiesSDKsDiscussions

Regards,

Gerardo.

topic Can I choose what categorizes I choose for allowing SSL-Opt Out Pages? in General Topics

Can I choose what categorizes I choose for allowing SSL-Opt Out Pages?

Re: Can I choose what categorizes I choose for allowing SSL-Opt Out Pages?