topic Re: User based ssl decryption in General Topics

User based ssl decryption

ToniE — Wed, 22 Jun 2016 08:18:06 GMT

Hi,

I try to test ssl forward proxy decryption. It works fine if I use IP address as a source but if I use Users(domain) as a source it doesn't work. I can't use IP's for testing because our IP's floating. What I need to check in configuration?

Toni

Re: User based ssl decryption

nikoo — Wed, 22 Jun 2016 08:45:49 GMT

Is user identified properly and does show up on #show user ip-user-mapping all?

Re: User based ssl decryption

reaper — Wed, 22 Jun 2016 09:33:27 GMT

please take a look through this article to make sure UserID is set up properly: Getting Started: User-ID

Re: User based ssl decryption

ToniE — Wed, 22 Jun 2016 09:44:22 GMT

Yep. User-ID works fine but user based decryption not.

Re: User based ssl decryption

scottsander — Wed, 22 Jun 2016 12:07:58 GMT

That's odd. We've been using TLS decryption for quite a while based on Active Directory group membership. It works fine here (other than the fact that downloads over decrypted TLS sessions are incredibly slow).

Re: User based ssl decryption

ToniE — Wed, 22 Jun 2016 12:33:45 GMT

Thanks for information. At least I know now that it could work.

Re: User based ssl decryption

nikoo — Wed, 22 Jun 2016 14:07:37 GMT

Which version of PANOS are you running on?

Re: User based ssl decryption

googol — Wed, 22 Jun 2016 14:54:39 GMT

I am running 7.0.5-h2, use user ID and do user based decryption as part of a pilot for decryption right now. No issues here.

Re: User based ssl decryption

ToniE — Thu, 23 Jun 2016 07:25:22 GMT

Hello,

Our current version is 7.0.5-h2.

How you configure policy. Source address any and user domain\user ?

Toni

Re: User based ssl decryption

Roby_Sreejith — Thu, 23 Jun 2016 10:35:29 GMT

It seems the user to group mapping is not happening correctly. See this command for one ip

show user ip-user-mapping ip x.x.x.x

See if user is showing correctly

See also associated groups are showing correctly

If not add group mapping under Device-> user identification-> group mapping

Re: User based ssl decryption

ToniE — Thu, 23 Jun 2016 10:59:05 GMT

Hi,

show user ip-user-mapping ip x.x.x.x --> I can see my username correctly. But I can't see any groups associated --> Groups that the user belongs to (used in policy). This is empty.

I can see my username in group if --> show user group name "CN=XXXXXXXXX,OU=XXXXXXXX,OU=XXXX,DC=XX,DC=XXXXXX,DC=XXXX,DC=XXX"

Toni

Re: User based ssl decryption

ToniE — Thu, 23 Jun 2016 11:31:58 GMT

Sorry that was used in policy so that's also ok.

Re: User based ssl decryption

ToniE — Thu, 23 Jun 2016 11:36:23 GMT

Hello, I just found solution. It was in group mapping settings. User Domain was missing above Group Objects.

Thank you all for help. You put me to right direction!

Toni