topic Re: No SSL decrypt collaboration in General Topics

No SSL decrypt collaboration

ZEBIT — Mon, 21 Nov 2016 15:23:43 GMT

When we try to setup an Skype for Business call we always get blocked by the SSL decrypt of the Palo Alto system.

I would like to configure no ssl decrypt for collaboration. Is this possible and how?

Re: No SSL decrypt collaboration

TranceforLife — Mon, 21 Nov 2016 15:44:40 GMT

Hi,

My guess you can configure another policy for the particular application with "No Decrypt" option and put it above your existing decryption policy.

Re: No SSL decrypt collaboration

ZEBIT — Tue, 22 Nov 2016 08:25:42 GMT

That is the strange part, there is no URL category from palo alto to not decrypt collaboration.

If I check some url's to setup meetings in the url check of Palo Alto it tells me the category computer and internet info.

But if I make a no decrypt rule on this all other applications that are under this category are also not decrypted.

Re: No SSL decrypt collaboration

TranceforLife — Tue, 22 Nov 2016 09:45:46 GMT

Hi,

How do you see that traffic in the logs? How it is identified by Palo. If you can post a logs snapshot from the device for that particular session

Re: No SSL decrypt collaboration

santonic — Tue, 22 Nov 2016 10:49:00 GMT

It's mixed, internet-and-computer-info, internet-commincations-and-telephony... No good way to make exception for Skype.

Re: No SSL decrypt collaboration

BPry — Tue, 22 Nov 2016 13:45:39 GMT

To add on this because of the way that Skype opperates there will likely never be a good way to not decrypt Skype traffic and make it identify properly.