topic Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome in General Topics

PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Fri, 03 Feb 2017 12:31:54 GMT

After uprading my lab to pan-os 8.0 The forward Decryption failed when using Firefox and Chrome.

IE 11 en Edge still works.

For example when i go to www.google.com,

Chrome displays: www.google.com uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Firefox: Advanced info: SSL_ERROR_NO_CYPHER_OVERLAP

In the PA logs: Session end Reason = decrypt-error.

PA continues the tradition to break decryption on new major releases 😉

Does anyone else have same issue?

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

bbilut — Fri, 03 Feb 2017 16:58:34 GMT

What version were you running in your lab prior to moving to 8.0? It sounds like the same problem I had when I moved from 7.0.x to 7.1.x where in 7.1 they changed the default behavior in app-id and I had to make sure my outbound rules from "application-default" to "any".

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

BPry — Fri, 03 Feb 2017 16:59:58 GMT

I'm planning on upgrading my lab this weekend and can look at it then; I'm not sure how many people even have 8.0 on their lab enviroments yet.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Fri, 03 Feb 2017 17:48:10 GMT

Before 8.0 it was running 7.1.7, en decypting fine.

The decryption security rule was already set at "any"

But thanks for for the suggestion.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

sullivanpj2 — Fri, 03 Feb 2017 18:57:25 GMT

PanOS-8.0 is going to have a large number of issues, I remember upgrading to one of the beta versions a couple months back and it broke everything on the box. It continued to go through a reboot cycle until I was finally able to catch is correctly to jump into maint mode. It wasn't the simple you have 5 seconds to type "maint", it would jump past that 9/10 times and just restart the cycle all over again. 😞

It seemed to break because there was some config on there from 7.1 and it did not accept anything. I had to go and factory reset a 200 to have no configuration whatsoever before putting 8.0 on it.

- Peter

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Mon, 20 Feb 2017 19:24:13 GMT

It finally works now but its still strange.

What did i do:

It al VM so i reverted the snapshot to the previous (working) 7.1.7 snapshot.

For panos-8 you need to modify your VM "hardware" increase mem to 6.5 Gb and the disk size needs to be 60 GB

But the last time i only increased the memory, so for this time i also increase the disk from 40 to 60GB

After the disksize increase i upgraded to 8.0 again.

Then started the vm100 and that was it for that day, i did not test it or use it.

Today(1 day later) i want to examine the decryption issue further, but its started working immediately.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

MohamedSharief — Mon, 20 Feb 2017 10:45:40 GMT

Hi,

I have the same issue and its affecting all google domains on Chrome and Firefox but the weird thing its working fine on Internet Explorer!

Do I need to downgrade to resolve this?

Regards,

Sharief

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

BPry — Mon, 20 Feb 2017 14:43:14 GMT

If the VM that you are using (if using a VM) meets requirements, then yes you will likely need to revert to get things working again. I've seen that sometimes the upgrade itself causes an issue and simply reinstalling 8.0 gets things working again. Seeing as 8.0 is a brand new major software version I would advise that most people stick with 7.1.* as 8.0 is not yet a recommended release.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Mon, 20 Feb 2017 19:19:08 GMT

First: Open a case with TAC

I did some more research after my issue.

Immediately after installing or rebooting a panos 8.0 firewall this issue is present.

The issue disappeared by just waiting x hours whitout changing anything.

Yet i don't no what the minimum time for x is.

In my test i waited approx 12 hours

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Mon, 20 Feb 2017 19:21:16 GMT

On some new models PANOS 8 is the only version available.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

PatrickdeJong — Wed, 08 Mar 2017 12:47:34 GMT

Try using different browser.

Had same issue here in LAB. FF returned an error while IE ran just fine. See screenshots.

I assume both browsers try to establish a different SSL connection.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

PatrickdeJong — Wed, 08 Mar 2017 12:48:44 GMT

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Wed, 08 Mar 2017 14:29:14 GMT

Niets veranderen aan de PA een aan aantal uren laten draaien en opeens werkt het.

Na een reboot van de PA weer hetzelfde verhaal.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Wed, 22 Mar 2017 17:44:04 GMT

PAN-OS 8.0.1 issue still exist.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

ITSupportMedi — Sun, 26 Mar 2017 12:39:55 GMT

I can confirm I installed 8.1 on 3 units, all of them had the same issue, No Chrome (google sites) working. Spent a few hours trying different rules and fixes, nothing worked. Then I read the post about waiting X hours, so I waited until the next morning and everything works again, great. Hopefully it does not return after a reboot and the cycle starts again, X hours for things to work again.

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Tue, 28 Mar 2017 13:06:13 GMT

Any news on this? Have been seeing strange behaviour very similar to this with Android 7.1 / Google / PAN 8.0.1.

Thanks

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Gareth_Dale — Tue, 28 Mar 2017 14:14:32 GMT

David, we had the same issue after upgrading from 7.1.8 to 8.0.1 and after 24 hours it had resolved itself. Our TAC gave us a command that may help:

debug dataplane reset ssl-decrypt certificate-cache

I've asked them the question to whether this issue resurfaces after a reboot.

We also have issue with most of the Google apps including Play Store, the Wiki and Instagram app and decryption. I have a feeling most will have to bypass decryption at the OS level...

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Retired Member — Wed, 29 Mar 2017 06:02:14 GMT

Thanks for this.

Yes - have been chasing why Android phone (Nexus running Android 7.1.1) when initially connected notifies me of no internet. Think this is now a connectivity check via SSL, if I place a decryption exception I can get past this hurdle so guessing something is pinned in Android.

Also Google play no good, activity feed on Google Now/Assistant no good. Monitoring -> Logs -> Traffic I see session end as "Policy-Deny" on the decrypted traffic - category identified is search engines.
Do not decrypt - search engines & content delivery networks and everything seems a great deal better.

Ill keep at it. This is all on PAN 8.0.1 with SSL decryption enabled.

++ update very interesting:- https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html looks like Android 7.1.1 has tightened up and possibly mitm no longer possible.

+++ https://serializethoughts.com/2016/09/10/905/

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

jarbu — Wed, 29 Mar 2017 08:46:33 GMT

Hello,

We have that problem on 8.0.1 but we do not use VM series but PA3020. DId you find workaround?

Re: PAN-OS 8.0 Decryption Issue with Firefox and Chrome

Gareth_Dale — Wed, 29 Mar 2017 09:06:22 GMT

We also have a 3020, the only workaround we have at the moment is the command I posted earlier (untested) or wait 24 hours and it started working.

In terms of Google, et al and their apps not working with decryption, this is currently with our TAC (including the links above from David) and a remote session due this morning...