topic Re: PA-500 SSL decryption decrypt-error session end in General Topics

PA-500 SSL decryption decrypt-error session end

gwosad — Mon, 15 May 2017 19:11:34 GMT

I apologize of this is a dumb question as I know that some sites will have decyrption issues, but is it normal to have a lot of traffic log entries with decrypt-error as the session end reason?

None of our users are complaining that they can't get to something/anything, but I'm seeing a lot of entries with this session end reason. Was going to open a support case, but thought I'd ask hear first to see if perhaps I'm mistaking normal behaviour for an issue.

Thanks in advance for your thoughts.

Re: PA-500 SSL decryption decrypt-error session end

VinceM — Tue, 16 May 2017 13:20:27 GMT

hi,

Stupid question but have you configure some decryption rule ??

This error refer:

- no HSM availbale is configured

- No ressources available for decryption

- unsupported cypher suite ...

If no user complin it's maybe because you allowed undecrypted traffic du to error ???

Globally, decryption with PA500 ... is not a good idea 😉

Hope help

Re: PA-500 SSL decryption decrypt-error session end

Brandon_Wertz — Tue, 16 May 2017 13:28:14 GMT

What version of PAN-OS?

Re: PA-500 SSL decryption decrypt-error session end

Retired Member — Tue, 16 May 2017 19:45:24 GMT

Here an article how to dig deeper in the decryption error messages.

For example , The decrypt-error session end can also mean that the firewall has not enough resources to decrypt.

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-New-session-end-reasons/ta-p/73289

Re: PA-500 SSL decryption decrypt-error session end

gwosad — Tue, 16 May 2017 20:25:01 GMT

Thank you all for your replies. We are currently running OS 8.0.2. We had recently upgraded to 8.0.1, but had to upgrade again last week for a memory leak that appears to be ongoing.

Regarding decryption, we have a decryption policy that applies to most of our staff through AD group membership as well as a no-decrypt policy for select sites we have determined do not decrypt correctly. I am not certain if our policy is set to allow access on error. I will have to look further in to that.

I'm not sure if the reason could be lack of resources. I know that the PA500 is on the low end of the model list. I occassionally see the dataplane cpu usage get rather high, but generally it's not too bad.