topic Re: Outbound decryption and PAN-OS 8.0.2 in General Topics

Outbound decryption and PAN-OS 8.0.2

HeathRamos — Tue, 06 Jun 2017 20:20:37 GMT

we recently upgraded from PAN-OS 7.1.10 to 8.0.2 and some (but not all) websites are no longer decrypting

For instance, gmail doesn't decrypt anymore and we have a rule that allowed that application. Since that traffic isn't decrypted, it comes up as SSL and isn't applied.

Any known issues in 8.0.2 that would cause this?

Any way to fix it?

Heath

Re: Outbound decryption and PAN-OS 8.0.2

Remo — Tue, 06 Jun 2017 20:35:38 GMT

Hi @HeathRamos

On what hardware do you see these problems? Is it "only" gmail or google in general?

I am not aware of general problems but I also noticed some hardwarespecific issues with specific TLS 1.2 websites (PA-5020 works; PA-3020 does not work).

Regards,

Remo

Re: Outbound decryption and PAN-OS 8.0.2

HeathRamos — Tue, 06 Jun 2017 20:43:07 GMT

we have a PA-3020.

I am mainly concerned about web-based emails

mail.google.com doesn't decrypt

eas.outlook.com doesn't decrypt

Re: Outbound decryption and PAN-OS 8.0.2

Remo — Tue, 06 Jun 2017 21:07:41 GMT

mail.google.com does not look very special ... https://www.ssllabs.com/ssltest/analyze.html?d=mail.google.com&s=2607%3af8b0%3a4005%3a806%3a0%3a0%3a0%3a2005&hideResults=on

Do you have a decryption profile applied to your decryption rule?