topic Re: PA SSL decryption for web traffic and squid in General Topics

PA SSL decryption for web traffic and squid

Alex_Samad — Thu, 07 Sep 2017 23:46:51 GMT

Where should I be doing the decryption

client -> pa (l3) -> squid -> internet

client -> squid -> pa (l3) -> internet

I thinking the first one, then I can also see who is making the request

Re: PA SSL decryption for web traffic and squid

Remo — Fri, 08 Sep 2017 05:03:24 GMT

The problem with on the suggested solution is that palo then only sees http-proxy traffic and nothing else - no url logs and decryption isnt'possible this way.

So you have to use your second possibility.

Re: PA SSL decryption for web traffic and squid

Alex_Samad — Fri, 08 Sep 2017 05:19:43 GMT

I'm already doing 1 but with out decrypt and it works fine, it looks into the info and knows its in tunnel mode.

Re: PA SSL decryption for web traffic and squid

Remo — Fri, 08 Sep 2017 07:16:10 GMT

So you have url logs or only the app http-proxy in the traffic log with the username?

Re: PA SSL decryption for web traffic and squid

Alex_Samad — Fri, 08 Sep 2017 07:19:57 GMT

With what i have right now, which is no decryption i see and can filter on application type so google-mail , facebook chat, it looks inside the traffic.

My policy is basically

any work ip -> to my proxy server ip and port 3128 or 8080 as the service ports, with application set to general internat. I have had to add things as some sites are not under general internet.

I can also who is the user logged into the client pc.

Re: PA SSL decryption for web traffic and squid

Remo — Fri, 08 Sep 2017 07:26:59 GMT

Ok, in this case I have to thank you for teaching me something new.

Till your post I thought the way to do this in combination with a proxy is

Client --> proxy --> palo

And then use the x-forwarded-for http header to identify the user on the firewall

As described here: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/policy/identify-users-connected-through-a-proxy-server

Re: PA SSL decryption for web traffic and squid

Alex_Samad — Fri, 08 Sep 2017 07:42:20 GMT

Interesting, but I seem to get all that by doing it before. Plus I don't have the XFF value setup ..

Alex

Re: PA SSL decryption for web traffic and squid

Remo — Sun, 10 Sep 2017 07:07:58 GMT

Hi Alex

If you already have this setup, it should be pretty easy to test if this now also works with decryption (I am also interessted in your results, even if I don't like these traditional proxy servers 😛 )

Edit: Removed sensless sentence

Re: PA SSL decryption for web traffic and squid

Alex_Samad — Sun, 10 Sep 2017 02:15:55 GMT

I'm not running the proxies in transparent mode.

and I want all traffic going to proxy for outbound traffic