topic Re: Decryption problem in General Topics

Decryption problem

Radmin_85 — Fri, 15 Dec 2017 11:03:21 GMT

We have such a problem with Microsoft Exchange OWA which we have recently published through Palo Alto.We have installed certificates with private keys,created necessary rules for PBF and NAT.

Everything is working fine except decryption.We can see in monitoring tab errors like decrypt-error or decrypt-unsupport-param

we have tried to connect from different browsers from outside with from TLS 1.0 to TLS 1.2

we also checked cypher suite which use our Exchange server and the clients' browser

also checked by packet capture

The interesting thing is that in some users there is no problem with decryption but in most users we see that problem

The version of Pan OS is 7.1.10

global protect version 4.0.4

the appliance is VM-300

Re: Decryption problem

oscaringosv — Fri, 15 Dec 2017 14:03:18 GMT

We had a similar Issue with Skype and Teams, what we did, we excluded from decrypt "internet-communications-and-telephony" category, for some reason that we don't know yet O365 apps does not like being decrypted, not a good solution but in the mean time could work for you.

Re: Decryption problem

Radmin_85 — Mon, 18 Dec 2017 09:56:40 GMT

ok i will try to check it

Re: Decryption problem

Radmin_85 — Wed, 20 Dec 2017 19:40:21 GMT

Any other suggestions

Re: Decryption problem

OtakarKlier — Wed, 20 Dec 2017 21:37:09 GMT

Hello,

There are definitly a lot of apps that dont like to be decrypted. A lot of the time its trial and error by watching the logs and testing real time. We had/have similar issues with Lync, basically we cant decrypt it and have to create bypass rules for ours as well as external parties that are hosting Lync/Skype conferences.

Good luck.

Re: Decryption problem

OtakarKlier — Wed, 20 Dec 2017 21:56:17 GMT

Here are a few links to hopefully help out.

https://live.paloaltonetworks.com/t5/Management-Articles/SSL-decryption-resource-list/ta-p/70397

https://live.paloaltonetworks.com/t5/Configuration-Articles/List-of-Applications-Excluded-from-SSL-Decryption/ta-p/62201

Cheers!

Re: Decryption problem

clewis1 — Thu, 21 Dec 2017 11:24:51 GMT

Possible they are using an unsupported cypher. I know I had this issue before moving to 8.0.6.