topic Re: Decrypt error (soap) in General Topics

Decrypt error (soap)

BigPalo — Tue, 07 Aug 2018 12:54:51 GMT

Hi,

We realised that we are receiving decrypt errors accessing to O365 from inside to outside. We are doing decrypt in sessions. But we dont know why the sessions are finished with "decrypt-error".

Any idea?

Re: Decrypt error (soap)

BPry — Tue, 07 Aug 2018 15:37:29 GMT

@BigPalo,

It's likely because of Certificate Pinning, which the firewall can't actually transparently decrypt. If you view the associated session directly on the firewall it'll have a tad bit more information that may be helpful, such as if you are running into a proxy decrypt failure.

Re: Decrypt error (soap)

BigPalo — Tue, 07 Aug 2018 15:42:12 GMT

Yes, we are doing decrypt for this kind of sessions. This is the log view detailed. Where can i get more info about the root cause for this error???

I thought that we could be hitting this link:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Identify-Root-Cause-for-SSL-Decryption-Failure-Issues/ta-p/59445

Re: Decrypt error (soap)

BPry — Tue, 07 Aug 2018 15:48:47 GMT

@BigPalo,

The first line of the 'General' box will be the session id number. Through the CLI running 'show session id session_id_number' would give you a bit more information about what exactly caused the issue in the 'tracker stage firewall' section. You could be hitting a variety of issues with this, but the most common is due to an unsupported SSL protocol. You can verify this by viewing the global counters and seeing if it increments as you see these logs.

Re: Decrypt error (soap)

Remo — Tue, 07 Aug 2018 20:26:07 GMT

@BigPalo

A little strange actually is that the firewalls already sees the application soap which implies that the decryption already happened. In addition the sessions are too big already in my opinion. If a decryption error happens the sessions normally are smaller.

In addition to what @BPry wrote I would also do a packet capture and check if there is already data or if you see TLS handshake errors.