topic Re: unknown-tcp when tls decryption is enabled in General Topics

unknown-tcp when tls decryption is enabled

ce1028 — Tue, 04 Sep 2018 02:59:49 GMT

I have a VM-100 in my lab. I haven't used it in while but recently booted it up and upgraded to 8.0.12. I noticed a lot of unknown-tcp traffic for mostly any site when I enabled tls decryption. If i disabled tls decryption, the traffic is all ssl.

I have never seen this before. I'm running it on esxi 5.5

Re: unknown-tcp when tls decryption is enabled

santonic — Tue, 04 Sep 2018 07:04:47 GMT

I've seen similar issue with inbound SSL decryption of activesync towards Exchange on PAN-OS 8.0.10. The session was first 'recognised' as unknown-tcp instead of activesync. Later we started getting decrypt error messages in logs. The certificate was correct and the supported cipher suites on server matched those on PA. Still researching this issue before opening a case.

Re: unknown-tcp when tls decryption is enabled

ce1028 — Tue, 04 Sep 2018 21:23:18 GMT

I was able to resolve the issue by reconfiguring my lab environment. I did some creative routing to initially configure this how I needed it, but seems all of a sudden it was creating an issue.

I really should switch to a PA-220 lab unit 🙂