topic ssl decryption and policy deny in General Topics

ssl decryption and policy deny

MP18 — Fri, 12 Oct 2018 19:18:01 GMT

I have configured ssl decryption and rule is there to allow the traffic

IT is hitting the right rule but policy says denied?

what can be reason for this?

Re: ssl decryption and policy deny

OtakarKlier — Fri, 12 Oct 2018 20:11:10 GMT

Hello,

Would you also be able to post hte security policy rule that it is supposed to allow the traffic? I see its being decrypted but something is stopping it, maybe the policies are out of order? I see that the application is 'incomplete' this could be because of an out of order deny policy or routing.

Is the traffic allowed if decryption is disabled?

Just some thoughts,

Re: ssl decryption and policy deny

Remo — Fri, 12 Oct 2018 20:33:14 GMT

@MP18

I am almost 100% certain that this is because of a decryption error

... https://live.paloaltonetworks.com/t5/General-Topics/Action-and-Session-End-Reason-conflict-when-SSL-decryption/m-p/163593#M52946

Re: ssl decryption and policy deny

MP18 — Fri, 12 Oct 2018 20:34:04 GMT

yes i added the screenshot of security policy rule number 24

yes traffic is allowed

what is out of order policy?

Re: ssl decryption and policy deny

OtakarKlier — Fri, 12 Oct 2018 20:38:57 GMT

Hello,

I was just thinking if you had a deny policy above the allow policy, doesnt look to be the case here. Check out the link that was posted, could be the issue.

Regards,

Re: ssl decryption and policy deny

MP18 — Fri, 12 Oct 2018 20:57:04 GMT

Many thanks Remo for replying to the post.