topic policy-deny website problem in General Topics

policy-deny website problem

MPI-AE — Fri, 22 Feb 2019 12:44:47 GMT

Hey all,

PA-3020 8.0.7

I would like to access https://experimental-concert-research.org and I get "Secured connection failed"

The traffic log allows those packets, but session end reason says "policy-deny".

I have never seen this before.

Can someone tell me what's the problem here?

Thank you.

Re: policy-deny website problem

Chacko42 — Fri, 22 Feb 2019 13:06:35 GMT

I guess you are using TLS-Interception and have a corresponding Decryption policy.

Please check the decryption profile, I'm sure the site is using algorithms which are not allowed according to your decryption profile.

Re: policy-deny website problem

MPI-AE — Sun, 24 Feb 2019 16:06:55 GMT

@Chacko42No, I don't have a decryption policy

Re: policy-deny website problem

Chacko42 — Mon, 25 Feb 2019 07:53:29 GMT

Please have a look at the unified log and the threat log, if there is more detail about the connection.

If not: Please create a filter and have a look at the global counters, described here:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clf1CAC

Re: policy-deny website problem

MPI-AE — Tue, 26 Feb 2019 08:03:03 GMT

@Chacko42 Wow thank you! I have never used unified log before. But it helped me a lot because it's a url problem. Normally a url banner appears so I never expected that it's a url problem.