topic Re: SSL decryption and Carbonite in General Topics

SSL decryption and Carbonite

tcjnole64 — Wed, 16 Mar 2011 13:32:09 GMT

SSL decryption seems to interfere with Carbonite. When the policy is enabled, the Carbonite client reports "waiting for connecton to carbonite pro backup server...". I assume I could add a rule to not touch anything in category "online-personal-storage", but I'd rather not just guess until I get it right.

Has anyone had the same experience?

Thanks,

Todd

Re: SSL decryption and Carbonite

migration — Wed, 16 Mar 2011 13:47:47 GMT

Hi,

as you know, applications use various degrees of SSL.

Some are not implemented to standards or use capabilities in the standards that are not compatible with Palo Alto Networks SSL decryption capability. In addition, SSL decryption cannot be used when servers require client certificates.

You have to avoid SSL decryption if:

• Server requires client certi

ficates

• Non-standard implementations of SSL used

• New certi

ficate authorities can’t be added to the client application

• Client software requires speci

fic server certificates

So, I suggest you to make an exception per Carbonite URLs or Dst IP Address/es.

Regards

Re: SSL decryption and Carbonite

tcjnole64 — Wed, 16 Mar 2011 14:54:38 GMT

That will work. In case anyone stumbles onto this, I contacted Carbonite. The IP addresses to exclude are:

38.97.103.128/26

38.111.3.192/26

38.97.75.1/25