topic Re: Updates palo alto network website and ssl decryption in General Topics

Updates palo alto network website and ssl decryption

MP18 — Sun, 03 Nov 2019 02:59:21 GMT

I am going to implement ssl decryption for some subnets

where we have management subnet of Palo Alto networks.

Need to know if PA website updates.paloaltonetworks.com works when SSL decryption is enabled?

Do I need to check - verify server identity for ssl decryption to take effect?

Regards

Mike

Re: Updates palo alto network website and ssl decryption

BruceBennett — Sun, 03 Nov 2019 03:42:00 GMT

You will need to uncheck the verify box, or set that source and url as no decrypt in a rule before your general decrypt rule.

Re: Updates palo alto network website and ssl decryption

MP18 — Sun, 03 Nov 2019 17:05:47 GMT

it is good to use exempt for url

updates.paloaltonetworks.com is this the right way?

Re: Updates palo alto network website and ssl decryption

BruceBennett — Sun, 03 Nov 2019 20:25:52 GMT

You should be good with just the updates.paloaltonetworks.com as the destination url, if you are just getting app and software updates. If you have other things like URL filtering also running on TV he firewall, you will have other URLs that you will need to bypass the SSL intercept.

Re: Updates palo alto network website and ssl decryption

MP18 — Tue, 05 Nov 2019 16:27:45 GMT

Seems on PA server verification is checked.

I did exempt for url updates.paloaltonetworks.com and ssl decryption is enabled.

I am not getting any app updates?

is this by design?