topic Re: financial-services is exempt from decryption still decrypt error in General Topics

financial-services is exempt from decryption still decrypt error

MP18 — Wed, 27 Nov 2019 20:01:14 GMT

PA running 8.1.9 we have rule from any source any zone do not decrypt financial-services category.

CLI test

test decryption-policy-match source 10.x.x.x destination 23.249.200.33 category financial-services

Matched rule: 'No_Decrypt' action: no-decrypt

Traffic log shows decrypt error URL log shows no decrypt.

OtakarKlier — Wed, 27 Nov 2019 20:28:40 GMT

Hello,

It could be because you are using an IP address instead of the URL. Check the URL against the PAN-DB URl checker.

If its listed correctly there, then the URL should not be decrypted.

Regards,

MP18 — Wed, 27 Nov 2019 20:31:36 GMT

on traffic log it shows category as unknown and on url filtering logs i see

ipg1.moneris.com/ and category as financial services

OtakarKlier — Wed, 27 Nov 2019 20:33:55 GMT

Hello,

If you browse to it from a workstation, does it try to decrypt the traffic?

Regards,

MP18 — Wed, 27 Nov 2019 21:07:22 GMT

PRoblem is it is ticket vending machine which uses that

MP18 — Wed, 27 Nov 2019 21:09:26 GMT

url log shows ipg1.moneris.com/

i can not access this from my pc

OtakarKlier — Wed, 27 Nov 2019 21:11:42 GMT

Hello,

I have a better understanding now. So what I would do is the following:

Create a security policy that allows that machine to only go to the specific web address.

Create a decryption policy that allows all traffic sourced from the machine to bypass encryption.

You still know exactly where its going and what its doing.

Just a thought.

MP18 — Wed, 27 Nov 2019 21:16:39 GMT

I create the decryption security policy to exempt all the traffic to that destination ip address.

Since then PA is not decrypting.

Also SSL decryption exclusion list i put *.moneris.com and it did not worked.