topic Re: SSL inbound decryption and Post message in PA PCAPS in General Topics

SSL inbound decryption and Post message in PA PCAPS

MP18 — Tue, 21 Apr 2020 00:07:00 GMT

We have configured the SSL inbound decryption.

When we do the PCAPS on the PA we do not see POST message on the re and tx pcaps.

Need to know is this default behaviour?

On traffic logs we see decryption flag as checked.

Also from CLI i verify that PA is decrypting the traffic.

Re: SSL inbound decryption and Post message in PA PCAPS

BPry — Tue, 21 Apr 2020 15:12:41 GMT

@MP18,

This is expected. If you want the post message you would need to enable the decryption port mirror license and verify that you can legally enable that feature in your location and your industry.

From a CLI perspective the command show session all filter ssl-decrypt yes will display all the decrypted sessions across the firewall. You can filter this more to ensure that traffic is being actively decrypted where you expect it to be.

Re: SSL inbound decryption and Post message in PA PCAPS

MP18 — Tue, 21 Apr 2020 16:28:57 GMT

The issue is that we have cert with name like *.city.ca

and it has multiple sub domains like

maps.city.ca

All the urls with domain *.city.ca point to single IP address.

When i do the pcaps for the city.ca i see the post and get message on the fw pcaps.

When domain is maps.city.ca then i do not see the get and post info in pcaps of the fw.

I also tested with creating custom url for maps.city.ca and then adding that to decryption rule same thing.

Re: SSL inbound decryption and Post message in PA PCAPS

MP18 — Tue, 05 May 2020 01:09:39 GMT

We open the TAC case as we were able to exploit the vulnerabiity even though PA ssl decrypt is enabled.

Yes you were spot on you can not see the get/post messages on the PCAP on firewall or debug ssl proxy.

But PA should able to see the threat signature and block it when ssl decryption is enabled.

Re: SSL inbound decryption and Post message in PA PCAPS

MP18 — Sun, 21 Jun 2020 16:32:08 GMT

Seems the PA did the content update and now we see that the threat signature is triggered and traffic is blocked under threat logs.

Earlier we were seeing that traffic is decrypted and not blocked under threat logs