topic SSL Decryption and Reddit Posting in General Topics

SSL Decryption and Reddit Posting

nreynders — Fri, 29 Jan 2021 18:19:00 GMT

Last year I implemented a rule to allow users in my company access to the reddit.com site. It is in our company policy to disallow sharing messages on social media, so I implemented this rule with URL filtering (chat/messages/etc...) and only allowing the appid "reddit-base", not "reddit-posting". This worked at the time, and has stopped functioning properly some time in the past year.

Now, users are still limited from messaging/chat/etc... but can post comments and new threads on the site.

This relates to SSL decryption as I was digging down the rabbit-hole and think that the "reddit-posting" appid has switched over to "web-browsing". I was wondering :

1. If I implement SSL decryption on reddit, will it pick up the "reddit-posting" appid again?

2. Why do I no longer see "reddit-posting" in my logs?

3. What can SSL decryption do--or can't do--to help me solve this issue?

4. Is this a more-so a question about how PA identifies appids for reddit?

Re: SSL Decryption and Reddit Posting

Brandon_Wertz — Fri, 29 Jan 2021 21:39:57 GMT

@nreynders wrote:

Last year I implemented a rule to allow users in my company access to the reddit.com site. It is in our company policy to disallow sharing messages on social media, so I implemented this rule with URL filtering (chat/messages/etc...) and only allowing the appid "reddit-base", not "reddit-posting". This worked at the time, and has stopped functioning properly some time in the past year.

Now, users are still limited from messaging/chat/etc... but can post comments and new threads on the site.

This relates to SSL decryption as I was digging down the rabbit-hole and think that the "reddit-posting" appid has switched over to "web-browsing". I was wondering :

1. If I implement SSL decryption on reddit, will it pick up the "reddit-posting" appid again?

2. Why do I no longer see "reddit-posting" in my logs?

3. What can SSL decryption do--or can't do--to help me solve this issue?

4. Is this a more-so a question about how PA identifies appids for reddit?

When you built the policy last year and it worked with the proper APP-ID being identified had SSL decryption been configured? In general the answer is always going to be, yes, to ensure proper application of policy and identify traffic as the right APP-ID SSL decryption will always be looked at needing to be deployed. SSL decryption breaks open the SSL/TLS packets exposing the encrypted payload. APP-ID is going to be based on being able to properly see a packets contents/payload. So if the packet is encrypted there's certainly going to be a limitation of Palo's ability to apply the correct application to traffic traversing the firewall.

Re: SSL Decryption and Reddit Posting

brianpauler — Sat, 17 Jul 2021 06:10:03 GMT

Did you add a ssl profile to the decryption rules as well? If so, check which ciphers you've selected as being ok, because this can be a cause of the Palo dropping the SSL connection.

Also if you are using Chrome, make sure you either disable the Quic protocol or block it on the Palo. Quic is Https over UDP, which the Palo can't decrypt. This only affects chrome though, so also check with IE to see if the same issues occur.

Re: SSL Decryption and Reddit Posting

nreynders — Wed, 20 Oct 2021 14:21:56 GMT

As an update, we've implemented full SSL decryption since my original post for users, and now the issue persists by having all reddit related web traffic come through as "reddit-base". Previously--when first implemented--"reddit-posting" app-id would appear and function normally. By excluding this from our allow rule we could prevent users from messaging, signing in, commenting, etc... seems to not be the case anymore.

I opened a case with PA and they let me know this is a known issue being tracked as bug id CON-50447 but I don't have much more information than that. They are able to reproduce on their end, so hopefully some additional visibility will help.

Re: SSL Decryption and Reddit Posting

nreynders — Wed, 20 Oct 2021 14:25:08 GMT

Thanks for the additional info here! I have noticed Quic protocol coming through, but I can also replicate the issue on IE and Firefox.

We implemented SSL decryption for our users since the time of my first post, now all reddit related traffic comes through as "reddit-base", still no reddit-posting. PA verified that they can replicate the bug on their end, said they are looking into it with CON-50447.