topic Online payment with SSL decryption in General Topics

Online payment with SSL decryption

Joe_Ng — Wed, 22 Sep 2021 01:17:02 GMT

We have SSL decryption enabled on our PA NGFWs but our users have reported issues relating to online payment transactions. We have worked around this by creating a whitelist to bypass decryption but as more sites offer payment facilities online, it will eventually become unfeasible to maintain a bypass list. What is Palo's approach to dealing with this? Are other organizations facing the same issue and how are they dealing with it?

Re: Online payment with SSL decryption

PavelK — Wed, 22 Sep 2021 12:54:44 GMT

Thank you for your post @Joe_Ng

Palo Alto's recommendation is to exclude whole URL category: "financial-services" https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/decryption-exclusions/create-a-policy-based-decryption-exclusion.html This should cover sites that you get redirected to for online payments.

Kind Regards

Pavel

Re: Online payment with SSL decryption

Joe_Ng — Thu, 23 Sep 2021 00:36:36 GMT

Thank you for your response. The URL category 'financial services' has already been included in a non-decrypt policy before the decrypt all policy. I suspect some sites may be running these services behind URLs that may be not be categorized under financial services.

Re: Online payment with SSL decryption

PavelK — Fri, 24 Sep 2021 04:59:13 GMT

Thank you for reply @Joe_Ng

I see. If you believe there is a URL mis-categorization, you can submit a request from this link: https://urlfiltering.paloaltonetworks.com/

Other than what you are already doing with a manual whitelist, I can't think of any better way to avoid the issue you reported.

Kind Regards

Pavel