Decrypting Dropbox

Reply
Highlighted
L3 Networker

Decrypting Dropbox

Hi,

I want to decrypt Dropbox but it doesn't work. I have a catch-all decrypt policy that decrypts any-any SSL. It works fine except for Dropbox. My understanding is that Dropbox is on the PanOS internal exception list so decryption is supposed to be disabled automatically for DB. Looking at my traffic logs, I can confirm that application dropbox is not decrypted. However, my Dropbox client still reports it's unable to establish a secure connection.

Is there anything I need to do to make it work?

Thanks

L3 Networker

Re: Decrypting Dropbox

Hi

this is because it's not on the default exclusion list anymore.

Search the forum for "dropbox" and you get numerous resources and explanations, but the short way to get the client running again is to do the following on the CLI:

set shared ssl-decrypt ssl-exclude-cert "*.dropbox.com"

L3 Networker

Re: Decrypting Dropbox

Thanks Andre!

L3 Networker

Re: Decrypting Dropbox

Happy to help.

If it works for your, just mark your question as "answered"

Andre

L6 Presenter

Re: Decrypting Dropbox

Also note that when you add dropbox to exclude list the PA will not be able to perform IPS/AV/DLP on the contents of the dropbox traffic.

L3 Networker

Re: Decrypting Dropbox

I figured that one :smileyhappy:

L3 Networker

Re: Decrypting Dropbox

Now this is strange. With the config in place it worked, and now it stopped working. Dropbox client reporting the same error as before, while *.dropbox.com is in the ssl-decrypt exlude list. Are there other domains that should be on the exclude list for Dropbox?

Thanks

Sascha

L3 Networker

Re: Decrypting Dropbox

Two minutes later it's working again. Huh???

L6 Presenter

Re: Decrypting Dropbox

How is your device configuration regarding CRL and OSCP checks etc?

L2 Linker

Re: Decrypting Dropbox

thanks

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!