SSL Decryption quits working.

Reply
Highlighted
L1 Bithead

SSL Decryption quits working.

We have SSL Decryption setup and seems to work for awhile and then quits.  I cannot say for sure but it seems to be USER-ID related.  Out IT department logs in locally onto their laptops.  They might occasionally map a network drive or launch a program using run as their domain user account.  You might be browsing away and all the SSL is working (certificate shows it is issues by the Palo) and then all of a suddent it quits working.  By quits working it simply says the page cannot be found.  It does not give a certificate error or nothing.  Users are expeiriencing the same thing on a Terminal server, so maybe its because we are not using the agent for terminal server?  

Tags (1)
L7 Applicator

Re: SSL Decryption quits working.

@BrianAult,

What does your Decryption Policy look like. If you have specified source-user as a matching criteria in the policy this would help explain why you are seeing an issue for instances where the user-mapping would change. 

You would be able to correct this a number of ways; but lets take a look at how you've actually configured the policy before anything else. 

L1 Bithead

Re: SSL Decryption quits working.

Hi,

 

I do have just one user in the source now, but before it was any.  So the only source criteria is our main subnet.

 

"Test-1; index: 2" {
from [ Trust GP-VPN ];
source [ 192.x.x.0/24 10.x.x.0/24 ];
source-region none;
to Untrust;
destination any;
destination-region none;
user domain\user;
category any;
application/service 0:ssl/any/any/any;
action decrypt;
decryption-profile XXX-Test;
terminal yes;
}

L7 Applicator

Re: SSL Decryption quits working.

@BrianAult,

I wouldn't expect that to depend on user-id information then outside of the security policies that they may be matching. 

I might imagine that part of your issue would actually be that you are only including 'ssl' as you would potentially stop decrypting when it gets identifies as another app-id. Most things will then complain because it was being presented with a cert generated by your firewall, and then starts getting a certificate generated the host. 

L1 Bithead

Re: SSL Decryption quits working.

It says Any for the service, is that what you mean by the second part?

L7 Applicator

Re: SSL Decryption quits working.

@BrianAult,

Sorry I misread what you had configured and for some reason thought you were specifying 'ssl' as a app-id match criteria. What does your security rulebase look like; do you do a lot of user-id based rules? 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!