I am using dropbox on my PC and ssl decryption has been enabled on my Palo Alto. I added my PA root cert to my trusted certificates on my computer and am not getting any complains from my browser when surfing to https websites.
However, my dropbox application is complaining that it can not make a secure connection to the internet.
And yes, I have internet connectivity :-)
I've tried creating a custom URL category containing dropbox.com and *.dropbox.com, but this did not resolve the problem.
When checking the monitor, I see some traffic identified as dropbox, but going to random public IP addresses (as expected for a CDN).
I found some post stating that dropbox can not be decrypted, if this is the case, sad but no problem, but how can I exclude it?
Solved! Go to Solution.
You can use the following command to exclude individual urls.
# set shared ssl-decrypt ssl-exclude-cert <value>
In your case it would be:
# set shared ssl-decrypt ssl-exclude-cert "*.dropbox.com"
The result will create an exclude rule for a single URL. After adding the exclusion rule you may need to refresh your browser to have it recognize the actual server certificate, as opposed to the self-signed cert from the Palo Alto Networks device.
Verification can be done using the following command:
admin@88-PA-VM# show shared ssl-decrypt
Let me know if that helps!
Thanks and regards,
Note however that this mean that all dropbox traffic will bypass without being inspected nor logged which will introduce a huge security hole in your infrastructure.
If im not mistaken you could use the webclient instead (that is through webbrowser) and having your PA device inspecting the traffic securely (including threats, DLP, logging etc).
I have the same problem and tried "set shared ssl-decrypt ssl-exclude-cert "*.dropbox.com" "; but, I am still having the issue. It is intermittent, it works fine for most of the time, but once in a while I get the red X and the "Can't establish a secure connection" error.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!