Clear SSL opt-out response cache for client

[nickcx1]

PanOS 4.1.14

How does one clear the cache for an individual client IP, so that the end-user is presented with the SSL Opt-Out page again when they next try a site which uses SSL? All I can think of is clear session all filter ssl-decrypt yes. If I do a show session all I don't know which session ID I should be clearing, if any...

Thanks

[harshanatarajan]

Have you tried using the following command -

clear session all filter ssl-decrypt yes source <source ip>.

Also, By design, the user's choice to opt-out is honored for a fixed period of 24 hours and cannot be changed.  For the purpose of testing the opt-out page, the user may wish to use a different PC / different source IP / different user.

[nickcx1]

Hmm, that doesn't seem to clear the Opt-out choice. Any other suggestions; I'm testing against a single machine - I'm sure it must be possible? I do a similar thing to clear the test user's Captive portal mapping to force reauthentication when I was testing CP.

Thanks

[nickcx1 · Accepted solution]

Worked it out:

debug dataplane reset ssl-decrypt notify-cache source <IP ADDRESS>

[harshanatarajan]

Awesome..I was about to give you the same command.