decrypt-unsupport-param error with no decryption

[Claw4609]

We are receiving a decrypt-unsupport-param to a specific destination with no ssl inspection applied. I created a no decrypt rule and didnt apply a decryption profile so we weren't checking for expired or untrusted certs either. There is also nothing in the decryption logs for this destination IP address (we only log on failure)

If I filter and check the counters in the firewall I am met with TCP sessions closed via injecting RST. I can not find an indication as to why we are actually hitting an error with this site. This is a public site that we do not host.

In the traffic logs it shows action allow, type deny, session end reason decrypt-unsupport-param error

[JayGolf]

Hi @Claw4609 ,

Which PAN-OS version are you currently running? I would triple-check to make sure you currently do not have any decryption policies created that could catch this traffic.

[Claw4609]

Hello @JayGolf ,

We're running Pan-OS 10.2.3. To ensure it wasnt hitting a decrypt rule I placed a no decrypt decryption policy at the top with the destination of the IP address, with no decryption profile attached.

[Claw4609]

And for whatever reason the site it working today. If worked from devices outside of the network perfectly fine so the site itself was functioning fine. So no idea why it wasnt working yesterday but it is today. 

[SandipSingh]

I too have the same issue, can anyone suggest the solutions on this.

[CPayne4]

We had this issue. Palo support said that the issue observed matches one of the known reports with the engineering team.

They upgraded all Prisma portals and gateway instances to the fixed version 10.2.4-h19 to resolve the issue.