Decryption problem

[Radmin_85]

We have such a problem with Microsoft Exchange OWA which we have recently published through Palo Alto.We have installed certificates with private keys,created necessary rules for PBF and NAT.

Everything is working fine except decryption.We can see in monitoring tab errors like  decrypt-error or decrypt-unsupport-param

we have tried to connect from different browsers from outside with from TLS 1.0 to  TLS 1.2 

we also checked cypher suite which use our Exchange server and the clients' browser 

also checked by packet capture

The interesting thing is that in some users there is no problem with decryption but in most users we see that problem

The version of Pan OS is 7.1.10

global protect version 4.0.4

the appliance is VM-300

[oscaringosv]

We had a similar Issue with Skype and Teams, what we did, we excluded from decrypt "internet-communications-and-telephony" category, for some reason that we don't know yet O365 apps does not like being decrypted, not a good solution but in the mean time could work for you.

[Radmin_85]

ok i will try to check it

[Radmin_85]

Any other suggestions

[OtakarKlier]

Hello,

There are definitly a lot of apps that dont like to be decrypted. A lot of the time its trial and error by watching the logs and testing real time. We had/have similar issues with Lync, basically we cant decrypt it and have to create bypass rules for ours as well as external parties that are hosting Lync/Skype conferences.

Good luck.

[OtakarKlier]

Here are a few links to hopefully help out.

https://live.paloaltonetworks.com/t5/Management-Articles/SSL-decryption-resource-list/ta-p/70397

https://live.paloaltonetworks.com/t5/Configuration-Articles/List-of-Applications-Excluded-from-SSL-D...

Cheers!

[clewis1]

Possible they are using an unsupported cypher. I know I had this issue before moving to 8.0.6.