Dectyption Issue

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Dectyption Issue

L2 Linker

Dear Team!

I got a problem with Decryption on some websites. For example admin.microsoft.com. When I try to open this website, the web browser gives me a simple white blank without any content in it. In this case, decryption is on. I saw the error, depending on the certificate chain of trust, and I follow the documentation and imported the missing certificate to Firewall and then to the end user machine, but, not fixed.

 

This issue was in 10.1.7 and continues in 10.1.9 h2 I think. And, this problem the first time was faced while upgrading to 10.1.7.

 

Any ideas?

 

2 REPLIES 2

Community Team Member

Hi @RovshanRajabli ,

 

You might be running into bug behavior.

I've seen this exact same behaviour when http2 decrypted traffic was getting identified as unknown-tcp.  Please check if that's the case or if it is being identified correctly.

 

The root cause in my example was that each large http2 header holds a swbuf 4 until the end of the flow. This causes the swbuf 4 depletion.  You can check this with the following command as well:

 

admin@Lab> debug dataplane pool statistics | match "buffer 4"

 

As a workaround you could try to strip ALPN for the website that causes the buffer depletion.

 

That being said, I recommend grabbing a tech support file and have it analyzed by support in order to confirm if you are hitting this exact same bug or if you are experiencing a different issue.

 

Kind regards,

-Kim.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite

Hello,

Also some websites do not like it when you decrypt them. I know a lot of the Microsoft sites are like this and its best to bypass decryption on them.

 

Regards,

  • 765 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!