Exclude www.google.* from decryption

[Hithead]

Hello,

are you able to exculde https://www.google.com ; https://www.google.de and other domains from SSL decryption?

Or clients complain about the slow loading of the website when they open Google or try to search something.

Currently i add in a white custom URL category:

www.google.com

www.google.com/

www.google.com/*

www.google.*

www.google.*/

www.google.*/*

and still the PA decrypt the traffic. If i try the policy from our location in US, it works (www.google.com). But if i try it from Germany - or other locations - the white list don't take affect.

Do you also have a slow loading of www.google.* if you enable ssl decyption?

[mikand]

If Im not mistaken you are supposed to use the stuff mentioned in the CN part of the cert being used at the server. Thats the only way PA can identify which site you are trying to reach when using HTTPS without actually decrypt anything.

Also it sounds strange that only google would be "slow".

Which hardware and panos do you use?

I know that PA-2000 series uses mgmtplane to generate the mitm-certs on the fly so in case mgmtplane is at 100% cpu then generating these mitm-certs would take an additional second(s) to complete and the client would experience this as a "slow" connection. However once terminated (since these certs I belienve are being cached) the speed should be good.

Other things to look into is how many bits the CA-cert is using (which will affect the time it takes to generate the mitm-cert on the fly).

[Hithead]

Hi,

the thing is: www.google.(whatever) loads slow. Some second delay. Also when established once a connection (Google open in your browser and search again something).

And yes, we are using the "powerful" and "stable" PA2000 series......with 5.0.3.....In the last versions the problem was also available....

Checked the bits: With/Without Decryption - www.google.de - 1024         

Checked also hotmail.com: With Decryption: 1024 Without: 2048

(btw we using PA generated certificate for the ssl-decryption)

Whatever, i though to exclude the URL www.google.* as a workaround. But with my entries in the URL whitelist the PA still decrypt the session...?!

[ewilen]

Possibly this document will help:

What I take away from it is that if you want to exclude a site from decryption, you need to create a custom URL category that lists that site by ip address (page 3) not by name.

[Hithead]

I know its possible to exclude websites from decryption by adding the IP address....But i don't want to use IP address. Really need to exculde the URL www.google.* ...

[ewilen]

I understand--I'm dealing with a similar issue myself. I'm working with support, and if I can get a config working I'll update this thread.

[Hithead]

Thanks. Will be helpful!

[oneidanation]

You can exclude URLs by creating a Custom URL Category and add the sites into that URL Category then use the custom URL Category in your do not decrypt rule.

[Hithead]

yes, i know...

thats my problem in this thread....its not possible.

[goku123]

Hi,

You could try to import cert used by google on the german site onto the PA device and then select the usage as "SSL Exclude Certificate" & see if you could prevent it from being decrypted.

[Hithead]

Hi,

no it doesn't work. Whatever, our clients become accustomed to wait few seconds.

[ericgearhart]

Hithead wrote:

And yes, we are using the "powerful" and "stable" PA2000 series......with 5.0.3.....In the last versions the problem was also available....

I hope you're being sarcastic here The PA2000 series is neither powerful nor stable in my experience

[Hithead]

egearhart wrote:


Hithead wrote:

And yes, we are using the "powerful" and "stable" PA2000 series......with 5.0.3.....In the last versions the problem was also available....



I hope you're being sarcastic here  The PA2000 series is neither powerful nor stable in my experience

:smileylaugh: yes. Also had and have bad experience with the PA2000 series...

But however, the software should be able to exclude http://www.google.(de, com, nl, com.mx,... etc.) from the ssl decryption.

[mr.linus]

I was able to get this to work, but only with a custom category including:

*.google.*

*.google.*/*

google.*

google.*/*

so this would include mail.google.com, which I guess you don't want...

If I put in www.google.* some traffic remains undecrypted, but other is decrypted just like you said.

This means that making your own custom category to excluded from decryption does work, but just not always :-s

Do you have a support ticket open for this? If so, please keep us informed of the output.

[oneidanation]

Did you ever get his working for some reason ours that was working with a custom url category now is not working for wildcard urls in the category.