I'm looking for the best practice to allow user to download apps over the ms windows store. But sometimes the download is successfully and sometimes i get an error.
No Decryption on which ip or url?
Which Apps I need to allow - ms-store and others?
I hope you can help me
If this is only happening over the VPN then this is a known issue and is also a Microsoft issue that impacts any and all/other VPN clients. This is fixable with some GPO changes, we made these changes (did not require a reboot) and everything worked with the app store 100% of the time immediately.
I do not have the original post link that I found the fix on but I *think* this is the same fix here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNL5CAO
If this is not over the VPN and you are not doing decryption all of this traffic is going to be primarily identified as ms-store, which works with or without encryption.
If this is while you are connected to GlobalProtect then @shawnhafen is 100% correct and you'll want to make the Group Policy changes described in the KB article so that this starts functioning correctly again.
Hi BPry and shawnhafen,
Thanks but thats not my question/solution. I also had Troubles with Downloads/Updates over normal lan. Sometime I can download apps.
I think the problems are the palo settings - no decryption, apps - but which one?
I hope you understand my correct and you have other ideas?!
If it's happening even on the LAN connection it's more than likely a security rulebase problem.
First and foremost make sure that you have logging enabled on your interzone-default policy, or are otherwise capturing denied traffic to the untrust (internet) interface. By default you won't have logs for this, and if you aren't allowing required traffic you may not have the associated threat logs to look at. Store traffic should be getting identified as ms-store and ssl.
You mention no decryption but I'm unsure exactly what you mean on this. Are you not performing decryption on traffic at all, or are you wondering what URLs should be set to not decrypt? By default, the firewall already has most of what you will need present in the ssl decryption exclusions automatically.
The following URLs can also be excluded for decryption to prevent any store related issues:
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!