Problem with ssh decryption after SSH server upgrade

[mariusz_sawczuk]

After upgrade ssh server to OpenSSH_6.4p1-hpn14v2, OpenSSL 1.0.0j 10 May 2012 I can't connect to this server when using ssh decryption on Palo Alto.

Before ssh server upgrade, decryption was working correctly and I could connect and decrypt ssh traffic.

When I'm trying to connect from client PC I get response:'Server unexpectly closed network connection'.

I check that Palo Alto is sending this message to the client PC (as an SSH proxy) not the destination SSH server.

I also try to connect from the same client PC with SSH decryption turned off, and I could connect.

I'm using PA-3020 with 5.0.9 PAN-OS.

[goku123]

Was the server's version < 6.2 before the upgrade ?

[mariusz_sawczuk]

I;m not sure right now, what was previous version but was working correctly.

[dpalani]

Do you have a decyption profile attached to the ssl decypt policy ? What have you configured for unsupported mode checks and failure checks.

Set up a filter and run ssl counters to get more info.

show counter global filter category ssl

Deepak

[goku123]

Keep an eye out for PAN OS 5.0.10. A fix for an issue with some SSH proxy sessions not working to OpenSSH servers versions > 6.2 is being published through fix # 57612

This fix, when available, may help you.

[VinceM]

Hi,

Look in Rn for version 5.0.10, there is:

57612—SSH sessions to servers running OpenSSH version 6.2 or newer through SSH

Decryption were failing in some instances when the computed Diffie-Hellman key is

4096 bits.

Hope help.

V.

[mariusz_sawczuk]

I've upgraded my PAN device even to PAN-OS 6.0, and still ssh decryption doesn't work properly.

I've tried with and without decryption profiles enabled.