09-26-2013 07:43 AM
As the title suggests, I'm getting to grips with SSL decryption (which is working fine). We use a response pages for a virus notices and I'm testing the eicar site (Download ° EICAR - European Expert Group for IT-Security). Over HTTPS the 'virus' is blocked however I don't receive a response page, whereas I do for HTTP. I have tried having a play with the the options here (though not quite the same) How to Configure the Palo Alto Networks Device to Serve a URL Response page Over an HTTPS Session wi... but no joy.
Reading posts on here it's similar to this problem (No Malware Block Page When Using SSL Decryption), but any advice would be gratefully received. I'm sure I'm missing something simple.
PanOS 4.1.14 - PA200.
09-26-2013 08:52 AM
Could you please provide us the output for:
# show deviceconfig setting ssl-decrypt
I am trying to replicate this issue on 5.0.7 to see what behavior I get.
09-26-2013 08:57 AM
admin@PA-200# show deviceconfig setting ssl-decrypt
Additionally, if of use:
admin@PA-200> show system setting ssl-decrypt setting
vsys : vsys1
Forward Proxy Ready : yes
Inbound Proxy Ready : no
Disable ssl : no
Disable ssl-decrypt : no
Notify user : no
Proxy for URL : yes
Wait for URL : no
Deny session if setup fails : no
Block revoked Cert : yes
Block timeout Cert : no
Block unknown Cert : yes
Cert Status Query Timeout : 5
URL Category Query Timeout : 5
Use Cert Cache : yes
Verify CRL : yes
Verify OCSP : yes
CRL Status receive Timeout : 5
OCSP Status receive Timeout : 5
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!