Response Page for virus (e.g. Eicar test) when using SSL inspection

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Response Page for virus (e.g. Eicar test) when using SSL inspection

Not applicable

As the title suggests, I'm getting to grips with SSL decryption (which is working fine). We use a response pages for a virus notices and I'm testing the eicar site (Download ° EICAR - European Expert Group for IT-Security). Over HTTPS the 'virus' is blocked however I don't receive a response page, whereas I do for HTTP. I have tried having a play with the the options here (though not quite the same) How to Configure the Palo Alto Networks Device to Serve a URL Response page Over an HTTPS Session wi... but no joy.

Reading posts on here it's similar to this problem (No Malware Block Page When Using SSL Decryption), but any advice would be gratefully received. I'm sure I'm missing something simple.

PanOS 4.1.14 - PA200.

3 REPLIES 3

L5 Sessionator

Hello Nick,

Could you please provide us the output for:

# show deviceconfig setting ssl-decrypt

I am trying to replicate this issue on 5.0.7 to see what behavior I get.

Regards,

Kunal Adak

Kunal,

admin@PA-200# show deviceconfig setting ssl-decrypt

ssl-decrypt {

  url-proxy yes;

  crl yes;

  crl-receive-timeout 5;

  ocsp yes;

  ocsp-receive-timeout 5;

  block-unknown-cert yes;

  block-timeout-cert no;

  cert-status-timeout 5;

}

Additionally, if of use:

admin@PA-200> show system setting ssl-decrypt setting

vsys                          : vsys1

Forward Proxy Ready           : yes

Inbound Proxy Ready           : no

Disable ssl                   : no

Disable ssl-decrypt           : no

Notify user                   : no

Proxy for URL                 : yes

Wait for URL                  : no

Deny session if setup fails   : no

Block revoked Cert            : yes

Block timeout Cert            : no

Block unknown Cert            : yes

Cert Status Query Timeout     : 5

URL Category Query Timeout    : 5

Use Cert Cache                : yes

Verify CRL                    : yes

Verify OCSP                   : yes

CRL Status receive Timeout    : 5

OCSP Status receive Timeout   : 5

Thanks!

L6 Presenter

We are using this as education in every lab.

Also I tried this today, no problem.

Better you open a case.

  • 2412 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!