Response Page for virus (e.g. Eicar test) when using SSL inspection

[nickcx1]

As the title suggests, I'm getting to grips with SSL decryption (which is working fine). We use a response pages for a virus notices and I'm testing the eicar site (Download ° EICAR - European Expert Group for IT-Security). Over HTTPS the 'virus' is blocked however I don't receive a response page, whereas I do for HTTP. I have tried having a play with the the options here (though not quite the same) How to Configure the Palo Alto Networks Device to Serve a URL Response page Over an HTTPS Session wi... but no joy.

Reading posts on here it's similar to this problem (No Malware Block Page When Using SSL Decryption), but any advice would be gratefully received. I'm sure I'm missing something simple.

PanOS 4.1.14 - PA200.

[kadak]

Hello Nick,

Could you please provide us the output for:

# show deviceconfig setting ssl-decrypt

I am trying to replicate this issue on 5.0.7 to see what behavior I get.

Regards,

Kunal Adak

[nickcx1]

Kunal,

admin@PA-200# show deviceconfig setting ssl-decrypt

ssl-decrypt {

  url-proxy yes;

  crl yes;

  crl-receive-timeout 5;

  ocsp yes;

  ocsp-receive-timeout 5;

  block-unknown-cert yes;

  block-timeout-cert no;

  cert-status-timeout 5;

}

Additionally, if of use:

admin@PA-200> show system setting ssl-decrypt setting

vsys                          : vsys1

Forward Proxy Ready           : yes

Inbound Proxy Ready           : no

Disable ssl                   : no

Disable ssl-decrypt           : no

Notify user                   : no

Proxy for URL                 : yes

Wait for URL                  : no

Deny session if setup fails   : no

Block revoked Cert            : yes

Block timeout Cert            : no

Block unknown Cert            : yes

Cert Status Query Timeout     : 5

URL Category Query Timeout    : 5

Use Cert Cache                : yes

Verify CRL                    : yes

Verify OCSP                   : yes

CRL Status receive Timeout    : 5

OCSP Status receive Timeout   : 5

Thanks!

[panos]

We are using this as education in every lab.

Also I tried this today, no problem.

Better you open a case.