Restrict Google Domain login

[MichaelWrigh]

Hello,

I have been using a header insertion to restrict login to an approved list of Google Domains for a couple of years now. However, I have now encountered an issue and was wondering if anyone else had a similar experience or has any idea what to do.

On one of our domains, there is a regular but seemingly random occurrence of login failures with the error message - 

Something went wrong

Sorry, something went wrong there. Please try again.

When this happens on a device, it can start working correctly again afterwards with no changes being made. If I disable decryption for accounts.google.com then users can login with any account again.

Checking Chrome in developer mode shows that the connection fails going to https://accounts.google.com/_/lookup/accountlookup?hl=en-GB&_reqid=* and stalls when at the initial connection stage. Another device on the same subnet will be able to successfully connect to the above URL and thereofee be restricted to only the Google Domains we allow.

Other domains we have in our organisation dont seem to have the problem, I am struggling to see a pattern that would enable me to isolate the issue. Any help would be greatly appreciated!

[LAYER_8]

Are you able to confirm that those decrypted sessions aren't utilizing TLS 1.3 (unless you're on PAN-OS 10+), and not utilizing QUIC? 

I've seen some funky things happen as a result of the two, and infrequently is it because of App-ID or a security policy. 

[MichaelWrigh]

Hi,

Thanks for the response. Unfortunately I cant confirm this as the issue never seems to appear when a packet capture is done, very strange. I have a TAC support case open on this one.

[arg2022]

Did you ever get this figured out, was TAC any help? Facing the same problem intermittently, minus the any header insertion (just decryption). It's hit or miss as you indicated and PCAP shows what you describe as the stall w/ no response from the server, like it never makes it out. Logs have been unhelpful thus far. Appreciate the assist!

[MichaelWrigh]

Hi,

Still working with TAC on this one, still think we have a way to go. One thing I have found is that certain commands for diagnostics prevent the issue from occurring on the device you are testing with which is a little odd. What PAN-OS version are you using?

[arg2022]

Sitting on the v9.0 branch. Have disabled QUIC, TLS 1.3 Early Data, and CECPQ2 via the client browser thinking that might help, but it made no difference. Appearing like it might be an issue w/ the Palo acting as the client w/ the external server (accounts.google.com) vs the Palo acting as the server to internal clients. If you could let us know what the final resolution w/ TAC is, that'd be great!