SSL Decryption quits working.

[BrianAult]

We have SSL Decryption setup and seems to work for awhile and then quits.  I cannot say for sure but it seems to be USER-ID related.  Out IT department logs in locally onto their laptops.  They might occasionally map a network drive or launch a program using run as their domain user account.  You might be browsing away and all the SSL is working (certificate shows it is issues by the Palo) and then all of a suddent it quits working.  By quits working it simply says the page cannot be found.  It does not give a certificate error or nothing.  Users are expeiriencing the same thing on a Terminal server, so maybe its because we are not using the agent for terminal server?  

[BPry]

@BrianAult,

What does your Decryption Policy look like. If you have specified source-user as a matching criteria in the policy this would help explain why you are seeing an issue for instances where the user-mapping would change. 

You would be able to correct this a number of ways; but lets take a look at how you've actually configured the policy before anything else. 

[BrianAult]

Hi,

I do have just one user in the source now, but before it was any.  So the only source criteria is our main subnet.

"Test-1; index: 2" {
from [ Trust GP-VPN ];
source [ 192.x.x.0/24 10.x.x.0/24 ];
source-region none;
to Untrust;
destination any;
destination-region none;
user domain\user;
category any;
application/service 0:ssl/any/any/any;
action decrypt;
decryption-profile XXX-Test;
terminal yes;
}

[BPry]

@BrianAult,

I wouldn't expect that to depend on user-id information then outside of the security policies that they may be matching. 

I might imagine that part of your issue would actually be that you are only including 'ssl' as you would potentially stop decrypting when it gets identifies as another app-id. Most things will then complain because it was being presented with a cert generated by your firewall, and then starts getting a certificate generated the host. 

[BrianAult]

It says Any for the service, is that what you mean by the second part?

[BPry]

@BrianAult,

Sorry I misread what you had configured and for some reason thought you were specifying 'ssl' as a app-id match criteria. What does your security rulebase look like; do you do a lot of user-id based rules?