07-08-2013 12:10 PM
we just configured our first SSL Inbound decryption, but we have some trouble and need help troubleshooting it.
Very simple setup:
Webserver in DMZ zone
Firewall policy: from:untrust to:dmz; src:any; dst:webserver; app:ssl,web-browsing; service:service-http(s); action:allow
Decryption policy: from:untrust to:dmz; src:any; dst:webserver; action:decrypt
The webserver's certifictate and key have been imported to the firewall.
Accessing the webserver from an external PC: Traffic gets decrypted perfectly.
Accessing the webserver from an iPhone and from and Android device: Traffic is *not* being decrypted.
In all cases the source IPs were completely random and are not subject to any firewall rule. This is reproducible and I tried to find out why it would decrypt in one case but not in another.
Any ideas? Is there a way I can troubleshoot this other than looking at the traffic logs, which don't contain any helpful information?
07-08-2013 12:37 PM
Can you try different browsers on the mobile devices.This could be caused by Unsupported SSL cipher suite (algo) selected by Client.
07-08-2013 01:19 PM
How can I see that on the firewall? Where are incompatibilities being logged?
07-08-2013 04:12 PM
If the SSL version or cipher suite is not supported for decryption you should see a related entry in O/P of following command :
>show system setting ssl-decrypt exclude-cache
To reset this cache :
> debug dataplane reset ssl-decrypt exclude-cache
Following Global counters could be helpful in troubleshoting :
>show counter global | match proxy - PAN-OS 3.0.0 and 3.1.0
proxy_process 1205 info proxy pktproc Number of flows go through proxy
proxy_no_process 453 info proxy pktproc Number of flows donot go through proxy
proxy_wqe_held 253 info proxy resource Number of wqe held by proxy for notify answer
proxy_excluded 78 info proxy pktproc Number of ssl sessions bypassed proxy because of exclusion
proxy_client_hello_failed 4 warn proxy pktproc Number of ssl sessions bypassed proxy because client hello can't be parsed
proxy_url_request_pkt_drop 24 info proxy pktproc The number of packets get dropped because of waiting for url category request in ssl proxy
proxy_url_category_unknown 23435 info proxy pktproc Number of sessions checked by proxy with unknown url category
url_session_not_in_ssl_wait 4 error url system The session is not waiting for url in ssl proxy
07-08-2013 11:25 PM
thanks for the help. In fact, when I tried mobile Firefox the session was decrypted just fine. Using Google Chrome (Android) or mobile Safari (iPhone) the session would not get decrypted. Looks like an issue with Webkit based browsers. HOWEVER:
There is nothing related in the certificate list you get when issuing the 'show system setting ssl-decrypt exclude-cache' command. The webserver's certificate does not show up in that list.
What I also don't understand: If there is a problem with ciphers, why can I connect to the webserver using iPhone/Android just fine? The browser seems to be encrypting the session without a problem. It's the firewall that does not decrypt.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!