SSL Inbound decryption woes

[cryptochrome]

Hi there,

we just configured our first SSL Inbound decryption, but we have some trouble and need help troubleshooting it.

Very simple setup:

Webserver in DMZ zone

Firewall policy: from:untrust to:dmz; src:any; dst:webserver; app:ssl,web-browsing; service:service-http(s); action:allow

Decryption policy: from:untrust to:dmz; src:any; dst:webserver; action:decrypt

The webserver's certifictate and key have been imported to the firewall.

Accessing the webserver from an external PC: Traffic gets decrypted perfectly.

Accessing the webserver from an iPhone and from and Android device: Traffic is *not* being decrypted.

In all cases the source IPs were completely random and are not subject to any firewall rule. This is reproducible and I tried to find out why it would decrypt in one case but not in another.

Any ideas? Is there a way I can troubleshoot this other than looking at the traffic logs, which don't contain any helpful information?

Thanks

[Ameya-Kawimandan]

Can you try different browsers on the mobile devices.This could be caused by Unsupported SSL cipher suite (algo)  selected by Client.

[cryptochrome]

How can I see that on the firewall? Where are incompatibilities being logged?

Will try...

[Ameya-Kawimandan]

If the SSL version or cipher suite is not supported for decryption you should see a related entry in O/P of following command :

>show system setting ssl-decrypt exclude-cache

To  reset this cache :

> debug dataplane reset ssl-decrypt exclude-cache

Ref :

Following Global counters could be helpful in troubleshoting  :

>show counter global | match proxy - PAN-OS 3.0.0 and 3.1.0

proxy_process 1205 info proxy pktproc Number of flows go through proxy

proxy_no_process 453 info proxy pktproc Number of flows donot go through proxy

proxy_wqe_held 253 info proxy resource Number of wqe held by proxy for notify answer

proxy_excluded 78 info proxy pktproc Number of ssl sessions bypassed proxy because of exclusion

proxy_client_hello_failed 4 warn proxy pktproc Number of ssl sessions bypassed proxy because client hello can't be parsed

proxy_url_request_pkt_drop 24 info proxy pktproc The number of packets get dropped because of waiting for url category request in ssl proxy

proxy_url_category_unknown 23435 info proxy pktproc Number of sessions checked by proxy with unknown url category

url_session_not_in_ssl_wait 4 error url system The session is not waiting for url in ssl proxy

[cryptochrome]

Hi Nadir,

thanks for the help. In fact, when I tried mobile Firefox the session was decrypted just fine. Using Google Chrome (Android) or mobile Safari (iPhone) the session would not get decrypted. Looks like an issue with Webkit based browsers. HOWEVER:

There is nothing related in the certificate list you get when issuing the 'show system setting ssl-decrypt exclude-cache' command. The webserver's certificate does not show up in that list.

What I also don't understand: If there is a problem with ciphers, why can I connect to the webserver using iPhone/Android just fine? The browser seems to be encrypting the session without a problem. It's the firewall that does not decrypt.