ssl-inbound inspection problem

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

ssl-inbound inspection problem

L1 Bithead

Hello everyone.

 

i'm configuring decryption with ssl-inbound inspection towards a nas synology via DNAT port-forwarding but i'm having trouble working with the following error that gives me the browser "PR_END_OF_FILE_ERROR". DNAT without ssl-inbound inspection works fine without certificate errors if I try to reach the web server from outside.

I have imported the certificate and the priv-key of the synology correctly on the fw and applied to the decryption policy, but I doubt that the zone-level decryption policy is wrong.

I post a couple of screens for completeness, decrypt, nat, security and logs

porq91_0-1662322178791.png

 

 

porq91_1-1662322223915.png

 

porq91_2-1662322296995.png

 

porq91_0-1662322701882.png

 

 

Actually topology:  internet--->router(dnat to ptp-fw)--->FW(dnat to synology TCP 5001)---->SYNOLOGY

 

Thanks in advice,

 

Angelo.

 

 

2 REPLIES 2

L6 Presenter

There are other posts for such issues and you can google them but "PTP-FW-WAN2" is the destination address in your nat and security policies and for the security policy I think it should the translated internal zone address "SYNLOGY-NAC-...".

 

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/nat/nat-policy-rules/nat-polic...

 

 

If you still have issues see drop packet captures, global counters, flow basic etc:

 

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-palo-alto-checking-for-drops-r...

 

 

 

Still check that the app is indeed using normal SSL and that it is not using pinned SSL certs that can't be decrypted. You can look at the SSL logs:

 

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decry...

 

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloUCAS

 

L6 Presenter

If you managed to get the needed answers, please flag the question as answered.

  • 1708 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!