Troubleshooting SSL decryption failure of a website

Reply
Highlighted
L3 Networker

Troubleshooting SSL decryption failure of a website

Hello.

 

We are using panOS 8.0.7 , Pan-DB URL filtering, and SSL decryption.

 

We are K12 education and use many Chromebooks in the organization.

 

We are trying to use a system called Clever to have our students log into their Chromebooks by scanning a QR code.  The problem is I cannot get the program to work. (https://clever.com/)

 

I know the issue is with the SSL decryption because if I exclude the device from decryption, things works correctly and I am prompted to scan my QR code.  With decryption turned on, I get a hung screen and can't proceed to the next step of login.

 

I have worked with Palo TAC and Clever support and haven't been able to get it working.

 

I have many URLs excluded from decryption that Google and Clever say need to be bypassed from decyption as well.

 

My next thoughts would be to run some packet captures, but I'm not that familiar with Wireshark analysis.  I am thinking I need to look at the headers to see if there are any other URLs which I don't have in my exclude list.

 

Under the traffic logs, for the sessions, I can see some entries are being decrypted.  In the URL filtering logs, I can see the sessions are not being decrypted.

 

Anyone have any thoughts on this, or would be willing to help out?

Dan

 


Accepted Solutions
Highlighted
Cyber Elite

Hello,

You are correct, adding URL's is the same for either. Here is hte breakdown of what I suggested:

 

*.domain.com = will allow anything infront of hte domain.com ,i.e. www.domain.com, mail.domain.com, etc.

domain.com = will allow anything if it doesnt have a prefix, i.e. domain.com, domain.com/whatever, etc.

 

So one just allows for a prefix prior to the domain name. While I cannot find the article, its best practice to perform it the way i have it outlined.

 

Hope that clears things up and glad its working for you!

View solution in original post


All Replies
Highlighted
Cyber Elite

Hello,

Sounds like you on are on the correct path. I'm sure many of us are willing to help, but would need to see the pcaps or any other information you are willing to share. I would agree that its probably a quick redirect somewhere that is causing the issue.

 

Try looking at the Unified logs from a client and see if that can tell the whole story.

 

Hope that helps.

Highlighted
L3 Networker

OK.

 

I can do a packet capture on the Palo with and without decryption turned on, so I'd hae 2 sets of captures (drop, firewall, transmit, receive)

 

Which ones would you like me to upload here?

 

Highlighted
Cyber Elite

Hello,

Do you have the unified logs of the attempts made with SSL on and off? I think that may be a better start. Sorry for the confusion.

 

Please filter them by the source IP of the client making the attempts.

 

If you would rather perform this live via webex or something. Let me know when you might have time.

 

Regards,

Highlighted
L3 Networker

Here are the 2 screenshots.  I've got the excel files also, but don't know how to upload them.

 

 

GoodGoodFailFail

Highlighted
Cyber Elite

Hello,

How are you bypassing decryption? For example when I know its a website, I create a custom URL and add the sites I dont want to decrypt there. And then create a decryption policy above my decrypt everything and set it to no decrypt.

 

I'm assuming you have clever.com and *.clever.com listed as no decrypt?

Highlighted
Cyber Elite

On the second line from the top in the fail screenshot, there is traffic to 13.57.157.75 that was decrypted, when I looked it up, it belonged to clever.com.

 

https://www.virustotal.com/en/ip-address/13.57.157.75/information/

 

https://www.virustotal.com/en/domain/clever.com/information/

 

I would say it might be a no decrypt rule that is not getting hit for some reason.

Highlighted
L3 Networker

Hello.

 

I've got all of my URLs in a custome URL category called "no decrypt".  I've got my decryption rules with the no decryption up top

 

decrypt.JPG

 

Decryption rule #1 is for bypass.  All other traffic gets decrypted by rule #5.  Rules 2-4 don't apply in this situation.

 

I also just verified that I have the following in my "no-decryption" URL category:

 

*.clever.com

*.clever.com/

 

I wasn't sure if I needed both URLs in a decryption bypass rule, so I have both.

 

 

 

Highlighted
Cyber Elite

Hello,

The No-Decrypt URL should be"

 

*.clever.com

clever.com

 

Regards,

Highlighted
L3 Networker

OK.

 

I think that fixed it.

 

I'm confused now about how to enter URLs into the Palo -

 

for adding URLs to a custom category rules, I read here on Palo's site to enter them as

 

*.domain

*.domain/

 

to catch everything.  This would be if I wanted to recategorize a URL from a blocked to an allowed custom-URL category.  Or vice-versa.

 

I thought adding them to a no-decryption rule would be the same thing.

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!